File rke2-1.27.7+rke2r1.obscpio of Package rke2-1.27

Overview Repositories Revisions Requests Users Attributes Meta

File rke2-1.27.7+rke2r1.obscpio of Package rke2-1.27 (Revision 1c0369e63dbe8c671b873f4c0f52017f)

Currently displaying revision 1c0369e63dbe8c671b873f4c0f52017f , Show latest

07070100000000000081A4000000000000000000000001653C446F00000021000000000000000000000000000000000000002400000000rke2-1.27.7+rke2r1/.codespellignoreaks
ec2
eks
gce
gcp
ro
shouldnot
07070100000001000081A4000000000000000000000001653C446F0000001A000000000000000000000000000000000000002100000000rke2-1.27.7+rke2r1/.dockerignore./.dapper
./.cache
./dist
07070100000002000081A4000000000000000000000001653C446F000034C8000000000000000000000000000000000000001E00000000rke2-1.27.7+rke2r1/.drone.yml---
kind: pipeline
type: docker
name: build-amd64

platform:
  os: linux
  arch: amd64

clone:
  retries: 3

steps:
  - name: skipfiles
    image: plugins/git
    commands:
      - export NAME=$(test $DRONE_BUILD_EVENT = pull_request && echo remotes/origin/${DRONE_COMMIT_BRANCH:-master} || echo ${DRONE_COMMIT_SHA}~)
      - export DIFF=$(git --no-pager diff --name-only $NAME | grep -v -f .droneignore);
      - if [ -z "$DIFF" ]; then
            echo "All files in PR are on ignore list";
            exit 78;
        else
            echo "Some files in PR are not ignored, $DIFF";
        fi;
    when:
      ref:
        include:
          - refs/heads/master
          - refs/heads/release-*
          - refs/pull/**

- name: validate-release
    image: rancher/dapper:v0.5.5
    commands:
      - dapper -f Dockerfile --target dapper make validate-release
    volumes:
      - name: docker
        path: /var/run/docker.sock
    when:
      event:
        - tag
      instance:
        - drone-publish.rancher.io

- name: build
    image: rancher/dapper:v0.5.5
    environment:
      ENABLE_REGISTRY: 'true'
      AWS_ACCESS_KEY_ID:
        from_secret: AWS_ACCESS_KEY_ID-rke2-ci-uploader
      AWS_SECRET_ACCESS_KEY:
        from_secret: AWS_SECRET_ACCESS_KEY-rke2-ci-uploader     
    commands:
      - docker pull --quiet alpine:3.17
      - dapper -f Dockerfile --target dapper make dapper-ci
    volumes:
      - name: docker
        path: /var/run/docker.sock
    when:
      ref:
        include:
          - refs/heads/master
          - refs/heads/release-*
          - refs/pull/**
          - refs/tags/*

- name: fossa
    image: rancher/drone-fossa:latest
    failure: ignore
    settings:
      api_key:
        from_secret: FOSSA_API_KEY
    when:
      instance:
        - drone-publish.rancher.io
      ref:
        include:
          - "refs/heads/master"
          - "refs/heads/release-*"
          - "refs/tags/v*"
          - "refs/pull/*"
      event:
        - push
        - tag

- name: package-images
    image: rancher/dapper:v0.5.5
    commands:
      - dapper -f Dockerfile --target dapper make package-images
    volumes:
      - name: docker
        path: /var/run/docker.sock
    when:
      event:
        - tag
      instance:
        - drone-publish.rancher.io

- name: scan
    image: rancher/dapper:v0.5.5
    failure: ignore
    commands:
      - dapper -f Dockerfile --target dapper make scan-images
    volumes:
      - name: docker
        path: /var/run/docker.sock
    when:
      instance:
        - drone-publish.rancher.io
      ref:
        include:
          - refs/heads/master
          - refs/heads/release-*
          - refs/tags/*

- name: test
    image: rancher/dapper:v0.5.5
    secrets: [ AWS_ACCESS_KEY_ID-rke2-ci-uploader, AWS_SECRET_ACCESS_KEY-rke2-ci-uploader ]
    environment:
      ENABLE_REGISTRY: 'true'
      AWS_ACCESS_KEY_ID:
        from_secret: AWS_ACCESS_KEY_ID-rke2-ci-uploader
      AWS_SECRET_ACCESS_KEY:
        from_secret: AWS_SECRET_ACCESS_KEY-rke2-ci-uploader  
    commands:
      - dapper -f Dockerfile --target dapper make test
    volumes:
      - name: docker
        path: /var/run/docker.sock
    when:
      ref:
        include:
          - refs/heads/master
          - refs/heads/release-*
          - refs/pull/**
          - refs/tags/*

- name: publish-image-runtime
    image: rancher/hardened-build-base:v1.20.10b1
    commands:
      - docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
      - DRONE_TAG=${DRONE_TAG} make publish-image-runtime
    environment:
      DOCKER_PASSWORD:
        from_secret: docker_password
      DOCKER_USERNAME:
        from_secret: docker_username
    volumes:
      - name: docker
        path: /var/run/docker.sock
    when:
      event:
        - tag
      instance:
        - drone-publish.rancher.io
      ref:
        - refs/head/master
        - refs/tags/*

- name: package-windows-images
    image: rancher/dapper:v0.5.5
    commands:
      - dapper -f Dockerfile --target dapper make package-windows-images
    when:
      event:
        - tag
      instance:
        - drone-publish.rancher.io
    volumes:
      - name: docker
        path: /var/run/docker.sock

- name: publish-dist-artifacts
    image: plugins/github-release
    settings:
      api_key:
        from_secret: github_token
      checksum:
        - sha256
      checksum_file: CHECKSUMsum-amd64.txt
      checksum_flatten: true
      files:
        - dist/artifacts/*
      prerelease: true
    when:
      event:
        - tag
      instance:
        - drone-publish.rancher.io
      ref:
        - refs/head/master
        - refs/tags/*

volumes:
  - name: docker
    host:
      path: /var/run/docker.sock

---
kind: pipeline
type: docker
name: build-arm64

platform:
  os: linux
  arch: arm64

clone:
  retries: 3

- name: publish-dist-artifacts
    image: plugins/github-release
    settings:
      api_key:
        from_secret: github_token
      checksum:
        - sha256
      checksum_file: CHECKSUMsum-arm64.txt
      checksum_flatten: true
      files:
        - dist/artifacts/*
      prerelease: true
    when:
      event:
        - tag
      instance:
        - drone-publish.rancher.io
      ref:
        - refs/head/master
        - refs/tags/*

volumes:
  - name: docker
    host:
      path: /var/run/docker.sock
---
kind: pipeline
type: docker
name: build-s390x

platform:
  os: linux
  arch: amd64

node:
  arch: s390x

clone:
  retries: 3

steps:
  - name: skipfiles
    image: alpine/git:v2.30.2-s390x
    commands:
      - export NAME=$(test $DRONE_BUILD_EVENT = pull_request && echo remotes/origin/${DRONE_COMMIT_BRANCH:-master} || echo ${DRONE_COMMIT_SHA}~)
      - export DIFF=$(git --no-pager diff --name-only $NAME | grep -v -f .droneignore);
      - if [ -z "$DIFF" ]; then
            echo "All files in PR are on ignore list";
            exit 78;
        else
            echo "Some files in PR are not ignored, $DIFF";
        fi;
    when:
      ref:
        include:
          - refs/heads/master
          - refs/heads/release-*
          - refs/pull/**

- name: build
    image: rancher/dapper:v0.5.8
    commands:
      - dapper -f Dockerfile --target dapper make dapper-ci
    volumes:
      - name: docker
        path: /var/run/docker.sock
    when:
      ref:
        include:
          - refs/heads/master
          - refs/heads/release-*
          - refs/pull/**
          - refs/tags/*

- name: package-images
    image: rancher/dapper:v0.5.8
    commands:
      - dapper -f Dockerfile --target dapper make package-images
    volumes:
      - name: docker
        path: /var/run/docker.sock
    when:
      event:
        - tag
      instance:
        - drone-publish.rancher.io

- name: publish-dist-artifacts
    image: rancher/drone-images:github-release-s390x
    settings:
      api_key:
        from_secret: github_token
      checksum:
        - sha256
      checksum_file: CHECKSUMsum-s390x.txt
      checksum_flatten: true
      files:
        - dist/artifacts/*
      prerelease: true
    when:
      event:
        - tag
      instance:
        - drone-publish.rancher.io
      ref:
        - refs/head/master
        - refs/tags/*
volumes:
  - name: docker
    host:
      path: /var/run/docker.sock

---
kind: pipeline
type: docker
name: dispatch

platform:
  os: linux
  arch: amd64

clone:
  retries: 3

- name: dispatch
    image: rancher/dapper:v0.5.5
    commands:
      - dapper -f Dockerfile --target dapper make dispatch
    environment:
      PAT_TOKEN:
        from_secret: github_token
      PAT_USERNAME:
        from_secret: pat_username
    volumes:
      - name: docker
        path: /var/run/docker.sock
    when:
      event:
        - tag
      instance:
        - drone-publish.rancher.io
      ref:
        - refs/head/master
        - refs/tags/*

volumes:
  - name: docker
    host:
      path: /var/run/docker.sock

depends_on:
  - build-amd64
  - build-arm64
  - build-s390x
---
kind: pipeline
type: docker
name: manifest

platform:
  os: linux
  arch: amd64

clone:
  retries: 3

- name: push-runtime-manifest
    image: plugins/manifest
    settings:
      username:
        from_secret: docker_username
      password:
        from_secret: docker_password
      spec: manifest-runtime.tmpl
    when:
      event:
        - tag
      instance:
        - drone-publish.rancher.io
      ref:
        - refs/head/master
        - refs/tags/*
depends_on:
  - build-amd64
  - build-arm64
  - build-s390x
...
07070100000003000081A4000000000000000000000001653C446F00000070000000000000000000000000000000000000002000000000rke2-1.27.7+rke2r1/.droneignore^.*\.md$
^install\.sh$
^\.droneignore$
^\.github/*$
^MAINTAINERS$
^CODEOWNERS$
^LICENSE$
^DCO$
^channels\.yaml$
07070100000004000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001B00000000rke2-1.27.7+rke2r1/.github07070100000005000081A4000000000000000000000001653C446F0000014A000000000000000000000000000000000000002800000000rke2-1.27.7+rke2r1/.github/.codecov.ymlcoverage:
  status:
    project:
      default: false # disable the default status that measures entire project
      pkg: # declare a new status context "pkg"
        paths:
          - pkg/* # only include coverage in "pkg/" folder
        informational: true # Always pass check
    patch: off # disable the commit only checks
07070100000006000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002A00000000rke2-1.27.7+rke2r1/.github/ISSUE_TEMPLATE07070100000007000081A4000000000000000000000001653C446F00000568000000000000000000000000000000000000003800000000rke2-1.27.7+rke2r1/.github/ISSUE_TEMPLATE/bug_report.md---
name: Bug report
about: Create a report to help us improve
title: ''
labels: ''
assignees: ''

---

**Environmental Info:**
RKE2 Version:

Node(s) CPU architecture, OS, and Version:

Cluster Configuration:

**Describe the bug:**

**Steps To Reproduce:**

- Installed RKE2:

**Expected behavior:**

**Actual behavior:**

**Additional context / logs:**

07070100000008000081A4000000000000000000000001653C446F00000F68000000000000000000000000000000000000003900000000rke2-1.27.7+rke2r1/.github/ISSUE_TEMPLATE/cut_release.md---
name: Cut Release
about: Create a new release checklist
title: 'Cut VERSION'
labels: 'kind/release'
assignees: ''

---

**Summary:**
Task covering patch release work.

Dev Complete: RELEASE_DATE (Typically ~1 week prior to upstream release date)

**List of required releases:**

_To release as soon as able for QA:_
- VERSION

_To release once have approval from QA:_
- VERSION (Never release on a Friday unless specified otherwise)

**Prep work:**
- [ ] PJM: Dev and QA team to be notified of the incoming releases - add event to team calendar
- [ ] PJM: Dev and QA team to be notified of the date we will mark the latest release as stable - add event to team calendar [ONLY APPLICABLE FOR LATEST MINOR RELEASE]
- [ ] PJM: Sync with Rancher PJM to identify applicable Rancer release date
  - [ ] Create tracking issues in rancher/rancher for each Rancher line that the RKE2 release is going into. Assign to release captain. Link to this issue. Ensure it's in the proper milestone by aligning with Rancher PJM.
  - [ ] Track RKE2 release against the Rancher release date and vice versa. Communicate any changes to Rancher PJM and RKE2 team.
- [ ] QA: Review changes and understand testing efforts
- [ ] Release Captain: Prepare release notes in our private [release-notes repo](https://github.com/rancherlabs/release-notes) (submit PR for changes taking care to carefully check links and the components, once merged, create the release in GitHub and mark as a draft and check the pre-release box, fill in title, set target release branch, leave tag version blank for now until we are ready to release)
- [ ] QA: Validate and close out all issues in the release milestone.

**Vendor and release work:**
To find more information on specific steps, please see documentation [here](https://github.com/rancher/rke2/blob/master/developer-docs/upgrading_kubernetes.md)
- [ ] Release Captain: Tag new Hardened Kubernetes release
- [ ] Release Captain: Update Helm chart versions
- [ ] Release Captain: Update RKE2
- [ ] Release Captain: Tag new RKE2 RC
- [ ] Release Captain: Tag new RKE2 packaging RC "testing"
- [ ] Release Captain: Prepare PRs as needed to update [KDM](https://github.com/rancher/kontainer-driver-metadata/) in the appropriate dev branches using an RC.  For more information on the structure of the PR, see the [docs](https://github.com/rancher/rke2/blob/master/developer-docs/upgrading_kubernetes.md#update-rancher-kdm)
  - [ ] If server args, agent args, or charts are changed, link relevant rancher/rancher issue or create new rancher/rancher issue
  - [ ] If any new issues are created, escalated to Rancher PJM so they know and can plan for it 
- [ ] EM: Review and merge above PR
- [ ] QA: Post merge, run rancher with KDM pointed at the dev branch (where the PR in the previous step was merged) and test import, upgrade, and provisioning against those RCs. This work may be split between Rancher and RKE2 QAs.
- [ ] Release Captain: Tag the RKE2 release
- [ ] Release Captain: Add release notes to release
- [ ] Release Captain: Tag RKE2 packaging release "testing"
- [ ] Release Captain: Tag RKE2 packaging release "latest"

**Post-Release work:**
- [ ] Release Captain: Once release is fully complete (CI is all green and all release artifacts exist), edit the release, uncheck "Pre-release", and save.
- [ ] Wait 24 hours
- [ ] Release Captain: Tag RKE2 packaging "stable"
- [ ] Release Captain: Update stable release in channels.yaml
- [ ] Release Captain: Prepare PRs as needed to update [KDM](https://github.com/rancher/kontainer-driver-metadata/) in the appropriate dev branches to go from RC to non-RC release. Link this PR to rancher/rancher issue that is tracking the version bump (created in the "Prep work" phase)
- [ ] EM: Review and merge above PR. Update issue so that QA knows to test
- [ ] QA: Final validation of above PR and tracked through the linked ticket
- [ ] PJM: Close the milestone in GitHub.
07070100000009000081A4000000000000000000000001653C446F00000363000000000000000000000000000000000000003D00000000rke2-1.27.7+rke2r1/.github/ISSUE_TEMPLATE/feature_request.md---
name: Feature request
about: Suggest an idea for this project
title: ''
labels: ''
assignees: ''

---

**Is your feature request related to a problem? Please describe.**

**Describe the solution you'd like**

**Describe alternatives you've considered**

**Additional context**

0707010000000A000081A4000000000000000000000001653C446F000003C4000000000000000000000000000000000000003B00000000rke2-1.27.7+rke2r1/.github/ISSUE_TEMPLATE/os_validation.md---
name: Validate Operating System
about: Request validation of an operating system
title: 'Validate OS VERSION'
labels: ["kind/os-validation"]
assignees: ''

---

**RKE2 Versions to be Validated**

**Testing Considerations**

1. Install and run sonobuoy conformance tests on a hardened cluster
2. Validate SUC upgrade
3. Install Rancher Manager
4. Validate snapshot restore via `cluster-reset-restore-path`

**Additional Information**

0707010000000B000081A4000000000000000000000001653C446F00000604000000000000000000000000000000000000003400000000rke2-1.27.7+rke2r1/.github/PULL_REQUEST_TEMPLATE.md

#### Proposed Changes ####

#### Types of Changes ####

#### Verification ####

#### Testing ####

#### Linked Issues ####

#### User-Facing Change ####

```release-note

```

#### Further Comments ####

0707010000000C000081A4000000000000000000000001653C446F0000001A000000000000000000000000000000000000002300000000rke2-1.27.7+rke2r1/.github/dco.ymlrequire:
  members: false
0707010000000D000081A4000000000000000000000001653C446F0000023B000000000000000000000000000000000000002A00000000rke2-1.27.7+rke2r1/.github/dependabot.ymlversion: 2
updates:

# Maintain dependencies for Docker Images
  - package-ecosystem: "docker"
    directory: "/"
    ignore:
      - dependency-name: "rancher/hardened-build-base"
      - dependency-name: "rancher/hardened-kubernetes"
    schedule:
      interval: "weekly"
    labels:
      - "kind/dependabot"
    reviewers:
      - "rancher/k3s"

# Maintain dependencies for GitHub Actions
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    labels:
      - "kind/dependabot"
    reviewers:
      - "rancher/k3s"
0707010000000E000081A4000000000000000000000001653C446F000007C3000000000000000000000000000000000000002500000000rke2-1.27.7+rke2r1/.github/stale.yml# Configuration for probot-stale - https://github.com/probot/stale

# Number of days of inactivity before an Issue or Pull Request becomes stale
daysUntilStale: 180

# Number of days of inactivity before an Issue or Pull Request with the stale label is closed.
# Set to false to disable. If disabled, issues still need to be closed manually, but will remain marked as stale.
daysUntilClose: 14

# Only issues or pull requests with all of these labels are check if stale. Defaults to `[]` (disabled)
onlyLabels: []

# Issues or Pull Requests with these labels will never be considered stale. Set to `[]` to disable
exemptLabels:
  - internal
  - kind/bug
  - kind/bug-qa
  - kind/task
  - kind/feature
  - kind/enhancement
  - kind/design
  - kind/ci-improvements
  - kind/performance
  - kind/flaky-test
  - kind/documentation
  - kind/epic
  - kind/upstream-issue
  - priority/backlog
  - priority/critical-urgent
  - priority/important-longterm
  - priority/important-soon

# Set to true to ignore issues in a project (defaults to false)
exemptProjects: true

# Set to true to ignore issues in a milestone (defaults to false)
exemptMilestones: false

# Set to true to ignore issues with an assignee (defaults to false)
exemptAssignees: true

# Label to use when marking as stale
staleLabel: status/stale

# Comment to post when marking as stale. Set to `false` to disable
markComment: >
  This repository uses a bot to automatically label issues which have not had any activity (commit/comment/label) 
  for 180 days. This helps us manage the community issues better. If the issue is still relevant, please add a comment to the 
  issue so the bot can remove the label and we know it is still valid. If it is no longer relevant (or possibly fixed in the 
  latest release), the bot will automatically close the issue in 14 days. Thank you for your contributions.

# Limit the number of actions per hour, from 1-30. Default is 30
limitPerRun: 30

# Limit to only `issues`
only: issues

0707010000000F000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002500000000rke2-1.27.7+rke2r1/.github/workflows07070100000010000081A4000000000000000000000001653C446F00000167000000000000000000000000000000000000002F00000000rke2-1.27.7+rke2r1/.github/workflows/docs.yamlname: docs
on:
  push:
    branches:
      - master
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
        with:
          python-version: 3.x
      - run: pip install mkdocs-material
      - run: pip install mkdocs-markdownextradata-plugin
      - run: mkdocs gh-deploy --force

07070100000011000081A4000000000000000000000001653C446F00000162000000000000000000000000000000000000002F00000000rke2-1.27.7+rke2r1/.github/workflows/epic.yamlname: Update epics
on:
  issues:
    types: [opened, closed, reopened]
jobs:
  epics:
    runs-on: ubuntu-latest
    name: Update epic issues
    steps:
      - name: Run epics action
        uses: cloudaper/epics-action@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          epic-label-name: epic
          auto-close-epic: false07070100000012000081A4000000000000000000000001653C446F0000097A000000000000000000000000000000000000003A00000000rke2-1.27.7+rke2r1/.github/workflows/nightly-install.yamlname: Nightly Install
on:
  schedule:
    - cron: "0 0 * * 1-5"
  workflow_dispatch: {}
jobs:
  test:
    name: "Smoke Test"
    # nested virtualization is only available on macOS hosts
    runs-on: macos-12
    timeout-minutes: 40
    strategy:
      fail-fast: false
      matrix:
        channel: [stable]
        vm: [centos-7, rocky-8, opensuse-microos, opensuse-leap, ubuntu-focal, windows-2019, windows-2022]
        include:
          - {channel: latest, vm: rocky-8}
          - {channel: latest, vm: ubuntu-focal}
      max-parallel: 2
    defaults:
      run:
        working-directory: tests/install/${{ matrix.vm }}
    env:
      INSTALL_RKE2_CHANNEL: ${{ matrix.channel }}
    steps:
      - name: "Checkout"
        uses: actions/checkout@v3
        with: {fetch-depth: 1}
      - name: "Vagrant Cache"
        uses: actions/cache@v3
        with:
          path: |
            ~/.vagrant.d/boxes
            ~/.vagrant.d/gems
          key: install-${{ hashFiles(format('tests/install/{0}/Vagrantfile', matrix.vm)) }}
        id: vagrant-cache
        continue-on-error: true
      - name: "Vagrant Plugin(s)"
        run: vagrant plugin install vagrant-reload vagrant-rke2
      - name: "Vagrant Up ⏩ Install RKE2"
        run: vagrant up
      - name: "⏳ Node"
        if: ${{ !contains(matrix.vm, 'windows') }}
        run: vagrant provision --provision-with=rke2-wait-for-node
      - name: "⏳ Canal"
        if: ${{ !contains(matrix.vm, 'windows') }}
        run: vagrant provision --provision-with=rke2-wait-for-canal
        continue-on-error: true
      - name: "⏳ CoreDNS"
        if: ${{ !contains(matrix.vm, 'windows') }}
        run: vagrant provision --provision-with=rke2-wait-for-coredns
        continue-on-error: true
      - name: "⏳ Metrics Server"
        if: ${{ !contains(matrix.vm, 'windows') }}
        run: vagrant provision --provision-with=rke2-wait-for-metrics-server
        continue-on-error: true
      - name: "⏳ Ingress NGINX"
        if: ${{ !contains(matrix.vm, 'windows') }}
        run: vagrant provision --provision-with=rke2-wait-for-ingress-nginx
        continue-on-error: true
      - name: "rke2-status"
        if: ${{ !contains(matrix.vm, 'windows') }}
        run: vagrant provision --provision-with=rke2-status
      - name: "rke2-procps"
        if: ${{ !contains(matrix.vm, 'windows') }}
        run: vagrant provision --provision-with=rke2-procps
07070100000013000081A4000000000000000000000001653C446F00000281000000000000000000000000000000000000003500000000rke2-1.27.7+rke2r1/.github/workflows/spellcheck.yamlname: Codespell
on:
  push:  
  pull_request:
    branches:
      - master
  workflow_dispatch: {}
jobs:
  spellcheck:
    name: Spell Check
    runs-on: ubuntu-20.04
    steps:
    - name: Checkout
      uses: actions/checkout@v3
      with:
        fetch-depth: 1
    - name: Set up Python 🐍
      uses: actions/setup-python@v4
    - name: Install codespell
      run: |
        python -m pip install --upgrade pip
        pip install codespell
    - name: Check spelling
      run: codespell --skip=.git,./vendor,./MAINTAINERS,go.mod,go.sum --check-filenames --ignore-regex=.te# --ignore-words=.codespellignore
07070100000014000081A4000000000000000000000001653C446F00000466000000000000000000000000000000000000003700000000rke2-1.27.7+rke2r1/.github/workflows/unitcoverage.yaml# name: Unit Test Coverage
# on:
#   push:
#     paths-ignore:
#       - "install.sh"
#       - "tests/vagrant/**"
#   pull_request:
#     paths-ignore:
#       - "install.sh"
#       - "tests/vagrant/**"
# jobs:
#   test:
#     name: Unit Tests
#     runs-on: ${{ matrix.os }}
#     strategy:
#       matrix:
#         os: [ubuntu-20.04]
#     timeout-minutes: 20
#     steps:
#     - name: Install Go
#       uses: actions/setup-go@v3
#       with: 
#         go-version: '1.19.3'
#     - name: Checkout
#       uses: actions/checkout@v3
#       with:
#         fetch-depth: 1
#     - name: Run Unit Tests
#       run: | 
#         go test -coverpkg=./... -covermode=atomic -coverprofile=coverage.out ./pkg/... -run Unit
#         go tool cover -func coverage.out
#     - name: On Failure, Launch Debug Session
#       if: ${{ failure() }}
#       uses: mxschmitt/action-tmate@v3
#       timeout-minutes: 2
#     - name: Upload Results To Codecov
#       uses: codecov/codecov-action@v1
#       with:
#         files: ./coverage.out
#         flags: unittests # optional
#         verbose: true # optional (default = false)
07070100000015000081A4000000000000000000000001653C446F000006D2000000000000000000000000000000000000003300000000rke2-1.27.7+rke2r1/.github/workflows/updatecli.ymlname: "Updatecli: Dependency Management"

on:
  schedule:
    # Runs at 06 PM UTC
    - cron: '0 18 * * *'
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

permissions:
  contents: write
  issues: write
  pull-requests: write

jobs:
  updatecli:
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/master'
    steps:
      - name: Checkout
        uses: actions/checkout@v3

- name: Install Go
        uses: actions/setup-go@v4
        with:
          go-version: 'stable'

- name: Install Updatecli
        uses: updatecli/updatecli-action@v2

- name: Delete leftover UpdateCLI branches
        run: |
          gh pr list \
            --search "is:closed is:pr head:updatecli_" \
            --json headRefName \
            --jq ".[].headRefName" | sort -u > closed_prs_branches.txt
          gh pr list \
            --search "is:open is:pr head:updatecli_" \
            --json headRefName \
            --jq ".[].headRefName" | sort -u > open_prs_branches.txt
          for branch in $(comm -23 closed_prs_branches.txt open_prs_branches.txt); do
            if (git ls-remote --exit-code --heads origin "$branch"); then
              echo "Deleting leftover UpdateCLI branch - $branch";
              git push origin --delete "$branch";
            fi
          done
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Apply Updatecli
        # Never use '--debug' option, because it might leak the access tokens.
        run: "updatecli apply --clean --config ./updatecli/updatecli.d/ --values ./updatecli/values.yaml"
        env:
          UPDATECLI_GITHUB_ACTOR: ${{ github.actor }}
          UPDATECLI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
07070100000016000081A4000000000000000000000001653C446F00000060000000000000000000000000000000000000001E00000000rke2-1.27.7+rke2r1/.gitignore/.dapper
/.cache
/bin
/dist
*.swp
.idea
.vscode
/data
/rke2
/build
.vagrant/
.DS_Store
go.work*
07070100000017000081A4000000000000000000000001653C446F0000024C000000000000000000000000000000000000002200000000rke2-1.27.7+rke2r1/.golangci.json{
	"linters": {
		"disable-all": true,
		"enable": [
			"govet",
			"revive",
			"goimports",
			"misspell",
			"ineffassign",
			"gofmt"
		]
	},
	"linters-settings": {
		"govet": {
			"check-shadowing": false
		}
	},
	"run": {
		"skip-files": [
			"/zz_generated_"
		],
		"skip-dirs": [
			"bundle",
			"charts",
			"contrib",
			"developer-docs",
			"scripts",
			"docs"
		],
		"timeout": "10m"
	},
	"issues": {
		"exclude-rules": [
			{
				"linters": "typecheck",
				"text": "imported but not used"
			},
			{
				"linters": "revive",
				"text": "should have comment"
			}
		]
	}
}
07070100000018000081A4000000000000000000000001653C446F00000700000000000000000000000000000000000000001F00000000rke2-1.27.7+rke2r1/BUILDING.md# Building RKE2

## Prerequisites

By default, RKE2 is built with Dapper which uses Docker. To build RKE2 you will need to install these packages:
- bash
- docker
- gcc (CGO, don't ya know, if using `scripts/build` directly)
- go (check the `go.mod` for which series of go, e.g. 1.14.x, 1.15.x, etc)
- make

### Required for Running
When running RKE2 you will also need to install these packages:
- ca-certificates

## Building

```shell script
# this will build inside of a container via dapper.
# use `make build` to leverage host-local tooling
make
```

## Running

### rke2 (dev-shell)
To run locally in a container, there is a handy `make` target:
```shell script
make dev-shell
```

This will spin up a privileged container and setup the environment ready for you to invoke `./bin/rke2` at your leisure.
Since the `rancher/rke2-runtime` image was built locally and likely not yet pushed, this, along with the airgap images,
has been bind-mounted into the container ready to be imported into containerd on start-up.

### rke2 (generic)

To run the built artifact(s) locally or on a remote host:
- install prerequisites mentioned above
- copy `./bin/rke2` to the path on your host
- if not testing air-gapped, copy these (local) image tarballs to `/var/lib/rancher/rke2/agent/images/`:
  - `./build/images/rke2-runtime.tar`
  - `./build/images/rke2-kubernetes.tar`
- if testing air-gapped, copy this (local + remote) image tarball to `/var/lib/rancher/rke2/agent/images/`:
  - `./build/images/rke2-airgap.tar`
- run rke2 server: `rke2 server --token=test`

### kubectl

It isn't obvious but `kubectl` will be installed and ready to use after starting up `rke2`. To use it you will need to:
- `export KUBECONFIG=/etc/rancher/rke2/rke2.yaml`
- `export PATH=/var/lib/rancher/rke2/bin:$PATH`
07070100000019000081A4000000000000000000000001653C446F0000000F000000000000000000000000000000000000001E00000000rke2-1.27.7+rke2r1/CODEOWNERS* @rancher/k3s
0707010000001A000081A4000000000000000000000001653C446F00001EEF000000000000000000000000000000000000001E00000000rke2-1.27.7+rke2r1/DockerfileARG KUBERNETES_VERSION=dev

# Build environment
FROM rancher/hardened-build-base:v1.20.10b1 AS build
ARG DAPPER_HOST_ARCH
ENV ARCH $DAPPER_HOST_ARCH
RUN set -x && \
    apk --no-cache add \
    bash \
    curl \
    file \
    git \
    libseccomp-dev \
    rsync \
    gcc \
    bsd-compat-headers \
    py-pip \
    py3-pip \
    pigz \
    tar \
    yq

RUN if [ "${ARCH}" = "amd64" ]; then \
    	apk --no-cache add mingw-w64-gcc; \
    fi

FROM registry.suse.com/bci/bci-base AS rpm-macros
RUN zypper install -y systemd-rpm-macros

# Dapper/Drone/CI environment
FROM build AS dapper
ENV DAPPER_ENV GODEBUG REPO TAG DRONE_TAG PAT_USERNAME PAT_TOKEN KUBERNETES_VERSION DOCKER_BUILDKIT DRONE_BUILD_EVENT IMAGE_NAME AWS_SECRET_ACCESS_KEY AWS_ACCESS_KEY_ID ENABLE_REGISTRY
ARG DAPPER_HOST_ARCH
ENV ARCH $DAPPER_HOST_ARCH
ENV DAPPER_OUTPUT ./dist ./bin ./build
ENV DAPPER_DOCKER_SOCKET true
ENV DAPPER_TARGET dapper
ENV DAPPER_RUN_ARGS "--privileged --network host -v /tmp:/tmp -v rke2-pkg:/go/pkg -v rke2-cache:/root/.cache/go-build -v trivy-cache:/root/.cache/trivy"
RUN if [ "${ARCH}" = "amd64" ] || [ "${ARCH}" = "arm64" ]; then \
        VERSION=0.56.10 OS=linux && \
        curl -sL "https://github.com/vmware-tanzu/sonobuoy/releases/download/v${VERSION}/sonobuoy_${VERSION}_${OS}_${ARCH}.tar.gz" | \
        tar -xzf - -C /usr/local/bin; \
    fi
RUN curl -sL https://storage.googleapis.com/kubernetes-release/release/$( \
    curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt \
    )/bin/linux/${ARCH}/kubectl -o /usr/local/bin/kubectl && \
    chmod a+x /usr/local/bin/kubectl; \
    pip install codespell

RUN python3 -m pip install awscli
RUN curl -sL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v1.52.2
RUN set -x && \
    apk --no-cache add \
    libarchive-tools \
    zstd \
    jq \
    python3 && \
    if [ "${ARCH}" != "s390x" ] || [ "${GOARCH}" != "arm64" ]; then \
    	apk add --no-cache rpm-dev; \
    fi

RUN GOCR_VERSION="v0.5.1" && \
    if [ "${ARCH}" = "arm64" ]; then \
        wget https://github.com/google/go-containerregistry/releases/download/${GOCR_VERSION}/go-containerregistry_Linux_arm64.tar.gz && \
        tar -zxvf go-containerregistry_Linux_arm64.tar.gz && \
        mv crane /usr/local/bin && \
        chmod a+x /usr/local/bin/crane; \
    else \
        wget https://github.com/google/go-containerregistry/releases/download/${GOCR_VERSION}/go-containerregistry_Linux_x86_64.tar.gz && \
        tar -zxvf go-containerregistry_Linux_x86_64.tar.gz && \
        mv crane /usr/local/bin && \
        chmod a+x /usr/local/bin/crane; \
    fi

WORKDIR /source

COPY --from=rpm-macros /usr/lib/rpm/macros.d/macros.systemd /usr/lib/rpm/macros.d
# End Dapper stuff

# Shell used for debugging
FROM dapper AS shell
RUN set -x && \
    apk --no-cache add \
    bash-completion \
    iptables \
    less \
    psmisc \
    rsync \
    socat \
    sudo \
    vim
# For integration tests
RUN go get github.com/onsi/ginkgo/v2 github.com/onsi/gomega/...
RUN GO111MODULE=off GOBIN=/usr/local/bin go get github.com/go-delve/delve/cmd/dlv
RUN echo 'alias abort="echo -e '\''q\ny\n'\'' | dlv connect :2345"' >> /root/.bashrc
ENV PATH=/var/lib/rancher/rke2/bin:$PATH
ENV KUBECONFIG=/etc/rancher/rke2/rke2.yaml
VOLUME /var/lib/rancher/rke2
# This makes it so we can run and debug k3s too
VOLUME /var/lib/rancher/k3s

FROM build AS charts
ARG CHART_REPO="https://rke2-charts.rancher.io"
ARG KUBERNETES_VERSION=""
ARG CACHEBUST="cachebust"
COPY charts/ /charts/
RUN echo ${CACHEBUST}>/dev/null
RUN CHART_VERSION="1.14.200"                  CHART_FILE=/charts/rke2-cilium.yaml         CHART_BOOTSTRAP=true   /charts/build-chart.sh
RUN CHART_VERSION="v3.26.1-build2023080200"   CHART_FILE=/charts/rke2-canal.yaml          CHART_BOOTSTRAP=true   /charts/build-chart.sh
RUN CHART_VERSION="v3.26.101"                 CHART_FILE=/charts/rke2-calico.yaml         CHART_BOOTSTRAP=true   /charts/build-chart.sh
RUN CHART_VERSION="v3.26.101"                 CHART_FILE=/charts/rke2-calico-crd.yaml     CHART_BOOTSTRAP=true   /charts/build-chart.sh
RUN CHART_VERSION="1.24.006"                  CHART_FILE=/charts/rke2-coredns.yaml        CHART_BOOTSTRAP=true   /charts/build-chart.sh
RUN CHART_VERSION="4.8.200"                   CHART_FILE=/charts/rke2-ingress-nginx.yaml  CHART_BOOTSTRAP=false  /charts/build-chart.sh
RUN CHART_VERSION="2.11.100-build2023051510"  CHART_FILE=/charts/rke2-metrics-server.yaml CHART_BOOTSTRAP=false  /charts/build-chart.sh
RUN CHART_VERSION="v4.0.2-build2023081100"    CHART_FILE=/charts/rke2-multus.yaml         CHART_BOOTSTRAP=true   /charts/build-chart.sh
RUN CHART_VERSION="1.5.100"                   CHART_FILE=/charts/rancher-vsphere-cpi.yaml CHART_BOOTSTRAP=true   /charts/build-chart.sh
RUN CHART_VERSION="3.0.1-rancher101"          CHART_FILE=/charts/rancher-vsphere-csi.yaml CHART_BOOTSTRAP=true   /charts/build-chart.sh
RUN CHART_VERSION="0.2.200"                   CHART_FILE=/charts/harvester-cloud-provider.yaml CHART_BOOTSTRAP=true /charts/build-chart.sh
RUN CHART_VERSION="0.1.1600"                  CHART_FILE=/charts/harvester-csi-driver.yaml     CHART_BOOTSTRAP=true /charts/build-chart.sh
RUN CHART_VERSION="1.7.202"                   CHART_FILE=/charts/rke2-snapshot-controller.yaml CHART_BOOTSTRAP=false /charts/build-chart.sh
RUN CHART_VERSION="1.7.202"                   CHART_FILE=/charts/rke2-snapshot-controller-crd.yaml CHART_BOOTSTRAP=false /charts/build-chart.sh
RUN CHART_VERSION="1.7.302"                   CHART_FILE=/charts/rke2-snapshot-validation-webhook.yaml CHART_BOOTSTRAP=false /charts/build-chart.sh
RUN rm -vf /charts/*.sh /charts/*.md

# rke2-runtime image
# This image includes any host level programs that we might need. All binaries
# must be placed in bin/ of the file image and subdirectories of bin/ will be flattened during installation.
# This means bin/foo/bar will become bin/bar when rke2 installs this to the host
FROM rancher/hardened-kubernetes:v1.27.7-rke2r1-build20231018 AS kubernetes
FROM rancher/hardened-containerd:v1.7.7-k3s1-build20231010 AS containerd
FROM rancher/hardened-crictl:v1.26.1-build20230606 AS crictl
FROM rancher/hardened-runc:v1.1.8-build20230802 AS runc

FROM scratch AS runtime-collect
COPY --from=runc \
    /usr/local/bin/runc \
    /bin/
COPY --from=crictl \
    /usr/local/bin/crictl \
    /bin/
COPY --from=containerd \
    /usr/local/bin/containerd \
    /usr/local/bin/containerd-shim \
    /usr/local/bin/containerd-shim-runc-v1 \
    /usr/local/bin/containerd-shim-runc-v2 \
    /usr/local/bin/ctr \
    /bin/
COPY --from=kubernetes \
    /usr/local/bin/kubectl \
    /usr/local/bin/kubelet \
    /bin/
COPY --from=charts \
    /charts/ \
    /charts/

FROM scratch AS runtime
COPY --from=runtime-collect / /

FROM ubuntu:22.04 AS test
ARG TARGETARCH
VOLUME /var/lib/rancher/rke2
VOLUME /var/lib/kubelet
VOLUME /var/lib/cni
VOLUME /var/log
COPY bin/rke2 /bin/
# use built air-gap images
COPY build/images/rke2-images.linux-amd64.tar.zst /var/lib/rancher/rke2/agent/images/
COPY build/images.txt /images.txt

# use rke2 bundled binaries
ENV PATH=/var/lib/rancher/rke2/bin:$PATH
# for kubectl
ENV KUBECONFIG=/etc/rancher/rke2/rke2.yaml
# for crictl
ENV CONTAINER_RUNTIME_ENDPOINT="unix:///run/k3s/containerd/containerd.sock"
# for ctr
RUN mkdir -p /run/containerd && \
    ln -s /run/k3s/containerd/containerd.sock /run/containerd/containerd.sock
# for go dns bug
RUN mkdir -p /etc && \
    echo 'hosts: files dns' > /etc/nsswitch.conf
# for conformance testing
RUN chmod 1777 /tmp
RUN set -x && \
    export DEBIAN_FRONTEND=noninteractive && \
    apt-get -y update && \
    apt-get -y upgrade && \
    apt-get -y install \
    bash \
    bash-completion \
    ca-certificates \
    conntrack \
    ebtables \
    ethtool \
    iptables \
    jq \
    less \
    socat \
    vim 
ENTRYPOINT ["/bin/rke2"]
CMD ["server"]
0707010000001B000081A4000000000000000000000001653C446F0000006B000000000000000000000000000000000000002300000000rke2-1.27.7+rke2r1/Dockerfile.docsFROM squidfunk/mkdocs-material
RUN pip install mkdocs-markdownextradata-plugin
RUN apk add -U git openssh

0707010000001C000081A4000000000000000000000001653C446F000013BD000000000000000000000000000000000000002600000000rke2-1.27.7+rke2r1/Dockerfile.windowsFROM alpine:3.18 AS build

RUN apk --no-cache add \
    curl \
    unzip

# Dapper/Drone/CI environment
FROM rancher/hardened-build-base:v1.20.4b11 AS dapper
ENV DAPPER_ENV GODEBUG REPO TAG DRONE_TAG PAT_USERNAME PAT_TOKEN KUBERNETES_VERSION DOCKER_BUILDKIT DRONE_BUILD_EVENT IMAGE_NAME AWS_SECRET_ACCESS_KEY AWS_ACCESS_KEY_ID ENABLE_REGISTRY
ARG DAPPER_HOST_ARCH
ENV ARCH $DAPPER_HOST_ARCH
ENV DAPPER_OUTPUT ./dist ./bin ./build
ENV DAPPER_DOCKER_SOCKET true
ENV DAPPER_TARGET dapper
ENV DAPPER_RUN_ARGS "--privileged --network host -v /tmp:/tmp -v rke2-pkg:/go/pkg -v rke2-cache:/root/.cache/go-build"
RUN apk update
RUN set -x && \
    apk add --no-cache \
    mingw-w64-gcc \
    libarchive-tools \
    gcc \
    bsd-compat-headers \
    zstd \
    jq \
    python3 \
    git \
    libseccomp-dev \
    rsync \
    file \
    bash \
    py-pip
RUN curl -sL https://storage.googleapis.com/kubernetes-release/release/$( \
    curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt \
    )/bin/linux/${ARCH}/kubectl -o /usr/local/bin/kubectl && \
    chmod a+x /usr/local/bin/kubectl; \
    pip install codespell
RUN curl -sL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v1.47.3
WORKDIR /source
# End Dapper stuff

FROM rancher/hardened-containerd:v1.7.7-k3s1-build20231010-amd64-windows AS containerd
FROM build as windows-runtime-collect
ARG KUBERNETES_VERSION=dev

# windows runtime image
ENV CRICTL_VERSION="v1.27.0"
ENV CALICO_VERSION="v3.26.1"
ENV CNI_PLUGIN_VERSION="v1.1.1"

RUN mkdir -p rancher

# We use the containerd-shim-runhcs-v1.exe binary from upstream, as it apparently can't be cross-built on Linux
COPY Dockerfile ./
RUN CONTAINERD_VERSION=$(grep "rancher/hardened-containerd" Dockerfile | grep ':v' | cut -d '=' -f 2- | grep -oE "([0-9]+)\.([0-9]+)\.([0-9]+)") \
 && curl -sLO https://github.com/containerd/containerd/releases/download/v${CONTAINERD_VERSION}/containerd-${CONTAINERD_VERSION}-windows-amd64.tar.gz \
 && curl -sLO https://github.com/containerd/containerd/releases/download/v${CONTAINERD_VERSION}/containerd-${CONTAINERD_VERSION}-windows-amd64.tar.gz.sha256sum \
 && sha256sum -c containerd-${CONTAINERD_VERSION}-windows-amd64.tar.gz.sha256sum

RUN curl -sLO https://github.com/kubernetes-sigs/cri-tools/releases/download/${CRICTL_VERSION}/crictl-${CRICTL_VERSION}-windows-amd64.tar.gz
# cri-tools artifact sha256sums are currently broken
#RUN curl -SLO https://github.com/kubernetes-sigs/cri-tools/releases/download/${CRICTL_VERSION}/crictl-${CRICTL_VERSION}-windows-amd64.tar.gz.sha256
#RUN sha256sum -c ./crictl-${CRICTL_VERSION}-windows-amd64.tar.gz.sha256

RUN curl -sLO https://github.com/containernetworking/plugins/releases/download/${CNI_PLUGIN_VERSION}/cni-plugins-windows-amd64-${CNI_PLUGIN_VERSION}.tgz
RUN curl -sLO https://github.com/containernetworking/plugins/releases/download/${CNI_PLUGIN_VERSION}/cni-plugins-windows-amd64-${CNI_PLUGIN_VERSION}.tgz.sha256
RUN sha256sum -c cni-plugins-windows-amd64-${CNI_PLUGIN_VERSION}.tgz.sha256

RUN curl -sLO https://dl.k8s.io/release/${KUBERNETES_VERSION}/bin/windows/amd64/kubectl.exe
RUN curl -sLO https://dl.k8s.io/${KUBERNETES_VERSION}/bin/windows/amd64/kubectl.exe.sha256
RUN echo "  kubectl.exe" >> kubectl.exe.sha256
RUN sha256sum -c kubectl.exe.sha256
RUN mv kubectl.exe rancher/

RUN curl -sLO https://dl.k8s.io/release/${KUBERNETES_VERSION}/bin/windows/amd64/kubelet.exe
RUN curl -sLO https://dl.k8s.io/${KUBERNETES_VERSION}/bin/windows/amd64/kubelet.exe.sha256
RUN echo "  kubelet.exe" >> kubelet.exe.sha256
RUN sha256sum -c kubelet.exe.sha256
RUN mv kubelet.exe rancher/

RUN curl -sLO https://dl.k8s.io/release/${KUBERNETES_VERSION}/bin/windows/amd64/kube-proxy.exe
RUN curl -sLO https://dl.k8s.io/${KUBERNETES_VERSION}/bin/windows/amd64/kube-proxy.exe.sha256
RUN echo "  kube-proxy.exe" >> kube-proxy.exe.sha256
RUN sha256sum -c kube-proxy.exe.sha256
RUN mv kube-proxy.exe rancher/

RUN curl -sLO https://github.com/projectcalico/calico/releases/download/${CALICO_VERSION}/calico-windows-${CALICO_VERSION}.zip
RUN curl -sL https://github.com/Microsoft/SDN/raw/master/Kubernetes/windows/hns.psm1 -o rancher/hns.psm1

RUN CONTAINERD_VERSION=$(grep "rancher/hardened-containerd" Dockerfile | grep ':v' | cut -d '=' -f 2- | grep -oE "([0-9]+)\.([0-9]+)\.([0-9]+)") \
 && tar xvzf containerd-${CONTAINERD_VERSION}-windows-amd64.tar.gz -C rancher/ bin/containerd-shim-runhcs-v1.exe
RUN tar xzvf crictl-${CRICTL_VERSION}-windows-amd64.tar.gz crictl.exe -C rancher/
RUN tar xzvf cni-plugins-windows-amd64-${CNI_PLUGIN_VERSION}.tgz ./win-overlay.exe ./host-local.exe -C rancher/

RUN unzip calico-windows-${CALICO_VERSION}.zip
RUN mv CalicoWindows/calico-node.exe rancher/
RUN mv CalicoWindows/cni/calico.exe rancher/
RUN mv CalicoWindows/cni/calico-ipam.exe rancher/
RUN mv CalicoWindows/confd confd/

FROM scratch AS windows-runtime
COPY --from=containerd /usr/local/bin/*.exe /bin/
COPY --from=windows-runtime-collect ./rancher/* /bin/
COPY --from=windows-runtime-collect ./confd/ /bin/confd
0707010000001D000081A4000000000000000000000001653C446F000027BE000000000000000000000000000000000000001B00000000rke2-1.27.7+rke2r1/LICENSE
                                 Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/

TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

1. Definitions.

"License" shall mean the terms and conditions for use, reproduction,
      and distribution as defined by Sections 1 through 9 of this document.

"Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.

"Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.

"You" (or "Your") shall mean an individual or Legal Entity
      exercising permissions granted by this License.

"Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.

"Object" form shall mean any form resulting from mechanical
      transformation or translation of a Source form, including but
      not limited to compiled object code, generated documentation,
      and conversions to other media types.

"Work" shall mean the work of authorship, whether in Source or
      Object form, made available under the License, as indicated by a
      copyright notice that is included in or attached to the work
      (an example is provided in the Appendix below).

"Derivative Works" shall mean any work, whether in Source or Object
      form, that is based on (or derived from) the Work and for which the
      editorial revisions, annotations, elaborations, or other modifications
      represent, as a whole, an original work of authorship. For the purposes
      of this License, Derivative Works shall not include works that remain
      separable from, or merely link (or bind by name) to the interfaces of,
      the Work and Derivative Works thereof.

"Contribution" shall mean any work of authorship, including
      the original version of the Work and any modifications or additions
      to that Work or Derivative Works thereof, that is intentionally
      submitted to Licensor for inclusion in the Work by the copyright owner
      or by an individual or Legal Entity authorized to submit on behalf of
      the copyright owner. For the purposes of this definition, "submitted"
      means any form of electronic, verbal, or written communication sent
      to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
      excluding communication that is conspicuously marked or otherwise
      designated in writing by the copyright owner as "Not a Contribution."

"Contributor" shall mean Licensor and any individual or Legal Entity
      on behalf of whom a Contribution has been received by Licensor and
      subsequently incorporated within the Work.

2. Grant of Copyright License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      copyright license to reproduce, prepare Derivative Works of,
      publicly display, publicly perform, sublicense, and distribute the
      Work and such Derivative Works in Source or Object form.

3. Grant of Patent License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,
      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work
      or a Contribution incorporated within the Work constitutes direct
      or contributory patent infringement, then any patent licenses
      granted to You under this License for that Work shall terminate
      as of the date such litigation is filed.

4. Redistribution. You may reproduce and distribute copies of the
      Work or Derivative Works thereof in any medium, with or without
      modifications, and in Source or Object form, provided that You
      meet the following conditions:

(a) You must give any other recipients of the Work or
          Derivative Works a copy of this License; and

(b) You must cause any modified files to carry prominent notices
          stating that You changed the files; and

(c) You must retain, in the Source form of any Derivative Works
          that You distribute, all copyright, patent, trademark, and
          attribution notices from the Source form of the Work,
          excluding those notices that do not pertain to any part of
          the Derivative Works; and

(d) If the Work includes a "NOTICE" text file as part of its
          distribution, then any Derivative Works that You distribute must
          include a readable copy of the attribution notices contained
          within such NOTICE file, excluding those notices that do not
          pertain to any part of the Derivative Works, in at least one
          of the following places: within a NOTICE text file distributed
          as part of the Derivative Works; within the Source form or
          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. You may add Your own attribution
          notices within Derivative Works that You distribute, alongside
          or as an addendum to the NOTICE text from the Work, provided
          that such additional attribution notices cannot be construed
          as modifying the License.

You may add Your own copyright statement to Your modifications and
      may provide additional or different license terms and conditions
      for use, reproduction, or distribution of Your modifications, or
      for any such Derivative Works as a whole, provided Your use,
      reproduction, and distribution of the Work otherwise complies with
      the conditions stated in this License.

5. Submission of Contributions. Unless You explicitly state otherwise,
      any Contribution intentionally submitted for inclusion in the Work
      by You to the Licensor shall be under the terms and conditions of
      this License, without any additional terms or conditions.
      Notwithstanding the above, nothing herein shall supersede or modify
      the terms of any separate license agreement you may have executed
      with Licensor regarding such Contributions.

6. Trademarks. This License does not grant permission to use the trade
      names, trademarks, service marks, or product names of the Licensor,
      except as required for reasonable and customary use in describing the
      origin of the Work and reproducing the content of the NOTICE file.

7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
      Contributor provides its Contributions) on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
      implied, including, without limitation, any warranties or conditions
      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
      PARTICULAR PURPOSE. You are solely responsible for determining the
      appropriateness of using or redistributing the Work and assume any
      risks associated with Your exercise of permissions under this License.

8. Limitation of Liability. In no event and under no legal theory,
      whether in tort (including negligence), contract, or otherwise,
      unless required by applicable law (such as deliberate and grossly
      negligent acts) or agreed to in writing, shall any Contributor be
      liable to You for damages, including any direct, indirect, special,
      incidental, or consequential damages of any character arising as a
      result of this License or out of the use or inability to use the
      Work (including but not limited to damages for loss of goodwill,
      work stoppage, computer failure or malfunction, or any and all
      other commercial damages or losses), even if such Contributor
      has been advised of the possibility of such damages.

9. Accepting Warranty or Additional Liability. While redistributing
      the Work or Derivative Works thereof, You may choose to offer,
      and charge a fee for, acceptance of support, warranty, indemnity,
      or other liability obligations and/or rights consistent with this
      License. However, in accepting such obligations, You may act only
      on Your own behalf and on Your sole responsibility, not on behalf
      of any other Contributor, and only if You agree to indemnify,
      defend, and hold each Contributor harmless for any liability
      incurred by, or claims asserted against, such Contributor by reason
      of your accepting any such warranty or additional liability.

END OF TERMS AND CONDITIONS
0707010000001E000081A4000000000000000000000001653C446F0000037C000000000000000000000000000000000000001F00000000rke2-1.27.7+rke2r1/MAINTAINERS# The following is the list of current RKE2 maintainers
# Github ID, Name, Email Address

brandond, Brad Davidson, brad.davidson@suse.com
briandowns, Brian Downs, brian.downs@suse.com
brooksn, Brooks Newberry, brooks.newberry@suse.com
caroline-suse-rancher, Caroline Davis, caroline.davis@suse.com
cwayne18, Chris Wayne, chris.wayne@suse.com
dereknola, Derek Nola, derek.nola@suse.com
galal-hussein, Hussein Galal, hussein.galalabdelazizahmed@suse.com
manuelbuil, Manuel Buil, mbuil@suse.com
matttrach, Matt Trachier, matt.trachier@suse.com
mdrahman-suse, MD Rahman, md.rahman@suse.com
Oats87, Chris Kim, chris.kim@suse.com
rancher-max, Max Ross, max.ross@suse.com
rbrtbnfgl, Roberto Bonafiglia, roberto.bonafiglia@suse.com
ShylajaDevadiga, Shylaja Devadiga, shylaja.devadiga@suse.com
thomasferrandiz, Thomas Ferrandiz, thomas.ferrandiz@suse.com
VestigeJ, Justin Janes, justin.janes@suse.com
0707010000001F000081A4000000000000000000000001653C446F000014AC000000000000000000000000000000000000001C00000000rke2-1.27.7+rke2r1/Makefile.PHONY: default
default: in-docker-build                 ## Build using docker environment (default target)
	@echo "Run make help for info about other make targets"

.PHONY: ci
ci: in-docker-.ci                        ## Run CI locally

.PHONY: ci-shell
ci-shell: clean .dapper                  ## Launch a shell in the CI environment to troubleshoot. Runs clean first
	@echo
	@echo '######################################################'
	@echo '# Run "make dapper-ci" to reproduce CI in this shell #'
	@echo '######################################################'
	@echo
	./.dapper -f Dockerfile --target dapper -s

.PHONY: dapper-ci
dapper-ci: .ci                           ## Used by Drone CI, does the same as "ci" but in a Drone way

.ci: validate build package

.PHONY: build
build:                                   ## Build using host go tools
	./scripts/build

.PHONY: build-binary
build-binary:                             	## Build only the Linux binary using host go tools
	./scripts/build-binary

.PHONY: build-windows-binary
build-windows-binary:                       ## Build only the Windows binary using host go tools
	./scripts/build-windows-binary

.PHONY: build-debug
build-debug:                             ## Debug build using host go tools
	GODEBUG=y ./scripts/build-binary

.PHONY: scan-images
scan-images:
	./scripts/scan-images

.PHONY: build-images
build-images:                             ## Build all images and image tarballs (including airgap)
	./scripts/build-images

.PHONY: build-windows-images
build-windows-images:                     ## Build only the Windows images and tarballs (including airgap)
	./scripts/build-windows-images

.PHONY: build-image-kubernetes
build-image-kubernetes:                   ## Build the kubernetes image
	./scripts/build-image-kubernetes

.PHONY: build-image-runtime
build-image-runtime:                      ## Build the runtime image
	./scripts/build-image-runtime

.PHONY: publish-image-kubernetes
publish-image-kubernetes: build-image-kubernetes
	./scripts/publish-image-kubernetes

.PHONY: publish-image-runtime
publish-image-runtime: build-image-runtime
	./scripts/publish-image-runtime

.PHONY: validate
validate:                                ## Run go fmt/vet
	./scripts/validate

.PHONY: validate-release
validate-release: 
	./scripts/validate-release

.PHONY: run
run: build-debug
	./scripts/run

.PHONY: remote-debug
remote-debug: build-debug        		 ## Run with remote debugging listening on :2345
	./scripts/remote-debug

.PHONY: remote-debug-exit
remote-debug-exit:              		 ## Kill dlv started with make remote-debug
	./scripts/remote-debug-exit

.PHONY: dev-shell-build
dev-shell-build: in-docker-build
	./scripts/dev-shell-build

.PHONY: clean-cache
clean-cache:                             ## Clean up docker base caches used for development
	./scripts/clean-cache

.PHONY: clean
clean:                                   ## Clean up workspace
	./scripts/clean

.PHONY: dev-shell
dev-shell: dev-shell-build              ## Launch a development shell to run test builds
	./scripts/dev-shell

.PHONY: dev-shell-enter
dev-shell-enter:                       ## Enter the development shell on another terminal
	./scripts/dev-shell-enter

.PHONY: dev-peer
dev-peer: dev-shell-build              ## Launch a server peer to run test builds
	./scripts/dev-peer

.PHONY: dev-peer-enter
dev-peer-enter:                         ## Enter the peer shell on another terminal
	./scripts/dev-peer-enter

.PHONY: publish-manifest-kubernetes
publish-manifest-kubernetes: build-image-kubernetes						## Create and push the kubernetes manifest
	./scripts/publish-manifest-kubernetes

.PHONY: dispatch
dispatch:								## Send dispatch event to rke2-upgrade repo
	./scripts/dispatch

.PHONY: package
package: build 						## Package the rke2 binary
	./scripts/package

.PHONY: package-images
package-images: build-images		## Package docker images for airgap environment
	./scripts/package-images

.PHONY: package-windows-images
package-windows-images: build-windows-images		## Package Windows crane images for airgap environment
	./scripts/package-windows-images

.PHONY: package-bundle
package-bundle: build-binary					## Package the tarball bundle
	./scripts/package-bundle

.PHONY: package-windows-bundle
package-windows-bundle: build-windows-binary	## Package the Windows tarball bundle
	./scripts/package-windows-bundle

.PHONY: test
test: unit-tests integration-tests

.PHONY: unit-tests
unit-tests:
	./scripts/unit-tests

.PHONY: integration-tests
integration-tests:
	./scripts/test

./.dapper:
	@echo Downloading dapper
	@curl -sL https://releases.rancher.com/dapper/v0.5.8/dapper-$$(uname -s)-$$(uname -m) > .dapper.tmp
	@@chmod +x .dapper.tmp
	@./.dapper.tmp -v
	@mv .dapper.tmp .dapper

in-docker-%: .dapper                     ## Advanced: wraps any target in Docker environment, for example: in-docker-build-debug
	mkdir -p ./bin/ ./dist/ ./build
	./.dapper -f Dockerfile --target dapper make $*

.PHONY: help
help: ## this help
	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)

serve-docs: mkdocs
	docker run -p 8000:8000 --rm -it -v $${PWD}:/docs mkdocs serve -a 0.0.0.0:8000

mkdocs:
	docker build -t mkdocs -f Dockerfile.docs .
07070100000020000081A4000000000000000000000001653C446F00000D47000000000000000000000000000000000000001D00000000rke2-1.27.7+rke2r1/README.md# RKE2
![RKE2](https://docs.rke2.io/img/logo-horizontal-rke2.svg)

RKE2, also known as RKE Government, is Rancher's next-generation Kubernetes distribution.

It is a fully [conformant Kubernetes distribution](https://landscape.cncf.io/?selected=rke-government) that focuses on security and compliance within the U.S. Federal Government sector.

To meet these goals, RKE2 does the following:

- Provides [defaults and configuration options](https://docs.rke2.io/security/hardening_guide/) that allow clusters to pass the [CIS Kubernetes Benchmark](https://docs.rke2.io/security/cis_self_assessment123/) with minimal operator intervention
- Enables [FIPS 140-2 compliance](https://docs.rke2.io/security/fips_support/)
- Supports SELinux policy and [Multi-Category Security (MCS)](https://selinuxproject.org/page/NB_MLS) label enforcement
- Regularly scans components for CVEs using [trivy](https://github.com/aquasecurity/trivy) in our build pipeline

For more information and detailed installation and operation instructions, [please visit our docs](https://docs.rke2.io/).

## Quick Start
Here's the ***extremely*** quick start:
```sh
curl -sfL https://get.rke2.io | sh -
systemctl enable rke2-server.service
systemctl start rke2-server.service
# Wait a bit
export KUBECONFIG=/etc/rancher/rke2/rke2.yaml PATH=$PATH:/var/lib/rancher/rke2/bin
kubectl get nodes
```
For a bit more, [check out our full quick start guide](https://docs.rke2.io/install/quickstart/).

## Installation

A full breakdown of installation methods and information can be found [here](https://docs.rke2.io/install/methods/).

## Configuration File

The primary way to configure RKE2 is through its [config file](https://docs.rke2.io/install/configuration#configuration-file). Command line arguments and environment variables are also available, but RKE2 is installed as a systemd service and thus these are not as easy to leverage.

By default, RKE2 will launch with the values present in the YAML file located at `/etc/rancher/rke2/config.yaml`.

An example of a basic `server` config file is below:

```yaml
# /etc/rancher/rke2/config.yaml
write-kubeconfig-mode: "0644"
tls-san:
  - "foo.local"
node-label:
  - "foo=bar"
  - "something=amazing"
```

In general, cli arguments map to their respective yaml key, with repeatable cli args being represented as yaml lists. So, an identical configuration using solely cli arguments is shown below to demonstrate this:

```bash
rke2 server \
  --write-kubeconfig-mode "0644"    \
  --tls-san "foo.local"             \
  --node-label "foo=bar"            \
  --node-label "something=amazing"
```

It is also possible to use both a configuration file and cli arguments.  In these situations, values will be loaded from both sources, but cli arguments will take precedence.  For repeatable arguments such as `--node-label`, the cli arguments will overwrite all values in the list.

Finally, the location of the config file can be changed either through the cli argument `--config FILE, -c FILE`, or the environment variable `$RKE2_CONFIG_FILE`.

## FAQ

- [How is this different from RKE1 or K3s?](https://docs.rke2.io/#how-is-this-different-from-rke-or-k3s)
- [Why two names?](https://docs.rke2.io/#why-two-names)

## Security

Security issues in RKE2 can be reported by sending an email to [security@rancher.com](mailto:security@rancher.com). Please do not open security issues here.
07070100000021000081A4000000000000000000000001653C446F00000E00000000000000000000000000000000000000001F00000000rke2-1.27.7+rke2r1/SECURITY.md# Security Policy

## Reporting a Vulnerability

SUSE Rancher supports responsible disclosure and endeavors to resolve security issues in a reasonable timeframe. To report a security vulnerability, email [security-rancher@suse.com](mailto:security-rancher@suse.com). You may (but are not required to) use the GPG key `rsa4096/C9DF50BDAC351DA9` for encrypted communication.

### GPG Key - `security-rancher@suse.com`

```
-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBGHvxFcBEADibmTaKMTFbiMRAxtM5OjMOAjko7CovpnYSUOuRYi4IblFKIjL
P41oMBT+NgYEQh2//ktNAnAD/v83fkhjPZEM/Fo3yE6JdedCsHajZ2ryeuqEzs5F
c94UtTg8NQxrUgEe4Lk0tFdniGCt8BOb8spZIo9N87L2Zu3Z4P2vIjxdVGvXEQM8
dr/+s4e973C6PXzXlIDeS3NE51aA0BSHHX72SwZWpvrNusW5fm0mFdLh1y6hNK16
eNhXLwsA8RnvoOGS04DJCKxAlHQwUDRUDhPI6ULvN/RKm4mlf/qhNHvAntcJ9kiP
upFuPkHZxWAnLUyaWE+o8FhEVjHkaC9Abdyh33E6L252LKZvWszSiQSIJGXEa2TD
njume+jIMdoJN+g7m5NH7HszeKMF5YF0wek8ZvKBfJCxSn9EbUymNkDW5BwSnavQ
sukUawP89VLyXUd+hyd/e5IPMkYDvuHwqHlk60VWPKk7JC2M1LPCgqUsvyHaApQL
TFKHX6F6e0PnIkkU5VGhoSEBTT9B7vFYOMIvQSCavZadKTEZ0dNqd+bJWiLf3VYL
0srd9mPA6blO67EnuP6iuindzrZjQRGnjKkn7JCIoh0FG18kOnjw8dIu6UhCxu2m
V10xCbAMiEMAESuZr6iHG2y//UAYf7drPAGXcEqC+y51DxKcX6TPxNzkXwARAQAB
tDFTVVNFIFJhbmNoZXIgU2VjdXJpdHkgPHNlY3VyaXR5LXJhbmNoZXJAc3VzZS5j
b20+iQJSBBMBCAA8FiEEes5vtg3E4mxMbzRNyd9Qvaw1HakFAmHvxFcCGwMFCwkI
BwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEMnfUL2sNR2pDaYQAJuTbJVAVDWT
zGY2qbg5WSeniKWfS9EYkBD+7HIJWS8M3qOE6rC3plAWYOxs9imKLMJ/mg6dLb0Y
1EqofnqmNewd+QRouSwOG8smyjBubRXFQfSM7WLhid8DItnqK6a97ZoJ+TWB1tLQ
Nx6dkyrFRJS6uQtJxcA1ry6MazXduF7YKTmg7tjaV7Lc+RDReDLWMyk9YTlHFDSn
toKKxB0PxTHOVlhxkItDsxVhdhmfy5BSU9m703so7qnfKU5FEMBj9GwykJKdCtZV
pgk6BNONZkLNH9Mh2kVT2jUf8W/QxjKszHXJixhah6kfSKDaEwiwubP3Q5eVEWei
qzZSfHELXG/fi6yp2P25isttjRS1ovEScjMcgoGFFJjaXA2Rjm7/bMK1Ip1hJdDN
+In2PUuntqPlAFlsnD5bnq2l/uP4QDr/T8aLZxrpuNgKStZTpNrsk6XOOeEagQIO
+AVTIyE/DyHWO8LuX1lgj6aQHJSncbjMMMTdLwGFavliErsBuAhaHRqiuZXG8hLn
ggKkVw/t+pp3RPCuRkOEN/BjubbbIOb39SoWd5w/7X66pHQMxlS1vfy3GllGps9W
Oj0pSuuK1AOnExIdVdj1+9oR9NXABNNZkx1+GgZgIcoTrDWrm74DG9tkIp2OMuFM
ElnSEsmoDgz33ODc/PPx5CElN4zdp9r9uQINBGHvxFcBEADV5xofPXD5LoZN80nq
7DaRPxDm4sOXpI/29Yom+fYLtAetI4usMkBV/0+DoHyryPJoJFgIohGHmb3s5U3y
kEJb3ie+KignEQCI0TA0tUpc3d8R38JAFwzRi+yWakPp00a9lmSVUwD6bm6xG5U4
arV4xcR12UdPzTSwDGjrt3oDEfpBO927mI5zaboLB7tmhSjwofgtcVsWJAZ28P7I
yD6E+EigxHgTEwT9nhAf42aIzp+NIl2gpdv7BOA3Akef5YhN0eFe8I3n0eyw4d3v
mp0fwjUgi26LYsCBdJR7VbIahjuLEJ7La2H5mNZUNGRCch3m5uSkAvYyMmrMQa0T
STUzzWwgftyqIYTijBMMWmoTRUsrKf6J975J8y92HzPxe3Rd/xJkiG6Dpv6bX2zp
monCoqOwTDihANFDp5xKcO8MvF5jNEIVy3OUqEeBVjL+7d03mFeej1YnBejOxwDs
vG+joSWEdwgBzkOnU5Uv2cBzs8XimgbR8dew//3DcHCqrrKQ8bVDN9ggKPDQsytv
toWaxi0hCPbM/XNh9eFKb/jEEmtYLTKN4UQVxQWZ2h2yrGPnIYzwWPc6n212pqdM
Pzy76xFLl6q8bYYBZ0whKZRr6SDgKOA+SA8XeSuShwnTlu49OFLmWeTNDnAIXbAk
ZsFnI/Sc9iLeLlq/C0NXDPwgxwARAQABiQI2BBgBCAAgFiEEes5vtg3E4mxMbzRN
yd9Qvaw1HakFAmHvxFcCGwwACgkQyd9Qvaw1HambBw/+Je2au+Tuqzk7Cmb3M9ri
re4/7H40GwWCerg0+7khBNM4qcRfJ/0cMnIwkT/U/8ezDY7Vvysmx8FalVDdERAT
ke6hVBIDBMq2EbhakEliHx8H0PZVvVXIe/ficZ48X167N6g44TG3LHagzbdniggy
V5P61Ktv1acXlKWgEJekOVn5AnA3PXupRHBbwXKWGlCnCqQiNJrQIgbz5lP+8DsF
+hb3YXVvQ48C2PBx1gOWRwaZ7eB7DLp7iGNYSvdBpyBW5mjaMoUHajvpM0cG+5Zg
D/brCWasbmaD7QulDCvi/JkTjA3BMgBAfuDTCC/buk+8QoAeREruRWPfF5IYqjD0
x8xnkTFywz7HwX548kAbPftjZ3Fnwre5JWqkPWu7r15TPt+kHOPvt3mZIr4HNUye
QZG+RrN8rTYpHAYJm7Sc6Qt+Iilk6vp1hO/EBly2g/Er+IH/rykotmcbCvwqlITU
M9IVbqRcO0AEAD6QDBiswL1c2FxshAcjfab8zsbGP1UMhTo3RpddujvSiwenaeSK
WcUE3jFEJK6NjKRNzUjnudhesOUVysKex0ePmhL02wwVFTgxd0+Fa93AyEwVVlK7
7deeeRAxLgvAMBI8N4+KkznAtyXwtVcWz4wIflznYr0ZW9kJZFepC/mQgUJs/A46
ArCzVjxOM8JhL941OADyL1A=
=l4yT
-----END PGP PUBLIC KEY BLOCK-----
```
07070100000022000081A4000000000000000000000001653C446F00001A02000000000000000000000000000000000000001F00000000rke2-1.27.7+rke2r1/Vagrantfile# -*- mode: ruby -*-
# vi: set ft=ruby :

# Adapted from https://github.com/containerd/containerd/pull/4451
Vagrant.configure("2") do |config|
  config.vm.box = "centos/7"
  config.vm.provider :virtualbox do |v|
    config.vm.box_url = "https://cloud.centos.org/centos/7/vagrant/x86_64/images/CentOS-7-x86_64-Vagrant-2004_01.VirtualBox.box"
    v.memory = 2048
    v.cpus = 2
  end
  config.vm.provider :libvirt do |v|
    config.vm.box_url = "https://cloud.centos.org/centos/7/vagrant/x86_64/images/CentOS-7-x86_64-Vagrant-2004_01.LibVirt.box"
    v.memory = 2048
    v.cpus = 2
  end

config.vm.hostname = "rke2-test"

# Disabled by default. To run:
  #   vagrant up --provision-with=upgrade-packages
  # To upgrade only specific packages:
  #   UPGRADE_PACKAGES=selinux vagrant up --provision-with=upgrade-packages
  #
  config.vm.provision "upgrade-packages", type: "shell", run: "never" do |sh|
    sh.upload_path = "/tmp/vagrant-upgrade-packages"
    sh.env = {
        'UPGRADE_PACKAGES': ENV['UPGRADE_PACKAGES'],
    }
    sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eux -o pipefail
        yum -y upgrade ${UPGRADE_PACKAGES}
    SHELL
  end

# To re-run, installing CNI from RPM:
  #   INSTALL_PACKAGES="containernetworking-plugins" vagrant up --provision-with=install-packages
  #
  config.vm.provision "install-packages", type: "shell", run: "once" do |sh|
    sh.upload_path = "/tmp/vagrant-install-packages"
    sh.env = {
        'INSTALL_PACKAGES': ENV['INSTALL_PACKAGES'],
    }
    sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eux -o pipefail
        yum -y install \
            container-selinux \
            curl \
            gcc \
            git \
            iptables \
            libseccomp-devel \
            libselinux-devel \
            less \
            lsof \
            make \
            selinux-policy-devel \
            setools-console \
            vim \
            ${INSTALL_PACKAGES}
    SHELL
  end

# To re-run this provisioner, installing a different version of go:
  #   GO_VERSION="1.15rc2" vagrant up --provision-with=install-golang
  #
  config.vm.provision "install-golang", type: "shell", run: "never" do |sh|
    sh.upload_path = "/tmp/vagrant-install-golang"
    sh.env = {
        'GO_VERSION': ENV['GO_VERSION'] || "1.14.7",
    }
    sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eux -o pipefail
        curl -fsSL "https://dl.google.com/go/go${GO_VERSION}.linux-amd64.tar.gz" | tar Cxz /usr/lib
        ln -fnsv /usr/lib/go/bin/{go,gofmt} /usr/bin
    SHELL
  end

config.vm.provision "install-cri-tools", type: "shell", run: "never" do |sh|
    sh.upload_path = "/tmp/vagrant-install-cri-tools"
    sh.env = {
        'CRI_TOOLS_VERSION': ENV['CRI_TOOLS_VERSION'] || 'master',
        'GOBIN': '/usr/bin',
        'GOPATH': '/go',
    }
    sh.inline = <<~SHELL
        #!/usr/bin/env bash
        source /etc/environment
        source /etc/profile.d/sh.local
        set -eux -o pipefail
        go get -u github.com/onsi/ginkgo/v2
        go get -d github.com/kubernetes-sigs/cri-tools/...
        cd "$GOPATH"/src/github.com/kubernetes-sigs/cri-tools
        git checkout $CRI_TOOLS_VERSION
        make
        sudo make BINDIR=$GOBIN install
        cat << EOF | sudo tee /etc/crictl.yaml
runtime-endpoint: unix:///run/k3s/containerd/containerd.sock
EOF
        type crictl critest ginkgo
        critest --version
    SHELL
  end

# SELinux is Enforcing by default.
  # To set SELinux as Disabled on a VM that has already been provisioned:
  #   SELINUX=Disabled vagrant up --provision-with=selinux
  # To set SELinux as Permissive on a VM that has already been provisioned
  #   SELINUX=Permissive vagrant up --provision-with=selinux
  config.vm.provision "selinux", type: "shell", run: "once" do |sh|
    sh.upload_path = "/tmp/vagrant-selinux"
    sh.env = {
        'SELINUX': ENV['SELINUX'] || "Permissive"
    }
    sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eux -o pipefail

if ! type -p getenforce setenforce &>/dev/null; then
          echo SELinux is Disabled
          exit 0
        fi

case "${SELINUX}" in
          Disabled)
            if mountpoint -q /sys/fs/selinux; then
              setenforce 0
              umount -v /sys/fs/selinux
            fi
            ;;
          Enforcing)
            mountpoint -q /sys/fs/selinux || mount -o rw,relatime -t selinuxfs selinuxfs /sys/fs/selinux
            setenforce 1
            ;;
          Permissive)
            mountpoint -q /sys/fs/selinux || mount -o rw,relatime -t selinuxfs selinuxfs /sys/fs/selinux
            setenforce 0
            ;;
          *)
            echo "SELinux mode not supported: ${SELINUX}" >&2
            exit 1
            ;;
        esac

echo SELinux is $(getenforce)
    SHELL
  end

config.vm.provision "install-rke2-policy", type: "shell", run: "never" do |sh|
    sh.upload_path = "/tmp/vagrant-install-rke2-policy"
    sh.env = {
        'SELINUX_POLICY_REPO': ENV['SELINUX_POLICY_REPO'] || "github.com/rancher/rke2-selinux",
        'SELINUX_POLICY_BRANCH': ENV['SELINUX_POLICY_BRANCH'] || "master",
    }
    sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eux -o pipefail
        if [ ! -d /vagrant/rke2-policy ]; then
            git clone https://${SELINUX_POLICY_REPO}.git /vagrant/rke2-policy
        fi
        pushd /vagrant/rke2-policy
        git checkout ${SELINUX_POLICY_BRANCH}
        make -f /usr/share/selinux/devel/Makefile rke2.pp
        semodule -i rke2.pp
    SHELL
  end

config.vm.provision "install-rke2", type: "shell", run: "once" do |sh|
    sh.upload_path = "/tmp/vagrant-install-rke2"
    sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eux -o pipefail
        mkdir -vp /usr/local
        if [ -e /vagrant/dist/artifacts/rke2.linux-amd64.tar.gz ]; then
            tar xz -f /vagrant/dist/artifacts/rke2.linux-amd64.tar.gz -C /usr/local
        fi

mkdir -vp /var/lib/rancher/rke2/agent/images
        if [ -e /vagrant/build/images/rke2-airgap.tar ]; then
            cp -vf /vagrant/build/images/rke2-airgap.tar /var/lib/rancher/rke2/agent/images/rke2.tar
        elif [ -e /vagrant/dist/artifacts/rke2-images.linux-amd64.tar.gz ]; then
            gzip -d < /vagrant/dist/artifacts/rke2-images.linux-amd64.tar.gz > /var/lib/rancher/rke2/agent/images/rke2.tar
        fi
        restorecon -r /var/lib/rancher/rke2 /usr/local || true
        cat <<-EOF > /etc/profile.d/rke2.sh
export KUBECONFIG=/etc/rancher/rke2/rke2.yaml PATH=/usr/local/bin:$PATH:/var/lib/rancher/rke2/bin
EOF
    SHELL
  end

end
07070100000023000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001A00000000rke2-1.27.7+rke2r1/bundle07070100000024000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001E00000000rke2-1.27.7+rke2r1/bundle/bin07070100000025000081ED000000000000000000000001653C446F00000CE3000000000000000000000000000000000000002E00000000rke2-1.27.7+rke2r1/bundle/bin/rke2-killall.sh#!/bin/sh

# make sure we run as root
if [ ! $(id -u) -eq 0 ]; then
    echo "$(basename "${0}"): must be run as root" >&2
    exit 1
fi

pschildren() {
    ps -e -o ppid= -o pid= | \
    sed -e 's/^\s*//g; s/\s\s*/\t/g;' | \
    grep -w "^$1" | \
    cut -f2
}

pstree() {
    for pid in "$@"; do
        echo ${pid}
        for child in $(pschildren ${pid}); do
            pstree ${child}
        done
    done
}

killtree() {
    kill -9 $(
        { set +x; } 2>/dev/null;
        pstree "$@";
        set -x;
    ) 2>/dev/null
}

getshims() {
    ps -e -o pid= -o args= | sed -e 's/^ *//; s/\s\s*/\t/;' | grep -w 'rke2/data/[^/]*/bin/containerd-shim' | cut -f1
}

do_unmount_and_remove() {
    { set +x; } 2>/dev/null
    MOUNTS=
    while read ignore mount ignore; do
        MOUNTS="${mount}\n${MOUNTS}"
    done </proc/self/mounts
    MOUNTS=$(printf ${MOUNTS} | grep "^$1" | sort -r)
    if [ -n "${MOUNTS}" ]; then
        set -x
        umount ${MOUNTS}
        rm -rf --one-file-system ${MOUNTS}
    else
        set -x
    fi
}

export PATH=$PATH:/var/lib/rancher/rke2/bin

set -x

systemctl stop rke2-server.service || true
systemctl stop rke2-agent.service || true

killtree $({ set +x; } 2>/dev/null; getshims; set -x)

do_unmount_and_remove '/run/k3s'
do_unmount_and_remove '/var/lib/rancher/rke2'
do_unmount_and_remove '/var/lib/kubelet/pods'
do_unmount_and_remove '/run/netns/cni-'

# Delete network interface(s) that match 'master cni0'
ip link show 2>/dev/null | grep 'master cni0' | while read ignore iface ignore; do
    iface=${iface%%@*}
    [ -z "$iface" ] || ip link delete $iface
done
ip link delete cni0
ip link delete flannel.1
ip link delete flannel-v6.1
ip link delete flannel-wg
ip link delete flannel-wg-v6
ip link delete vxlan.calico
ip link delete vxlan-v6.calico
ip link delete cilium_vxlan
ip link delete cilium_net
ip link delete kube-ipvs0

#Delete the nodeLocal created objects
if [ -d /sys/class/net/nodelocaldns ]; then
  for i in $(ip address show nodelocaldns | grep inet | awk '{print $2}');
  do
    iptables-save | grep -v $i | iptables-restore
  done
  ip link delete nodelocaldns
fi

rm -rf /var/lib/cni/ /var/log/pods/ /var/log/containers

# Remove pod-manifests files for rke2 components
POD_MANIFESTS_DIR=/var/lib/rancher/rke2/agent/pod-manifests

rm -f ${POD_MANIFESTS_DIR}/etcd.yaml \
      ${POD_MANIFESTS_DIR}/kube-apiserver.yaml \
      ${POD_MANIFESTS_DIR}/kube-controller-manager.yaml \
      ${POD_MANIFESTS_DIR}/cloud-controller-manager.yaml\
      ${POD_MANIFESTS_DIR}/kube-scheduler.yaml \
      ${POD_MANIFESTS_DIR}/kube-proxy.yaml

set +x

echo 'If this cluster was upgraded from an older release of the Canal CNI, you may need to manually remove some flannel iptables rules:'
echo -e '\texport cluster_cidr=YOUR-CLUSTER-CIDR'
echo -e '\tiptables -D POSTROUTING -s $cluster_cidr -j MASQUERADE --random-fully'
echo -e '\tiptables -D POSTROUTING ! -s $cluster_cidr -d  -j MASQUERADE --random-fully'
07070100000026000081A4000000000000000000000001653C446F000032A4000000000000000000000000000000000000003100000000rke2-1.27.7+rke2r1/bundle/bin/rke2-uninstall.ps1#Requires -RunAsAdministrator
<# 
.SYNOPSIS 
    Uninstalls the RKE2 Windows service and cleans the RKE2 Windows Agent (Worker) Node. Backup your data. Use at your own risk.
.DESCRIPTION 
    Run the script to uninstall the RKE2 Windows service and cleans the RKE2 Windows Agent (Worker) node of all RKE2 related data.
.NOTES
    This script needs to be run with Elevated permissions to allow for the complete collection of information.
    Backup your data.
    Use at your own risk.
.EXAMPLE 
    rke2-uninstall.ps1
    Uninstalls the RKE2 Windows service and cleans the RKE2 Windows Agent (Worker) Node
#>

$ErrorActionPreference = 'Stop'
$WarningPreference = 'SilentlyContinue'
$VerbosePreference = 'SilentlyContinue'
$DebugPreference = 'SilentlyContinue'
$InformationPreference = 'SilentlyContinue'

Set-StrictMode -Version Latest

function Test-Command($cmdname) {
    return [bool](Get-Command -Name $cmdname -ErrorAction SilentlyContinue)
}

function Write-LogInfo {
    Write-Host -NoNewline -ForegroundColor Blue "INFO: "
    Write-Host -ForegroundColor Gray ("{0,-44}" -f ($args -join " "))
}
function Write-LogWarn {
    Write-Host -NoNewline -ForegroundColor DarkYellow "WARN: "
    Write-Host -ForegroundColor Gray ("{0,-44}" -f ($args -join " "))
}
function Write-LogError {
    Write-Host -NoNewline -ForegroundColor DarkRed "ERROR: "
    Write-Host -ForegroundColor Gray ("{0,-44}" -f ($args -join " "))
}
function Write-LogFatal {
    Write-Host -NoNewline -ForegroundColor DarkRed "FATA: "
    Write-Host -ForegroundColor Gray ("{0,-44}" -f ($args -join " "))
    exit 255
}

function Get-VmComputeNativeMethods() {
    $ret = 'VmCompute.PrivatePInvoke.NativeMethods' -as [type]
    if (-not $ret) {
        $signature = @'
[DllImport("vmcompute.dll")]
public static extern void HNSCall([MarshalAs(UnmanagedType.LPWStr)] string method, [MarshalAs(UnmanagedType.LPWStr)] string path, [MarshalAs(UnmanagedType.LPWStr)] string request, [MarshalAs(UnmanagedType.LPWStr)] out string response);
'@
        $ret = Add-Type -MemberDefinition $signature -Namespace VmCompute.PrivatePInvoke -Name "NativeMethods" -PassThru
    }
    return $ret
}

function Invoke-HNSRequest {
    param
    (
        [ValidateSet('GET', 'DELETE')]
        [parameter(Mandatory = $true)] [string] $Method,
        [ValidateSet('networks', 'endpoints', 'activities', 'policylists', 'endpointstats', 'plugins')]
        [parameter(Mandatory = $true)] [string] $Type,
        [parameter(Mandatory = $false)] [string] $Action,
        [parameter(Mandatory = $false)] [string] $Data = "",
        [parameter(Mandatory = $false)] [Guid] $Id = [Guid]::Empty
    )

$hnsPath = "/$Type"
    if ($id -ne [Guid]::Empty) {
        $hnsPath += "/$id"
    }
    if ($Action) {
        $hnsPath += "/$Action"
    }

$response = ""
    $hnsApi = Get-VmComputeNativeMethods
    $hnsApi::HNSCall($Method, $hnsPath, "$Data", [ref]$response)

$output = @()
    if ($response) {
        try {
            $output = ($response | ConvertFrom-Json)
            if ($output.Error) {
                Write-LogError $output;
            }
            else {
                $output = $output.Output;
            }
        }
        catch {
            Write-LogError $_.
        }
    }

return $output;
}

# cleanup
Write-Host "Beginning the uninstall process"

function Stop-Processes () {
    $ProcessNames = @('rke2', 'kube-proxy', 'kubelet', 'containerd', 'wins', 'calico-node')
    foreach ($ProcessName in $ProcessNames) {
        Write-LogInfo "Checking if $ProcessName process exists"
        if ((Get-Process -Name $ProcessName -ErrorAction SilentlyContinue)) {
            Write-LogInfo "$ProcessName process found, stopping now"
            Stop-Process -Name $ProcessName
            while (-Not(Get-Process -Name $ProcessName).HasExited) {
                Write-LogInfo "Waiting for $ProcessName process to stop"
                Start-Sleep -s 5
            }
        }
    }
}

# clean up firewall rules
Get-NetFirewallRule -PolicyStore ActiveStore -Name "rke2*" -ErrorAction Ignore | ForEach-Object {
    Write-LogInfo "Cleaning up firewall rule $($_.Name) ..."
    $_ | Remove-NetFirewallRule -ErrorAction Ignore | Out-Null
}

function Invoke-CleanServices () {
    $ServiceNames = @('rke2', 'wins')
    # clean up wins and rke2 service
    foreach ($ServiceName in $ServiceNames) {
        Write-LogInfo "Checking if $ServiceName service exists"
        if ((Get-Service -Name $ServiceName -ErrorAction SilentlyContinue)) {
            Write-LogInfo "$ServiceName service found, stopping now"
            Stop-Service -Name $ServiceName
            while ((Get-Service -Name $ServiceName).Status -ne 'Stopped') {
                Write-LogInfo "Waiting for $ServiceName service to stop"
                Start-Sleep -s 5
            }
            Write-LogInfo "$ServiceName service has stopped. Removing the $ServiceName service ..."
            if (($PSVersionTable.PSVersion.Major) -ge 6) {
                Remove-Service $ServiceName
            }
            else {
                sc.exe delete $ServiceName
            }
        }
    }
}

function Reset-HNS () {
    try {
        Get-HnsNetwork | Where-Object { $_.Name -eq 'Calico' -or $_.Name -eq 'vxlan0' -or $_.Name -eq 'nat' -or $_.Name -eq 'External' } | Select-Object Name, ID | ForEach-Object {
            Write-LogInfo "Cleaning up HnsNetwork $($_.Name) ..."
            hnsdiag delete networks $($_.ID)
        }

Invoke-HNSRequest -Method "GET" -Type "policylists" | Where-Object { -not [string]::IsNullOrEmpty($_.Id) } | ForEach-Object {
            Write-LogInfo "Cleaning up HNSPolicyList $($_.ID) ..."
            Invoke-HNSRequest -Method "DELETE" -Type "policylists" -Id ($_.ID)
        }

Get-HnsEndpoint  | Select-Object Name, ID | ForEach-Object {
            Write-LogInfo "Cleaning up HnsEndpoint $($_.Name) ..."
            hnsdiag delete endpoints $($_.ID)
        }
    
        Get-HnsNamespace  | Select-Object ID | ForEach-Object {
            Write-LogInfo "Cleaning up HnsEndpoint $($_.ID) ..."
            hnsdiag delete namespace $($_.ID)
        }
    }
    catch {
        Write-LogWarn "Could not clean: $($_)"
    }   
}

# clean up data
function Remove-Data () {
    $cleanDirs = @("c:/usr", "c:/etc", "c:/run", "c:/var")
    foreach ($dir in $cleanDirs) {
        Write-LogInfo "Cleaning $dir..."
        if (Test-Path $dir) {
            $symLinkCheck = "Get-ChildItem -Path $dir -Recurse -Attributes ReparsePoint"
            if ($symLinkCheck) {
                Get-ChildItem -Path $dir -Recurse -Attributes ReparsePoint | ForEach-Object { $_.Delete() }
            }
            Remove-Item -Path $dir -Recurse -Force -ErrorAction SilentlyContinue
        }
        else {
            Write-LogInfo "$dir is empty, moving on"
        }
    }
    $cleanCustomDirs = @("$env:CATTLE_AGENT_BIN_PREFIX", "$env:CATTLE_AGENT_VAR_DIR", "$env:CATTLE_AGENT_CONFIG_DIR")
    if ($cleanCustomDirs) {
        $ErrorActionPreference = 'SilentlyContinue'
        foreach ($dirs in $cleanCustomDirs) {
            if ($dirs.Contains("/")) {
                $dirs = $dirs -Replace "/", "\"
            }
            $dirs = $dirs.Substring(0, $dirs.IndexOf('\'))
            Write-LogInfo "Cleaning $dirs..."
            if (Test-Path $dirs) {
                $symLinkCheck = "Get-ChildItem -Path $dirs -Recurse -Attributes ReparsePoint"
                if ($symLinkCheck) {
                    Get-ChildItem -Path $dirs -Recurse -Attributes ReparsePoint | ForEach-Object { $_.Delete() }
                }
                Remove-Item -Path $dirs -Recurse -Force -ErrorAction SilentlyContinue
            }
            else {
                Write-LogInfo "$dirs is empty, moving on"
            }
        }
    }
}

function Remove-TempData () {
    Write-LogInfo "Cleaning Temp Install Directory..."
    if (Test-Path -Path C:\Users\Administrator\AppData\Local\Temp\rke2-install) {
        Remove-Item -Force -Recurse C:\Users\Administrator\AppData\Local\Temp\rke2-install | Out-Null
    }
}

function Reset-Environment () {
    $customVars = @('CATTLE_AGENT_BINARY_URL', 'CATTLE_AGENT_CONFIG_DIR', 'CATTLE_AGENT_BIN_PREFIX', 'CATTLE_AGENT_LOGLEVEL', 'CATTLE_AGENT_VAR_DIR', 'CATTLE_CA_CHECKSUM', 'CATTLE_ID', 'CATTLE_LABELS', 'CATTLE_PRESERVE_WORKDIR', 'CATTLE_REMOTE_ENABLED', 'CATTLE_RKE2_VERSION', 'CATTLE_ROLE_CONTROLPLANE', 'CATTLE_ROLE_ETCD', 'CATTLE_ROLE_WORKER', 'CATTLE_SERVER', 'CATTLE_SERVER_CHECKSUM', 'CATTLE_TOKEN', 'RANCHER_CERT', 'RKE2_RESOLV_CONF', 'RKE2_PATH' )
    Write-LogInfo "Cleaning RKE2 Environment Variables"
    try {
        ForEach ($v in $customVars) {
            if ([Environment]::GetEnvironmentVariable($v, "Process")) {
                Write-LogInfo "Cleaning $v"
                [Environment]::SetEnvironmentVariable($v, $null, "Process")
            }
            if ([Environment]::GetEnvironmentVariable($v, "User")) {
                Write-LogInfo "Cleaning $v"
                [Environment]::SetEnvironmentVariable($v, $null, "User")
            }
        }
    }
    catch {
        Write-LogWarn "Could not reset environment variables: $($_)"
    }
}

function Reset-MachineEnvironment () {
    $customMachineVars = @('CATTLE_AGENT_VAR_DIR', 'CATTLE_AGENT_CONFIG_DIR', 'CATTLE_AGENT_BIN_PREFIX')
    Write-LogInfo "Cleaning RKE2 Machine Environment Variables"
    try {
        ForEach ($v in $customMachineVars) {
            if ([Environment]::GetEnvironmentVariable($v, "Machine")) {
                Write-LogInfo "Cleaning $v"
                [Environment]::SetEnvironmentVariable($v, $null, "Machine")
            }
            if ([Environment]::GetEnvironmentVariable($v, "User")) {
                Write-LogInfo "Cleaning $v"
                [Environment]::SetEnvironmentVariable($v, $null, "User")
            }
        }
    }
    catch {
        Write-LogWarn "Could not reset machine environment variable: $($_)"
    }
}

function Remove-Containerd () {
    $CONTAINERD_ADDRESS = "\\.\\pipe\\containerd-containerd"
    crictl config --set runtime-endpoint="npipe:$CONTAINERD_ADDRESS"
    function Invoke-Ctr {
        param (
            [parameter()]
            [string]
            $cmd
        )
        $baseCommand = "ctr -a $CONTAINERD_ADDRESS"
        Invoke-Expression -Command "$(-join $baseCommand,$cmd)"
    }

if (ctr) {
        $namespaces = $(Find-Namespaces)
        if (-Not($namespaces)) {
            $ErrorActionPreference = 'SilentlyContinue'
            $namespaces = @('default', 'cattle-system', 'kube-system', 'fleet-default', 'calico-system')
            Write-LogInfo "Could not find containerd namespaces, will use default list instead:`r`n$namespaces"
        }
        foreach ($ns in $namespaces) {
            $tasks = $(Find-Tasks $ns)
            foreach ($task in $tasks) {
                Remove-Task $ns $task
            }
            $containers = $(Find-ContainersInNamespace $ns)
            foreach ($container in $containers) {
                Remove-Container $ns $container
            }

$images = $(Find-Images $ns)
            foreach ($image in $images) {
                Remove-Image $ns $image
            }
            Remove-Namespace $ns
            # TODO
            # clean pods with crictl
            # $CONTAINER_RUNTIME_ENDPOINT = "npipe:\\.\\pipe\\containerd-containerd"
        }
    }
    else {
        Write-LogError "PATH is misconfigured or ctr is missing from PATH"
        Write-LogWarn "Cannot clean up containerd resources"
    }
}

function Find-Namespaces () {
    Invoke-Ctr -cmd "namespace list -q"
}
function Find-ContainersInNamespace() {
    $namespace = $args[0]
    Invoke-Ctr -cmd "-n $namespace container list -q"
}

function Find-Tasks() {
    $namespace = $args[0]
    Invoke-Ctr -cmd "-n $namespace task list -q"
}

function Find-Images() {
    $namespace = $args[0]
    Invoke-Ctr -cmd "-n $namespace image list -q"
}

function Remove-Image() {
    $namespace = $args[0]
    $image = $args[1]
    Invoke-Ctr -cmd "-n $namespace image rm $image"
}

function Remove-Task() {
    $namespace = $args[0]
    $task = $args[1]
    Invoke-Ctr -cmd "-n $namespace task delete --force $task"
}

function Remove-Container() {
    $namespace = $args[0]
    $container = $args[1]
    Invoke-Ctr -cmd "-n $namespace container delete $container"
}

function Remove-Namespace() {
    $namespace = $args[0]
    Invoke-Ctr -cmd "namespace remove $namespace"
}

function Invoke-Rke2Uninstall () {
    $env:PATH += ";$env:CATTLE_AGENT_BIN_PREFIX/bin/;c:\var\lib\rancher\rke2\bin"
    Remove-Containerd
    Stop-Processes
    Invoke-CleanServices
    Remove-Data
    Remove-TempData
    Reset-Environment
    Reset-MachineEnvironment
    Write-LogInfo "HNS will be cleaned next, temporary network disruption may occur. HNS cleanup is the final step."
    Reset-HNS
    Write-LogInfo "Finished!"
}

Invoke-Rke2Uninstall
exit 0
07070100000027000081ED000000000000000000000001653C446F00001000000000000000000000000000000000000000003000000000rke2-1.27.7+rke2r1/bundle/bin/rke2-uninstall.sh#!/bin/sh
set -ex

# make sure we run as root
if [ ! $(id -u) -eq 0 ]; then
    echo "$(basename "${0}"): must be run as root" >&2
    exit 1
fi

# check_target_mountpoint return success if the target directory is on a dedicated mount point
check_target_mountpoint() {
    mountpoint -q "$1"
}

# check_target_ro returns success if the target directory is read-only
check_target_ro() {
    touch "$1"/.rke2-ro-test && rm -rf "$1"/.rke2-ro-test
    test $? -ne 0
}

. /etc/os-release
if [ -r /etc/redhat-release ] || [ -r /etc/centos-release ] || [ -r /etc/oracle-release ]; then
    # If redhat/oracle family os is detected, double check whether installation mode is yum or tar.
    # yum method assumes installation root under /usr
    # tar method assumes installation root under /usr/local
    if rpm -q rke2-common >/dev/null 2>&1; then
        : "${INSTALL_RKE2_ROOT:="/usr"}"
    else
        : "${INSTALL_RKE2_ROOT:="/usr/local"}"
    fi
elif [ "${ID_LIKE%%[ ]*}" = "suse" ]; then
    if rpm -q rke2-common >/dev/null 2>&1; then
        : "${INSTALL_RKE2_ROOT:="/usr"}"
        if [ -x /usr/sbin/transactional-update ]; then
            transactional_update="transactional-update -c --no-selfupdate -d run"
        fi
    elif check_target_mountpoint "/usr/local" || check_target_ro "/usr/local"; then
        # if /usr/local is mounted on a specific mount point or read-only then
        # install we assume that installation happened in /opt/rke2
        : "${INSTALL_RKE2_ROOT:="/opt/rke2"}"
    else
        : "${INSTALL_RKE2_ROOT:="/usr/local"}"
    fi
else
    : "${INSTALL_RKE2_ROOT:="/usr/local"}"
fi

uninstall_killall()
{
    _killall="$(dirname "$0")/rke2-killall.sh"
    if [ -e "${_killall}" ]; then
      eval "${_killall}"
    fi
}

uninstall_disable_services()
{
    if command -v systemctl >/dev/null 2>&1; then
        systemctl disable rke2-server || true
        systemctl disable rke2-agent || true
        systemctl reset-failed rke2-server || true
        systemctl reset-failed rke2-agent || true
        systemctl daemon-reload
    fi
}

uninstall_remove_files()
{   
    
    if [ -r /etc/redhat-release ] || [ -r /etc/centos-release ] || [ -r /etc/oracle-release ]; then
        yum remove -y "rke2-*"

rm -f /etc/yum.repos.d/rancher-rke2*.repo
    fi

if [ "${ID_LIKE%%[ ]*}" = "suse" ]; then
         if rpm -q rke2-common >/dev/null 2>&1; then
            # rke2 rpm detected
            uninstall_cmd="zypper remove -y rke2-server rke2-agent rke2-common rke2-selinux"
            if [ "${TRANSACTIONAL_UPDATE=false}" != "true" ] && [ -x /usr/sbin/transactional-update ]; then
                uninstall_cmd="transactional-update -c --no-selfupdate -d run $uninstall_cmd"
            fi
            $uninstall_cmd
            rm -f /etc/zypp/repos.d/rancher-rke2*.repo
         fi
    fi

$transactional_update find "${INSTALL_RKE2_ROOT}/lib/systemd/system" -name rke2-*.service -type f -delete
    $transactional_update find "${INSTALL_RKE2_ROOT}/lib/systemd/system" -name rke2-*.env -type f -delete
    find /etc/systemd/system -name rke2-*.service -type f -delete
    $transactional_update rm -f "${INSTALL_RKE2_ROOT}/bin/rke2"
    $transactional_update rm -f "${INSTALL_RKE2_ROOT}/bin/rke2-killall.sh"
    $transactional_update rm -rf "${INSTALL_RKE2_ROOT}/share/rke2"
    rm -rf /etc/rancher/rke2
    rm -rf /etc/rancher/node
    rm -d /etc/rancher || true
    rm -rf /etc/cni
    rm -rf /opt/cni/bin
    rm -rf /var/lib/kubelet || true
    rm -rf /var/lib/rancher/rke2
    rm -d /var/lib/rancher || true

if type fapolicyd >/dev/null 2>&1; then
        if [ -f /etc/fapolicyd/rules.d/80-rke2.rules ]; then
            rm -f /etc/fapolicyd/rules.d/80-rke2.rules
        fi
        fagenrules --load
        systemctl restart fapolicyd
    fi
}

uninstall_remove_self()
{
    $transactional_update rm -f "${INSTALL_RKE2_ROOT}/bin/rke2-uninstall.sh"
}

uninstall_remove_policy()
{
    semodule -r rke2 || true
}

uninstall_killall
trap uninstall_remove_self EXIT
uninstall_disable_services
uninstall_remove_files
uninstall_remove_policy
07070100000028000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001E00000000rke2-1.27.7+rke2r1/bundle/lib07070100000029000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002600000000rke2-1.27.7+rke2r1/bundle/lib/systemd0707010000002A000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002D00000000rke2-1.27.7+rke2r1/bundle/lib/systemd/system0707010000002B000081A4000000000000000000000001653C446F0000000B000000000000000000000000000000000000003C00000000rke2-1.27.7+rke2r1/bundle/lib/systemd/system/rke2-agent.envHOME=/root
0707010000002C000081A4000000000000000000000001653C446F00000366000000000000000000000000000000000000004000000000rke2-1.27.7+rke2r1/bundle/lib/systemd/system/rke2-agent.service[Unit]
Description=Rancher Kubernetes Engine v2 (agent)
Documentation=https://github.com/rancher/rke2#readme
Wants=network-online.target
After=network-online.target
Conflicts=rke2-server.service

[Install]
WantedBy=multi-user.target

[Service]
Type=notify
EnvironmentFile=-/etc/default/%N
EnvironmentFile=-/etc/sysconfig/%N
EnvironmentFile=-/usr/local/lib/systemd/system/%N.env
KillMode=process
Delegate=yes
LimitNOFILE=1048576
LimitNPROC=infinity
LimitCORE=infinity
TasksMax=infinity
TimeoutStartSec=0
Restart=always
RestartSec=5s
ExecStartPre=/bin/sh -xc '! /usr/bin/systemctl is-enabled --quiet nm-cloud-setup.service'
ExecStartPre=-/sbin/modprobe br_netfilter
ExecStartPre=-/sbin/modprobe overlay
ExecStart=/usr/local/bin/rke2 server
ExecStopPost=-/bin/sh -c "systemd-cgls /system.slice/%n | grep -Eo '[0-9]+ (containerd|kubelet)' | awk '{print $1}' | xargs -r kill"
0707010000002F000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002000000000rke2-1.27.7+rke2r1/bundle/share07070100000030000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002500000000rke2-1.27.7+rke2r1/bundle/share/rke207070100000031000081A4000000000000000000000001653C446F00000050000000000000000000000000000000000000003A00000000rke2-1.27.7+rke2r1/bundle/share/rke2/rke2-cis-sysctl.confvm.panic_on_oom=0
vm.overcommit_memory=1
kernel.panic=10
kernel.panic_on_oops=1
07070100000032000081A4000000000000000000000001653C446F00000435000000000000000000000000000000000000002100000000rke2-1.27.7+rke2r1/channels.yamlchannels:
- name: stable
  latest: v1.25.12+rke2r1
- name: latest
  latestRegexp: .*
  excludeRegexp: (^[^+]+-|v1\.25\.5\+rke2r1|v1\.26\.0\+rke2r1)
- name: v1.18
  latestRegexp: v1\.18\..*
  excludeRegexp: ^[^+]+-
- name: v1.19
  latestRegexp: v1\.19\..*
  excludeRegexp: (^[^+]+-|v1\.19\.13\+rke2r1)
- name: testing
  latestRegexp: -(alpha|beta|rc)
- name: v1.20
  latestRegexp: v1\.20\..*
  excludeRegexp: (^[^+]+-|v1\.20\.9\+rke2r1)
- name: v1.21
  latestRegexp: v1\.21\..*
  excludeRegexp: (^[^+]+-|v1\.21\.3\+rke2r2)
- name: v1.22
  latestRegexp: v1\.22\..*
  excludeRegexp: ^[^+]+-
- name: v1.23
  latestRegexp: v1\.23\..*
  excludeRegexp: ^[^+]+-
- name: v1.24
  latestRegexp: v1\.24\..*
  excludeRegexp: (^[^+]+-|v1\.24\.9\+rke2r1)
- name: v1.25
  latestRegexp: v1\.25\..*
  excludeRegexp: (^[^+]+-|v1\.25\.5\+rke2r1)
- name: v1.26
  latestRegexp: v1\.26\..*
  excludeRegexp: (^[^+]+-|v1\.26\.0\+rke2r1)
- name: v1.27
  latestRegexp: v1\.27\..*
  excludeRegexp: ^[^+]+-
github:
  owner: rancher
  repo: rke2
redirectBase: https://github.com/rancher/rke2/releases/tag/

07070100000033000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001A00000000rke2-1.27.7+rke2r1/charts07070100000034000081A4000000000000000000000001653C446F00000110000000000000000000000000000000000000002400000000rke2-1.27.7+rke2r1/charts/README.md# charts

Place manifests or charts in this directory so that they will end up in the /charts directory in the rke2-runtime image.

---

See the `charts` target in the `Dockerfile` at the root of this repository for an example of how the `./build-chart.sh` scripts works.
07070100000035000081ED000000000000000000000001653C446F00000625000000000000000000000000000000000000002900000000rke2-1.27.7+rke2r1/charts/build-chart.sh#!/usr/bin/env bash

set -eux -o pipefail

: "${KUBERNETES_VERSION:=v0.0.0-0}"
: "${CHART_FILE?required}"
: "${CHART_NAME:="$(basename "${CHART_FILE%%.yaml}")"}"
: "${CHART_PACKAGE:="${CHART_NAME%%-crd}"}"
: "${TAR_OPTS:=--owner=0 --group=0 --mode=gou-s+r --numeric-owner --no-acls --no-selinux --no-xattrs}"
: "${CHART_URL:="${CHART_REPO:="https://rke2-charts.rancher.io"}/assets/${CHART_PACKAGE}/${CHART_NAME}-${CHART_VERSION:="v0.0.0"}.tgz"}"
: "${CHART_TMP:=$(mktemp --suffix .tar.gz)}"
: "${YAML_TMP:=$(mktemp --suffix .yaml)}"

cleanup() {
  exit_code=$?
  trap - EXIT INT
  rm -rf ${CHART_TMP} ${CHART_TMP/tar.gz/tar} ${YAML_TMP}
  exit ${exit_code}
}
trap cleanup EXIT INT

curl -fsSL "${CHART_URL}" -o "${CHART_TMP}"
gunzip ${CHART_TMP}

# Extract out Chart.yaml, inject a version requirement and bundle-id annotation, and delete/replace the one in the original tarball
tar -xOf ${CHART_TMP/.gz/} ${CHART_NAME}/Chart.yaml > ${YAML_TMP}
yq -i e ".kubeVersion = \">= ${KUBERNETES_VERSION}\" | .annotations.\"fleet.cattle.io/bundle-id\" = \"rke2\"" ${YAML_TMP}
tar --delete -b 8192 -f ${CHART_TMP/.gz/} ${CHART_NAME}/Chart.yaml
tar --transform="s|.*|${CHART_NAME}/Chart.yaml|" ${TAR_OPTS} -vrf ${CHART_TMP/.gz/} ${YAML_TMP}

pigz -11 ${CHART_TMP/.gz/}

cat <<-EOF > "${CHART_FILE}"
apiVersion: helm.cattle.io/v1
kind: HelmChart
metadata:
  name: "${CHART_NAME}"
  namespace: "${CHART_NAMESPACE:="kube-system"}"
  annotations:
    helm.cattle.io/chart-url: "${CHART_URL}"
spec:
  bootstrap: ${CHART_BOOTSTRAP:=false}
  chartContent: $(base64 -w0 < "${CHART_TMP}")
EOF
07070100000036000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001B00000000rke2-1.27.7+rke2r1/contrib07070100000037000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000003000000000rke2-1.27.7+rke2r1/contrib/custom-image-kubelet07070100000038000081A4000000000000000000000001653C446F0000001F000000000000000000000000000000000000003800000000rke2-1.27.7+rke2r1/contrib/custom-image-kubelet/.flake8[flake8]
max-line-length = 160
07070100000039000081A4000000000000000000000001653C446F00000A5E000000000000000000000000000000000000003A00000000rke2-1.27.7+rke2r1/contrib/custom-image-kubelet/README.mdRKE2 Image / Kubelet Override
=====

This repo contains a python script that will generate configuration files and extract binaries from a Kubernetes release manifest YAML.
Releases should be in the format described by [releases.distro.eks.amazonaws.com/v1alpha1 Release](https://github.com/aws/eks-distro-build-tooling/blob/main/release/config/crds/distro.eks.amazonaws.com_releases.yaml).
One example of a vendor providing releases in this format is [EKS Distro](https://github.com/aws/eks-distro#releases).

The resulting configuration will override binaries and images for the following components:
* coredns
* etcd
* kube-apiserver
* kube-controller-manager
* kube-proxy
* kube-scheduler
* kubelet
* metrics-server
* pause

The remaining RKE2 components include:
* Helm Controller
* Calico+Flannel CNI
* Nginx Ingress

Requirements
----

1. RKE2 v1.18.13+rke2r1 or newer (with image/kubelet override support)
1. Python 3
1. Access to AWS ECR (either via AWS CLI IAM keys, or EC2 instance role)
    *This is only necessary if the replacement RKE2 images are stored in ECR*

Installing
-----

On an Ubuntu host:

```bash
curl -sfL https://get.rke2.io | INSTALL_RKE2_VERSION=v1.18.13+rke2r1 sh -

sudo apt update
sudo apt install -y python3-venv python3-wheel python3-pip
python3 -m venv ~/python3
. ~/python3/bin/activate

git clone --shallow git@github.com:rancher/rke2.git
cd rke2/contrib/custom-image-kubelet

pip install -r requirements.txt
```

Running
-----

```bash
sudo ~/python3/bin/python genconfig.py --release-url https://X/kubernetes-1-18/kubernetes-1-18.yaml

systemctl start rke2-server
```

You may also generate the files on an administrative host that can then be embedded into deployment pipelines or copied to multiple hosts:

```bash
./genconfig.py --prefix ./kubernetes-1-18/ --release-url https://X/kubernetes-1-18/kubernetes-1-18.yaml
```

Example Output
-----

```
I Got Release: kubernetes-1-18-9
I Writing HelmChartConfig to /var/lib/rancher/rke2/server/manifests/rke2-kube-proxy-config.yaml
I Writing HelmChartConfig to /var/lib/rancher/rke2/server/manifests/rke2-coredns-config.yaml
I Writing HelmChartConfig to /var/lib/rancher/rke2/server/manifests/rke2-metrics-server-config.yaml
I Extracting files from https://X/kubernetes-1-18/releases/1/artifacts/kubernetes/v1.18.9/kubernetes-node-linux-amd64.tar.gz
I Extracting /var/lib/rancher/rke2/opt/bin/kube-proxy
I Extracting /var/lib/rancher/rke2/opt/bin/kubelet
I Extracting /var/lib/rancher/rke2/opt/bin/kubeadm
I Getting auth tokens for ['X'] in us-east-1
I Writing credentials to /etc/rancher/rke2/registries.yaml
I Writing config to /etc/rancher/rke2/config.yaml
```
0707010000003A000081ED000000000000000000000001653C446F00001CC9000000000000000000000000000000000000003D00000000rke2-1.27.7+rke2r1/contrib/custom-image-kubelet/genconfig.py#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import io
import logging
import os
import re
import stat
import sys
import tarfile
from base64 import b64decode
from collections import defaultdict
from os.path import basename, normpath
from shutil import copyfileobj

import boto3
import click
import requests
from yaml import dump, load

try:
    from yaml import CDumper as Dumper
    from yaml import CLoader as Loader
except ImportError:
    from yaml import Dumper, Loader

IMAGES = ['kube-apiserver', 'kube-controller-manager', 'kube-scheduler', 'pause', 'etcd']
COMPONENTS = ['kube-proxy', 'coredns', 'metrics-server']
ECR_REGEX = r'(?P<registry>.+)\.dkr\.ecr\.(?P<region>.+)\.amazonaws\.com'

@click.command(context_settings={'max_content_width': 120})
@click.option('--release-url', type=str, required=True, help='URL to a Kubernetes Release YAML')
@click.option('--data-dir', type=str, default='/var/lib/rancher/rke2', help='RKE2 data directory', show_default=True)
@click.option('--prefix', type=str, default='/', help='Prefix for output files created by this script', show_default=True)
def main(release_url, data_dir, prefix):
    release = get_release(release_url)

logging.info(f'Got Release: {release["metadata"]["name"]}')

rke2_config = {
            'kubelet-path': normpath(f'{data_dir}/opt/bin/kubelet'),
            'data-dir': normpath(data_dir),
            }

try:
        write_ecr_credentials(release, prefix)
    except Exception as e:
        raise Exception(f'Unable to write ECR credentials to registries.yaml: {e}') from e

for image in IMAGES:
        alt_image = get_image_artifact(release, image)
        rke2_config[f'{image}-image'] = alt_image

for component in COMPONENTS:
        alt_image = get_image_artifact(release, component)
        write_chart_config(component, alt_image, f'{prefix}/{data_dir}')

extract_archive(release, 'kubernetes-node-linux-amd64.tar.gz', f'{prefix}/{data_dir}')

write_rke2_config(rke2_config, prefix)

def get_release(release_url):
    response = requests.get(release_url)
    response.raise_for_status()
    return load(response.text, Loader=Loader)

def get_image_artifact(release, component):
    for c in release.get('status', {}).get('components', []):
        for a in c.get('assets', []):
            if a['name'] == component + '-image':
                return a['image']['uri']

raise Exception(f'Unable to find image asset for {component}')

def write_rke2_config(config, prefix):
    etc_dir = f'{prefix}/etc/rancher/rke2'

try:
        os.makedirs(normpath(etc_dir), mode=0o0700)
    except FileExistsError:
        pass

with open(normpath(f'{etc_dir}/config.yaml'), mode='a+') as config_file:
        config_file.seek(0, 0)
        config_yaml = load(config_file, Loader=Loader)
        if not config_yaml:
            config_yaml = dict()
        config_yaml.update(config)
        logging.info(f'Writing config to {config_file.name}')
        config_file.seek(0, 0)
        config_file.truncate()
        dump(config_yaml, config_file, Dumper=Dumper)

def write_chart_config(component, image, data_dir):
    manifests_dir = f'{data_dir}/server/manifests'
    repository, tag = image.split(':')

values_yaml = {
        'image': {
            'repository': repository,
            'tag': tag,
            },
        }
    config_yaml = {
        'apiVersion': 'helm.cattle.io/v1',
        'kind': 'HelmChartConfig',
        'metadata': {
            'name': f'rke2-{component}',
            'namespace': 'kube-system',
            },
        'spec': {
            'valuesContent': dump(values_yaml, Dumper=Dumper),
            },
        }

try:
        os.makedirs(normpath(manifests_dir), mode=0o0700)
    except FileExistsError:
        pass

with open(normpath(f'{manifests_dir}/rke2-{component}-config.yaml'), mode='w+') as config_file:
        logging.info(f'Writing HelmChartConfig to {config_file.name}')
        dump(config_yaml, config_file, Dumper=Dumper)

def extract_archive(release, name, data_dir):
    bin_dir = normpath(f'{data_dir}/opt/bin')

try:
        os.makedirs(normpath(bin_dir), mode=0o0700)
    except FileExistsError:
        pass

for c in release.get('status', {}).get('components', []):
        for a in c.get('assets', []):
            if a['type'] == 'Archive' and a['name'] == name:
                extract_network_tar(a['archive']['uri'], bin_dir)

def extract_network_tar(archive_url, bin_dir):
    logging.info(f'Extracting files from {archive_url}')
    with requests.get(archive_url, stream=True) as response, io.BytesIO() as buf:
        response.raise_for_status()
        copyfileobj(response.raw, buf)
        buf.seek(0, 0)

with tarfile.open(fileobj=buf) as tar:
            for member in tar.getmembers():
                if member.isreg() and member.mode & stat.S_IXUSR:
                    member.name = basename(member.name)
                    logging.info(f'Extracting {bin_dir}/{member.name}')
                    tar.extract(member, bin_dir)

def write_ecr_credentials(release, prefix):
    etc_dir = f'{prefix}/etc/rancher/rke2'
    registries = get_ecr_registries(release)

registry_configs = dict()
    registry_regions = defaultdict(list)

for registry in registries:
        match = re.match(ECR_REGEX, registry)
        if match:
            registry_regions[match.group('region')].append(match.group('registry'))

if not registry_regions:
        return

for region, registries in registry_regions.items():
        logging.info(f'Getting auth tokens for {registries} in {region}')
        response = boto3.client('ecr', region_name=region).get_authorization_token(registryIds=registries)
        for auth in response.get('authorizationData', []):
            endpoint = auth['proxyEndpoint'].split('//')[1]
            username, password = b64decode(auth['authorizationToken']).decode().split(':')
            registry_configs[endpoint] = {'auth': {'username': username, 'password': password}}

try:
        os.makedirs(normpath(etc_dir), mode=0o0700)
    except FileExistsError:
        pass

with open(normpath(f'{etc_dir}/registries.yaml'), mode='a+') as registries_file:
        registries_file.seek(0, 0)
        registries_yaml = load(registries_file, Loader=Loader)
        if not registries_yaml:
            registries_yaml = dict()
        if 'configs' not in registries_yaml:
            registries_yaml['configs'] = dict()
        registries_yaml['configs'].update(registry_configs)
        logging.info(f'Writing credentials to {registries_file.name}')
        registries_file.seek(0, 0)
        registries_file.truncate()
        dump(registries_yaml, registries_file, Dumper=Dumper)

def get_ecr_registries(release):
    registries = set()
    for c in release.get('status', {}).get('components', []):
        for a in c.get('assets', []):
            if 'image' in a:
                registry = a['image']['uri'].split('/')[0]
                if '.ecr.' in registry:
                    registries.add(registry)
    return registries

if __name__ == '__main__':
    try:
        logging.basicConfig(format="%(levelname).1s %(message)s", level=logging.INFO, stream=sys.stdout)
        main()
    except (KeyboardInterrupt, BrokenPipeError):
        pass
    except Exception as e:
        logging.fatal(e)
0707010000003B000081A4000000000000000000000001653C446F0000001C000000000000000000000000000000000000004100000000rke2-1.27.7+rke2r1/contrib/custom-image-kubelet/requirements.txtboto3
click
pyyaml
requests
0707010000003C000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002D00000000rke2-1.27.7+rke2r1/contrib/gotests_templates0707010000003D000081A4000000000000000000000001653C446F000000F2000000000000000000000000000000000000003700000000rke2-1.27.7+rke2r1/contrib/gotests_templates/call.tmpl{{define "call"}}{{with .Receiver}}{{if not .IsStruct}}tt.{{end}}{{Receiver .}}.{{end}}{{.Name}}({{range $i, $el := .Parameters}}{{if $i}}, {{end}}{{if not .IsWriter}}tt.args.{{end}}{{Param .}}{{if .Type.IsVariadic}}...{{end}}{{end}}){{end}}
0707010000003E000081A4000000000000000000000001653C446F00000BCC000000000000000000000000000000000000003B00000000rke2-1.27.7+rke2r1/contrib/gotests_templates/function.tmpl{{define "function"}}
{{- $f := .}}

func Test_Unit{{.FullName}}(t *testing.T) {
	{{- with .Receiver}}
		{{- if .IsStruct}}
			{{- if .Fields}}
				type fields struct {
				{{- range .Fields}}
					{{Field .}} {{.Type}}
				{{- end}}
				}
			{{- end}}
		{{- end}}
	{{- end}}
	{{- if .TestParameters}}
	type args struct {
		{{- range .TestParameters}}
				{{Param .}} {{.Type}}
		{{- end}}
	}
	{{- end}}
	tests := []struct {
		name string
		{{- with .Receiver}}
			{{- if and .IsStruct .Fields}}
				fields fields
			{{- else}}
				{{Receiver .}} {{.Type}}
			{{- end}}
		{{- end}}
		{{- if .TestParameters}}
			args args
		{{- end}}
		setup    func() error // Optional, delete if unused
		teardown func() error // Optional, delete if unused
		{{- range .TestResults}}
			{{Want .}} {{.Type}}
		{{- end}}
		{{- if .ReturnsError}}
			wantErr bool
		{{- end}}
	}{
		// TODO: Add test cases.
		// {
		//      name: "Example Test",
		//      args: args {
		//      },
		// {{- range .TestResults}}
		//      want: {{Want .}} {{.Type}}
                // {{- end}}
		//      setup: func() error { return nil },
		//      teardown: func() error { return nil },
		// },
	}
	for {{if (or .Subtests (not .IsNaked))}} _, tt := {{end}} range tests {
		{{- if .Subtests}}
		{{- if .Parallel}}tt := tt{{end}}
		t.Run(tt.name, func(t *testing.T) {
			{{- if .Parallel}}t.Parallel(){{end}}
		{{- end}}
			{{- with .Receiver}}
				{{- if .IsStruct}}
					{{Receiver .}} := {{if .Type.IsStar}}&{{end}}{{.Type.Value}}{
					{{- range .Fields}}
						{{.Name}}: tt.fields.{{Field .}},
					{{- end}}
					}
				{{- end}}
			{{- end}}
			{{- range .Parameters}}
				{{- if .IsWriter}}
					{{Param .}} := &bytes.Buffer{}
				{{- end}}
			{{- end}}
			defer tt.teardown()
			if err := tt.setup(); err != nil {
			        t.Errorf("Setup for {{template "message" $f}} failed = %v", err)
			        return
			}
			{{- if and (not .OnlyReturnsError) (not .OnlyReturnsOneValue) }}
				{{template "results" $f}} {{template "call" $f}}
			{{- end}}
			{{- if .ReturnsError}}
				if {{if .OnlyReturnsError}} err := {{template "call" $f}}; {{end}} (err != nil) != tt.wantErr {
					t.Errorf("{{template "message" $f}} error = %v, wantErr %v", {{template "inputs" $f}} err, tt.wantErr)
					{{- if .TestResults}}
						{{if .Subtests }}return{{else}}continue{{end}}
					{{- end}}
				}
			{{- end}}
			{{- range .TestResults}}
				{{- if .IsWriter}}
					if {{Got .}} := {{Param .}}.String(); {{Got .}} != tt.{{Want .}} {
				{{- else if .IsBasicType}}
					if {{if $f.OnlyReturnsOneValue}}{{Got .}} := {{template "inline" $f}}; {{end}} {{Got .}} != tt.{{Want .}} {
				{{- else}}
					if {{if $f.OnlyReturnsOneValue}}{{Got .}} := {{template "inline" $f}}; {{end}} !reflect.DeepEqual({{Got .}}, tt.{{Want .}}) {
				{{- end}}
				t.Errorf("{{template "message" $f}} {{if $f.ReturnsMultiple}}{{Got .}} {{end}}= %+v\nWant = %+v", {{template "inputs" $f}} {{Got .}}, tt.{{Want .}})
				}
			{{- end}}
		{{- if .Subtests }} }) {{- end -}}
	}
}

{{end}}
0707010000003F000081A4000000000000000000000001653C446F0000008E000000000000000000000000000000000000003900000000rke2-1.27.7+rke2r1/contrib/gotests_templates/header.tmpl{{define "header"}}
{{range .Comments}}{{.}}
{{end -}}
package {{.Package}}

import (
{{range .Imports}}{{.Name}} {{.Path}}
{{end}}
)
{{end}}
07070100000040000081A4000000000000000000000001653C446F00000032000000000000000000000000000000000000003900000000rke2-1.27.7+rke2r1/contrib/gotests_templates/inline.tmpl{{define "inline"}} {{template "call" .}} {{end}}
07070100000041000081A4000000000000000000000001653C446F00000099000000000000000000000000000000000000003900000000rke2-1.27.7+rke2r1/contrib/gotests_templates/inputs.tmpl{{define "inputs"}}{{$f := .}}{{if not .Subtests}}tt.name, {{end}}{{if $f.PrintInputs}}{{range $f.Parameters}}tt.args.{{Param .}}, {{end}}{{end}}{{end}}
07070100000042000081A4000000000000000000000001653C446F000000CA000000000000000000000000000000000000003A00000000rke2-1.27.7+rke2r1/contrib/gotests_templates/message.tmpl{{define "message" -}}
{{if not .Subtests}}%q. {{end}}{{with .Receiver}}{{.Type.Value}}.{{end}}{{.Name}}({{if .PrintInputs}}{{range $i, $el := .Parameters}}{{if $i}}, {{end}}%v{{end}}{{end}})
{{- end}}
07070100000043000081A4000000000000000000000001653C446F000000A9000000000000000000000000000000000000003A00000000rke2-1.27.7+rke2r1/contrib/gotests_templates/results.tmpl{{define "results"}} {{range $i, $el := .Results}}{{if $i}}, {{end}}{{Got .}}{{end}}{{if .ReturnsError}}, err{{end}} {{if or .Results .ReturnsError}} := {{end}} {{end}}
07070100000044000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002200000000rke2-1.27.7+rke2r1/developer-docs07070100000045000081A4000000000000000000000001653C446F00000B02000000000000000000000000000000000000003500000000rke2-1.27.7+rke2r1/developer-docs/about_rke2_docs.md# About RKE2 docs

The RKE2 git repository currently holds two kinds of documentation:

- RKE2 User Docs
- RKE2 Developer Docs

There are other differences than their audiences, and this document elaborates on it.

## User docs

As its name suggests, the main target for this documentation is Rancher RKE2 users. Covering RKE2 topics such as architecture, installation and upgrade process, and security from an end-user perspective.

The markdown files in the `docs/` directory within this repository are the documentation's source. These documents are processed using [mkdocs](https://www.mkdocs.org/) and served on <https://docs.rke2.io/> as a documentation website.

Since the documents use a specific markdown superset, [pymdown](https://facelessuser.github.io/pymdown-extensions/), it is preferred to process them using `mkdocs` beforehand to have a better understanding. However, any markdown preview tool should be able to render them.

To serve the RKE2 user docs website locally, one can either:

1. Run `make serve-docs` [Makefile](../Makefile) target. This will start a docker container locally with all the required configurations and serve them on port `8000`.
2. Run `mkdocs serve` in the local environment. This will start the mkdocs server locally, exposing port `8000`. Since the said tool is written in [python3](https://www.python.org/), it requires installing its interpreter and the following packages beforehand `mkdocs`, `mkdocs-material`,  `mkdocs-markdownextradata-plugin`, and `pymdown-extensions`.

Worth noting that the second option should only be used whenever running a docker container locally does not work correctly (i.e., working on non-Linux OS's or needing to deal with shared mounts).

## Developer docs

Like this file, the target audience for these documents is the RKE2 developers and contributors. The topics may not hold a specific order, technicalities may come along, and are focused on transmitting internal processes around RKE2.

The developer docs are the markdown files in this repository's `developer-docs/` directory. These files are intended to be read using any markdown preview tool, being Github's web view the default one, so no enhanced versions of this markup language are allowed. The only exception to this rule is usage of [embedded mermaid diagrams supported by Github](https://github.blog/2022-02-14-include-diagrams-markdown-files-mermaid/).

As hinted in the last section, the diagrams within the developer docs are written in the markdown-like [Mermaid](https://mermaidjs.github.io/) syntax and held in code blocks with the <code>```mermaid</code> language specifier. These diagrams can be created and edited with the help of the [Mermaid live editor](https://mermaid.live/); then, it is a matter of copying and pasting the result in a markdown file.
07070100000046000081A4000000000000000000000001653C446F00001D17000000000000000000000000000000000000003300000000rke2-1.27.7+rke2r1/developer-docs/image_sources.mdThis document lists all of the images used by RKE2 and any of its packaged components (Helm charts), along with info on where they are built and what other images they copy content from. If you find an image not on this list, please open a PR.

The **Chart** column indicates the Helm chart that uses this image. `CORE` indicates that this is not used by a Helm chart, but by the supervisor itself to host a control-plane component. `CORE FROM` indicates that one of the `CORE` images has a `COPY --from` line in the Dockerfile that loads content from this image.

| Chart | Image | Build Repo | Source Images | Hardened |
| ----- | ----- | ---------- | ------------- | -------- |
| CORE | rancher/hardened-kubernetes | rancher/image-build-kubernetes | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
| CORE | rancher/rke2-runtime | rancher/rke2 | ‣ rancher/k3s<br>‣ rancher/hardened-kubernetes<br>‣ rancher/hardened-containerd<br>‣ rancher/hardened-crictl<br>‣ rancher/hardened-runc | TRUE |
| CORE FROM | rancher/hardened-containerd | rancher/image-build-containerd | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
| CORE FROM | rancher/hardened-crictl | rancher/image-build-crictl | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
| CORE FROM | rancher/hardened-runc | rancher/image-build-runc | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
| CORE | rancher/rke2-cloud-provider  | rancher/image-build-rke2-cloud-provider | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
| CORE | rancher/hardened-etcd | rancher/image-build-etcd | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
| CORE | docker.io/rancher/klipper-helm | k3s-io/klipper-helm | ‣ alpine | FALSE |
|  |  |  |  |  |
| rke2-coredns | rancher/hardened-cluster-autoscaler | rancher/image-build-coredns | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
| rke2-coredns | rancher/hardened-coredns | rancher/image-build-coredns | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
| rke2-coredns | rancher/hardened-dns-node-cache | rancher/image-build-dns-nodecache | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base<br>‣ rancher/hardened-kube-proxy | TRUE |
|  |  |  |  |  |
| rke2-metrics-server | rancher/hardened-k8s-metrics-server | rancher/image-build-k8s-metrics-server | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
|  |  |  |  |  |
| rke2-ingress-nginx | rancher/nginx-ingress-controller | rancher/ingress-nginx | ‣ ubi8/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
| rke2-ingress-nginx | rancher/mirrored-jettech-kube-webhook-certgen | rancher/image-mirror |  | FALSE |
|  |  |  |  |  |
| rke2-canal | rancher/hardened-calico | rancher/image-build-calico | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base<br>‣ rancher/hardened-cni-plugins<br>‣ calico/bpftool<br>‣ calico/bird<br>centos | TRUE |
| rke2-canal FROM | rancher/hardened-cni-plugins | rancher/image-build-cni-plugins | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
| rke2-canal | rancher/hardened-flannel | rancher/image-build-flannel | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
|  |  |  |  |  |
| rke2-multus | rancher/hardened-multus-cni | rancher/image-build-multus | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
| rke2-multus | rancher/hardened-cni-plugins | rancher/image-build-cni-plugins | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
|  |  |  |  |  |
| rancher-sriov | rancher/hardened-sriov-cni  | rancher/image-build-sriov-cni | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
| rancher-sriov | rancher/hardened-ib-sriov-cni | rancher/image-build-ib-sriov-cni | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
| rancher-sriov | rancher/hardened-sriov-network-config-daemon  | rancher/image-build-sriov-operator | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base<br>goboring/golang | TRUE |
| rancher-sriov | rancher/hardened-sriov-network-device-plugin | rancher/image-build-sriov-network-device-plugin | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
| rancher-sriov | rancher/hardened-sriov-network-operator | rancher/image-build-sriov-operator | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
| rancher-sriov | rancher/hardened-sriov-network-resources-injector | rancher/image-build-sriov-network-resources-injector | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
| rancher-sriov | rancher/hardened-sriov-network-webhook | rancher/image-build-sriov-operator | ‣ ubi7/ubi-minimal<br>‣ rancher/hardened-build-base | TRUE |
|  |  |  |  |  |
| rke2-calico | rancher/mirrored-calico-operator | rancher/image-mirror |  | FALSE |
| rke2-calico | rancher/mirrored-calico-ctl | rancher/image-mirror |  | FALSE |
| rke2-calico | rancher/mirrored-calico-kube-controllers | rancher/image-mirror |  | FALSE |
| rke2-calico | rancher/mirrored-calico-typha | rancher/image-mirror |  | FALSE |
| rke2-calico | rancher/mirrored-calico-node | rancher/image-mirror |  | FALSE |
| rke2-calico | rancher/mirrored-calico-pod2daemon-flexvol | rancher/image-mirror |  | FALSE |
| rke2-calico | rancher/mirrored-calico-cni | rancher/image-mirror |  | FALSE |
|  |  |  |  |  |
| rke2-cilium | rancher/mirrored-cilium-cilium | rancher/image-mirror |  | FALSE |
| rke2-cilium | rancher/mirrored-cilium-operator-aws | rancher/image-mirror |  | FALSE |
| rke2-cilium | rancher/mirrored-cilium-operator-azure | rancher/image-mirror |  | FALSE |
| rke2-cilium | rancher/mirrored-cilium-operator-generic | rancher/image-mirror |  | FALSE |
| rke2-cilium | rancher/mirrored-cilium-startup-script | rancher/image-mirror |  | FALSE |
|  |  |  |  |  |
| rancher-vsphere-cpi | rancher/mirrored-cloud-provider-vsphere-cpi-release-manager | rancher/image-mirror |  | FALSE |
| rancher-vsphere-cpi | rancher/mirrored-cloud-provider-vsphere-csi-release-driver | rancher/image-mirror |  | FALSE |
| rancher-vsphere-cpi | rancher/mirrored-cloud-provider-vsphere-csi-release-syncer | rancher/image-mirror |  | FALSE |
|  |  |  |  |  |
| rancher-vsphere-csi | rancher/mirrored-k8scsi-csi-attacher | rancher/image-mirror |  | FALSE |
| rancher-vsphere-csi | rancher/mirrored-k8scsi-csi-node-driver-registrar | rancher/image-mirror |  | FALSE |
| rancher-vsphere-csi | rancher/mirrored-k8scsi-csi-provisioner | rancher/image-mirror |  | FALSE |
| rancher-vsphere-csi | rancher/mirrored-k8scsi-csi-resizer | rancher/image-mirror |  | FALSE |
| rancher-vsphere-csi | rancher/mirrored-k8scsi-livenessprobe | rancher/image-mirror |  | FALSE |
|  |  |  |  |  |
| harvester-cloud-provider | docker.io/rancher/harvester-cloud-provider | Harvester team |  | FALSE |
|  |  |  |  |  |
| harvester-csi-driver | docker.io/rancher/harvester-csi-driver | Harvester team |  | FALSE |
| harvester-csi-driver | docker.io/rancher/longhornio-csi-attacher | Longhorn team |  | FALSE |
| harvester-csi-driver | docker.io/rancher/longhornio-csi-node-driver-registrar | Longhorn team |  | FALSE |
| harvester-csi-driver | docker.io/rancher/longhornio-csi-provisioner | Longhorn team |  | FALSE |
| harvester-csi-driver | docker.io/rancher/longhornio-csi-resizer | Longhorn team |  | FALSE |
|  |  |  |  |  |
| rke2-upgrade | rancher/rke2-upgrade | rancher/rke2-upgrade | alpine | FALSE |
07070100000047000081A4000000000000000000000001653C446F000007CE000000000000000000000000000000000000002900000000rke2-1.27.7+rke2r1/developer-docs/k3s.mdAt the heart of RKE2 is the embedded K3s engine which functions as a
supervisor for the kubelet and containerd processes. The K3s engine also
provides AddOn and Helm controllers that RKE2 leverages. So, RKE2 depends on K3s,
but what does that look like from version to version? It is not yet as simple
as 1.20.7+rke2r1 &rarr; 1.20.7+k3s1, but starting with the release-1.22 branch
it should be.

Until then, here is a handy table:

| RKE2 Branch | K3s Branch | Comments |
|-------------------------------------------------------------|-----------------------------------------------------------|---|
| [release-1.18](https://github.com/rancher/rke2/tree/release-1.18) | [release-1.19](https://github.com/k3s-io/k3s/tree/release-1.19) | Making k3s an embeddable engine required changes developed after release-1.18 was branched. |
| [release-1.19](https://github.com/rancher/rke2/tree/release-1.19) | [release-1.19](https://github.com/k3s-io/k3s/tree/release-1.19) | RKE2 development stayed on 1.18 for a long time, essentially jumping from 1.18 to 1.20 with both release-1.18 and release-1.19 forked off master close to each other. |
| [release-1.20](https://github.com/rancher/rke2/tree/release-1.20) | [engine-1.21](https://github.com/k3s-io/k3s/tree/engine-1.21) | The K3s engine-1.21 branch was forked from K3s master just before master was updated to Kubernetes 1.22, and contains critical changes necessary to support RKE2 on Windows. |
| [release-1.21](https://github.com/rancher/rke2/tree/release-1.21) | [engine-1.21](https://github.com/k3s-io/k3s/tree/engine-1.21) | Same K3s upstream as the RKE2 release-1.20 branch. |
| [release-1.22](https://github.com/rancher/rke2/tree/release-1.22) | [engine-1.21](https://github.com/k3s-io/k3s/tree/release-1.22) | We plan to better align the K3s and RKE2 release-1.22 branches, when they are forked. |
| [master](https://github.com/rancher/rke2/tree/master) | [master](https://github.com/k3s-io/k3s/tree/master) | Rolling commit from K3s master |
07070100000048000081A4000000000000000000000001653C446F000021E8000000000000000000000000000000000000002D00000000rke2-1.27.7+rke2r1/developer-docs/testing.md# Testing Standards in RKE2

Go testing in RKE2 comes in 4 forms:
- [Unit](#unit-tests)
- [Integration](#integration-tests)
- [Smoke](#installer-tests)
- [End-to-End (E2E)](#end-to-end-e2e-tests)

This document will explain *when* each test should be written and *how* each test should be
generated, formatted, and run.

Note: all shell commands given are relative to the root RKE2 repo directory.

___

## Unit Tests

Unit tests should be written when a component or function of a package needs testing.
Unit tests should be used for "white box" testing.

### Framework

All unit tests in RKE2 follow a [Table Driven Test](https://github.com/golang/go/wiki/TableDrivenTests) style.
Specifically, RKE2 unit tests are automatically generated using the [gotests](https://github.com/cweill/gotests) tool.
This is built into the Go vscode extension, has documented integrations for other popular editors, or can be run via
command line. Additionally, a set of custom templates are provided to extend the generated test's functionality.
To use these templates, call:

```bash
gotests --template_dir=<PATH_TO_RKE2>/contrib/gotests_templates
```

Or in vscode, edit the Go extension setting `Go: Generate Tests Flags`  
and add `--template_dir=<PATH_TO_RKE2>/contrib/gotests_templates` as an item.

### Format

All unit tests should be placed within the package of the file they test.  
All unit test files should be named: `<FILE_UNDER_TEST>_test.go`.
All unit test functions should be named: `Test_Unit<FUNCTION_TO_TEST>` or `Test_Unit<RECEIVER>_<METHOD_TO_TEST>`.
See the [service account unit test](https://github.com/rancher/rke2/blob/master/pkg/rke2/serviceaccount_test.go) as an example.

### Running

```bash
go test ./pkg/... -run Unit
```

Note: As unit tests call functions directly, they are the primary drivers of RKE2's code coverage metric.

___

## Integration Tests

Integration tests should be used to test a specific functionality of RKE2 that exists across multiple Go packages,
either via exported function calls, or more often, CLI commands. Integration tests should be used for "black box"
testing.

### Framework

All integration tests in RKE2 follow a [Behavior Driven Development (BDD)](https://en.wikipedia.org/wiki/Behavior-driven_development) style.
Specifically, RKE2 uses [Ginkgo](https://onsi.github.io/ginkgo/) and [Gomega](https://onsi.github.io/gomega/) to drive the tests.  
To generate an initial test, the command `ginkgo bootstrap` can be used.

To facilitate RKE2 CLI testing, see `tests/util/cmd.go` helper functions.

### Format

All integration tests should be places in `tests` directory.
All integration test files should be named: `<TEST_NAME>_int_test.go`
All integration test functions should be named: `Test_Integration<Test_Name>`.
See the [etcd snapshot test](https://github.com/rancher/rke2/blob/master/tests/etcd_int_test.go) as an example.

### Running

Integration tests must be with an existing single-node cluster, tests will skip if the server is not configured correctly.
```bash
make dev-shell
# Once in the dev-shell
# Start rke2 server with appropriate flags
./bin/rke2 server 
```
Open another terminal
```bash
make dev-shell-enter
# once in the dev-shell
go test ./tests/ -run Integration
```
___

## Installer Tests

Installer tests should be run anytime one makes a modification to the installer script(s).
These can be run locally with Vagrant:
- [CentOS 7](../tests/install/centos-7) (stand-in for RHEL 7)
- [Rocky 8](../tests/install/rocky-8) (stand-in for RHEL 8)
- [MicroOS](../tests/install/opensuse-microos) (stand-in for SLE-Micro)
- [Ubuntu 20.04](../tests/install/ubuntu-focal) (Focal Fossa)

When adding new installer test(s) please copy the prevalent style for the `Vagrantfile`.
Ideally, the boxes used for additional assertions will support the default `virtualbox` provider which
enables them to be used by our Github Actions Workflow(s). See [install.yaml](../.github/workflows/install.yaml).

### Framework

If you are new to Vagrant, Hashicorp has written some pretty decent introductory tutorials and docs, see:
- https://learn.hashicorp.com/collections/vagrant/getting-started
- https://www.vagrantup.com/docs/installation

#### Plugins and Providers

The `libvirt` and `vmware_desktop` providers cannot be used without first [installing the relevant plugins](https://www.vagrantup.com/docs/cli/plugin#plugin-install)
which are [`vagrant-libvirt`](https://github.com/vagrant-libvirt/vagrant-libvirt) and
[`vagrant-vmware-desktop`](https://www.vagrantup.com/docs/providers/vmware/installation), respectively.
Much like the default [`virtualbox` provider](https://www.vagrantup.com/docs/providers/virtualbox) these will do
nothing useful without also installing the relevant server runtimes and/or client programs.

#### Environment Variables

These can be set on the CLI or exported before invoking Vagrant:
- `TEST_INSTALL_SH` (default :arrow_right: `../../../../install.sh`)
  The location of the installer script to be uploaded to the guest by the [Vagrant File Provisioner](https://www.vagrantup.com/docs/provisioning/file) before being invoked at `/home/vagrant/install.sh`.
- `TEST_VM_CPUS` (default :arrow_right: 2)
  The number of vCPU for the guest to use.
- `TEST_VM_MEMORY` (default :arrow_right: 2048)
  The number of megabytes of memory for the guest to use.
- `TEST_VM_BOOT_TIMEOUT` (default :arrow_right: 600)
  The time in seconds that Vagrant will wait for the machine to boot and be accessible.
- `INSTALL_PACKAGES`
  A space-delimited string of package names (or locations accessible to the guest's native package manager) that will 
  be installed prior to invoking the RKE2 install script. Useful for overriding the `rke2-selinux` RPM via URL pointing
  at a specific Github release artifact.
- `INSTALL_RKE2_*`, `RKE2_*`
  All values (other than those mentioned below) are passed through to the guest for capture by the installer script:
    - `INSTALL_RKE2_TYPE=server` (hard-coded)
    - `RKE2_KUBECONFIG_MODE=0644` (hard-coded)
    - `RKE2_TOKEN=vagrant` (hard-coded)

___

## End-to-End (E2E) Tests

E2E tests cover multi-node RKE2 configuration and administration: bringup, update, teardown etc. across a wide range of operating systems. E2E tests are run nightly as part of RKE2 quality assurance (QA).

### Framework 
End-to-end tests utilize [Ginkgo](https://onsi.github.io/ginkgo/) and [Gomega](https://onsi.github.io/gomega/) like the integration tests, but rely on [Vagrant](https://www.vagrantup.com/) to provide the underlying cluster configuration.

Currently tested operating systems are:
- [Ubuntu 20.04](https://app.vagrantup.com/generic/boxes/ubuntu2004)
- [Leap 15.3](https://app.vagrantup.com/opensuse/boxes/Leap-15.3.x86_64) (stand-in for SLE-Server)

### Format

All E2E tests should be placed under `tests/e2e/<TEST_NAME>`.  
All E2E test functions should be named: `Test_E2E<TEST_NAME>`.  
A E2E test consists of two parts:
1. `Vagrantfile`: a vagrant file which describes and configures the VMs upon which the cluster and test will run
2. `<TEST_NAME>.go`: A go test file which calls `vagrant up` and controls the actual testing of the cluster

See the [validate cluster test](../tests/e2e/validatecluster/validatecluster_test.go) as an example.

### Running

Generally, E2E tests are run as a nightly Jenkins job for QA. They can still be run locally but additional setup is required. By default, all E2E tests are designed with `libvirt` as the underlying VM provider. Instructions for installing libvirt and its associated vagrant plugin, `vagrant-libvirt` can be found [here.](https://github.com/vagrant-libvirt/vagrant-libvirt#installation) `VirtualBox` is also supported as a backup VM provider.

Once setup is complete, all E2E tests can be run with:
```bash
go test -timeout=15m ./tests/e2e/... -run E2E
```
Tests can be run individually with:
```bash
go test -timeout=15m ./tests/e2e/validatecluster/... -run E2E
#or
go test -timeout=15m ./tests/e2e/... -run E2EClusterValidation
```

Additionally, to generate junit reporting for the tests, the Ginkgo CLI is used. Installation instructions can be found [here.](https://onsi.github.io/ginkgo/#getting-started)

To run the all E2E tests and generate JUnit testing reports:
```
ginkgo --junit-report=result.xml ./tests/e2e/...
```

Note: The `go test` default timeout is 10 minutes, thus the `-timeout` flag should be used. The `ginkgo` default timeout is 1 hour, no timeout flag is needed.
___

## Contributing New Or Updated Tests

___
If you wish to create a new test or update an existing test, 
please submit a PR with a title that includes the words `<NAME_OF_TEST> (Created/Updated)`.
07070100000049000081A4000000000000000000000001653C446F00001B93000000000000000000000000000000000000003A00000000rke2-1.27.7+rke2r1/developer-docs/updating_rke2_charts.md# Updating RKE2 charts

In each release, it is very common to update the charts that rke2 is using. This document describes the process that mus
t be followed to succeed in updating and integrating it into rke2 and Rancher.

## What are these rke2-charts?

The following RKE2 components are consumed using Helm Charts:

- coredns
- ingress-nginx
- metrics-server
- kube-proxy (up to v1.21)
- all cni plugins

The charts of these components are in the [rke2-charts repo](https://github.com/rancher/rke2-charts/tree/main-source/packages)
and are installed in the cluster by the [helm-controller](https://github.com/k3s-io/helm-controller), which is one of
the controllers part of `rke2 server` binary.

## How to update a chart?

Before going into updating the chart, note a chart update normally means updating the images that this chart is consumin
g. In general, rke2 is consuming hardened images that are built using a FIPS compliant process. In other words, **do not
 use the upstream images**. Instead, refer to the Github project building that image and use the code of the upstream
project to yield a hardened image. The Github projects building hardened images are under our [github rancher](https://github.com/rancher/)
and start with the name `image-build-`, for example: [image-build-coredns](https://github.com/rancher/image-build-coredns).
There are two exceptions to this rule: Calico and Cilium. For these components, we are mirroring the upstream images
into our rancher dockerhub and consuming those. To mirror new images, refer to [the README of the image-mirror repo](https://github.com/rancher/image-mirror/blob/master/README.md).

To apply changes to a chart, please follow the [README](https://github.com/rancher/rke2-charts/blob/main-source/README.md)
of the rke2-charts project. Once the PR has been merged, move to the `main` branch in the rke2-charts project and check
your chart under the directory `assets/`. A new tarball would be there with your changes with a name that follows the
pattern `$chartName-$version.tgz`. For example: `rke2-calico-v3.19.2-201.tgz`.

## My chart is ready, how to integrate it into rke2 and Rancher?

From the previous section, you know the name of the chart (e.g. `rke2-calico`) and its version (e.g. `v3.19.2-201`).
Using that information, we can easily update rke2 and Rancher following the next steps:

1. Open [Dockerfile](https://github.com/rancher/rke2/blob/master/Dockerfile) and go to the stage where the charts are
build (`FROM build AS charts`). There, modify the line where we are referring to the chart, e.g. for calico:
```
RUN CHART_VERSION="v3.19.1-105"               CHART_FILE=/charts/rke2-calico.yaml         CHART_BOOTSTRAP=true   /charts/build-chart.sh
```
If we want the new version to be consumed, we should update the value of `RUN CHART_VERSION`:
```
RUN CHART_VERSION="v3.19.2-201"               CHART_FILE=/charts/rke2-calico.yaml         CHART_BOOTSTRAP=true   /charts/build-chart.sh
```

2. For CNI plugins only, we need to do the same for [Dockerfile.windows](https://github.com/rancher/rke2/blob/master/Dockerfile.windows).
In this case, we are not using helm and we are downloading a released tarball from the upstream project. Therefore, we
must use the version that makes sense for the upstream project, and not the previous version which was pointing to the
rke2-charts tarball. The version in the Dockerfile is tracked by a variable, which for example for Calico is
`CALICO_VERSION`. If we move from v3.19.1 to v3.19.2, we should open the file and change:
```
ENV CALICO_VERSION="v3.19.2"
```

3. If the update of the chart means using different images, we must update the script for air-gap scenarios. Open the
file [scripts/build-images](https://github.com/rancher/rke2/blob/master/scripts/build-images) and update the version of
the images. Images used by CNI plugins have their own section, for example for Calico:
```
xargs -n1 -t docker image pull --quiet << EOF > build/images-calico.txt
    ${REGISTRY}/rancher/mirrored-calico-operator:v1.17.6
    ${REGISTRY}/rancher/mirrored-calico-ctl:v3.19.2
    ${REGISTRY}/rancher/mirrored-calico-kube-controllers:v3.19.2
    ${REGISTRY}/rancher/mirrored-calico-typha:v3.19.2
    ${REGISTRY}/rancher/mirrored-calico-node:v3.19.2
    ${REGISTRY}/rancher/mirrored-calico-pod2daemon-flexvol:v3.19.2
    ${REGISTRY}/rancher/mirrored-calico-cni:v3.19.2
EOF
```
whereas basic RKE2 images like coredns are all grouped together in the same section of the file:
```
xargs -n1 -t docker image pull --quiet << EOF >> build/images-core.txt
    ${REGISTRY}/rancher/hardened-kubernetes:${KUBERNETES_IMAGE_TAG}
    ${REGISTRY}/rancher/hardened-coredns:v1.8.3-build20210720
    ${REGISTRY}/rancher/hardened-cluster-autoscaler:v1.8.3-build20210729
    ${REGISTRY}/rancher/hardened-dns-node-cache:1.20.0-build20210803
    ${REGISTRY}/rancher/hardened-etcd:${ETCD_VERSION}-build20220413
    ${REGISTRY}/rancher/hardened-k8s-metrics-server:v0.5.0-build20210915
    ${REGISTRY}/rancher/klipper-helm:v0.6.1-build20210616
    ${REGISTRY}/rancher/pause:${PAUSE_VERSION}
    ${REGISTRY}/rancher/mirrored-jettech-kube-webhook-certgen:v1.5.1
    ${REGISTRY}/rancher/nginx-ingress-controller:nginx-0.47.0-hardened1
    ${REGISTRY}/rancher/rke2-cloud-provider:${CCM_VERSION}
EOF
```
Update the image version so that it points to the correct one

4. Once the previous steps are done and the PR is merged in rke2, we can go ahead and, if needed, update Rancher with
the change. We must only update it in case the options available to the user changed, i.e. when a field in values.yaml
changed. If that is the case, we must create a PR in the `kontainer-driver-metadata` Github repo or [KDM](https://github.com/rancher/kontainer-driver-metadata).
KDM collects information so that the UI/API knows what options to display and validate for chart configuration.
It does not impact what is deployed in the cluster, it only informs the options that rancher exposes. Therefore, it is
crucial that the versions are the same as what rke2 is consuming. Open the file `channels-rke2.yaml` and under the
charts variable, modify the version of the chart. The version is the one we used in step 1, i.e. the version of the
tarball in rke2-charts. For example, for coredns:
```
      rke2-coredns:
        repo: rancher-rke2-charts
        version: 1.10.101-build2021022304
```

Note that there are some charts that separate their crds into a different helm chart. This affects this step because
there will be two charts to update. For example Calico:
```
      rke2-calico:
        repo: rancher-rke2-charts
        version: v3.19.2-201
      rke2-calico-crd:
        repo: rancher-rke2-charts
        version: v1.0.101
```
Once that file is updated, as explained in the [README](https://github.com/rancher/kontainer-driver-metadata/blob/dev-v2.6/README.md#run)
run `go generate` and create a different commit for its changes

5. Make sure all the issues in rke2 and rancher related to this update are updated and possibly moved "To test" so that
 QA can take over
0707010000004A000081A4000000000000000000000001653C446F00000477000000000000000000000000000000000000003C00000000rke2-1.27.7+rke2r1/developer-docs/upgrading_dependencies.md# Upgrade Image Process

From time to time we need to update the images that RKE2 depends on. This document serves as a how-to for that process. The following steps are laid out in order.

##  Update Image

Create a new release in the image repository (eg [image-build-etcd](github.com/rancher/image-build-etcd)). This is done by specifying the tag version you want built from whatever upstream this repo is using. An image will be built and pushed to Docker Hub.

## Update RKE2

The following example files have references that will need to be updated in the respective locations for etcd. Replace the found version with the desired version.

* build-images: `${REGISTRY}/rancher/hardened-etcd:${ETCD_VERSION}-build20220413`
* scripts/version.sh:    `ETCD_VERSION=${ETCD_VERSION:-v3.4.13-k3s1}`

Some images may include a build date as part of the tag in format `-buildYYYYmmdd`. Trivy image scans may periodically fail as vulnerabilities are found in the base operating system. Re-tagging an image with the current build date should force an update of the base operating system and may help to resolve vulnerabilities found in image scans.
0707010000004B000081A4000000000000000000000001653C446F00000014000000000000000000000000000000000000003200000000rke2-1.27.7+rke2r1/developer-docs/upgrading_go.md# Upgrade Go Image

0707010000004C000081A4000000000000000000000001653C446F00004ED5000000000000000000000000000000000000003A00000000rke2-1.27.7+rke2r1/developer-docs/upgrading_kubernetes.md# Upgrade Kubernetes Process

From time to time, we need to update the version of Kubernetes used by RKE2. This document serves as a how-to for said process and elaborates on what constitutes a "release". The steps described in the document are laid out in order.

**NOTE:** This process will be needed whenever a new release is required, even when no new Kubernetes release is available. A handy checklist can be found [here](#release-process-overview).

- [Upgrade Kubernetes Process](#upgrade-kubernetes-process)
  - [QA Releases](#qa-releases)
  - [Hardened Kubernetes](#hardened-kubernetes)
  - [Update RKE2](#update-rke2)
  - [RKE2 Release RC](#rke2-release-rc)
    - [RKE2 Packaging](#rke2-packaging)
    - [Primary Release](#primary-release)
    - [Release Notes](#release-notes)
      - [Packaged Components](#packaged-components)
  - [Update Rancher KDM](#update-rancher-kdm)
    - [Promoting to Stable](#promoting-to-stable)
    - [Updating Channel Server](#updating-channel-server)
  - [Release Process Overview](#release-process-overview)

## QA Releases

If QA requires a release candidate (RC) for testing efforts before a Kubernetes patch is available, a new RC should be created with the most current Kubernetes release. For example, if QA wants a release for v1.23.5 before the Kubernetes patch, and the most recent release is v1.23.5+rke2r1, a tag should be cut for v1.23.5-rc1+rke2r1 release. Note that doing so will also require tagging v1.23.5+rke2r1 in image-build-kubernetes and bumping versions across rke2-charts and rke2, as if preparing for a full release.

## Hardened Kubernetes

The Hardened Kubernetes build process for RKE2 was once part of the RKE2 build process itself. It's been since split out and exists on its own in the [image-build-kubernetes](https://github.com/rancher/image-build-kubernetes) repository. Follow the steps below to create a new Hardened Kubernetes build.

Create a new release tag at the [image-build-kubernetes](https://github.com/rancher/image-build-kubernetes) repo.

* Click "Releases"
* Click "Draft a new release"
* Enter the new release version (the RKE2 Kubernetes version), appended with `-buildYYYYMMdd`, into the "Tag version" box.  **NOTE** The build system is in UTC. The command `TZ=utc date '+-build%Y%m%d'` can be used to get the correct format.
* When converting the RKE2 version to the Kubernetes version, use dash instead of plus, and do not include any alpha/beta/rc components. For example, if preparing for RKE2 `v1.23.5+rke2r1` before 5 PM Pacific on Friday, August 27th 2021 you would tag `v1.23.5-rke2r1-build20210829`
* Click the "Publish release" button.

This will take a few minutes for [CI](https://drone-pr.rancher.io/rancher/image-build-kubernetes) to run but upon completion, a new image will be available in [Dockerhub](https://hub.docker.com/r/rancher/hardened-kubernetes).

## Update RKE2

The following files have references that will need to be updated in the respective locations. Replace the found version with the desired version. There are also references in documentation that should be updated and kept in sync.

* Dockerfile: `FROM rancher/hardened-kubernetes:v1.23.5-rke2r1-build20220217 AS kubernetes`
* version.sh:
  * `KUBERNETES_VERSION=${KUBERNETES_VERSION:-v1.23.5}`
  * `KUBERNETES_IMAGE_TAG=${KUBERNETES_IMAGE_TAG:-v1.21.13-rke2r1-build20220525}`
* In v1.21, kube-proxy is still in use an needs to be updated in the Dockerfile. Update the line: `RUN CHART_VERSION="v1.21.10-build2021041301"     CHART_FILE=/charts/rke2-kube-proxy.yaml` to the relevant RKE2 Kubernetes build version.
* go.mod: ensure that the associated k3s version is used.

Once these changes are made, submit a PR for review and let CI complete. When CI is finished and upon getting 1 approval, merge the PR. CI will run for the master merge.

## RKE2 Release Candidate

Next, we need to create a release candidate (RC). The Drone (CI) process that builds the release itself can be monitored [here](https://drone-publish.rancher.io/rancher/rke2/).

* Click "Releases"
* Click "Draft new release"
* Select the target branch
* Enter the desired version into the "Tag version" box. 
    * Example tag: `v1.23.5-rc1+rke2r1`
    * **NOTE** Make sure to create the tag against the correct release branch. In the example above, that would map to release branch `release-1.23`.

Ensure "Set as a pre-release" checkbox is selected.
Ensure "Set as the latest release" is **NOT** selected.

CI will run and build the release assets as well as kick off an image build for [RKE2 Upgrade images](https://hub.docker.com/r/rancher/rke2-upgrade/tags?page=1&ordering=last_updated).

_**Note: Once an RC is released for QA, the release branch associated with the RC is now considered frozen until the final release is complete. If additional PRs need to get merged in after an RC, but before the final release, you should notify the RKE2 team of this immediately. After merging, an additional RC will need to be released for QA.**_

### RKE2 RC RPM Packaging

Along with creating a new RKE2 release, we need to trigger a new build of the associated RPM. These are found in the [rke2-packaging](https://github.com/rancher/rke2-packaging) repository. We need to create a new release here and the process is nearly identical to the above steps. The Drone (CI) process that builds the release itself can be monitored [here](https://drone-publish.rancher.io/rancher/rke2-packaging/).

* Click "Releases"
* Click "Draft new release"
* Select the target branch
* Enter the desired version into the "Tag version" box. 
    * Example tag: `v1.23.5-rc1+rke2r1.testing.0`
    * The first part of the tag here must match the tag created in the RKE2 repo.

When CI completes, let QA know so they can perform testing.

### Communicating with QA

When coordinating release efforts it is important to maintain a clear line of communication with the QA team. This is best done by relaying timely updates in the release thread of the #discuss-k3s-rke2-release channel in the organisations slack. It is best to notify QA once RCs, RPMs, and KDM PRs are available. Fill in the template below and paste it into the release thread:

```
RKE2 <tag> is now available for testing! @k3s-rke2-qa
KDM PRs:
<links to relevant KDM PRs>
RC:
<links to relevant rcs>
RPM:
<links to relevant rpms>
```

### Primary Release

Once QA signs off on the RC, it's time to cut the primary release. Go to the [rke2](https://github.com/rancher/rke2) repository.

* Click "Releases"
* Click "Draft new release"
* Enter the desired version into the "Tag version" box. 
    * Example tag: `v1.23.5+rke2r1`

Ensure "Set as a pre-release" checkbox is selected.
Ensure "Set as the latest release" is **NOT** selected.

Once complete, the process is repeated in the [rke2-packaging](https://github.com/rancher/rke2-packaging) repository.

* Click "Releases"
* Click "Draft new release"
* Enter the desired version into the "Tag version" box. 
    * Example tag: `v1.23.5+rke2r1.testing.0`
    * The first part of the tag here must match the tag created in the RKE2 repo.

Make sure that CI passes. This is for RPM availability in the testing channel.

Once complete, perform the steps below for the "**latest**" RPMs.

* Click "Releases"
* Click "Draft new release"
* Enter the desired version into the "Tag version" box. 
    * Example tag: `v1.23.5+rke2r1.latest.0`
    * The first part of the tag here must match the tag created in the RKE2 repo.

We will wait at least 24 hours in case the community finds an issue. Patches will need at least 24 hours.

We then create the "**stable**" RPMs. Follow the steps below.

* Click "Releases"
* Click "Draft new release"
* Enter the desired version into the "Tag version" box. 
    * Example tag: `v1.23.5+rke2r1.stable.0`
    * The first part of the tag here must match the tag created in the RKE2 repo.

### Release Notes

The drafting of release notes occurs in the [Rancher Labs - Release Notes](https://github.com/rancherlabs/release-notes) repository. To begin drafing release notes create a new branch from your fork and update the relevant files in `rke2/` directory. The release note files have been standardized and should adhere to the existing style and formatting.

The 2 primary sections of the release notes are the "Changes since ..." and the "Package Component Versions". The other sections need to be reviewed as well. The "Changes since ..." section can be fleshed out by reviewing the closed issues and pull requests for the matching milestone.

#### Packaged Components
It can be confusing to track where each number for a component is getting pulled from.

Here are some locations to check component versions:
- Kubernetes: Look in `Dockerfile` for `FROM rancher/hardened-kubernetes`.
- Etcd: Look in `scripts/version` for `ETCD_VERSION`.
- Containerd: Look in `Dockerfile` for `FROM rancher/hardened-containerd`.
- Runc: Look in `Dockerfile` for `FROM rancher/hardened-runc`.
- Metrics-server: Look in `scripts/build-images` for `rancher/hardened-k8s-metrics-server`.
- CoreDNS: Look in `scripts/build-images` for `rancher/hardened-coredns`.
- Ingress-Nginx: Look in `Dockerfile` find the line with `CHART_FILE=/charts/rke2-ingress-nginx`.
- Helm-controller: Look in `go.mod` for `helm-controller`.

#### Available CNIs

All CNI versions are in `scripts/build-images`.

Here are some locations to check CNI versions in the build-images script:
- Canal-Flannel: Look in `build/images-canal` section for `/rancher/hardened-flannel`
- Canal-Calico: Look in `build/images-canal` section for `/rancher/hardened-calico`
- Calico: Look in `build/images-calico` section for `/rancher/mirrored-calico-cni`.
- Cilium: Look in `build/images-cilium` section for `/rancher/mirrored-cilium-cilium`
- Multus: Look in `build/images-multus` section for `/rancher/hardened-multus-cni`

The build-images script controls what images are available to be built for air-gapped installs.
If the build-images script is not up to date then air-gapped installs will fail,
 this is a release-blocking issue that needs to be resolved.
Normally it is the responsibility of the person who updates the chart or component to
also update the build-image script, so if it is not up to date there is a failure in that process.

To validate the build-image script:

- look in the Dockerfile and find the chart version
- find the git repo for that chart
- find the GH release of the chart that is mentioned
- look in the chart for the CNI container version

Once the release notes are approved and merged, through the normal review and approval process, copy the contents of the files and paste them into the release itself, by editing the relevant release.

Be sure to review the rest of the sections as some of them may become irrelevant based on included fixes or version updates.

## Update Rancher KDM

This step is specific to Rancher and serves to update Rancher's [Kontainer Driver Metadata](https://github.com/rancher/kontainer-driver-metadata/).

Normally we'd create PRs in the [KDM](https://github.com/rancher/kontainer-driver-metadata/) `dev-2.6` and `dev-2.7` branches to update the Kubernetes versions in `channels-rke2.yaml`. However, for the time being, there are different branches that need to be updated. They can be found by going to the `#discuss-rancher-k3s-rke2-release` channel in Suse slack and checking the topic for the channel.
* The PR should consist of two commits:
    1. Changes made to `channels-rke2.yaml` to update the Kubernetes versions.
    2. Run `go generate` and commit the changes this caused to data/data.json. Title this second commit "go generate".
* Please note if this is a new minor release of Kubernetes, then a new entry will need to be created in `channels-rke2.yaml`. Ensure to set the min/max versions accordingly. If you are not certain what they should be, reach out to the team for input on this as it will depend on what Rancher will be supporting.

Entries that include `charts`, `serverArgs`, and/or `agentArgs` fields may not be altered or removed once they have been published to a release branch. Once a version has been released, a new entry must be added following it. It is possible to build off the `charts`, `serverArgs`, and `agentArgs` values defined in other entries using [yaml anchors](https://github.com/yaml/libyaml/blob/0.2.5/examples/anchors.yaml). For example, v1.23.5 has its charts defined as follows:
```
- version: v1.23.5+rke2r1
minChannelServerVersion: v2.6.0-alpha1
maxChannelServerVersion: v2.6.99
...
charts: &charts-v1
rke2-cilium:
    repo: rancher-rke2-charts
    version: 1.9.808
```
A later version can point to the same charts definition with no change:
```
- version: v1.21.5+rke2r1
minChannelServerVersion: v2.6.0-alpha1
maxChannelServerVersion: v2.6.99
...
charts: *charts-v1
```
Or a later version can define a new charts value that builds off the previous definition, with modifications:
```
- version: v1.21.5+rke2r1
minChannelServerVersion: v2.6.0-alpha1
maxChannelServerVersion: v2.6.99
...
charts: &charts-v2
<<: *charts-v1
harvester-cloud-provider:
    repo: rancher-rke2-charts
    version: 0.1.200
```
* To easily find chart differences, use the following:
    ```
    git fetch upstream --tags
    git diff v1.23.5+rke2r2..v1.21.5+rke2r1 -- Dockerfile
    ```
* To easily compare server and agent arguments, use the following:
    ```
    curl https://github.com/rancher/rke2/releases/download/v1.23.5+rke2r2/rke2.linux-amd64 -L -o rke2-r1
    curl https://github.com/rancher/rke2/releases/download/v1.21.5+rke2r1/rke2.linux-amd64 -L -o rke2-r2
    chmod u+x rke2-r*

# verify versions
    ./rke2-r1 --version
    ./rke2-r2 --version

# output args to a file
    ./rke2-r1 server --help >r1 && ./rke2-r1 agent --help >>r1args
    ./rke2-r2 server --help >r2 && ./rke2-r2 agent --help >>r2args

# diff arguments
    diff -y --suppress-common-lines r1args r2args
    ```

Create a backport PR in any additional dev branches as necessary.
Approval for PRs should come from people on the rke2/k3s team. Approval from the rancher team is not necessary (they control merging from dev branches to release branches).
The PRs should be merged in a timely manner, within about a day; however, they do not need to be merged before RC releases and they typically do not need to block the final release.

### Promoting to Stable

After 24 hours, we'll promote the release to stable and need to rebuild the RPM's. This involves the same steps for RPM releases but changing "latest" to "stable" in the release name. E.g. `v1.21.5+rke2r1.stable.0`.
NOTE: All releases for the month need to be marked as stable, not just the highest release (e.g. v1.19.15, v1.20.11, and v1.21.5 all get marked as stable, not just v1.21.5).

### Updating Channel Server

After promoting the release to stable, we need to update the channel server. This is done by editing the `channels.yaml` file in the [repo](https://github.com/rancher/rke2/blob/master/channels.yaml).

* Update the line: `latest: <release>` to be the recent release. e.g. `v1.21.5+rke2r1`.
* Verify updated in the JSON output from a call [here](https://update.rke2.io/v1-release/channels).

### Checking downstream components

Every RKE2 release, from RC to primary, triggers the release process of the downstream components listed in the `scripts/dispatch` script. It is worth ensuring each of them successfully finishes.

- system-agent-installer-rke2
  - [Repository](https://github.com/rancher/system-agent-installer-rke2)
  - [Drone publish job](https://drone-publish.rancher.io/rancher/system-agent-installer-rke2)
- rke2-upgrade
  - [Repository](https://github.com/rancher/rke2-upgrade)
  - [Drone publish job](https://drone-publish.rancher.io/rancher/rke2-upgrade)

## Prepare for an 'R2'
At this point it is likely that the release is over. However, in the event of a CVE, critical bug affecting user experiences or something similar, we may be required to cut what the release team refers to as an 'R2' or 'Release 2'. This process is identical to the release process, save only that the tags are cut with ```+rke2r2```. To prep an R2 one need only to perform the following:

Create a new release tag at the [image-build-kubernetes](https://github.com/rancher/image-build-kubernetes) repo.

* Click "Releases"
* Click "Draft a new release"
* Enter the new release version (the RKE2 Kubernetes version), appended with `-buildYYYYMMdd`, into the "Tag version" box.  **NOTE** The build system is in UTC. The command `TZ=utc date '+-build%Y%m%d'` can be used to get the correct format.
* When converting the RKE2 version to the Kubernetes version, use dash instead of plus, and do not include any alpha/beta/rc components. For example, if preparing for RKE2 `v1.23.5+rke2r2` before 5 PM Pacific on Friday, August 27th 2021 you would tag `v1.23.5-rke2r2-build20210829`
* Click the "Publish release" button.

Now restart the RKE2 upgrades as defined [here](#L39) with the updated image-build-kubernetes tags.

Once the updates are made, create a PR with '[WIP]' in the title, request review, and leave open until needed. If an R2 isn't necessary, these PRs should be closed at the start of the next release process.

## Release Process Overview

```mermaid
flowchart TB;
 prerelease([Create cut release ticket])

subgraph rc[RKE2 Release Candidate Flow]
   direction LR;
   cut_k8s([Cut hardened<br/>Kubernetes release])-->|For Kubernetes<br/>1.20 and 1.21|update_kubeproxy([Update kubeproxy<br/>in RKE2-charts]);
   update_kubeproxy-->|Once RKE2-charts<br/>index refreshes|update_rke_refs;
   cut_k8s-->|From Kubernetes<br/>1.22 onwards|update_rke_refs([Update RKE2 components<br/>version references]);
   update_rke_refs-->|Once RKE2 PR's<br/>are approved|cut_rke2_rc([Cut RKE2<br/>release candidate]);
   cut_rke2_rc-->cut_rke2_rc_rpm([Cut RKE2<br/>testing rpms]);
 end

subgraph kdm_rc[Rancher KDM RC Release Flow]
   direction LR;
   kdm_channel_rc([Update RKE RC release references])-->kdm_generated_data_rc([Update KDM generated data]);
 end

subgraph primary_release[RKE2 Primary Release Flow]
   direction LR;
   cut_rke([Cut RKE2 primary pre-release])-->cut_rke2_testing_rpm([Cut RKE2 testing rpms]);
   cut_rke2_testing_rpm-->|Once QA approves<br/>testing rpms|cut_rke2_latest_rpm([Cut RKE2 latest rpms]);
   cut_rke2_latest_rpm-->update_release_notes([Update release notes]);
 end

subgraph kdm_stable[Rancher KDM Stable Release Flow]
   direction LR;
   kdm_channel_stable([Update RKE release references])-->kdm_generated_data_stable([Update KDM generated data]);
 end

subgraph stable_release[RKE2 Stable Release Flow]
   direction LR;
   cut_rke_stable_rpm([Cut RKE2 stable rpm])-->GA([Set RKE2 releases as generally available])
   GA-->rke_stable([Update RKE2 channel server configurations]);
 end

prerelease-.->|Once Kubernetes release<br/>is generally available|rc;
 rc-->kdm_rc;
 kdm_rc-->|Once QA approves RKE2 release candidates|primary_release;
 primary_release-->kdm_stable;
 kdm_stable-->|Once QA approves RKE2 releases|stable_release;
 stable_release-->postrelease([Close cut release ticket])

classDef edgeLabel fill:#e8e8e8,color:#333,background-color:#e8e8e8;
 classDef default fill:#fff,stroke:#35b9ab,stroke-width:5px,color:#333;
 classDef section fill:#fff,stroke:#bbb,stroke-width:1px,color:#173f4f;

class rc,primary_release,kdm_rc,kdm_stable,stable_release section;
```

Be sure to reference the sections above for further detail on each step.

- Tag new Hardened Kubernetes release
- Update Helm chart versions
- Update RKE2
- Tag new RKE2 RC
- Tag new RKE2 packaging RC "testing"
- Tag the RKE2 release
- Add release notes to release
- Tag RKE2 packaging release "testing"
- Tag RKE2 packaging release "latest"
- Uncheck "pre-release"
- Wait 1 week for community to report issues
- Tag RKE2 packaging release "stable"
- Update stable release in channels.yaml
- Update KDM
- Begin R2 preparations

0707010000004D000081A4000000000000000000000001653C446F00000968000000000000000000000000000000000000003400000000rke2-1.27.7+rke2r1/developer-docs/upgrading_rke2.md# Upgrade RKE2 Process

The steps which the user should follow to automatically upgrade rke2 are very well described in the [docs](https://docs.rke2.io/upgrade/automated_upgrade/). This documents goes a bit deeper into what happens behind the scenes.

## System upgrade controller

As described in the upper link, a system-upgrade-controller is used to upgrade the cluster. The upgrade procedure can be adjusted based on the configuration plan, which is fed to the system using a CR. The controller will read that CR and create a job that will execute the upgrade. Normally, the job is using the image `rancher/rke2-upgrade`, which is generated by a project with the same name.

## rke2-upgrade project

The [rke2-upgrade project](https://github.com/rancher/rke2-upgrade) basically generates an image with three important pieces:
1 - The new rke2 binary based on the version set in the plan
2 - The new kubectl binary based on the version set in the plan
3 - The upgrade.sh script

That script replaces the rke2 binary and kills the current rke2 process. That way, systemd (or others) will restart the service now using the correct upgraded rke2 binary.

## rke2 binary restarting

The rke2 binary will do as it does on every startup of rke2. It extracts the manifests of the runtime image into the /var/lib/rancher/rke2/server/manifests dir, replacing the existing ones coming from an old rke2 version, with the new ones. The [k3s deploy controller](https://github.com/k3s-io/k3s/blob/master/pkg/deploy/controller.go) will loop over them and apply them to the cluster creating an Addon resource. These will happen to all manifests except for:

* Manifests that refer to a explicitly disabled component (e.g. via the --disable flag in the cli). In this case, the controller tries to uninstall it and removes the manifest
* Manifests that refer to a component that should be skipped. For a component to be skipped, we just need to add the suffix `.skip` to the file name of the manifest (e.g. rke2-canal.yaml.skip). In this case, the controller will ignore this component and will not try to upgrade it. If you are running several control-plane nodes, remember to add the `.skip` suffix to the file in all control-plane nodes.

The skips procedure can be very useful for cases such as a user switching to the enterprise version of a cni plugin. In this case, the cni plugin vendor will take care of upgrades.
0707010000004E000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001800000000rke2-1.27.7+rke2r1/docs0707010000004F000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001D00000000rke2-1.27.7+rke2r1/docs/adrs07070100000050000081A4000000000000000000000001653C446F000001E4000000000000000000000000000000000000004200000000rke2-1.27.7+rke2r1/docs/adrs/001-record-architecture-decisions.md# 1. Record architecture decisions

Date: 2022-01-26

## Status

Accepted

## Context

We need to record the architectural decisions made on this project.

## Decision

We will use Architecture Decision Records, as [described by Michael Nygard](http://thinkrelevance.com/blog/2011/11/15/documenting-architecture-decisions).

## Consequences

See Michael Nygard's article, linked above. For a lightweight ADR toolset, see Nat Pryce's [adr-tools](https://github.com/npryce/adr-tools).

07070100000051000081A4000000000000000000000001653C446F0000044A000000000000000000000000000000000000003500000000rke2-1.27.7+rke2r1/docs/adrs/002-rke2-rpm-support.md# 2. RPM support for RKE2

Date: 2022-01-20

## Status

Accepted

## Context

RKE2 publishes RPMs for distribution of RKE2 through the https://github.com/rancher/rke2-packaging repository. These RPMs are built using automated calls to `rpmbuild` and corresponding GPG signing/publishing plugins, and publish RPMs to the `rpm.rancher.io`/`rpm-testing.rancher.io` S3-backed buckets.

## Decision

Until a more robust RPM building/mechanism is established for RKE2, we will not add any new platforms for RPM publishing beyond the existing CentOS/RHEL 7 and 8 RPMs that are published. We will publish selinux policy RPMs for new platforms as needed, and ensure the selinux RPMs are compatible with the tarball installation method for the platform in question.

This decision can be re-evaluated in the future if a more robust RPM publishing technique/platform is developed/made available.

## Consequences

The only supported installation method for all platforms except CentOS 7/8 with selinux support will be a combination of the use of a tarball install in conjunction with an selinux policy RPM.

07070100000052000081A4000000000000000000000001653C446F000005B1000000000000000000000000000000000000003900000000rke2-1.27.7+rke2r1/docs/adrs/003-rke2-rpm-sle-support.md# 3. RPM SLE support for RKE2

Date: 2022-01-27

## Status

Accepted

## Context

RKE2 publishes RPMs for SUSE OS distributions, the rpms will be installed via transactional updates if exists, this will enable two things, the installation of rke2-selinux and the extraction of the binaries in the right `/usr` paths instead of the alternative tarball installation which will extract the binaries in `/opt`.

## Decision

We will add support for RPM publishing for SUSE OS distributions in rke2-packaging repo, the `rke2-server` and `rke2-agent` packages will require installing `rke2-common` which will in turn install the `rke2-selinux` RPM package which is already supported for microos.

The decision will involve defaulting to the tarball installation for SUSE OS distribution in the installation script to prevent breaking current compatibility with users who currently installed via tarball installation, the RPM installation will be allowed via passing the environment variable `RKE2_INSTALL_METHOD=rpm` to the install script.

The installation script will also have measures to prevent installation switching from RPM to tarball installation and vice versa, and finally the installation via the tarball method will not allow SELINUX to be enabled unless manually.

## Consequences

The decision will result in some drawbacks:

- The decision will not enable RPM installation by default.
- The tarball installation will not enable SELINUX by default.07070100000053000081A4000000000000000000000001653C446F00000751000000000000000000000000000000000000003700000000rke2-1.27.7+rke2r1/docs/adrs/004-rke2-rc-versioning.md# 4. Release Candidate 'RC' Version Format

Date: 2022-07-14

## Status

Rejected

## Question

Should we remove the `-rc` text from the prerelease section of RKE2 releases so that we can reduce the overall steps necessary in releasing?

## Context

Our workflow for generating Release Candidates for RKE2 is the same as our workflow for generating GA RKE2 releases,
with the exception of the "-rc" text in the prerelease section of the git tag.

### Strengths

- reduce CI time by producing one less release
- reduce manual effort by producing one less release (no need to update KDM)
- reduce the time from a release being approved to it being published
- improve reliability of the artifacts by promoting the artifacts tested rather than rebuilding them

### Weaknesses

- if we don't rebuild hardened images, we wouldn't have a way to know the version number of the release candidate
- testing would be more difficult because we wouldn't know the difference between an "rc-1" and an "rc-2"
- GitHub won't let you generate duplicate releases/tags
  - we would either have to delete the release and move the tag (essentially removing the rc version)
  - or figure out some other way to version the release candidates

### Opportunities

- normalizing the process would make it easier to automate
- SLSA compliance states that certification "is not transitive" predicating artifact orientation

### Threats

- a customer might mistake a RC artifact for a GA artifact

## Decision

We need to be able to quickly reference the differences between a release candidate and a general admission release,
and the risk that a user might mistake an RC artifact for a GA artifact is too high for the benefits provided.

## Consequences

We will (continue to) place `-rc` in the prerelease section of the version number for RKE2 tags and releases.
For example : `v1.24.3-rc1+rke2r1`
07070100000054000081A4000000000000000000000001653C446F000005A9000000000000000000000000000000000000003600000000rke2-1.27.7+rke2r1/docs/adrs/004-servicelb-support.md# Support for ServiceLB Load-Balancer Controller in RKE2

Date: 2022-09-30

## Status

Accepted

## Context

RKE2 does not currently bundle a load-balancer controller. Users that want to deploy Services of type
LoadBalancer must deploy a real cloud-provider chart, or use an alternative such as MetalLB or Kube-VIP.

## Decision

Taking advantage of recent changes to [move ServiceLB into the K3s stub
cloud-provider](https://github.com/k3s-io/k3s/blob/master/docs/adrs/servicelb-ccm.md), we will allow RKE2 to run ServiceLB as
part of a proper clould controller integration. This will require adding CLI flags to enable servicelb, as well as exposing
existing K3s flags to configure its namespace. Running servicelb will be opt-in, behind a new flag, to avoid changing
behavior on existing clusters.

## Consequences

* RKE2 uses less resources when ServiceLB is disabled, as several core controllers are no longer started unconditionally.
* The `--disable-cloud-controller` flag now disables the CCM's `cloud-node` and `cloud-node-lifecycle` controllers that were
historically the only supported controllers.
* The `--enable-servicelb` flag now prevents `--disable=servicelb` from being passed in to K3s, which in turn enables the CCM's
`service` controller.
* If the cloud-controller and servicelb are both disabled, the cloud-controller-manager is not run at all.
* The K3s `--servicelb-namespace` flag is now passed through instead of dropped.
07070100000055000081A4000000000000000000000001653C446F00001300000000000000000000000000000000000000004000000000rke2-1.27.7+rke2r1/docs/adrs/005-security-updates-automation.md# Security updates and versions bump automation

Date: 2022-11-18

## Status

Accepted

## Context

The current process of keeping third-party dependencies and container images up to date is manual and time consuming, which makes us lack behind upstream updates. This leads to RKE2 sometimes shipping outdated dependencies and images that can introduce security issues (CVEs) in our code and in users environments. A process is needed to automate the discovery of updates and PRs, so developers don't need to spend valuable time with manual tasks that can be easily automate.

The basic requirements that we need for such automation regarding the tooling are:

1. The tool is free and open-source.
2. Supports major packages ecosystems - Docker, Go, Python etc.
3. Automatically opens pull requests (PRs).
4. Preferably supports bumping versions in unstructured formats, e.g., `ENV` vars in Dockerfiles and by matching regular expressions.
5. Preferably supports scripting the automation process, e.g., update package A in repo B after package X in repo Y matches a pre-defined version criteria.

There are well known free and/or open-source tools available for this kind of automation:

### 1. [Dependabot](https://docs.github.com/en/code-security/dependabot)

- Provides PR automation for version and security updates.
- Is provided as a service by GitHub and free for public and private repos.
  - There is no need to add a GH app or token in the repo.
- Simple to configure in the repo settings in GitHub and with an YAML configuration `.github/dependabot.yml` file.
- Supports bumping of images in Dockerfiles and major packages ecosystem. See full list [here](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem).
- Doesn't support:
  - Bumping versions in unstructured formats.
  - Orchestrating updates.

### 2. [Renovate](https://github.com/renovatebot/renovate)

- Is similar to Dependabot.
- Requires installation of [Renovate bot](https://github.com/apps/renovate) as a GH app.
- Is provided as a service by [Mend](https://www.mend.io/free-developer-tools/renovate/) (previously called WhiteSource).
- Is configured through a JSON file `renovate.json`.
- Supports bumping of images in Dockerfiles and major packages ecosystem. See full list [here](https://docs.renovatebot.com/golang/).
- Supports version bumps in unstructured formats through [data sources](https://docs.renovatebot.com/modules/datasource/).
- Doesn't support orchestrating updates.

### 3. [Updatecli](https://www.updatecli.io/)

- Is similar to Dependabot and Renovate.
- Is installed as a [GH Action](https://www.updatecli.io/docs/automate/github_action/).
  - Requires configuration of a GH token.
- Is fully open-source and a core maintainer is a current SUSE employee.
- All configurations must be scripted as an [YAML file](https://www.updatecli.io/docs/prologue/quick-start/).
  - For bumps in images and Go dependencies, for example, it's necessary to script the steps more verbosely when compared to Dependabot and Renovate.
- Supports version bumps in unstructured formats.
- Supports orchestrating updates through [`conditions`](https://www.updatecli.io/docs/core/condition/).
- It's being used in some SUSE projects - [Epinio](https://github.com/epinio/helm-charts/blob/e0cec6d31be78a418dbfb06efcc57f60385ec88f/updatecli/updatecli.d/epinio.yaml) and [Kubewarden](https://github.com/kubewarden/deprecated-api-versions-policy/blob/dabf594f6eac8143d13a859b2aa0279518d44b69/updatecli-manifest.yaml). Soon will also be implemented in Rancher.

Each tool has its strong points and a combination of them will be required.

| Features x Tool | Dependabot | Renovate | Updatecli |
| --------------- | ---------- | -------- | --------- |
| Provides pull request automation | ✅ | ✅ | ✅ |
| Minimal configuration required for bumping major packages ecosystems | ✅ | ✅ | ⚪ |
| Minimal integration required (no GH app or token) | ✅ | ⚪ | ⚪ |
| Supports version bumps in unstructured formats | ⚪ | ✅ | ✅ |
| Supports orchestrating updates | ⚪ | ⚪ | ✅ |
| Offers greater extensibility | ⚪ | ⚪ | ✅ |

## Decision

Based on the evaluated context, we decided to use Dependabot and Updatecli for automating version and security bumps.

- Dependabot for its simplicity to integrate with GitHub and covering the major packages ecosystem with minimal configuration required.
- Updatecli for allowing orchestration and automation of updates in unstructured formats.

## Consequences

- PRs for version bumps of dependencies are automated.
- PRs for security updates of dependencies are automated.
- Developers spend less time doing manual tasks.
- RKE2 code and images are shipped with fewer security issues in dependencies.
- Users benefit from greater security.
07070100000056000081A4000000000000000000000001653C446F000019DE000000000000000000000000000000000000002700000000rke2-1.27.7+rke2r1/docs/adrs/README.md# Architectural Decision Records (ADRs)

ADRs are a record of the arguments and decisions made to change process or software architecture.
The idea is for these records to be regularly reviewed, updated, and documented so that new people or external parties
 to a project can read along and understand the points of a decision, the context, 
 and in general can make educated decisions based on previous discussions.

ADRs provide a safer place for individuals who would rather not speak up in face to face communication 
 (which can feel confrontational) or would like to educate themselves on a topic before commenting.

## Documenting Architecture Decisions

In [Documenting Architecture Decisions](https://cognitect.com/blog/2011/11/15/documenting-architecture-decisions)
Michael Nygard explains the concept as small, easy to read and update documents which give context to a decision.

He further explains the alternative (when the context for decisions is lost) as "Blindly accept the decision." or "Blindly change it.".
We agree with this point and have thus generated our own process for implementing this concept.

### Architectural

Micheal defines "Architectural" as decisions which "affect the structure, non-functional characteristics, dependencies, interfaces, or construction techniques" for a project.
Our definition is a a bit less structured, essentially if it comes up in a design discussion we want to keep track of it.

### Versioning

Michael states that the file names give no context (are simply numbered) and 
are never altered once resolved, because "It's still relevant to know that it was the decision, but is no longer the decision.".
We are choosing to place our ADRs in a version control system where the history of the decision can be queried in the versions of the document itself. 
This is handy because it lowers the total number of docs that will accumulate and allows us to give the files contextual names.
Our file names can summarize the decision they contain so that readers can easily find and reference that decision.

### Status Types

Michael gives four potential statuses for an ADR: "proposed", "accepted", "deprecated", and "superseded".
Since we are versioning our ADRs and using PRs, we only need "accepted", "rejected", and "superseded", affording us a simpler model.
Changes which are in review are handled in PRs, the review is finalized after a period of time with the status of "accepted" or "rejected".
If a decision supersedes another we change the superseded decision's status to "superseded by `doc`" where the doc is a link to the decision which superseded it.
Context should be given as to why it is superseded in both the superseded decision in the one superseding.

## Tools

A command line tool for ADRs [is available](https://github.com/npryce/adr-tools) to help manage the complexity of altering or finding a decision.
Our model makes such tools a bit less useful, preferring the use of the tools built into the source code management system.

## Process

The process of preparing, documenting, and presenting a decision should be easy and straightforward,
we don't want this process to encumber our ability to change, but enable educated decisions.

### Issue

The goal of an issue _isn't_ whether or not to accept or reject a decision.
The goal of an issue is to decide whether or not a decision needs to be made.

Generate an Issue if:
   - you have a question or need context about a decision
   - you have a suggestion which might need a decision to be made
   - you believe additional context might change a decision

### Pull Request

Generate a PR if:
   - you have additional context for a decision
   - a decision was made and there is no ADR for it
   - you brought up a decision in a design discussion and a change was suggested

Pull requests are more closely tied to the file version than Issues,
 so we prefer conversations about the decision to be in the Pull Request,
 where it can more easily be found.

### Step By Step Process for a new ADR

1. You have an idea to improve a process, design, etc
1. Document the idea to present in the design discussion
   - there is a format for this to help you get started
   - create a pull request for the decision with the outcome you would like (approved/rejected)
1. Link the new PR in the discuss-rancher-k3s-rke2 slack channel and notify the team
1. Present the idea in the design discussion meeting
1. Record any context brought forward in the design discussion
   - this should result in a update to the PR
1. Wait one week
   - this gives everyone who would like to comment in the PR the ability to do so
   - add any added context from the comments to the PR
1. Present the outcome of the decision in the next design discussion
   - if new context is brought forward, record it, add it to the PR, and wait another week
   - repeat this process until there is no new context
   - each week you present the ADR make sure to link in slack and notify the team
   - finalize the decision by merging the PR
   - merging should still have the normal requirements (2 approvals and passing CI)

### Step By Step Process for updating an ADR

1. You have some new context on an existing decision
1. Generate a PR to add the context
1. Merge after the normal requirements (2 approvals and CI passes)
- this process should not alter the decision, only add context to it
- any time the decision's status should change,
  please make sure the team is aware and has had time to discuss.

### Step By Step Process for revisiting an ADR

1. You disagree with the decision section of an ADR
   - maybe this is due to some new context that you added
1. The decision was made greater than a week ago (the ADR PR should have merged > 7 days ago)
   - this really only applies if there was no new context
   - if you have new context for a decision there should not be any waiting to present a change in the decision
   - this is meant to prevent excessive decision changes, not slow down any necessary change
1. Generate a PR to change the decision section of the ADR
1. Present your point of view in the next design discussion
1. Add any context discovered from the discussion to the PR
1. Highlight the change in slack and notify the team
1. Wait one week
1. Update the PR with any context added in the PR discussion
1. Present the outcome of the decision in the next design discussion
1. Finalize the change by merging the PR
   - if the change is not agreed upon and no context was added then _don't merge_ and close the PR
   - merging should still have the normal requirements (2 approvals and passing CI)
07070100000057000081A4000000000000000000000001653C446F00000897000000000000000000000000000000000000002D00000000rke2-1.27.7+rke2r1/docs/adrs/adr-template.md# ADR Format Template

This template provides a canvas for generating ADRs and a standard format so that we can build tools to parse them.
- notes are added to this template to help elaborate on the points without a separate document
- notes will be prefixed with a dash

## Established

2022-07-20
- this section should contain only the YYYY-MM-DD date of when the decision is considered final
- this can be added after context is given, in the PR which will wait for 1 week before merge

## Revisit by

2023-07-15
- this section should contain only the YYYY-MM-DD date of when the decision is considered stale
- at the next design discussion we should validate and renew this date

## Subject

Given `data`, when `triggering event`, then we `do something`.

- the person should be [first person plural](https://en.wikipedia.org/wiki/Grammatical_person)
  - "we" do something
  - not "I", "you", or "they"
- the tense should be [simple present](https://courses.dcs.wisc.edu/wp/grammar/category/tense-and-mood/), 
  - we "do" something
  - not "does", "doing", "did", or "done"
- the mood should be [indicative](https://osuwritingcenter.okstate.edu/blog/2020/11/6/the-five-grammatical-moods)
  - we "do" something
  - not "go do"
- Given when then statements should be used as often as possible to get as much context into the subject as possible.
- Don't force 'given, when, then'; if there is no triggering event or no data given, then leave those parts out.

## Status

Accepted / Rejected / Superseded by #other-issue
- accepted is the decision that the subject is appropriate and we will do it.
- rejected is the decision that the subject isn't appropriate and we won't do it.
- superseded relates that a different decision forces this decision (for instance a decision made at a higher level of abstraction)

## Context

- the following is a simple framework for judging a decision, these items are not required, but may be useful to the writer.
### Strength of doing process
### Weakness of doing process
### Threats involved in not doing process
### Threats involved in doing process
### Opportunities involved in doing process

- a different approach to context framework
### Pros
### Cons
07070100000058000081A4000000000000000000000001653C446F00005C89000000000000000000000000000000000000001A00000000rke2-1.27.7+rke2r1/go.modmodule github.com/rancher/rke2

go 1.19

replace (
	github.com/Microsoft/hcsshim => github.com/Microsoft/hcsshim v0.11.0
	github.com/Mirantis/cri-dockerd => github.com/k3s-io/cri-dockerd v0.3.4-k3s1
	github.com/benmoss/go-powershell => github.com/k3s-io/go-powershell v0.0.0-20201118222746-51f4c451fbd7
	github.com/cloudnativelabs/kube-router/v2 => github.com/k3s-io/kube-router/v2 v2.0.1-0.20230508174102-b42e5faded1c
	github.com/containerd/containerd => github.com/k3s-io/containerd v1.7.7-k3s1.27
	github.com/containerd/stargz-snapshotter => github.com/k3s-io/stargz-snapshotter v0.13.0-k3s1
	github.com/docker/distribution => github.com/docker/distribution v2.8.2+incompatible
	github.com/docker/docker => github.com/docker/docker v24.0.0-rc.2.0.20230801142700-69c9adb7d386+incompatible
	github.com/docker/libnetwork => github.com/docker/libnetwork v0.8.0-dev.2.0.20190624125649-f0e46a78ea34
	github.com/go-logr/logr => github.com/go-logr/logr v1.2.0
	github.com/golang/protobuf => github.com/golang/protobuf v1.5.3
	github.com/googleapis/gax-go/v2 => github.com/googleapis/gax-go/v2 v2.1.1
	github.com/juju/errors => github.com/k3s-io/nocode v0.0.0-20200630202308-cb097102c09f
	github.com/kubernetes-sigs/cri-tools => github.com/k3s-io/cri-tools v1.26.0-rc.0-k3s1
	github.com/matryer/moq => github.com/rancher/moq v0.0.0-20190404221404-ee5226d43009
	github.com/opencontainers/runc => github.com/opencontainers/runc v1.1.8
	github.com/opencontainers/runtime-spec => github.com/opencontainers/runtime-spec v1.0.3-0.20220909204839-494a5a6aca78
	github.com/opencontainers/selinux => github.com/opencontainers/selinux v1.10.1
	github.com/rancher/wrangler => github.com/rancher/wrangler v1.1.1-0.20230425173236-39a4707f0689
	go.etcd.io/etcd/api/v3 => github.com/k3s-io/etcd/api/v3 v3.5.9-k3s1
	go.etcd.io/etcd/client/pkg/v3 => github.com/k3s-io/etcd/client/pkg/v3 v3.5.9-k3s1
	go.etcd.io/etcd/client/v2 => github.com/k3s-io/etcd/client/v2 v2.305.9-k3s1
	go.etcd.io/etcd/client/v3 => github.com/k3s-io/etcd/client/v3 v3.5.9-k3s1
	go.etcd.io/etcd/etcdutl/v3 => github.com/k3s-io/etcd/etcdutl/v3 v3.5.9-k3s1
	go.etcd.io/etcd/pkg/v3 => github.com/k3s-io/etcd/pkg/v3 v3.5.9-k3s1
	go.etcd.io/etcd/raft/v3 => github.com/k3s-io/etcd/raft/v3 v3.5.9-k3s1
	go.etcd.io/etcd/server/v3 => github.com/k3s-io/etcd/server/v3 v3.5.9-k3s1
	go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful => go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful v0.35.0
	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc => go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.35.0
	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp => go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.35.1
	go.opentelemetry.io/contrib/propagators/b3 => go.opentelemetry.io/contrib/propagators/b3 v1.13.0
	go.opentelemetry.io/otel => go.opentelemetry.io/otel v1.13.0
	go.opentelemetry.io/otel/exporters/otlp/internal/retry => go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.13.0
	go.opentelemetry.io/otel/exporters/otlp/otlpmetric => go.opentelemetry.io/otel/exporters/otlp/otlpmetric v0.32.1
	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc => go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v0.32.1
	go.opentelemetry.io/otel/exporters/otlp/otlptrace => go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.13.0
	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.13.0
	go.opentelemetry.io/otel/metric => go.opentelemetry.io/otel/metric v0.32.1
	go.opentelemetry.io/otel/sdk => go.opentelemetry.io/otel/sdk v1.13.0
	go.opentelemetry.io/otel/trace => go.opentelemetry.io/otel/trace v1.13.0
	go.opentelemetry.io/proto/otlp => go.opentelemetry.io/proto/otlp v0.19.0
	golang.org/x/net => golang.org/x/net v0.17.0
	golang.org/x/sys => golang.org/x/sys v0.6.0
	google.golang.org/api => google.golang.org/api v0.60.0
	google.golang.org/genproto => google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21
	google.golang.org/grpc => google.golang.org/grpc v1.58.3
	gopkg.in/square/go-jose.v2 => gopkg.in/square/go-jose.v2 v2.6.0
	k8s.io/api => github.com/k3s-io/kubernetes/staging/src/k8s.io/api v1.27.7-k3s1
	k8s.io/apiextensions-apiserver => github.com/k3s-io/kubernetes/staging/src/k8s.io/apiextensions-apiserver v1.27.7-k3s1
	k8s.io/apimachinery => github.com/k3s-io/kubernetes/staging/src/k8s.io/apimachinery v1.27.7-k3s1
	k8s.io/apiserver => github.com/k3s-io/kubernetes/staging/src/k8s.io/apiserver v1.27.7-k3s1
	k8s.io/cli-runtime => github.com/k3s-io/kubernetes/staging/src/k8s.io/cli-runtime v1.27.7-k3s1
	k8s.io/client-go => github.com/k3s-io/kubernetes/staging/src/k8s.io/client-go v1.27.7-k3s1
	k8s.io/cloud-provider => github.com/k3s-io/kubernetes/staging/src/k8s.io/cloud-provider v1.27.7-k3s1
	k8s.io/cluster-bootstrap => github.com/k3s-io/kubernetes/staging/src/k8s.io/cluster-bootstrap v1.27.7-k3s1
	k8s.io/code-generator => github.com/k3s-io/kubernetes/staging/src/k8s.io/code-generator v1.27.7-k3s1
	k8s.io/component-base => github.com/k3s-io/kubernetes/staging/src/k8s.io/component-base v1.27.7-k3s1
	k8s.io/component-helpers => github.com/k3s-io/kubernetes/staging/src/k8s.io/component-helpers v1.27.7-k3s1
	k8s.io/controller-manager => github.com/k3s-io/kubernetes/staging/src/k8s.io/controller-manager v1.27.7-k3s1
	k8s.io/cri-api => github.com/k3s-io/kubernetes/staging/src/k8s.io/cri-api v1.27.7-k3s1
	k8s.io/csi-translation-lib => github.com/k3s-io/kubernetes/staging/src/k8s.io/csi-translation-lib v1.27.7-k3s1
	k8s.io/dynamic-resource-allocation => github.com/k3s-io/kubernetes/staging/src/k8s.io/dynamic-resource-allocation v1.27.7-k3s1
	k8s.io/klog => github.com/k3s-io/klog v1.0.0-k3s2 // k3s-release-1.x
	k8s.io/klog/v2 => github.com/k3s-io/klog/v2 v2.90.1-k3s1 // k3s-main
	k8s.io/kms => github.com/k3s-io/kubernetes/staging/src/k8s.io/kms v1.27.7-k3s1
	k8s.io/kube-aggregator => github.com/k3s-io/kubernetes/staging/src/k8s.io/kube-aggregator v1.27.7-k3s1
	k8s.io/kube-controller-manager => github.com/k3s-io/kubernetes/staging/src/k8s.io/kube-controller-manager v1.27.7-k3s1
	k8s.io/kube-openapi => k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f
	k8s.io/kube-proxy => github.com/k3s-io/kubernetes/staging/src/k8s.io/kube-proxy v1.27.7-k3s1
	k8s.io/kube-scheduler => github.com/k3s-io/kubernetes/staging/src/k8s.io/kube-scheduler v1.27.7-k3s1
	k8s.io/kubectl => github.com/k3s-io/kubernetes/staging/src/k8s.io/kubectl v1.27.7-k3s1
	k8s.io/kubelet => github.com/k3s-io/kubernetes/staging/src/k8s.io/kubelet v1.27.7-k3s1
	k8s.io/kubernetes => github.com/k3s-io/kubernetes v1.27.7-k3s1
	k8s.io/legacy-cloud-providers => github.com/k3s-io/kubernetes/staging/src/k8s.io/legacy-cloud-providers v1.27.7-k3s1
	k8s.io/metrics => github.com/k3s-io/kubernetes/staging/src/k8s.io/metrics v1.27.7-k3s1
	k8s.io/mount-utils => github.com/k3s-io/kubernetes/staging/src/k8s.io/mount-utils v1.27.7-k3s1
	k8s.io/node-api => github.com/k3s-io/kubernetes/staging/src/k8s.io/node-api v1.27.7-k3s1
	k8s.io/pod-security-admission => github.com/k3s-io/kubernetes/staging/src/k8s.io/pod-security-admission v1.27.7-k3s1
	k8s.io/sample-apiserver => github.com/k3s-io/kubernetes/staging/src/k8s.io/sample-apiserver v1.27.7-k3s1
	k8s.io/sample-cli-plugin => github.com/k3s-io/kubernetes/staging/src/k8s.io/sample-cli-plugin v1.27.7-k3s1
	k8s.io/sample-controller => github.com/k3s-io/kubernetes/staging/src/k8s.io/sample-controller v1.27.7-k3s1
	mvdan.cc/unparam => mvdan.cc/unparam v0.0.0-20210104141923-aac4ce9116a7
	vbom.ml/util => github.com/fvbommel/util v0.0.3 // github.com/tigera/operator using old repo
)

require (
	github.com/Microsoft/hcsshim v0.11.1
	github.com/aws/aws-sdk-go v1.44.197
	github.com/containerd/continuity v0.4.2 // indirect
	github.com/google/go-containerregistry v0.14.0
	github.com/iamacarpet/go-win64api v0.0.0-20210311141720-fe38760bed28
	github.com/k3s-io/helm-controller v0.15.4
	github.com/k3s-io/k3s v1.27.7-rc1.0.20231027220650-b6f23014b2e1 //release-1.27
	github.com/libp2p/go-netroute v0.2.0
	github.com/natefinch/lumberjack v2.0.0+incompatible
	github.com/onsi/ginkgo/v2 v2.11.0
	github.com/onsi/gomega v1.27.10
	github.com/pkg/errors v0.9.1
	github.com/rancher/wharfie v0.6.2
	github.com/rancher/wins v0.1.1
	github.com/rancher/wrangler v1.1.1
	github.com/sirupsen/logrus v1.9.3
	github.com/spf13/cobra v1.6.1
	github.com/spf13/pflag v1.0.5
	github.com/tigera/operator v1.28.1
	github.com/urfave/cli v1.22.14
	golang.org/x/sync v0.3.0
	golang.org/x/sys v0.13.0
	google.golang.org/grpc v1.57.0
	k8s.io/api v0.28.1
	k8s.io/apimachinery v0.28.1
	k8s.io/apiserver v0.27.7
	k8s.io/client-go v11.0.1-0.20190409021438-1a26190bd76a+incompatible
	k8s.io/component-base v0.27.7
	k8s.io/cri-api v0.29.0-alpha.0
	k8s.io/klog/v2 v2.100.1
	k8s.io/kubernetes v1.27.7
	k8s.io/utils v0.0.0-20230406110748-d93618cff8a2
	sigs.k8s.io/yaml v1.3.0
)

require (
	cloud.google.com/go/compute v1.21.0 // indirect
	cloud.google.com/go/compute/metadata v0.2.3 // indirect
	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
	github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 // indirect
	github.com/Azure/azure-sdk-for-go v56.3.0+incompatible // indirect
	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
	github.com/Azure/go-autorest/autorest v0.11.27 // indirect
	github.com/Azure/go-autorest/autorest/adal v0.9.20 // indirect
	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
	github.com/Azure/go-autorest/autorest/mocks v0.4.2 // indirect
	github.com/Azure/go-autorest/autorest/to v0.4.0 // indirect
	github.com/Azure/go-autorest/autorest/validation v0.3.1 // indirect
	github.com/Azure/go-autorest/logger v0.2.1 // indirect
	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
	github.com/GoogleCloudPlatform/k8s-cloud-provider v1.18.1-0.20220218231025-f11817397a1b // indirect
	github.com/JeffAshton/win_pdh v0.0.0-20161109143554-76bb4ee9f0ab // indirect
	github.com/Microsoft/go-winio v0.6.1 // indirect
	github.com/Mirantis/cri-dockerd v0.0.0-00010101000000-000000000000 // indirect
	github.com/NYTimes/gziphandler v1.1.1 // indirect
	github.com/Rican7/retry v0.1.0 // indirect
	github.com/antlr/antlr4/runtime/Go/antlr v1.4.10 // indirect
	github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e // indirect
	github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect
	github.com/avast/retry-go/v4 v4.3.2 // indirect
	github.com/beorn7/perks v1.0.1 // indirect
	github.com/blang/semver v3.5.1+incompatible // indirect
	github.com/blang/semver/v4 v4.0.0 // indirect
	github.com/bronze1man/goStrongswanVici v0.0.0-20201105010758-936f38b697fd // indirect
	github.com/buger/jsonparser v1.1.1 // indirect
	github.com/canonical/go-dqlite v1.5.1 // indirect
	github.com/cenkalti/backoff/v4 v4.2.0 // indirect
	github.com/cespare/xxhash/v2 v2.2.0 // indirect
	github.com/checkpoint-restore/go-criu/v5 v5.3.0 // indirect
	github.com/cilium/ebpf v0.9.1 // indirect
	github.com/cloudnativelabs/kube-router/v2 v2.0.0-00010101000000-000000000000 // indirect
	github.com/container-storage-interface/spec v1.7.0 // indirect
	github.com/containerd/cgroups v1.1.0 // indirect
	github.com/containerd/console v1.0.3 // indirect
	github.com/containerd/containerd v1.7.3 // indirect
	github.com/containerd/fifo v1.1.0 // indirect
	github.com/containerd/fuse-overlayfs-snapshotter v1.0.5 // indirect
	github.com/containerd/log v0.1.0 // indirect
	github.com/containerd/stargz-snapshotter v0.14.4-0.20230913082252-7275d45b185c // indirect
	github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
	github.com/containerd/ttrpc v1.2.2 // indirect
	github.com/containerd/typeurl/v2 v2.1.1 // indirect
	github.com/containernetworking/cni v1.1.2 // indirect
	github.com/containernetworking/plugins v1.2.0 // indirect
	github.com/coreos/go-iptables v0.7.0 // indirect
	github.com/coreos/go-oidc v2.1.0+incompatible // indirect
	github.com/coreos/go-semver v0.3.0 // indirect
	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf // indirect
	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
	github.com/cyphar/filepath-securejoin v0.2.3 // indirect
	github.com/davecgh/go-spew v1.1.1 // indirect
	github.com/docker/cli v24.0.5+incompatible // indirect
	github.com/docker/distribution v2.8.2+incompatible // indirect
	github.com/docker/docker v24.0.5+incompatible // indirect
	github.com/docker/docker-credential-helpers v0.7.0 // indirect
	github.com/docker/go-connections v0.4.0 // indirect
	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
	github.com/docker/go-metrics v0.0.1 // indirect
	github.com/docker/go-units v0.5.0 // indirect
	github.com/dustin/go-humanize v1.0.0 // indirect
	github.com/emicklei/go-restful v2.16.0+incompatible // indirect
	github.com/emicklei/go-restful/v3 v3.10.2 // indirect
	github.com/erikdubbelboer/gspt v0.0.0-20190125194910-e68493906b83 // indirect
	github.com/euank/go-kmsg-parser v2.0.0+incompatible // indirect
	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
	github.com/felixge/httpsnoop v1.0.3 // indirect
	github.com/flannel-io/flannel v0.22.2 // indirect
	github.com/fsnotify/fsnotify v1.6.0 // indirect
	github.com/ghodss/yaml v1.0.1-0.20190212211648-25d852aebe32 // indirect
	github.com/go-logr/logr v1.2.4 // indirect
	github.com/go-logr/stdr v1.2.2 // indirect
	github.com/go-ole/go-ole v1.2.4 // indirect
	github.com/go-openapi/jsonpointer v0.19.6 // indirect
	github.com/go-openapi/jsonreference v0.20.2 // indirect
	github.com/go-openapi/swag v0.22.3 // indirect
	github.com/go-sql-driver/mysql v1.7.1 // indirect
	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
	github.com/go-test/deep v1.0.7 // indirect
	github.com/godbus/dbus/v5 v5.1.0 // indirect
	github.com/gofrs/flock v0.8.1 // indirect
	github.com/gofrs/uuid v4.0.0+incompatible // indirect
	github.com/gogo/protobuf v1.3.2 // indirect
	github.com/golang-jwt/jwt/v4 v4.4.2 // indirect
	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
	github.com/golang/mock v1.6.0 // indirect
	github.com/golang/protobuf v1.5.3 // indirect
	github.com/google/btree v1.1.2 // indirect
	github.com/google/cadvisor v0.47.2 // indirect
	github.com/google/cel-go v0.12.7 // indirect
	github.com/google/gnostic v0.5.7-v3refs // indirect
	github.com/google/go-cmp v0.5.9 // indirect
	github.com/google/gofuzz v1.2.0 // indirect
	github.com/google/gopacket v1.1.19 // indirect
	github.com/google/pprof v0.0.0-20230323073829-e72429f035bd // indirect
	github.com/google/uuid v1.3.0 // indirect
	github.com/googleapis/gax-go/v2 v2.11.0 // indirect
	github.com/gorilla/mux v1.8.0 // indirect
	github.com/gorilla/websocket v1.5.0 // indirect
	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
	github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
	github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 // indirect
	github.com/hanwen/go-fuse/v2 v2.3.0 // indirect
	github.com/hashicorp/errwrap v1.1.0 // indirect
	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
	github.com/hashicorp/go-multierror v1.1.1 // indirect
	github.com/hashicorp/go-retryablehttp v0.7.4 // indirect
	github.com/imdario/mergo v0.3.13 // indirect
	github.com/inconshreveable/mousetrap v1.1.0 // indirect
	github.com/jackc/pgerrcode v0.0.0-20220416144525-469b46aa5efa // indirect
	github.com/jackc/pgpassfile v1.0.0 // indirect
	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
	github.com/jackc/pgx/v5 v5.4.2 // indirect
	github.com/jmespath/go-jmespath v0.4.0 // indirect
	github.com/jonboulle/clockwork v0.3.0 // indirect
	github.com/josharian/intern v1.0.0 // indirect
	github.com/josharian/native v1.1.0 // indirect
	github.com/json-iterator/go v1.1.12 // indirect
	github.com/k3s-io/kine v0.10.3 // indirect
	github.com/karrick/godirwalk v1.17.0 // indirect
	github.com/klauspost/compress v1.16.7 // indirect
	github.com/klauspost/cpuid/v2 v2.1.0 // indirect
	github.com/lib/pq v1.10.2 // indirect
	github.com/libopenstorage/openstorage v1.0.0 // indirect
	github.com/lithammer/dedent v1.1.0 // indirect
	github.com/mailru/easyjson v0.7.7 // indirect
	github.com/mattn/go-sqlite3 v1.14.17 // indirect
	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
	github.com/mdlayher/genetlink v1.3.2 // indirect
	github.com/mdlayher/netlink v1.7.2 // indirect
	github.com/mdlayher/socket v0.4.1 // indirect
	github.com/minio/highwayhash v1.0.2 // indirect
	github.com/minio/md5-simd v1.1.2 // indirect
	github.com/minio/minio-go/v7 v7.0.33 // indirect
	github.com/minio/sha256-simd v1.0.0 // indirect
	github.com/mistifyio/go-zfs v2.1.2-0.20190413222219-f784269be439+incompatible // indirect
	github.com/mitchellh/go-homedir v1.1.0 // indirect
	github.com/mitchellh/mapstructure v1.5.0 // indirect
	github.com/moby/ipvs v1.1.0 // indirect
	github.com/moby/locker v1.0.1 // indirect
	github.com/moby/spdystream v0.2.0 // indirect
	github.com/moby/sys/mountinfo v0.6.2 // indirect
	github.com/moby/sys/sequential v0.5.0 // indirect
	github.com/moby/sys/signal v0.7.0 // indirect
	github.com/moby/term v0.0.0-20221205130635-1aeaba878587 // indirect
	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
	github.com/modern-go/reflect2 v1.0.2 // indirect
	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
	github.com/morikuni/aec v1.0.0 // indirect
	github.com/mrunalp/fileutils v0.5.0 // indirect
	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
	github.com/nats-io/jsm.go v0.0.31-0.20220317133147-fe318f464eee // indirect
	github.com/nats-io/jwt/v2 v2.4.1 // indirect
	github.com/nats-io/nats-server/v2 v2.9.18 // indirect
	github.com/nats-io/nats.go v1.27.1 // indirect
	github.com/nats-io/nkeys v0.4.4 // indirect
	github.com/nats-io/nuid v1.0.1 // indirect
	github.com/opencontainers/go-digest v1.0.0 // indirect
	github.com/opencontainers/image-spec v1.1.0-rc3 // indirect
	github.com/opencontainers/runc v1.1.6 // indirect
	github.com/opencontainers/runtime-spec v1.1.0 // indirect
	github.com/opencontainers/selinux v1.11.0 // indirect
	github.com/otiai10/copy v1.7.0 // indirect
	github.com/pelletier/go-toml v1.9.5 // indirect
	github.com/pierrec/lz4 v2.6.0+incompatible // indirect
	github.com/pquerna/cachecontrol v0.1.0 // indirect
	github.com/prometheus/client_golang v1.16.0 // indirect
	github.com/prometheus/client_model v0.4.0 // indirect
	github.com/prometheus/common v0.42.0 // indirect
	github.com/prometheus/procfs v0.10.1 // indirect
	github.com/rancher/dynamiclistener v0.3.6-rc2 // indirect
	github.com/rancher/lasso v0.0.0-20221227210133-6ea88ca2fbcc // indirect
	github.com/rancher/remotedialer v0.3.0 // indirect
	github.com/robfig/cron/v3 v3.0.1 // indirect
	github.com/rootless-containers/rootlesskit v1.0.1 // indirect
	github.com/rs/xid v1.5.0 // indirect
	github.com/rubiojr/go-vhd v0.0.0-20200706105327-02e210299021 // indirect
	github.com/russross/blackfriday/v2 v2.1.0 // indirect
	github.com/seccomp/libseccomp-golang v0.9.2-0.20220502022130-f33da4d89646 // indirect
	github.com/shengdoushi/base58 v1.0.0 // indirect
	github.com/soheilhy/cmux v0.1.5 // indirect
	github.com/stoewer/go-strcase v1.2.0 // indirect
	github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 // indirect
	github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75 // indirect
	github.com/vbatts/tar-split v0.11.5 // indirect
	github.com/vishvananda/netlink v1.2.1-beta.2 // indirect
	github.com/vishvananda/netns v0.0.4 // indirect
	github.com/vmware/govmomi v0.30.6 // indirect
	github.com/xiang90/probing v0.0.0-20221125231312-a49e3df8f510 // indirect
	github.com/yl2chen/cidranger v1.0.2 // indirect
	go.etcd.io/bbolt v1.3.7 // indirect
	go.etcd.io/etcd/api/v3 v3.5.9 // indirect
	go.etcd.io/etcd/client/pkg/v3 v3.5.9 // indirect
	go.etcd.io/etcd/client/v2 v2.305.9 // indirect
	go.etcd.io/etcd/client/v3 v3.5.9 // indirect
	go.etcd.io/etcd/etcdutl/v3 v3.5.9 // indirect
	go.etcd.io/etcd/pkg/v3 v3.5.9 // indirect
	go.etcd.io/etcd/raft/v3 v3.5.9 // indirect
	go.etcd.io/etcd/server/v3 v3.5.9 // indirect
	go.opencensus.io v0.24.0 // indirect
	go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful v0.35.0 // indirect
	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.40.0 // indirect
	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.35.1 // indirect
	go.opentelemetry.io/otel v1.14.0 // indirect
	go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.14.0 // indirect
	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.14.0 // indirect
	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.14.0 // indirect
	go.opentelemetry.io/otel/metric v0.37.0 // indirect
	go.opentelemetry.io/otel/sdk v1.14.0 // indirect
	go.opentelemetry.io/otel/trace v1.14.0 // indirect
	go.opentelemetry.io/proto/otlp v0.19.0 // indirect
	go.uber.org/atomic v1.10.0 // indirect
	go.uber.org/multierr v1.9.0 // indirect
	go.uber.org/zap v1.24.0 // indirect
	golang.org/x/crypto v0.14.0 // indirect
	golang.org/x/mod v0.11.0 // indirect
	golang.org/x/net v0.17.0 // indirect
	golang.org/x/oauth2 v0.10.0 // indirect
	golang.org/x/term v0.13.0 // indirect
	golang.org/x/text v0.13.0 // indirect
	golang.org/x/time v0.3.0 // indirect
	golang.org/x/tools v0.10.0 // indirect
	golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b // indirect
	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6 // indirect
	google.golang.org/api v0.126.0 // indirect
	google.golang.org/appengine v1.6.7 // indirect
	google.golang.org/genproto v0.0.0-20230711160842-782d3b101e98 // indirect
	google.golang.org/protobuf v1.31.0 // indirect
	gopkg.in/gcfg.v1 v1.2.3 // indirect
	gopkg.in/inf.v0 v0.9.1 // indirect
	gopkg.in/ini.v1 v1.67.0 // indirect
	gopkg.in/natefinch/lumberjack.v2 v2.0.0 // indirect
	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
	gopkg.in/warnings.v0 v0.1.2 // indirect
	gopkg.in/yaml.v2 v2.4.0 // indirect
	gopkg.in/yaml.v3 v3.0.1 // indirect
	inet.af/tcpproxy v0.0.0-20200125044825-b6bb9b5b8252 // indirect
	k8s.io/apiextensions-apiserver v0.25.4 // indirect
	k8s.io/cloud-provider v0.27.7 // indirect
	k8s.io/cluster-bootstrap v0.0.0 // indirect
	k8s.io/component-helpers v0.27.7 // indirect
	k8s.io/controller-manager v0.25.4 // indirect
	k8s.io/csi-translation-lib v0.0.0 // indirect
	k8s.io/dynamic-resource-allocation v0.0.0 // indirect
	k8s.io/kms v0.0.0 // indirect
	k8s.io/kube-aggregator v0.25.4 // indirect
	k8s.io/kube-controller-manager v0.0.0 // indirect
	k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 // indirect
	k8s.io/kube-proxy v0.0.0 // indirect
	k8s.io/kube-scheduler v0.0.0 // indirect
	k8s.io/kubectl v0.25.4 // indirect
	k8s.io/kubelet v0.0.0 // indirect
	k8s.io/legacy-cloud-providers v0.0.0 // indirect
	k8s.io/metrics v0.0.0 // indirect
	k8s.io/mount-utils v0.27.7 // indirect
	k8s.io/pod-security-admission v0.0.0 // indirect
	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.1.2 // indirect
	sigs.k8s.io/controller-runtime v0.10.1 // indirect
	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
)
07070100000059000081A4000000000000000000000001653C446F0003261D000000000000000000000000000000000000001A00000000rke2-1.27.7+rke2r1/go.sumbazil.org/fuse v0.0.0-20160811212531-371fbbdaa898/go.mod h1:Xbm+BRKSBEpa4q4hTSxohYNQpsxXPbPry4JJWOB3LB8=
bazil.org/fuse v0.0.0-20180421153158-65cc252bf669/go.mod h1:Xbm+BRKSBEpa4q4hTSxohYNQpsxXPbPry4JJWOB3LB8=
bitbucket.org/creachadair/shell v0.0.6/go.mod h1:8Qqi/cYk7vPnsOePHroKXDJYmb5x7ENhtiFtfZq8K+M=
bitbucket.org/liamstask/goose v0.0.0-20150115234039-8488cc47d90c/go.mod h1:hSVuE3qU7grINVSwrmzHfpg9k87ALBk+XaualNyUzI4=
cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
cloud.google.com/go v0.39.0/go.mod h1:rVLT6fkc8chs9sfPtFc1SBH6em7n+ZoXaG+87tDISts=
cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
cloud.google.com/go v0.44.3/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
cloud.google.com/go v0.79.0/go.mod h1:3bzgcEeQlzbuEAYu4mrWhKqWjmpprinYgKJLgKHnbb8=
cloud.google.com/go v0.97.0/go.mod h1:GF7l59pYBVlXQIBLx3a761cZ41F9bBH3JUlihCt2Udc=
cloud.google.com/go v0.100.2/go.mod h1:4Xra9TjzAeYHrl5+oeLlzbM2k3mjVhZh4UqTZ//w99A=
cloud.google.com/go v0.102.0/go.mod h1:oWcCzKlqJ5zgHQt9YsaeTY9KzIvjyy0ArmiBUgpQ+nc=
cloud.google.com/go v0.102.1/go.mod h1:XZ77E9qnTEnrgEOvr4xzfdX5TRo7fB4T2F4O6+34hIU=
cloud.google.com/go v0.104.0/go.mod h1:OO6xxXdJyvuJPcEPBLN9BJPD+jep5G1+2U5B5gkRYtA=
cloud.google.com/go v0.105.0/go.mod h1:PrLgOJNe5nfE9UMxKxgXj4mD3voiP+YQ6gdt6KMFOKM=
cloud.google.com/go v0.107.0/go.mod h1:wpc2eNrD7hXUTy8EKS10jkxpZBjASrORK7goS+3YX2I=
cloud.google.com/go v0.110.0/go.mod h1:SJnCLqQ0FCFGSZMUNUf84MV3Aia54kn7pi8st7tMzaY=
cloud.google.com/go v0.110.2/go.mod h1:k04UEeEtb6ZBRTv3dZz4CeJC3jKGxyhl0sAiVVquxiw=
cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
cloud.google.com/go/compute v0.1.0/go.mod h1:GAesmwr110a34z04OlxYkATPBEfVhkymfTBXtfbBFow=
cloud.google.com/go/compute v1.6.0/go.mod h1:T29tfhtVbq1wvAPo0E3+7vhgmkOYeXjhFvz/FMzPu0s=
cloud.google.com/go/compute v1.6.1/go.mod h1:g85FgpzFvNULZ+S8AYq87axRKuf2Kh7deLqV/jJ3thU=
cloud.google.com/go/compute v1.7.0/go.mod h1:435lt8av5oL9P3fv1OEzSbSUe+ybHXGMPQHHZWZxy9U=
cloud.google.com/go/compute v1.10.0/go.mod h1:ER5CLbMxl90o2jtNbGSbtfOpQKR0t15FOtRsugnLrlU=
cloud.google.com/go/compute v1.12.0/go.mod h1:e8yNOBcBONZU1vJKCvCoDw/4JQsA0dpM4x/6PIIOocU=
cloud.google.com/go/compute v1.12.1/go.mod h1:e8yNOBcBONZU1vJKCvCoDw/4JQsA0dpM4x/6PIIOocU=
cloud.google.com/go/compute v1.14.0/go.mod h1:YfLtxrj9sU4Yxv+sXzZkyPjEyPBZfXHUvjxega5vAdo=
cloud.google.com/go/compute v1.18.0/go.mod h1:1X7yHxec2Ga+Ss6jPyjxRxpu2uu7PLgsOVXvgU0yacs=
cloud.google.com/go/compute v1.19.0/go.mod h1:rikpw2y+UMidAe9tISo04EHNOIf42RLYF/q8Bs93scU=
cloud.google.com/go/compute v1.20.1/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM=
cloud.google.com/go/compute v1.21.0 h1:JNBsyXVoOoNJtTQcnEY5uYpZIbeCTYIeDe0Xh1bySMk=
cloud.google.com/go/compute v1.21.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM=
cloud.google.com/go/compute/metadata v0.1.0/go.mod h1:Z1VN+bulIf6bt4P/C37K4DyZYZEXYonfTBHHFPO/4UU=
cloud.google.com/go/compute/metadata v0.2.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
cloud.google.com/go/compute/metadata v0.2.1/go.mod h1:jgHgmJd2RKBGzXqF5LR2EZMGxBkeanZ9wwa75XHJgOM=
cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqClKRT5SZwBmk=
cloud.google.com/go/iam v0.3.0/go.mod h1:XzJPvDayI+9zsASAFO68Hk07u3z+f+JrT2xXNdp4bnY=
cloud.google.com/go/iam v0.6.0/go.mod h1:+1AH33ueBne5MzYccyMHtEKqLE4/kJOibtffMHDMFMc=
cloud.google.com/go/iam v0.7.0/go.mod h1:H5Br8wRaDGNc8XP3keLc4unfUUZeyH3Sfl9XpQEYOeg=
cloud.google.com/go/iam v0.8.0/go.mod h1:lga0/y3iH6CX7sYqypWJ33hf7kkfXJag67naqGESjkE=
cloud.google.com/go/iam v0.13.0/go.mod h1:ljOg+rcNfzZ5d6f1nAUJ8ZIxOaZUVoS14bKCtaLZ/D0=
cloud.google.com/go/longrunning v0.1.1/go.mod h1:UUFxuDWkv22EuY93jjmDMFT5GPQKeFVJBIF6QlTqdsE=
cloud.google.com/go/longrunning v0.3.0/go.mod h1:qth9Y41RRSUE69rDcOn6DdK3HfQfsUI0YSmW3iIlLJc=
cloud.google.com/go/longrunning v0.4.1/go.mod h1:4iWDqhBZ70CvZ6BfETbvam3T8FMvLK+eFj0E6AaRQTo=
cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
cloud.google.com/go/spanner v1.17.0/go.mod h1:+17t2ixFwRG4lWRwE+5kipDR9Ef07Jkmc8z0IbMDKUs=
cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
cloud.google.com/go/storage v1.22.1/go.mod h1:S8N1cAStu7BOeFfE8KAQzmyyLkK8p/vmRq6kuBTW58Y=
cloud.google.com/go/storage v1.23.0/go.mod h1:vOEEDNFnciUMhBeT6hsJIn3ieU5cFRmzeLgDvXzfIXc=
cloud.google.com/go/storage v1.27.0/go.mod h1:x9DOL8TK/ygDUMieqwfhdpQryTeEkhGKMi80i/iqR2s=
cloud.google.com/go/storage v1.28.1/go.mod h1:Qnisd4CqDdo6BGs2AD5LLnEsmSQ80wQ5ogcBBKhU86Y=
cloud.google.com/go/storage v1.29.0/go.mod h1:4puEjyTKnku6gfKoTfNOU/W+a9JyuVNxjpS5GBrB8h4=
code.gitea.io/sdk/gitea v0.11.3/go.mod h1:z3uwDV/b9Ls47NGukYM9XhnHtqPh/J+t40lsUrR6JDY=
contrib.go.opencensus.io/exporter/aws v0.0.0-20181029163544-2befc13012d0/go.mod h1:uu1P0UCM/6RbsMrgPa98ll8ZcHM858i/AD06a9aLRCA=
contrib.go.opencensus.io/exporter/ocagent v0.5.0/go.mod h1:ImxhfLRpxoYiSq891pBrLVhN+qmP8BTVvdH2YLs7Gl0=
contrib.go.opencensus.io/exporter/stackdriver v0.12.1/go.mod h1:iwB6wGarfphGGe/e5CWqyUk/cLzKnWsOKPVW3no6OTw=
contrib.go.opencensus.io/exporter/stackdriver v0.13.5/go.mod h1:aXENhDJ1Y4lIg4EUaVTwzvYETVNZk10Pu26tevFKLUc=
contrib.go.opencensus.io/integrations/ocsql v0.1.4/go.mod h1:8DsSdjz3F+APR+0z0WkU1aRorQCFfRxvqjUUPMbF3fE=
contrib.go.opencensus.io/resource v0.1.1/go.mod h1:F361eGI91LCmW1I/Saf+rX0+OFcigGlFvXwEGEnkRLA=
dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
github.com/AdaLogics/go-fuzz-headers v0.0.0-20221206110420-d395f97c4830/go.mod h1:VzwV+t+dZ9j/H867F1M2ziD+yLHtB46oM35FxxMJ4d0=
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 h1:59MxjQVfjXsBpLy+dbd2/ELV5ofnUkUZBvWSC85sheA=
github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0/go.mod h1:OahwfttHWG6eJ0clwcfBAHoDI6X/LV/15hx/wlMZSrU=
github.com/Azure/azure-amqp-common-go/v2 v2.1.0/go.mod h1:R8rea+gJRuJR6QxTir/XuEd+YuKoUiazDC/N96FiDEU=
github.com/Azure/azure-pipeline-go v0.2.1/go.mod h1:UGSo8XybXnIGZ3epmeBw7Jdz+HiUVpqIlpz/HKHylF4=
github.com/Azure/azure-sdk-for-go v29.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
github.com/Azure/azure-sdk-for-go v30.1.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
github.com/Azure/azure-sdk-for-go v56.3.0+incompatible h1:DmhwMrUIvpeoTDiWRDtNHqelNUd3Og8JCkrLHQK795c=
github.com/Azure/azure-sdk-for-go v56.3.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
github.com/Azure/azure-service-bus-go v0.9.1/go.mod h1:yzBx6/BUGfjfeqbRZny9AQIbIe3AcV9WZbAdpkoXOa0=
github.com/Azure/azure-storage-blob-go v0.8.0/go.mod h1:lPI3aLPpuLTeUwh1sViKXFxwl2B6teiRqI0deQUvsw0=
github.com/Azure/go-ansiterm v0.0.0-20210608223527-2377c96fe795/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=
github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
github.com/Azure/go-autorest v12.0.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs=
github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
github.com/Azure/go-autorest/autorest v0.11.24/go.mod h1:G6kyRlFnTuSbEYkQGawPfsCswgme4iYf6rfSKUDzbCc=
github.com/Azure/go-autorest/autorest v0.11.27 h1:F3R3q42aWytozkV8ihzcgMO4OA4cuqr3bNlsEuF6//A=
github.com/Azure/go-autorest/autorest v0.11.27/go.mod h1:7l8ybrIdUmGqZMTD0sRtAr8NvbHjfofbf8RSP2q7w7U=
github.com/Azure/go-autorest/autorest/adal v0.9.18/go.mod h1:XVVeme+LZwABT8K5Lc3hA4nAe8LDBVle26gTrguhhPQ=
github.com/Azure/go-autorest/autorest/adal v0.9.20 h1:gJ3E98kMpFB1MFqQCvA1yFab8vthOeD4VlFRQULxahg=
github.com/Azure/go-autorest/autorest/adal v0.9.20/go.mod h1:XVVeme+LZwABT8K5Lc3hA4nAe8LDBVle26gTrguhhPQ=
github.com/Azure/go-autorest/autorest/date v0.3.0 h1:7gUk1U5M/CQbp9WoqinNzJar+8KY+LPI6wiWrP/myHw=
github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74=
github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
github.com/Azure/go-autorest/autorest/mocks v0.4.2 h1:PGN4EDXnuQbojHbU0UWoNvmu9AGVwYHG9/fkDYhtAfw=
github.com/Azure/go-autorest/autorest/mocks v0.4.2/go.mod h1:Vy7OitM9Kei0i1Oj+LvyAWMXJHeKH1MVlzFugfVrmyU=
github.com/Azure/go-autorest/autorest/to v0.4.0 h1:oXVqrxakqqV1UZdSazDOPOLvOIz+XA683u8EctwboHk=
github.com/Azure/go-autorest/autorest/to v0.4.0/go.mod h1:fE8iZBn7LQR7zH/9XU2NcPR4o9jEImooCeWJcYV/zLE=
github.com/Azure/go-autorest/autorest/validation v0.3.1 h1:AgyqjAd94fwNAoTjl/WQXg4VvFeRFpO+UhNyRXqF1ac=
github.com/Azure/go-autorest/autorest/validation v0.3.1/go.mod h1:yhLgjC0Wda5DYXl6JAsWyUe4KVNffhoDhG0zVzUMo3E=
github.com/Azure/go-autorest/logger v0.2.1 h1:IG7i4p/mDa2Ce4TRyAO8IHnVhAVF3RFU+ZtXWSmf4Tg=
github.com/Azure/go-autorest/logger v0.2.1/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8=
github.com/Azure/go-autorest/tracing v0.6.0 h1:TYi4+3m5t6K48TGI9AUdb+IzbnSxvnvUMfuitfgcfuo=
github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=
github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
github.com/GeertJohan/go.incremental v1.0.0/go.mod h1:6fAjUhbVuX1KcMD3c8TEgVUqmo4seqhv0i0kdATSkM0=
github.com/GeertJohan/go.rice v1.0.2/go.mod h1:af5vUNlDNkCjOZeSGFgIJxDje9qdjsO6hshx0gTmZt4=
github.com/GoogleCloudPlatform/cloudsql-proxy v0.0.0-20191009163259-e802c2cb94ae/go.mod h1:mjwGPas4yKduTyubHvD1Atl9r1rUq8DfVy+gkVvZ+oo=
github.com/GoogleCloudPlatform/k8s-cloud-provider v1.18.1-0.20220218231025-f11817397a1b h1:Heo1J/ttaQFgGJSVnCZquy3e5eH5j1nqxBuomztB3P0=
github.com/GoogleCloudPlatform/k8s-cloud-provider v1.18.1-0.20220218231025-f11817397a1b/go.mod h1:FNj4KYEAAHfYu68kRYolGoxkaJn+6mdEsaM12VTwuI0=
github.com/JeffAshton/win_pdh v0.0.0-20161109143554-76bb4ee9f0ab h1:UKkYhof1njT1/xq4SEg5z+VpTgjmNeHwPGRQl7takDI=
github.com/JeffAshton/win_pdh v0.0.0-20161109143554-76bb4ee9f0ab/go.mod h1:3VYc5hodBMJ5+l/7J4xAyMeuM2PNuepvHlGs8yilUCA=
github.com/Knetic/govaluate v3.0.1-0.20171022003610-9aa49832a739+incompatible/go.mod h1:r7JcOSlj0wfOMncg0iLm8Leh48TZaKVeNIfJntJ2wa0=
github.com/Masterminds/goutils v1.1.0/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
github.com/Masterminds/semver v1.4.2/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
github.com/Masterminds/semver/v3 v3.0.3/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
github.com/Masterminds/semver/v3 v3.1.0/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
github.com/Masterminds/sprig v2.15.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuNhlNS5hqE0NB0E6fgfo2Br3o=
github.com/Masterminds/sprig v2.22.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuNhlNS5hqE0NB0E6fgfo2Br3o=
github.com/Masterminds/sprig/v3 v3.2.2/go.mod h1:UoaO7Yp8KlPnJIYWTFkMaqPUYKTfGFPhxNuwnnxkKlk=
github.com/Microsoft/go-winio v0.4.11/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA=
github.com/Microsoft/go-winio v0.4.15/go.mod h1:tTuCMEN+UleMWgg9dVx4Hu52b1bJo+59jBh3ajtinzw=
github.com/Microsoft/go-winio v0.4.16/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
github.com/Microsoft/go-winio v0.4.17/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
github.com/Microsoft/go-winio v0.5.1/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
github.com/Microsoft/go-winio v0.6.0/go.mod h1:cTAf44im0RAYeL23bpB+fzCyDH2MJiz2BO69KH/soAE=
github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
github.com/Microsoft/hcsshim v0.11.0 h1:7EFNIY4igHEXUdj1zXgAyU3fLc7QfOKHbkldRVTBdiM=
github.com/Microsoft/hcsshim v0.11.0/go.mod h1:OEthFdQv/AD2RAdzR6Mm1N1KPCztGKDurW1Z8b8VGMM=
github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
github.com/NYTimes/gziphandler v1.1.1 h1:ZUDjpQae29j0ryrS0u/B8HZfJBtBQHjqw2rQ2cqUQ3I=
github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c=
github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
github.com/Rican7/retry v0.1.0 h1:FqK94z34ly8Baa6K+G8Mmza9rYWTKOJk+yckIBB5qVk=
github.com/Rican7/retry v0.1.0/go.mod h1:FgOROf8P5bebcC1DS0PdOQiqGUridaZvikzUmkFW6gg=
github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
github.com/Shopify/sarama v1.19.0/go.mod h1:FVkBWblsNy7DGZRfXLU0O9RCGt5g3g3yEuWXgklEdEo=
github.com/Shopify/toxiproxy v2.1.4+incompatible/go.mod h1:OXgGpZ6Cli1/URJOF1DMxUHB2q5Ap20/P/eIdh4G0pI=
github.com/VividCortex/gohistogram v1.0.0/go.mod h1:Pf5mBqqDxYaXu3hDrrU+w6nw50o/4+TcAqDqk/vUH7g=
github.com/afex/hystrix-go v0.0.0-20180502004556-fa1af6a1f4f5/go.mod h1:SkGFH1ia65gfNATL8TAiHDNxPzPdmEL5uirI2Uyuz6c=
github.com/agnivade/levenshtein v1.0.1/go.mod h1:CURSv5d9Uaml+FovSIICkLbAUZ9S4RqaHDIsdSBg7lM=
github.com/akavel/rsrc v0.8.0/go.mod h1:uLoCtb9J+EyAqh+26kdrTgmzRBFPGOolLWKpdxkKq+c=
github.com/alcortesm/tgz v0.0.0-20161220082320-9c5fe88206d7/go.mod h1:6zEj6s6u/ghQa61ZWa/C2Aw3RkjiTBOix7dkqa1VLIs=
github.com/alecthomas/kingpin v2.2.6+incompatible/go.mod h1:59OFYbFVLKQKq+mqrL6Rw5bR0c3ACQaawgXx0QYndlE=
github.com/alecthomas/kingpin/v2 v2.3.1/go.mod h1:oYL5vtsvEHZGHxU7DMp32Dvx+qL+ptGn6lWaot2vCNE=
github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
github.com/alessio/shellescape v1.4.1/go.mod h1:PZAiSCk0LJaZkiCSkPv8qIobYglO3FPpyFjDCtHLS30=
github.com/alexflint/go-filemutex v1.2.0/go.mod h1:mYyQSWvw9Tx2/H2n9qXPb52tTYfE0pZAWcBq5mK025c=
github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
github.com/antlr/antlr4/runtime/Go/antlr v0.0.0-20220418222510-f25a4f6275ed/go.mod h1:F7bn7fEU90QkQ3tnmaTx3LTKLEDqnwWODIYppRQ5hnY=
github.com/antlr/antlr4/runtime/Go/antlr v1.4.10 h1:yL7+Jz0jTC6yykIK/Wh74gnTJnrGr5AyrNMXuA0gves=
github.com/antlr/antlr4/runtime/Go/antlr v1.4.10/go.mod h1:F7bn7fEU90QkQ3tnmaTx3LTKLEDqnwWODIYppRQ5hnY=
github.com/aokoli/goutils v1.0.1/go.mod h1:SijmP0QR8LtwsmDs8Yii5Z/S4trXFGFC2oO5g9DP+DQ=
github.com/apache/beam v2.28.0+incompatible/go.mod h1:/8NX3Qi8vGstDLLaeaU7+lzVEu/ACaQhYjeefzQ0y1o=
github.com/apache/thrift v0.12.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
github.com/apache/thrift v0.13.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
github.com/apex/log v1.1.4/go.mod h1:AlpoD9aScyQfJDVHmLMEcx4oU6LqzkWp4Mg9GdAcEvQ=
github.com/apex/logs v0.0.4/go.mod h1:XzxuLZ5myVHDy9SAmYpamKKRNApGj54PfYLcFrXqDwo=
github.com/aphistic/golf v0.0.0-20180712155816-02c07f170c5a/go.mod h1:3NqKYiepwy8kCu4PNA+aP7WUV72eXWJeP9/r3/K9aLE=
github.com/aphistic/sweet v0.2.0/go.mod h1:fWDlIh/isSE9n6EPsRmC0det+whmX6dJid3stzu0Xys=
github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e h1:QEF07wC0T1rKkctt1RINW/+RMTVmiwxETico2l3gxJA=
github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
github.com/armon/go-metrics v0.3.0/go.mod h1:zXjbSimjXTd7vOpY8B0/2LpvNvDoXBuplAD+gJD3GYs=
github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
github.com/aryann/difflib v0.0.0-20170710044230-e206f873d14a/go.mod h1:DAHtR1m6lCRdSC2Tm3DSWRPvIPr6xNKyeHdqDQSQT+A=
github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA=
github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
github.com/avast/retry-go/v4 v4.3.2 h1:x4sTEu3jSwr7zNjya8NTdIN+U88u/jtO/q3OupBoDtM=
github.com/avast/retry-go/v4 v4.3.2/go.mod h1:rg6XFaiuFYII0Xu3RDbZQkxCofFwruZKW8oEF1jpWiU=
github.com/aws/aws-lambda-go v1.13.3/go.mod h1:4UKl9IzQMoD+QF79YdCuzCwp8VbmG4VAQwij/eHl5CU=
github.com/aws/aws-sdk-go v1.15.27/go.mod h1:mFuSZ37Z9YOHbQEwBWztmVzqXrEkub65tZoCYDt7FT0=
github.com/aws/aws-sdk-go v1.19.6/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
github.com/aws/aws-sdk-go v1.19.18/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
github.com/aws/aws-sdk-go v1.19.45/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
github.com/aws/aws-sdk-go v1.20.6/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
github.com/aws/aws-sdk-go v1.23.20/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
github.com/aws/aws-sdk-go v1.25.11/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
github.com/aws/aws-sdk-go v1.25.37/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
github.com/aws/aws-sdk-go v1.27.0/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
github.com/aws/aws-sdk-go v1.35.24/go.mod h1:tlPOdRjfxPBpNIwqDj61rmsnA85v9jc0Ps9+muhnW+k=
github.com/aws/aws-sdk-go v1.43.16/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
github.com/aws/aws-sdk-go v1.44.197 h1:pkg/NZsov9v/CawQWy+qWVzJMIZRQypCtYjUBXFomF8=
github.com/aws/aws-sdk-go v1.44.197/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g=
github.com/aybabtme/rgbterm v0.0.0-20170906152045-cc83f3b3ce59/go.mod h1:q/89r3U2H7sSsE2t6Kca0lfwTK8JdoNGS/yzM/4iH5I=
github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
github.com/bitly/go-simplejson v0.5.0/go.mod h1:cXHtHw4XUPsvGaxgjIAn8PhEWG9NfngEKAMDJEczWVA=
github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
github.com/bketelsen/crypt v0.0.4/go.mod h1:aI6NrJ0pMGgvZKL1iVgXLnfIFJtfV+bKCoqOes/6LfM=
github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb/go.mod h1:PkYb9DJNAwrSvRx5DYA+gUcOIgTGVMNkfSCbZM8cWpI=
github.com/blang/semver v3.5.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
github.com/bmizerany/perks v0.0.0-20141205001514-d9a9656a3a4b/go.mod h1:ac9efd0D1fsDb3EJvhqgXRbFx7bs2wqZ10HQPeU8U/Q=
github.com/bronze1man/goStrongswanVici v0.0.0-20201105010758-936f38b697fd h1:qn6a8rGrW+7p4ghypmYHZUKewXURuUDYxKqZxEoFjPc=
github.com/bronze1man/goStrongswanVici v0.0.0-20201105010758-936f38b697fd/go.mod h1:fWUtBEPt2yjrr3WFhOqvajM8JSEU8bEeBcoeSCsKRpc=
github.com/bruth/assert v0.0.0-20130823105606-de420fa3b72e/go.mod h1:MT8TZkfLPRir91B19sXF7pmKBma+n6ecyjbqgXabchs=
github.com/bshuster-repo/logrus-logstash-hook v1.0.0/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd/go.mod h1:2oa8nejYd4cQ/b0hMIopN0lCRxU0bueqREvZLWFrtK8=
github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
github.com/bytecodealliance/wasmtime-go v0.36.0/go.mod h1:q320gUxqyI8yB+ZqRuaJOEnGkAnHh6WtJjMaT2CW4wI=
github.com/caarlos0/ctrlc v1.0.0/go.mod h1:CdXpj4rmq0q/1Eb44M9zi2nKB0QraNKuRGYGrrHhcQw=
github.com/campoy/unique v0.0.0-20180121183637-88950e537e7e/go.mod h1:9IOqJGCPMSc6E5ydlp5NIonxObaeu/Iub/X03EKPVYo=
github.com/canonical/go-dqlite v1.5.1 h1:1YjtIrFsC1A3XlgsX38ARAiKhvkZS63PqsEd8z3T4yU=
github.com/canonical/go-dqlite v1.5.1/go.mod h1:wp00vfMvPYgNCyxcPdHB5XExmDoCGoPUGymloAQT17Y=
github.com/casbin/casbin/v2 v2.1.2/go.mod h1:YcPU1XXisHhLzuxH9coDNf2FbKpjGlbCg3n9yuLkIJQ=
github.com/cavaliercoder/go-cpio v0.0.0-20180626203310-925f9528c45e/go.mod h1:oDpT4efm8tSYHXV5tHSdRvBet/b/QzxZ+XyyPehvm3A=
github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
github.com/cenkalti/backoff/v4 v4.1.1/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
github.com/cenkalti/backoff/v4 v4.1.3/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
github.com/cenkalti/backoff/v4 v4.2.0 h1:HN5dHm3WBOgndBH6E8V0q2jIYIR3s9yglV8k/+MN3u4=
github.com/cenkalti/backoff/v4 v4.2.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
github.com/census-instrumentation/opencensus-proto v0.2.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
github.com/certifi/gocertifi v0.0.0-20180905225744-ee1a9a0726d2/go.mod h1:GJKEexRPVJrBSOjoqN5VNOIKJ5Q3RViH6eu3puDRwx4=
github.com/certifi/gocertifi v0.0.0-20210507211836-431795d63e8d/go.mod h1:sGbDF6GwGcLpkNXPUTkMRoywsNa/ol15pxFe6ERfguA=
github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
github.com/checkpoint-restore/go-criu/v5 v5.3.0 h1:wpFFOoomK3389ue2lAb0Boag6XPht5QYpipxmSNL4d8=
github.com/checkpoint-restore/go-criu/v5 v5.3.0/go.mod h1:E/eQpaFtUKGOOSEBZgmKAcn+zUUwWxqcaKZlF54wK8E=
github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
github.com/cilium/ebpf v0.2.0/go.mod h1:To2CFviqOWL/M0gIMsvSMlqe7em/l1ALkX1PyjrX2Qs=
github.com/cilium/ebpf v0.4.0/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA=
github.com/cilium/ebpf v0.9.1 h1:64sn2K3UKw8NbP/blsixRpF3nXuyhz/VjRlRzvlBRu4=
github.com/cilium/ebpf v0.9.1/go.mod h1:+OhNOIXx/Fnu1IE8bJz2dzOA+VSfyTfdNUVdlQnxUFY=
github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
github.com/clbanning/x2j v0.0.0-20191024224557-825249438eec/go.mod h1:jMjuTZXRI4dUb/I5gc9Hdhagfvm9+RyrPryS/auMzxE=
github.com/cloudflare/backoff v0.0.0-20161212185259-647f3cdfc87a/go.mod h1:rzgs2ZOiguV6/NpiDgADjRLPNyZlApIWxKpkT+X8SdY=
github.com/cloudflare/cfssl v1.6.1/go.mod h1:ENhCj4Z17+bY2XikpxVmTHDg/C2IsG2Q0ZBeXpAqhCk=
github.com/cloudflare/redoctober v0.0.0-20201013214028-99c99a8e7544/go.mod h1:6Se34jNoqrd8bTxrmJB2Bg2aoZ2CdSXonils9NsiNgo=
github.com/cncf/udpa/go v0.0.0-20210322005330-6414d713912e/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
github.com/cncf/xds/go v0.0.0-20230428030218-4003588d1b74/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4 h1:/inchEIKaYC1Akx+H+gqO04wryn5h75LSazbRlnya1k=
github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
github.com/cockroachdb/datadriven v1.0.2 h1:H9MtNqVoVhvd9nCBwOyDjUEdZCREqbIdCJD93PBm/jA=
github.com/cockroachdb/datadriven v1.0.2/go.mod h1:a9RdTaap04u637JoCzcUoIcDmvwSUtcUFtT/C3kJlTU=
github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd/go.mod h1:sE/e/2PUdi/liOCUjSTXgM1o87ZssimdTWN964YiIeI=
github.com/container-orchestrated-devices/container-device-interface v0.5.4/go.mod h1:DjE95rfPiiSmG7uVXtg0z6MnPm/Lx4wxKCIts0ZE0vg=
github.com/container-storage-interface/spec v1.7.0 h1:gW8eyFQUZWWrMWa8p1seJ28gwDoN5CVJ4uAbQ+Hdycw=
github.com/container-storage-interface/spec v1.7.0/go.mod h1:JYuzLqr9VVNoDJl44xp/8fmCOvWPDKzuGTwCoklhuqk=
github.com/containerd/aufs v1.0.0/go.mod h1:kL5kd6KM5TzQjR79jljyi4olc1Vrx6XBlcyj3gNv2PU=
github.com/containerd/btrfs/v2 v2.0.0/go.mod h1:swkD/7j9HApWpzl8OHfrHNxppPd9l44DFZdF94BUj9k=
github.com/containerd/cgroups v0.0.0-20210114181951-8a68de567b68/go.mod h1:ZJeTFisyysqgcCdecO57Dj79RfL0LNeGiFUqLYQRYLE=
github.com/containerd/cgroups v1.0.1/go.mod h1:0SJrPIenamHDcZhEcJMNBB85rHcUsw4f25ZfBiPYRkU=
github.com/containerd/cgroups v1.0.3/go.mod h1:/ofk34relqNjSGyqPrmEULrO4Sc8LJhvJmWbUCUKqj8=
github.com/containerd/cgroups v1.0.4/go.mod h1:nLNQtsF7Sl2HxNebu77i1R0oDlhiTG+kO4JTrUzo6IA=
github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
github.com/containerd/cgroups v1.1.0/go.mod h1:6ppBcbh/NOOUU+dMKrykgaBnK9lCIBxHqJDGwsa1mIw=
github.com/containerd/cgroups/v3 v3.0.2/go.mod h1:JUgITrzdFqp42uI2ryGA+ge0ap/nxzYgkGmIcetmErE=
github.com/containerd/console v1.0.1/go.mod h1:XUsP6YE/mKtz6bxc+I8UiKKTP04qjQL4qcS3XoQ5xkw=
github.com/containerd/console v1.0.3 h1:lIr7SlA5PxZyMV30bDW0MGbiOPXwc63yRuCP0ARubLw=
github.com/containerd/console v1.0.3/go.mod h1:7LqA/THxQ86k76b8c/EMSiaJ3h1eZkMkXar0TQ1gf3U=
github.com/containerd/continuity v0.0.0-20190827140505-75bee3e2ccb6/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
github.com/containerd/continuity v0.0.0-20210208174643-50096c924a4e/go.mod h1:EXlVlkqNba9rJe3j7w3Xa924itAMLgZH4UD/Q4PExuQ=
github.com/containerd/continuity v0.3.0/go.mod h1:wJEAIwKOm/pBZuBd0JmeTvnLquTB1Ag8espWhkykbPM=
github.com/containerd/continuity v0.4.2 h1:v3y/4Yz5jwnvqPKJJ+7Wf93fyWoCB3F5EclWG023MDM=
github.com/containerd/continuity v0.4.2/go.mod h1:F6PTNCKepoxEaXLQp3wDAjygEnImnZ/7o4JzpodfroQ=
github.com/containerd/fifo v1.0.0/go.mod h1:ocF/ME1SX5b1AOlWi9r677YJmCPSwwWnQ9O123vzpE4=
github.com/containerd/fifo v1.1.0 h1:4I2mbh5stb1u6ycIABlBw9zgtlK8viPI9QkQNRQEEmY=
github.com/containerd/fifo v1.1.0/go.mod h1:bmC4NWMbXlt2EZ0Hc7Fx7QzTFxgPID13eH0Qu+MAb2o=
github.com/containerd/fuse-overlayfs-snapshotter v1.0.5 h1:xO2DWI2l/J79lV/OoZ9uI8MmGDksmDHVn4syPJW02Xo=
github.com/containerd/fuse-overlayfs-snapshotter v1.0.5/go.mod h1:XJWpvDeM5/Ry0atraRI5g05QPE/imqMxOmWQtJlKBG4=
github.com/containerd/go-cni v1.1.6/go.mod h1:BWtoWl5ghVymxu6MBjg79W9NZrCRyHIdUtk4cauMe34=
github.com/containerd/go-cni v1.1.9/go.mod h1:XYrZJ1d5W6E2VOvjffL3IZq0Dz6bsVlERHbekNK90PM=
github.com/containerd/go-runc v1.0.0/go.mod h1:cNU0ZbCgCQVZK4lgG3P+9tn9/PaJNmoDXPpoJhDR+Ok=
github.com/containerd/imgcrypt v1.1.7/go.mod h1:FD8gqIcX5aTotCtOmjeCsi3A1dHmTZpnMISGKSczt4k=
github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
github.com/containerd/nri v0.4.0/go.mod h1:Zw9q2lP16sdg0zYybemZ9yTDy8g7fPCIB3KXOGlggXI=
github.com/containerd/stargz-snapshotter/estargz v0.13.0/go.mod h1:m+9VaGJGlhCnrcEUod8mYumTmRgblwd3rC5UCEh2Yp0=
github.com/containerd/stargz-snapshotter/estargz v0.14.3 h1:OqlDCK3ZVUO6C3B/5FSkDwbkEETK84kQgEeFwDC+62k=
github.com/containerd/stargz-snapshotter/estargz v0.14.3/go.mod h1:KY//uOCIkSuNAHhJogcZtrNHdKrA99/FCCRjE3HD36o=
github.com/containerd/ttrpc v1.1.0/go.mod h1:XX4ZTnoOId4HklF4edwc4DcqskFZuvXB1Evzy5KFQpQ=
github.com/containerd/ttrpc v1.1.1-0.20220420014843-944ef4a40df3/go.mod h1:YYyNVhZrTMiaf51Vj6WhAJqJw+vl/nzABhj8pWrzle4=
github.com/containerd/ttrpc v1.2.2 h1:9vqZr0pxwOF5koz6N0N3kJ0zDHokrcPxIR/ZR2YFtOs=
github.com/containerd/ttrpc v1.2.2/go.mod h1:sIT6l32Ph/H9cvnJsfXM5drIVzTr5A2flTf1G5tYZak=
github.com/containerd/typeurl v1.0.2 h1:Chlt8zIieDbzQFzXzAeBEF92KhExuE4p9p92/QmY7aY=
github.com/containerd/typeurl v1.0.2/go.mod h1:9trJWW2sRlGub4wZJRTW83VtbOLS6hwcDZXTn6oPz9s=
github.com/containerd/typeurl/v2 v2.1.1 h1:3Q4Pt7i8nYwy2KmQWIw2+1hTvwTE/6w9FqcttATPO/4=
github.com/containerd/typeurl/v2 v2.1.1/go.mod h1:IDp2JFvbwZ31H8dQbEIY7sDl2L3o3HZj1hsSQlywkQ0=
github.com/containerd/zfs v1.1.0/go.mod h1:oZF9wBnrnQjpWLaPKEinrx3TQ9a+W/RJO7Zb41d8YLE=
github.com/containernetworking/cni v1.0.1/go.mod h1:AKuhXbN5EzmD4yTNtfSsX3tPcmtrBI6QcRV0NiNt15Y=
github.com/containernetworking/cni v1.1.1/go.mod h1:sDpYKmGVENF3s6uvMvGgldDWeG8dMxakj/u+i9ht9vw=
github.com/containernetworking/cni v1.1.2 h1:wtRGZVv7olUHMOqouPpn3cXJWpJgM6+EUl31EQbXALQ=
github.com/containernetworking/cni v1.1.2/go.mod h1:sDpYKmGVENF3s6uvMvGgldDWeG8dMxakj/u+i9ht9vw=
github.com/containernetworking/plugins v1.2.0 h1:SWgg3dQG1yzUo4d9iD8cwSVh1VqI+bP7mkPDoSfP9VU=
github.com/containernetworking/plugins v1.2.0/go.mod h1:/VjX4uHecW5vVimFa1wkG4s+r/s9qIfPdqlLF4TW8c4=
github.com/containers/ocicrypt v1.1.6/go.mod h1:WgjxPWdTJMqYMjf3M6cuIFFA1/MpyyhIM99YInA+Rvc=
github.com/coreos/bbolt v1.3.1-coreos.6/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
github.com/coreos/etcd v3.3.15+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
github.com/coreos/go-iptables v0.6.0/go.mod h1:Qe8Bv2Xik5FyTXwgIbLAnv2sWSBmvWdFETJConOQ//Q=
github.com/coreos/go-iptables v0.7.0 h1:XWM3V+MPRr5/q51NuWSgU0fqMad64Zyxs8ZUoMsamr8=
github.com/coreos/go-iptables v0.7.0/go.mod h1:Qe8Bv2Xik5FyTXwgIbLAnv2sWSBmvWdFETJConOQ//Q=
github.com/coreos/go-oidc v2.1.0+incompatible h1:sdJrfw8akMnCuUlaZU3tE/uYXFgfqom8DBE9so9EBsM=
github.com/coreos/go-oidc v2.1.0+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc=
github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
github.com/coreos/go-semver v0.3.0 h1:wkHLiw0WNATZnSG7epLsujiMCgPAc9xhjJ4tgnAxmfM=
github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
github.com/coreos/go-systemd v0.0.0-20180511133405-39ca1b05acc7/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf h1:iW4rZ826su+pqaw19uhpSCzhj44qo35pNgKFGqzDKkU=
github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
github.com/coreos/go-systemd/v22 v22.1.0/go.mod h1:xO0FLkIi5MaZafQlIrOotqXZ90ih+1atmu1JpKERPPk=
github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
github.com/coreos/go-systemd/v22 v22.4.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
github.com/coreos/pkg v0.0.0-20160727233714-3ac0863d7acf/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
github.com/cyphar/filepath-securejoin v0.2.3 h1:YX6ebbZCZP7VkM3scTTokDgBL2TY741X51MTk3ycuNI=
github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
github.com/d2g/dhcp4 v0.0.0-20170904100407-a1d1b6c41b1c/go.mod h1:Ct2BUK8SB0YC1SMSibvLzxjeJLnrYEVLULFNiHY9YfQ=
github.com/d2g/dhcp4client v1.0.0/go.mod h1:j0hNfjhrt2SxUOw55nL0ATM/z4Yt3t2Kd1mW34z5W5s=
github.com/d2g/dhcp4server v0.0.0-20181031114812-7d4a0a7f59a5/go.mod h1:Eo87+Kg/IX2hfWJfwxMzLyuSZyxSoAug2nGa1G2QAi8=
github.com/daaku/go.zipexe v1.0.0/go.mod h1:z8IiR6TsVLEYKwXAoE/I+8ys/sDkgTzSL0CLnGVd57E=
github.com/daaku/go.zipexe v1.0.1/go.mod h1:5xWogtqlYnfBXkSB1o9xysukNP9GTvaNkqzUZbt3Bw8=
github.com/danieljoos/wincred v1.1.0/go.mod h1:XYlo+eRTsVA9aHGp7NGjFkPla4m+DCL7hqDjlFjiygg=
github.com/danieljoos/wincred v1.1.2/go.mod h1:GijpziifJoIBfYh+S7BbkdUTU4LfM+QnGqR5Vl2tAx0=
github.com/davecgh/go-spew v0.0.0-20161028175848-04cdfd42973b/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/decred/dcrd/crypto/blake256 v1.0.0/go.mod h1:sQl2p6Y26YV+ZOcSTP6thNdn47hh8kt6rqSlvmrXFAc=
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.0.0-20210816181553-5444fa50b93d/go.mod h1:tmAIfUFEirG/Y8jhZ9M+h36obRZAk/1fcSpXwAVlfqE=
github.com/denverdino/aliyungo v0.0.0-20190125010748-a747050bb1ba/go.mod h1:dV8lFg6daOBZbT6/BDGIz6Y3WFGn8juu6G+CQ6LHtl0=
github.com/devigned/tab v0.1.1/go.mod h1:XG9mPq0dFghrYvoBF3xdRrJzSTX1b7IQrvaL9mzjeJY=
github.com/dgraph-io/badger/v3 v3.2103.2/go.mod h1:RHo4/GmYcKKh5Lxu63wLEMHJ70Pac2JqZRYGhlyAo2M=
github.com/dgraph-io/ristretto v0.1.0/go.mod h1:fux0lOrBhrVCJd3lcTHsIJhq1T2rokOu6v9Vcb3Q9ug=
github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
github.com/dgryski/go-gk v0.0.0-20140819190930-201884a44051/go.mod h1:qm+vckxRlDt0aOla0RYJJVeqHZlWfOm2UIxHaqPB46E=
github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=
github.com/distribution/distribution/v3 v3.0.0-20220526142353-ffbd94cbe269/go.mod h1:28YO/VJk9/64+sTGNuYaBjWxrXTPrj0C0XmgTIOjxX4=
github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
github.com/docker/cli v20.10.17+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
github.com/docker/cli v20.10.21+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
github.com/docker/cli v23.0.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
github.com/docker/cli v23.0.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
github.com/docker/cli v24.0.5+incompatible h1:WeBimjvS0eKdH4Ygx+ihVq1Q++xg36M/rMi4aXAvodc=
github.com/docker/cli v24.0.5+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
github.com/docker/distribution v2.8.2+incompatible h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8=
github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
github.com/docker/docker v24.0.0-rc.2.0.20230801142700-69c9adb7d386+incompatible h1:9ccUsnrXhHTUwIRW9DaLflXDhihJMoVnR3VpCLVe4IE=
github.com/docker/docker v24.0.0-rc.2.0.20230801142700-69c9adb7d386+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
github.com/docker/docker-credential-helpers v0.6.4/go.mod h1:ofX3UI0Gz1TteYBjtgs07O36Pyasyp66D2uKT7H8W1c=
github.com/docker/docker-credential-helpers v0.7.0 h1:xtCHsjxogADNZcdv1pKUHXryefjlVRqWqIhk/uXJp0A=
github.com/docker/docker-credential-helpers v0.7.0/go.mod h1:rETQfLdHNT3foU5kuNkFR1R1V12OJRRO5lzt2D1b5X0=
github.com/docker/go-connections v0.3.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
github.com/docker/libnetwork v0.8.0-dev.2.0.20190624125649-f0e46a78ea34/go.mod h1:93m0aTqz6z+g32wla4l4WxTrdtvBRmVzYRkYvasA5Z8=
github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=
github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
github.com/eapache/go-resiliency v1.1.0/go.mod h1:kFI+JgMyC7bLPUVY133qvEBtVayf5mFgVsvEsIPBvNs=
github.com/eapache/go-xerial-snappy v0.0.0-20180814174437-776d5712da21/go.mod h1:+020luEh2TKB4/GOp8oxxtq0Daoen/Cii55CzbTV6DU=
github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I=
github.com/edsrzf/mmap-go v1.0.0/go.mod h1:YO35OhQPt3KJa3ryjFM5Bs14WD66h8eGKpfaBNrHW5M=
github.com/elastic/cloud-on-k8s v0.0.0-20210914143041-4f367c381636/go.mod h1:2FfmBNj4pURV6Ke2W55vCSLQoBP1Lo8qiWkAG9IB4t4=
github.com/elastic/go-licenser v0.3.1/go.mod h1:D8eNQk70FOCVBl3smCGQt/lv7meBeQno2eI1S5apiHQ=
github.com/elastic/go-sysinfo v1.1.1/go.mod h1:i1ZYdU10oLNfRzq4vq62BEwD2fH8KaWh6eh0ikPT9F0=
github.com/elastic/go-ucfg v0.8.3/go.mod h1:iaiY0NBIYeasNgycLyTvhJftQlQEUO2hpF+FX0JKxzo=
github.com/elastic/go-windows v1.0.0/go.mod h1:TsU0Nrp7/y3+VwE82FoZF8gC/XFg/Elz6CcloAxnPgU=
github.com/elazarl/goproxy v0.0.0-20190711103511-473e67f1d7d2/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
github.com/emicklei/go-restful v2.11.2-0.20200112161605-a7c079c43d51+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
github.com/emicklei/go-restful v2.16.0+incompatible h1:rgqiKNjTnFQA6kkhFe16D8epTksy9HQ1MyrbDXSdYhM=
github.com/emicklei/go-restful v2.16.0+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
github.com/emicklei/go-restful/v3 v3.8.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
github.com/emicklei/go-restful/v3 v3.9.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
github.com/emicklei/go-restful/v3 v3.10.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
github.com/emicklei/go-restful/v3 v3.10.2 h1:hIovbnmBTLjHXkqEBUz3HGpXZdM7ZrE9fJIZIqlJLqE=
github.com/emicklei/go-restful/v3 v3.10.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
github.com/emirpasic/gods v1.12.0/go.mod h1:YfzfFFoVP/catgzJb4IKIqXjX78Ha8FMSDh3ymbK86o=
github.com/envoyproxy/go-control-plane v0.11.1/go.mod h1:uhMcXKCQMEJHiAb0w+YGefQLaTEw+YhGluxZkrTmD0g=
github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
github.com/envoyproxy/protoc-gen-validate v0.3.0-java/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
github.com/envoyproxy/protoc-gen-validate v0.6.1/go.mod h1:txg5va2Qkip90uYoSKH+nkAAmXrb2j3iq4FLwdrCbXQ=
github.com/envoyproxy/protoc-gen-validate v1.0.1/go.mod h1:0vj8bNkYbSTNS2PIyH87KZaeN4x9zpL9Qt8fQC7d+vs=
github.com/envoyproxy/protoc-gen-validate v1.0.2 h1:QkIBuU5k+x7/QXPvPPnWXWlCdaBFApVqftFV6k087DA=
github.com/envoyproxy/protoc-gen-validate v1.0.2/go.mod h1:GpiZQP3dDbg4JouG/NNS7QWXpgx6x8QiMKdmN72jogE=
github.com/erikdubbelboer/gspt v0.0.0-20190125194910-e68493906b83 h1:ngHdSomn2MyugZYKHiycad2xERwIrmMlET7A0lC0UU4=
github.com/erikdubbelboer/gspt v0.0.0-20190125194910-e68493906b83/go.mod h1:v6o7m/E9bfvm79dE1iFiF+3T7zLBnrjYjkWMa1J+Hv0=
github.com/etcd-io/gofail v0.0.0-20190801230047-ad7f989257ca/go.mod h1:49H/RkXP8pKaZy4h0d+NW16rSLhyVBt4o6VLJbmOqDE=
github.com/euank/go-kmsg-parser v2.0.0+incompatible h1:cHD53+PLQuuQyLZeriD1V/esuG4MuU0Pjs5y6iknohY=
github.com/euank/go-kmsg-parser v2.0.0+incompatible/go.mod h1:MhmAMZ8V4CYH4ybgdRwPr2TU5ThnS43puaKEMpja1uw=
github.com/evanphx/json-patch v0.5.2/go.mod h1:ZWS5hhDbVDyob71nXKNL0+PWn6ToqBHMikGIFbs31qQ=
github.com/evanphx/json-patch v4.2.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
github.com/evanphx/json-patch v4.11.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH5pOlLGNtQ5lPWQu84=
github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
github.com/evanphx/json-patch/v5 v5.2.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4=
github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
github.com/fatih/color v1.12.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs=
github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBdXk=
github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
github.com/flannel-io/flannel v0.22.2 h1:gSmg4J8Lw0eU/D6Yg8uCEtTObDVnvWjtrOGKHOFrNvI=
github.com/flannel-io/flannel v0.22.2/go.mod h1:oG54GKg3mebZ0WhkxnytLrGfzWPHmZo+kpts1MbwxqM=
github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
github.com/form3tech-oss/jwt-go v3.2.3+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
github.com/fortytw2/leaktest v1.2.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
github.com/foxcpp/go-mockdns v0.0.0-20210729171921-fb145fc6f897/go.mod h1:lgRN6+KxQBawyIghpnl5CezHFGS9VLzvtVlwxvzXTQ4=
github.com/franela/goblin v0.0.0-20200105215937-c9ffbefa60db/go.mod h1:7dvUGVsVBjqR7JHJk0brhHOZYGmfBYOrK0ZhYMEtBr4=
github.com/franela/goreq v0.0.0-20171204163338-bcd34c9993f8/go.mod h1:ZhphrRTfi2rbfLwlschooIH4+wKKDR4Pdxhh+TRoA20=
github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
github.com/frankban/quicktest v1.14.0 h1:+cqqvzZV87b4adx/5ayVOaYZ2CrvM4ejQvUdBzPPUss=
github.com/frankban/quicktest v1.14.0/go.mod h1:NeW+ay9A/U67EYXNFA1nPE8e/tnQv/09mUdL/ijj8og=
github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmVXmkdnm1bU=
github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
github.com/fsouza/go-dockerclient v0.0.0-20171004212419-da3951ba2e9e/go.mod h1:KpcjM623fQYE9MZiTGzKhjfxXAV9wbyX2C1cyRHfhl0=
github.com/fullstorydev/grpcurl v1.8.0/go.mod h1:Mn2jWbdMrQGJQ8UD62uNyMumT2acsZUCkZIqFxsQf1o=
github.com/fullstorydev/grpcurl v1.8.1/go.mod h1:3BWhvHZwNO7iLXaQlojdg5NA6SxUDePli4ecpK1N7gw=
github.com/fvbommel/util v0.0.3/go.mod h1:izA2AZeYyvrB6Qo1T9wenVzrx1Clqo3ReUreqM8o5t8=
github.com/fxamacker/cbor/v2 v2.4.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo=
github.com/getsentry/raven-go v0.0.0-20190513200303-c977f96e1095/go.mod h1:KungGk8q33+aIAZUIVWZDr2OfAEBsO49PX4NzFV5kcQ=
github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
github.com/ghodss/yaml v1.0.1-0.20190212211648-25d852aebe32 h1:Mn26/9ZMNWSw9C9ERFA1PUxfmGpolnw2v0bKOREu5ew=
github.com/ghodss/yaml v1.0.1-0.20190212211648-25d852aebe32/go.mod h1:GIjDIg/heH5DOkXY3YJ/wNhfHsQHoXGjl8G8amsYQ1I=
github.com/gliderlabs/ssh v0.2.2/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
github.com/go-asn1-ber/asn1-ber v1.3.1/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
github.com/go-bindata/go-bindata v3.1.2+incompatible/go.mod h1:xK8Dsgwmeed+BBsSy2XTopBn/8uK2HWuGSnA11C3Joo=
github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
github.com/go-ini/ini v1.25.4/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
github.com/go-ini/ini v1.66.6/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
github.com/go-kit/kit v0.10.0/go.mod h1:xUsJbQ/Fp4kEt7AFgCuvyX4a71u8h9jB8tj/ORgOZ7o=
github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
github.com/go-kit/log v0.2.0/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
github.com/go-kit/log v0.2.1/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
github.com/go-ldap/ldap v3.0.3+incompatible/go.mod h1:qfd9rJvER9Q0/D/Sqn1DfHRoBp40uXYvFoEVrNEPqRc=
github.com/go-ldap/ldap/v3 v3.1.3/go.mod h1:3rbOH3jRS2u6jg2rJnKAMLE/xQyCKIveG2Sa/Cohzb8=
github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
github.com/go-logr/logr v1.2.0 h1:QK40JKJyMdUDz+h+xvCsru/bJhvG0UxvePV0ufL/AcE=
github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
github.com/go-logr/zapr v0.4.0/go.mod h1:tabnROwaDl0UNxkVeFRbY8bwB37GwRv0P8lg6aAiEnk=
github.com/go-logr/zapr v1.2.3 h1:a9vnzlIBPQBBkeaR9IuMUfmVOrQlkoC4YfPoFkX3T7A=
github.com/go-logr/zapr v1.2.3/go.mod h1:eIauM6P8qSvTw5o2ez6UEAfGjQKrxQTl5EoK+Qa2oG4=
github.com/go-ole/go-ole v1.2.4 h1:nNBDSCOigTSiarFpYE9J/KtEA1IOW4CNeqT9TQDqCxI=
github.com/go-ole/go-ole v1.2.4/go.mod h1:XCwSNxSkXRo4vlyPy93sltvi/qJq0jqQhjqQNIwKuxM=
github.com/go-openapi/jsonpointer v0.19.2/go.mod h1:3akKfEdA7DF1sugOqz1dVQHBcuDBPKZGEoHC/NkiQRg=
github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
github.com/go-openapi/jsonreference v0.19.2/go.mod h1:jMjeRr2HHw6nAVajTXJ4eiUwohSTlpa0o73RUL1owJc=
github.com/go-openapi/jsonreference v0.19.4-0.20191224164422-1f9748e5f45e/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8=
github.com/go-openapi/jsonreference v0.20.1/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
github.com/go-openapi/spec v0.19.3/go.mod h1:FpwSN1ksY1eteniUU7X0N/BgJ7a4WvBFVA8Lj9mJglo=
github.com/go-openapi/spec v0.19.5/go.mod h1:Hm2Jr4jv8G1ciIAo+frC/Ft+rR2kQDh8JHKHb3gWUSk=
github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
github.com/go-openapi/swag v0.19.7/go.mod h1:ao+8BpOPyKdpQz3AOJfbeEVpLmWAvlT1IfTe5McPyhY=
github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g=
github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
github.com/go-redis/redis v6.15.9+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8wamY7mA7PouImQ2Jvg6kA=
github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI=
github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
github.com/go-test/deep v1.0.2-0.20181118220953-042da051cf31/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
github.com/go-test/deep v1.0.7 h1:/VSMRlnY/JSyqxQUzQLKVMAskpY/NZKFA5j2P+0pP2M=
github.com/go-test/deep v1.0.7/go.mod h1:QV8Hv/iy04NyLBxAdO9njL0iVPN1S4d/A3NVv1V36o8=
github.com/gobuffalo/flect v0.2.3/go.mod h1:vmkQwuZYhN5Pc4ljYQZzP+1sq+NEkK+lh20jmEmX3jc=
github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
github.com/goccy/go-json v0.9.7/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
github.com/godbus/dbus/v5 v5.0.3/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
github.com/godbus/dbus/v5 v5.0.6/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
github.com/gofrs/flock v0.8.1 h1:+gYjHKf32LDeiEEFhQaotPbLuUXjY5ZqxKgXy7n59aw=
github.com/gofrs/flock v0.8.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
github.com/gofrs/uuid v4.0.0+incompatible h1:1SD/1F5pU8p29ybwgQSwpQk+mwdRrXCYuPhW6m+TnJw=
github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
github.com/gogo/googleapis v1.4.0/go.mod h1:5YRNX2z1oM5gXdAkurHa942MDgEJyk02w4OecKY87+c=
github.com/gogo/googleapis v1.4.1/go.mod h1:2lpHqI5OcWCtVElxXnPt+s8oJvMpySlOyM6xDCrzib4=
github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
github.com/gogo/protobuf v1.2.0/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
github.com/gogo/protobuf v1.3.0/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
github.com/golang-jwt/jwt/v4 v4.4.2 h1:rcc4lwaZgFMCZ5jxF9ABolDcIHdBytAFgqFPbSJQAYs=
github.com/golang-jwt/jwt/v4 v4.4.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
github.com/golang/glog v0.0.0-20210429001901-424d2337a529/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
github.com/golang/glog v1.1.0 h1:/d3pCKDPWNnvIWe0vVUpNP32qc8U3PDVxySP/y360qE=
github.com/golang/glog v1.1.0/go.mod h1:pfYeQZ3JWZoXTV5sFc986z3HTpwQs9At6P4ImfuP3NQ=
github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
github.com/gomodule/redigo v1.8.2/go.mod h1:P9dn9mFrCBvWhGE1wpxx6fgq7BAeLBk+UUUzlpkBYO0=
github.com/gonum/blas v0.0.0-20181208220705-f22b278b28ac/go.mod h1:P32wAyui1PQ58Oce/KYkOqQv8cVw1zAapXOl+dRFGbc=
github.com/gonum/floats v0.0.0-20181209220543-c233463c7e82/go.mod h1:PxC8OnwL11+aosOB5+iEPoV3picfs8tUpkVd0pDo+Kg=
github.com/gonum/graph v0.0.0-20170401004347-50b27dea7ebb/go.mod h1:ye018NnX1zrbOLqwBvs2HqyyTouQgnL8C+qzYk1snPY=
github.com/gonum/internal v0.0.0-20181124074243-f884aa714029/go.mod h1:Pu4dmpkhSyOzRwuXkOgAvijx4o+4YMUJJo9OvPYMkks=
github.com/gonum/lapack v0.0.0-20181123203213-e4cdc5a0bff9/go.mod h1:XA3DeT6rxh2EAE789SSiSJNqxPaC0aE9J8NTOI0Jo/A=
github.com/gonum/matrix v0.0.0-20181209220409-c518dec07be9/go.mod h1:0EXg4mc1CNP0HCqCz+K4ts155PXIlUywf0wqN+GfPZw=
github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
github.com/google/btree v1.0.1/go.mod h1:xXMiIv4Fb/0kKde4SpL7qlzvu5cMJDRkFDxJfI9uaxA=
github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
github.com/google/cadvisor v0.47.2 h1:lOS3Yprk88AIUi260eKYmTC4pKWAFkXV6Xev5jfCIP8=
github.com/google/cadvisor v0.47.2/go.mod h1:iJdTjcjyKHjLCf7OSTzwP5GxdfrkPusw2x5bwGvuLUw=
github.com/google/cel-go v0.12.7 h1:jM6p55R0MKBg79hZjn1zs2OlrywZ1Vk00rxVvad1/O0=
github.com/google/cel-go v0.12.7/go.mod h1:Jk7ljRzLBhkmiAwBoUxB1sZSCVBAzkqPF25olK/iRDw=
github.com/google/certificate-transparency-go v1.0.21/go.mod h1:QeJfpSbVSfYc7RgB3gJFj9cbuQMMchQxrWXz8Ruopmg=
github.com/google/certificate-transparency-go v1.1.2-0.20210422104406-9f33727a7a18/go.mod h1:6CKh9dscIRoqc2kC6YUFICHZMT9NrClyPrRVFrdw1QQ=
github.com/google/certificate-transparency-go v1.1.2-0.20210511102531-373a877eec92/go.mod h1:kXWPsHVPSKVuxPPG69BRtumCbAW537FydV/GH89oBhM=
github.com/google/flatbuffers v1.12.1/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
github.com/google/gnostic v0.5.7-v3refs h1:FhTMOKj2VhjpouxvWJAV1TL304uMlb9zcDqkl6cEI54=
github.com/google/gnostic v0.5.7-v3refs/go.mod h1:73MKFl6jIHelAJNaBGFzt3SPtZULs9dYrGFt8OiIsHQ=
github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/google/go-containerregistry v0.14.0 h1:z58vMqHxuwvAsVwvKEkmVBz2TlgBgH5k6koEXBtlYkw=
github.com/google/go-containerregistry v0.14.0/go.mod h1:aiJ2fp/SXvkWgmYHioXnbMdlgB8eXiiYOY55gfN91Wk=
github.com/google/go-github/v28 v28.1.1/go.mod h1:bsqJWQX05omyWVmc00nEUql9mhQyv38lDZ8kPZcQVoM=
github.com/google/go-licenses v0.0.0-20210329231322-ce1d9163b77d/go.mod h1:+TYOmkVoJOpwnS0wfdsJCV9CoD5nJYsHoFk/0CrTK4M=
github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
github.com/google/go-replayers/grpcreplay v0.1.0/go.mod h1:8Ig2Idjpr6gifRd6pNVggX6TC1Zw6Jx74AKp7QNH2QE=
github.com/google/go-replayers/httpreplay v0.1.0/go.mod h1:YKZViNhiGgqdBlUbI2MwGpq4pXxNmhJLPHQ7cv2b5no=
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
github.com/google/licenseclassifier v0.0.0-20210325184830-bb04aff29e72/go.mod h1:qsqn2hxC+vURpyBRygGUuinTO42MFRLcsmQ/P8v94+M=
github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
github.com/google/martian v2.1.1-0.20190517191504-25dcb96d9e51+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
github.com/google/martian/v3 v3.2.1/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
github.com/google/martian/v3 v3.3.2/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
github.com/google/pprof v0.0.0-20230323073829-e72429f035bd h1:r8yyd+DJDmsUhGrRBxH5Pj7KeFK5l+Y3FsgT8keqKtk=
github.com/google/pprof v0.0.0-20230323073829-e72429f035bd/go.mod h1:79YE0hCXdHag9sBkw2o+N/YnZtTkXi0UT9Nnixa5eYk=
github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
github.com/google/rpmpack v0.0.0-20191226140753-aa36bfddb3a0/go.mod h1:RaTPr0KUf2K7fnZYLNDrr8rxAamWs3iNywJLtQ2AzBg=
github.com/google/s2a-go v0.1.0/go.mod h1:OJpEgntRZo8ugHpF9hkoLJbS5dSI20XZeXJ9JVywLlM=
github.com/google/s2a-go v0.1.4/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
github.com/google/subcommands v1.0.1/go.mod h1:ZjhPrFU+Olkh9WazFPsl27BQ4UPiG37m3yTrtFlrHVk=
github.com/google/trillian v1.3.14-0.20210409160123-c5ea3abd4a41/go.mod h1:1dPv0CUjNQVFEDuAUFhZql16pw/VlPgaX8qj+g5pVzQ=
github.com/google/trillian v1.3.14-0.20210428093031-b4ddea2e86b1/go.mod h1:FdIJX+NoDk/dIN2ZxTyz5nAJWgf+NSSSriPAMThChTY=
github.com/google/uuid v0.0.0-20161128191214-064e2069ce9c/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/google/wire v0.3.0/go.mod h1:i1DMg/Lu8Sz5yYl25iOdmc5CT5qusaa+zmRWs16741s=
github.com/googleapis/enterprise-certificate-proxy v0.1.0/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
github.com/googleapis/enterprise-certificate-proxy v0.2.0/go.mod h1:8C0jb7/mgJe/9KK8Lm7X9ctZC2t60YyIpYEI16jx0Qg=
github.com/googleapis/enterprise-certificate-proxy v0.2.1/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
github.com/googleapis/enterprise-certificate-proxy v0.2.3/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
github.com/googleapis/gax-go v2.0.2+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
github.com/googleapis/gax-go/v2 v2.1.1 h1:dp3bWCh+PPO1zjRRiCSczJav13sBvG4UhNyVTa1KqdU=
github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
github.com/googleapis/gnostic v0.2.0/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
github.com/googleapis/gnostic v0.5.5/go.mod h1:7+EbHbldMins07ALC74bsA81Ovc97DwqyJO1AENw9kA=
github.com/googleapis/go-type-adapters v1.0.0/go.mod h1:zHW75FOG2aur7gAO2B+MLby+cLsWGBF62rFAi7WjWO4=
github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
github.com/gordonklaus/ineffassign v0.0.0-20200309095847-7953dde2c7bf/go.mod h1:cuNKsD1zp2v6XfE/orVX2QE1LC+i254ceGcVeDT3pTU=
github.com/goreleaser/goreleaser v0.134.0/go.mod h1:ZT6Y2rSYa6NxQzIsdfWWNWAlYGXGbreo66NmE+3X3WQ=
github.com/goreleaser/nfpm v1.2.1/go.mod h1:TtWrABZozuLOttX2uDlYyECfQX7x5XYkVxhjYcR6G9w=
github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
github.com/gorilla/handlers v1.5.1/go.mod h1:t8XrUpc4KVXb7HGyJ4/cEnwQiaxrX/hz1Zv/4g96P1Q=
github.com/gorilla/mux v0.0.0-20191024121256-f395758b854c/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
github.com/gorilla/websocket v0.0.0-20170926233335-4201258b820c/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
github.com/grpc-ecosystem/go-grpc-middleware v1.0.1-0.20190118093823-f849b5445de4/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
github.com/grpc-ecosystem/go-grpc-middleware v1.2.2/go.mod h1:EaizFBKfUKtMIF5iaDEhniwNedqGo9FuLFzppDr3uwI=
github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 h1:+9834+KizmvFV7pXQGSXQTsaWhq2GjuNUt0aUU0YBYw=
github.com/grpc-ecosystem/go-grpc-middleware v1.3.0/go.mod h1:z0ButlSOZa5vEBq9m2m2hlwIgKw+rp3sdCBRoJY+30Y=
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92BcuyuQ/YW4NSIpoGtfXNho=
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
github.com/grpc-ecosystem/grpc-gateway v1.8.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
github.com/grpc-ecosystem/grpc-gateway v1.9.2/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
github.com/grpc-ecosystem/grpc-gateway v1.14.6/go.mod h1:zdiPV4Yse/1gnckTHtghG4GkDEdKCRJduHpTxT3/jcw=
github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks=
github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 h1:lLT7ZLSzGLI08vc9cpd+tYmNWjdKDqyr/2L+f6U12Fk=
github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3/go.mod h1:o//XUCC/F+yRGJoPO/VU0GSB0f8Nhgmxx0VIRUvaC0w=
github.com/hanwen/go-fuse/v2 v2.1.1-0.20220112183258-f57e95bda82d/go.mod h1:B1nGE/6RBFyBRC1RRnf23UpwCdyJ31eukw34oAKukAc=
github.com/hanwen/go-fuse/v2 v2.3.0 h1:t5ivNIH2PK+zw4OBul/iJjsoG9K6kXo4nMDoBpciC8A=
github.com/hanwen/go-fuse/v2 v2.3.0/go.mod h1:xKwi1cF7nXAOBCXujD5ie0ZKsxc8GGSA1rlMJc+8IJs=
github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
github.com/hashicorp/consul/api v1.3.0/go.mod h1:MmDNSzIMUjNpY/mQ398R4bk2FnqQLoPndWW5VkKPlCE=
github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
github.com/hashicorp/consul/sdk v0.3.0/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd/go.mod h1:9bjs9uLqI8l75knNv3lV1kA55veR+WUPSiKIWcQHudI=
github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
github.com/hashicorp/go-hclog v0.12.0 h1:d4QkX8FRTYaKaCZBoXYY8zJX2BXjWxurN/GA2tkrmZM=
github.com/hashicorp/go-hclog v0.12.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
github.com/hashicorp/go-kms-wrapping/entropy v0.1.0/go.mod h1:d1g9WGtAunDNpek8jUIEJnBlbgKS1N2Q61QkHiZyR1g=
github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
github.com/hashicorp/go-plugin v1.0.1/go.mod h1:++UyYGoz3o5w9ZzAdZxtQKrWWP+iqPBn3cQptSMzBuY=
github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
github.com/hashicorp/go-retryablehttp v0.6.4/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
github.com/hashicorp/go-retryablehttp v0.7.1/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
github.com/hashicorp/go-retryablehttp v0.7.4 h1:ZQgVdpTdAL7WpMIwLzCfbalOcSUdkDZnpUv3/+BxzFA=
github.com/hashicorp/go-retryablehttp v0.7.4/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8=
github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
github.com/hashicorp/go-version v1.1.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
github.com/hashicorp/go-version v1.2.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
github.com/hashicorp/go-version v1.2.1/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
github.com/hashicorp/vault/api v1.1.0/go.mod h1:R3Umvhlxi2TN7Ex2hzOowyeNb+SfbVWI973N+ctaFMk=
github.com/hashicorp/vault/sdk v0.1.14-0.20200519221838-e0cfd64bc267/go.mod h1:WX57W2PwkrOPQ6rVQk+dy5/htHIaB4aBM70EwKThu10=
github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
github.com/huandu/xstrings v1.0.0/go.mod h1:4qWG/gcEcfX4z/mBDHJ++3ReCw9ibxbsNJbcucJdbSo=
github.com/huandu/xstrings v1.2.0/go.mod h1:DvyZB1rfVYsBIigL8HwpZgxHwXozlTgGqn63UyNX5k4=
github.com/huandu/xstrings v1.3.1/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
github.com/hudl/fargo v1.3.0/go.mod h1:y3CKSmjA+wD2gak7sUSXTAoopbhU08POFhmITJgmKTg=
github.com/iamacarpet/go-win64api v0.0.0-20210311141720-fe38760bed28 h1:QhDPvIcXXFltItF7kQ2Go4frViywCx9xDl2okzLNt+A=
github.com/iamacarpet/go-win64api v0.0.0-20210311141720-fe38760bed28/go.mod h1:oGJx9dz0Ny7HC7U55RZ0Smd6N9p3hXP/+hOFtuYrAxM=
github.com/iancoleman/strcase v0.0.0-20180726023541-3605ed457bf7/go.mod h1:SK73tn/9oHe+/Y0h39VT4UCxmurVJkR5NA7kMEAOgSE=
github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
github.com/imdario/mergo v0.3.4/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
github.com/imdario/mergo v0.3.6/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
github.com/imdario/mergo v0.3.7/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
github.com/imdario/mergo v0.3.8/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
github.com/imdario/mergo v0.3.9/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg=
github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d/go.mod h1:qj24IKcXYK6Iy9ceXlo3Tc+vtHo9lIhSX5JddghvEPo=
github.com/influxdata/tdigest v0.0.1/go.mod h1:Z0kXnxzbTC2qrx4NaIzYkE1k66+6oEDQTvL95hQFh5Y=
github.com/intel/goresctrl v0.3.0/go.mod h1:fdz3mD85cmP9sHD8JUlrNWAxvwM86CrbmVXltEKd7zk=
github.com/jackc/pgerrcode v0.0.0-20220416144525-469b46aa5efa h1:s+4MhCQ6YrzisK6hFJUX53drDT4UsSW3DEhKn0ifuHw=
github.com/jackc/pgerrcode v0.0.0-20220416144525-469b46aa5efa/go.mod h1:a/s9Lp5W7n/DD0VrVoyJ00FbP2ytTPDVOivvn2bMlds=
github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
github.com/jackc/pgx/v5 v5.4.2 h1:u1gmGDwbdRUZiwisBm/Ky2M14uQyUP65bG8+20nnyrg=
github.com/jackc/pgx/v5 v5.4.2/go.mod h1:q6iHT8uDNXWiFNOlRqJzBTaSH3+2xCXkokxHZC5qWFY=
github.com/jarcoal/httpmock v1.0.5/go.mod h1:ATjnClrvW/3tijVmpL/va5Z3aAyGvqU3gCT8nX0Txik=
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
github.com/jhump/protoreflect v1.6.1/go.mod h1:RZQ/lnuN+zqeRVpQigTwO6o0AJUkxbnSnpuG7toUTG4=
github.com/jhump/protoreflect v1.8.2/go.mod h1:7GcYQDdMU/O/BBrl/cX6PNHpXh6cenjd8pneu5yW7Tg=
github.com/jinzhu/copier v0.3.2/go.mod h1:24xnZezI2Yqac9J61UC6/dG/k76ttpq0DdJI3QmUvro=
github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
github.com/jmhodges/clock v0.0.0-20160418191101-880ee4c33548/go.mod h1:hGT6jSUVzF6no3QaDSMLGLEHtHSBSefs+MgcDWnmhmo=
github.com/jmoiron/sqlx v1.3.3/go.mod h1:2BljVx/86SuTyjE+aPYlHCTNvZrnJXghYGpNiXLBMCQ=
github.com/joeshaw/multierror v0.0.0-20140124173710-69b34d4ec901/go.mod h1:Z86h9688Y0wesXCyonoVr47MasHilkuLMqGhRZ4Hpak=
github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
github.com/jonboulle/clockwork v0.3.0 h1:9BSCMi8C+0qdApAp4auwX0RkLGUjs956h0EkuQymUhg=
github.com/jonboulle/clockwork v0.3.0/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
github.com/jpillora/backoff v0.0.0-20180909062703-3050d21c67d7/go.mod h1:2iMrUgbbvHEiQClaW2NsSzMyGHqN+rDFqY705q49KG0=
github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
github.com/json-iterator/go v1.1.8/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
github.com/juju/ratelimit v1.0.1/go.mod h1:qapgC/Gy+xNh9UxzV13HGGl/6UXNN+ct+vwSgWNm/qk=
github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
github.com/k3s-io/containerd v1.7.7-k3s1.27 h1:obFQjBCahWKETAmAVFdq4Ph8VduSK0Eho9bWjpd6hjs=
github.com/k3s-io/containerd v1.7.7-k3s1.27/go.mod h1:CrxVnLZTD61NLkOVNd7Cedb7E5huJzcmTVpunlITQJY=
github.com/k3s-io/cri-dockerd v0.3.4-k3s1 h1:eCeVCeXzf10fyanv1gniSwidBjdO83/akv+M72uEnZc=
github.com/k3s-io/cri-dockerd v0.3.4-k3s1/go.mod h1:0KDOU8lLjp+ETJFFCcVBRQbJ8puRoDxaHBDj8C87Fk4=
github.com/k3s-io/etcd/api/v3 v3.5.9-k3s1 h1:y4ont0HdnS7gtWNTXM8gahpKjAHtctgON/sjVRthlZY=
github.com/k3s-io/etcd/api/v3 v3.5.9-k3s1/go.mod h1:uyAal843mC8uUVSLWz6eHa/d971iDGnCRpmKd2Z+X8k=
github.com/k3s-io/etcd/client/pkg/v3 v3.5.9-k3s1 h1:LJFtNHaBJg2BqFE3lRxWZkUsKTYLbh0s0NCXPMjW3cg=
github.com/k3s-io/etcd/client/pkg/v3 v3.5.9-k3s1/go.mod h1:y+CzeSmkMpWN2Jyu1npecjB9BBnABxGM4pN8cGuJeL4=
github.com/k3s-io/etcd/client/v2 v2.305.9-k3s1 h1:/IyNFC677PfYafrm4sWPShbmw1bkpvEio6YaxxFA9cU=
github.com/k3s-io/etcd/client/v2 v2.305.9-k3s1/go.mod h1:0NBdNx9wbxtEQLwAQtrDHwx58m02vXpDcgSYI2seohQ=
github.com/k3s-io/etcd/client/v3 v3.5.9-k3s1 h1:Knr/8l7Sx92zUyevYO0gIO5P6EEc6ztvRO5EzSnMy+A=
github.com/k3s-io/etcd/client/v3 v3.5.9-k3s1/go.mod h1:i/Eo5LrZ5IKqpbtpPDuaUnDOUv471oDg8cjQaUr2MbA=
github.com/k3s-io/etcd/etcdutl/v3 v3.5.9-k3s1 h1:IkCP2oKkQwyu+ad4FuToJu9SOuEVQZwCpjXj6SJqwvs=
github.com/k3s-io/etcd/etcdutl/v3 v3.5.9-k3s1/go.mod h1:rQ6z0HAAxVgYwBTWJbs3ei8gMYiNQzF51lQ2kI+6LZU=
github.com/k3s-io/etcd/pkg/v3 v3.5.9-k3s1 h1:au8ekw/8/wNokQ5dHB7MEdStKMCNBNm4tDsPWEMqW4Y=
github.com/k3s-io/etcd/pkg/v3 v3.5.9-k3s1/go.mod h1:BZl0SAShQFk0IpLWR78T/+pyt8AruMHhTNNX73hkNVY=
github.com/k3s-io/etcd/raft/v3 v3.5.9-k3s1 h1:nlix2+EM1UDofoHgp/X2VHzMvJW7oYbZbEinblZusNc=
github.com/k3s-io/etcd/raft/v3 v3.5.9-k3s1/go.mod h1:WnFkqzFdZua4LVlVXQEGhmooLeyS7mqzS4Pf4BCVqXg=
github.com/k3s-io/etcd/server/v3 v3.5.9-k3s1 h1:B3039IkTPnwQEt4tIMjC6yd6b1Q3Z9ZZe8rfaBPfbXo=
github.com/k3s-io/etcd/server/v3 v3.5.9-k3s1/go.mod h1:GgI1fQClQCFIzuVjlvdbMxNbnISt90gdfYyqiAIt65g=
github.com/k3s-io/helm-controller v0.15.4 h1:l4DWmUWpphbtwmuXGtpr5Rql/2NaCLSv4ZD8HlND9uY=
github.com/k3s-io/helm-controller v0.15.4/go.mod h1:BgCPBQblj/Ect4Q7/Umf86WvyDjdG/34D+n8wfXtoeM=
github.com/k3s-io/k3s v1.27.7-rc1.0.20231027220650-b6f23014b2e1 h1:g7zpWXDOu2KlmwZo6QHT4y8Yh7UMupar4xsa7QUfhek=
github.com/k3s-io/k3s v1.27.7-rc1.0.20231027220650-b6f23014b2e1/go.mod h1:iTSKmWlJ7GJ3MzhlgeDs/6jelpoqCFJ3dgAGJQPsqpY=
github.com/k3s-io/kine v0.10.3 h1:OamjhtcQnK7zpzbiUDvXXKaAwdkXIuzr+nuyFWSC1ZA=
github.com/k3s-io/kine v0.10.3/go.mod h1:hiOK3Gj89Py+AB11YK0fxEwkdWxBvNfaMt8PRWXqh6M=
github.com/k3s-io/klog v1.0.0-k3s2/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
github.com/k3s-io/klog/v2 v2.90.1-k3s1 h1:QOJ/1xi4ERgpPGmSI3n1f989XjII+OvPdgdiMOKqV9s=
github.com/k3s-io/klog/v2 v2.90.1-k3s1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
github.com/k3s-io/kube-router/v2 v2.0.1-0.20230508174102-b42e5faded1c h1:7IaKAByGXNvZAmhYlaHH2LiqOGWtPNVg8vKV1Xvlrek=
github.com/k3s-io/kube-router/v2 v2.0.1-0.20230508174102-b42e5faded1c/go.mod h1:zhLSRTL1M+0BqeDTRzT42ZtlFJH/d9xaGvXGQR4c2Gc=
github.com/k3s-io/kubernetes v1.27.7-k3s1 h1:M56h9U+ci4odZlIgS6TWcdMblIcCadF0TtSe+pRgS8A=
github.com/k3s-io/kubernetes v1.27.7-k3s1/go.mod h1:9RuASG1ooCxhMDOxMG5nJ0Vw/wap9iylq4Y/Uzn/R/0=
github.com/k3s-io/kubernetes/staging/src/k8s.io/api v1.27.7-k3s1 h1:nGIiW/of4EdPRuQJ9xV6uLph60v2yCiFWi26nbYRLz8=
github.com/k3s-io/kubernetes/staging/src/k8s.io/api v1.27.7-k3s1/go.mod h1:FUBryYZAZ5c+HrWv669EGQI35bOf3bwmYe+0bvEsnbs=
github.com/k3s-io/kubernetes/staging/src/k8s.io/apiextensions-apiserver v1.27.7-k3s1 h1:cV+bFh3Moe7xXBwZUL/sdBKUB5VqKk2LjYv6PFUmWhQ=
github.com/k3s-io/kubernetes/staging/src/k8s.io/apiextensions-apiserver v1.27.7-k3s1/go.mod h1:gGRZ6Yj0Xz7nGVfZZgiJluDDizlvhPQzCRsR8Dwsf+s=
github.com/k3s-io/kubernetes/staging/src/k8s.io/apimachinery v1.27.7-k3s1 h1:lsTyN9dPnaHr8L97lx3HCWeizh45I8ZMDVZGq+nyYp4=
github.com/k3s-io/kubernetes/staging/src/k8s.io/apimachinery v1.27.7-k3s1/go.mod h1:FBRM3yUVRkA486KyB++ccRoNIUPCCi2F3clgDIXnBAU=
github.com/k3s-io/kubernetes/staging/src/k8s.io/apiserver v1.27.7-k3s1 h1:PqGn45uxcpoEE9Zxqpr4nJTFRCzqoGG0XLdn3PQPwBA=
github.com/k3s-io/kubernetes/staging/src/k8s.io/apiserver v1.27.7-k3s1/go.mod h1:s/BJV3mFaxu0qG+1nqnYNibw1xGZRSyO3adLE3FEKgg=
github.com/k3s-io/kubernetes/staging/src/k8s.io/client-go v1.27.7-k3s1 h1:7aLGysNdGCtmZrzkz1r6SbRAuA4bJR0uB0P68tRFESY=
github.com/k3s-io/kubernetes/staging/src/k8s.io/client-go v1.27.7-k3s1/go.mod h1:kaYyCkmMtGcJWjy2boCbgIVq1btSQC3arr69AlXfofA=
github.com/k3s-io/kubernetes/staging/src/k8s.io/cloud-provider v1.27.7-k3s1 h1:ySLbfHHPJ4Q1h9d6j+OzCVUxnJHD1v04dwKMWK9D8+g=
github.com/k3s-io/kubernetes/staging/src/k8s.io/cloud-provider v1.27.7-k3s1/go.mod h1:f/G5ZOFxSGF4LIxnx3GDrseIguKps0mnYp1BODQquQ4=
github.com/k3s-io/kubernetes/staging/src/k8s.io/cluster-bootstrap v1.27.7-k3s1 h1:ktiOtK+Ol1FmYcP6FEwuL/1LCGctIhnX6ZNlb8ypK8w=
github.com/k3s-io/kubernetes/staging/src/k8s.io/cluster-bootstrap v1.27.7-k3s1/go.mod h1:J1fM6i6cxeGJzrpJjXVFDYun0wuhXtwdqwywUh8T91A=
github.com/k3s-io/kubernetes/staging/src/k8s.io/code-generator v1.27.7-k3s1/go.mod h1:4V3ZZp4E+2307xDghUxTOwnKR4VSuDDSG2yFrgN+EDc=
github.com/k3s-io/kubernetes/staging/src/k8s.io/component-base v1.27.7-k3s1 h1:X4hiHUqq/1WoJNEp2+u9yjrSCD+DnZKTdLfO3zqcVXs=
github.com/k3s-io/kubernetes/staging/src/k8s.io/component-base v1.27.7-k3s1/go.mod h1:ABwqdKYIpKy0XjQZ44etMus8IXyeeVU6LGraeqRtg4Q=
github.com/k3s-io/kubernetes/staging/src/k8s.io/component-helpers v1.27.7-k3s1 h1:dANE48g24TCu3uLVERRWdxrpvGvNNkGVzMHwZ66IwKc=
github.com/k3s-io/kubernetes/staging/src/k8s.io/component-helpers v1.27.7-k3s1/go.mod h1:6lQjq0FKt83lcvGUeFUxW2+KMkrZPu7By3kT9kgT1Y0=
github.com/k3s-io/kubernetes/staging/src/k8s.io/controller-manager v1.27.7-k3s1 h1:gbtLYfFsYhqbtB7U1nyf4cql1L4Mj3YLvWrdJLQk3IU=
github.com/k3s-io/kubernetes/staging/src/k8s.io/controller-manager v1.27.7-k3s1/go.mod h1:MxykPYLqerBq87BNUcH5EEDf5g0QXsE5TVK4FB+wE4Y=
github.com/k3s-io/kubernetes/staging/src/k8s.io/cri-api v1.27.7-k3s1 h1:n5IOqRIPc+cG8BZ2cCKmVL+iMLd2akZYasZSPgjrQww=
github.com/k3s-io/kubernetes/staging/src/k8s.io/cri-api v1.27.7-k3s1/go.mod h1:mK1xYTFHroDCZrgTQYdKihUH/PQjbRAbdv3oPl+gD04=
github.com/k3s-io/kubernetes/staging/src/k8s.io/csi-translation-lib v1.27.7-k3s1 h1:Oeo2hDbiR+TnM18NY4SIRgVFZD5qB6GKmRUoXiusL/Y=
github.com/k3s-io/kubernetes/staging/src/k8s.io/csi-translation-lib v1.27.7-k3s1/go.mod h1:lL/I//YQbDHjCIN6QrogvwNovBGX5ntEmEaeTsdTzTY=
github.com/k3s-io/kubernetes/staging/src/k8s.io/dynamic-resource-allocation v1.27.7-k3s1 h1:xrMUgnqDNa27gQG2QOMfDwA6ZXQFVRKH6K5wd/fiVCY=
github.com/k3s-io/kubernetes/staging/src/k8s.io/dynamic-resource-allocation v1.27.7-k3s1/go.mod h1:SjSDN/HP8wtCu0+AzwDS692Xg1HTKFav8t6/R8nP8nE=
github.com/k3s-io/kubernetes/staging/src/k8s.io/kms v1.27.7-k3s1 h1:e8HsGGpftlyFa0gqOBLFMg1MmSZvM2qAjmvQsicknmU=
github.com/k3s-io/kubernetes/staging/src/k8s.io/kms v1.27.7-k3s1/go.mod h1:+aUINlI9Aa+P5RbkrHZK2NKZziBcYaCcXJ2umwodikQ=
github.com/k3s-io/kubernetes/staging/src/k8s.io/kube-aggregator v1.27.7-k3s1 h1:167UO5eurrkyRRlKYbiEZ8cI7vBygZ1gH4U0nZIDR78=
github.com/k3s-io/kubernetes/staging/src/k8s.io/kube-aggregator v1.27.7-k3s1/go.mod h1:GK5OqaCb/MbQE5gIRH/fugLIpVTCWoroTr++S33g48g=
github.com/k3s-io/kubernetes/staging/src/k8s.io/kube-controller-manager v1.27.7-k3s1 h1:F/mINO2CZtQdNePiQQVuj4jxVBh1sYkQIj3/aomnbYA=
github.com/k3s-io/kubernetes/staging/src/k8s.io/kube-controller-manager v1.27.7-k3s1/go.mod h1:mDzw7GljVZp1KU9X3oy1NYg4HIbRRAZJ+kaZ5dJecrQ=
github.com/k3s-io/kubernetes/staging/src/k8s.io/kube-proxy v1.27.7-k3s1 h1:I/cSqPbvBOgxwzLX+oJcHjJHPkAdJfi2aM/LwFlz170=
github.com/k3s-io/kubernetes/staging/src/k8s.io/kube-proxy v1.27.7-k3s1/go.mod h1:g6SlshcHSPGnbU24WVBY0rXLag0EX056UKTwWCwtGlk=
github.com/k3s-io/kubernetes/staging/src/k8s.io/kube-scheduler v1.27.7-k3s1 h1:uqXp2hl25Zm7EVau/mg5Hlp740g/31zS9r0k7aBmAE8=
github.com/k3s-io/kubernetes/staging/src/k8s.io/kube-scheduler v1.27.7-k3s1/go.mod h1:LS5pSQ9dLqYs3/euKfzhrW/u6q32FVgqRnmkklVcW0Y=
github.com/k3s-io/kubernetes/staging/src/k8s.io/kubectl v1.27.7-k3s1 h1:4QMZCRTk17N4iDP2CxA26IyA5ne4SVMi5cvXUj8sOOk=
github.com/k3s-io/kubernetes/staging/src/k8s.io/kubectl v1.27.7-k3s1/go.mod h1:9DdsX3ccm4FrG1FWGV0p5BPbNCtzIipwyV1E7mmCtAw=
github.com/k3s-io/kubernetes/staging/src/k8s.io/kubelet v1.27.7-k3s1 h1:uxuTE6uKHVWq4t3Qh22bjxE2rv5gAona42DDYTfFer4=
github.com/k3s-io/kubernetes/staging/src/k8s.io/kubelet v1.27.7-k3s1/go.mod h1:DY04KLDmGXCn7mCuFiTIs1U6k7l9o28eKV5lMpwT6Cw=
github.com/k3s-io/kubernetes/staging/src/k8s.io/legacy-cloud-providers v1.27.7-k3s1 h1:UrdIM2H5WKkZUftwYPkMmXoh6Ro1ifsvthoIGgsE7VM=
github.com/k3s-io/kubernetes/staging/src/k8s.io/legacy-cloud-providers v1.27.7-k3s1/go.mod h1:YE1ZYaYglkgyLj0f3VM9wH9+sqPLVSVqHITMCq878AA=
github.com/k3s-io/kubernetes/staging/src/k8s.io/metrics v1.27.7-k3s1 h1:hRXM2jB4NQIYTOj6T+rTX0WXDKrVsB0QTTxiV1Kr928=
github.com/k3s-io/kubernetes/staging/src/k8s.io/metrics v1.27.7-k3s1/go.mod h1:pADaEfZtP/9KduIDDkTUhN3I57X/OBPIAr8UN62N81w=
github.com/k3s-io/kubernetes/staging/src/k8s.io/mount-utils v1.27.7-k3s1 h1:yZsxn87IyXRnBIul45i0SUbiPhZvzmh3oQ6gvh353FM=
github.com/k3s-io/kubernetes/staging/src/k8s.io/mount-utils v1.27.7-k3s1/go.mod h1:d/tQm0lEZqnozuCAcvfJyVjP+wbgiSwYRha0EWfNLtE=
github.com/k3s-io/kubernetes/staging/src/k8s.io/pod-security-admission v1.27.7-k3s1 h1:MQ0ttxSFkz9zdf81WIS9VInVpAbavusBvxczx/1ljmA=
github.com/k3s-io/kubernetes/staging/src/k8s.io/pod-security-admission v1.27.7-k3s1/go.mod h1:qkFPHgTdmTIpD4DuARjzDBI+GQjsBjTztCCcknIniuE=
github.com/k3s-io/stargz-snapshotter v0.13.0-k3s1 h1:Kxs7Y1kayAX3hr3X+rkSBCaDwaWR/OfbWy+oESiBnN0=
github.com/k3s-io/stargz-snapshotter v0.13.0-k3s1/go.mod h1:k+OjA93AK1owz6DgNIpxuiepp/SGrSZ0HX6lWjA3CVI=
github.com/karrick/godirwalk v1.17.0 h1:b4kY7nqDdioR/6qnbHQyDvmA17u5G1cZ6J+CZXwSWoI=
github.com/karrick/godirwalk v1.17.0/go.mod h1:j4mkqPuvaLI8mp1DroR3P6ad7cyYd4c1qeJ3RV7ULlk=
github.com/kevinburke/ssh_config v0.0.0-20190725054713-01f96b0aa0cd/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
github.com/kisielk/sqlstruct v0.0.0-20201105191214-5f3e10d3ab46/go.mod h1:yyMNCyc/Ib3bDTKd379tNMpB/7/H5TjM2Y9QJ5THLbE=
github.com/kisom/goutils v1.4.3/go.mod h1:Lp5qrquG7yhYnWzZCI/68Pa/GpFynw//od6EkGnWpac=
github.com/klauspost/compress v1.11.13/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
github.com/klauspost/compress v1.12.3/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
github.com/klauspost/compress v1.14.4/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
github.com/klauspost/compress v1.15.12/go.mod h1:QPwzmACJjUTFsnSHH934V6woptycfrDDJnH7hvFVbGM=
github.com/klauspost/compress v1.16.0/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
github.com/klauspost/compress v1.16.7 h1:2mk3MPGNzKyxErAw8YaohYh69+pa4sIQSC0fPGCFR9I=
github.com/klauspost/compress v1.16.7/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
github.com/klauspost/cpuid/v2 v2.0.4/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
github.com/klauspost/cpuid/v2 v2.1.0 h1:eyi1Ad2aNJMW95zcSbmGg7Cg6cq3ADwLpMAP96d8rF0=
github.com/klauspost/cpuid/v2 v2.1.0/go.mod h1:RVVoqg1df56z8g3pUjL/3lE5UfnlrJX8tyFgg4nqhuY=
github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
github.com/kubernetes-sigs/kube-storage-version-migrator v0.0.0-20191127225502-51849bc15f17/go.mod h1:enH0BVV+4+DAgWdwSlMefG8bBzTfVMTr1lApzdLZ/cc=
github.com/kylelemons/go-gypsy v1.0.0/go.mod h1:chkXM0zjdpXOiqkCW1XcCHDfjfk14PH2KKkQWxfJUcU=
github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348/go.mod h1:B69LEHPfb2qLo0BaaOLcbitczOKLWTsrBG9LczfCD4k=
github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
github.com/lestrrat-go/backoff/v2 v2.0.8/go.mod h1:rHP/q/r9aT27n24JQLa7JhSQZCKBBOiM/uP402WwN8Y=
github.com/lestrrat-go/blackmagic v1.0.0/go.mod h1:TNgH//0vYSs8VXDCfkZLgIrVTTXQELZffUV0tz3MtdQ=
github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E=
github.com/lestrrat-go/iter v1.0.1/go.mod h1:zIdgO1mRKhn8l9vrZJZz9TUMMFbQbLeTsbqPDrJ/OJc=
github.com/lestrrat-go/jwx v1.2.25/go.mod h1:zoNuZymNl5lgdcu6P7K6ie2QRll5HVfF4xwxBBK1NxY=
github.com/lestrrat-go/option v1.0.0/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
github.com/letsencrypt/pkcs11key/v4 v4.0.0/go.mod h1:EFUvBDay26dErnNb70Nd0/VW3tJiIbETBPTl9ATXQag=
github.com/lib/pq v1.1.1/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
github.com/lib/pq v1.10.1/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
github.com/lib/pq v1.10.2 h1:AqzbZs4ZoCBp+GtejcpCpcxM3zlSMx29dXbUSeVtJb8=
github.com/lib/pq v1.10.2/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
github.com/libopenstorage/openstorage v1.0.0 h1:GLPam7/0mpdP8ZZtKjbfcXJBTIA/T1O6CBErVEFEyIM=
github.com/libopenstorage/openstorage v1.0.0/go.mod h1:Sp1sIObHjat1BeXhfMqLZ14wnOzEhNx2YQedreMcUyc=
github.com/libp2p/go-netroute v0.2.0 h1:0FpsbsvuSnAhXFnCY0VLFbJOzaK0VnP0r1QT/o4nWRE=
github.com/libp2p/go-netroute v0.2.0/go.mod h1:Vio7LTzZ+6hoT4CMZi5/6CpY3Snzh2vgZhWgxMNwlQI=
github.com/lightstep/lightstep-tracer-common/golang/gogo v0.0.0-20190605223551-bc2310a04743/go.mod h1:qklhhLq1aX+mtWk9cPHPzaBjWImj5ULL6C7HFJtXQMM=
github.com/lightstep/lightstep-tracer-go v0.18.1/go.mod h1:jlF1pusYV4pidLvZ+XD0UBX0ZE6WURAspgAczcDHrL4=
github.com/linuxkit/virtsock v0.0.0-20201010232012-f8cee7dfc7a3/go.mod h1:3r6x7q95whyfWQpmGZTu3gk3v2YkMi05HEzl7Tf7YEo=
github.com/lithammer/dedent v1.1.0 h1:VNzHMVCBNG1j0fh3OrsFRkVUwStdDArbgBWoPAffktY=
github.com/lithammer/dedent v1.1.0/go.mod h1:jrXYCQtgg0nJiN+StA2KgR7w6CiQNv9Fd/Z9BP0jIOc=
github.com/lyft/protoc-gen-star v0.5.1/go.mod h1:9toiA3cC7z5uVbODF7kEQ91Xn7XNFkVUl+SrEe+ZORU=
github.com/lyft/protoc-gen-star/v2 v2.0.3/go.mod h1:amey7yeodaJhXSbf/TlLvWiqQfLOSpEk//mLlc+axEk=
github.com/magefile/mage v1.14.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs=
github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
github.com/mattn/go-ieproxy v0.0.0-20190610004146-91bb50d98149/go.mod h1:31jz6HNzdxOmlERGGEc4v/dMssOfmp2p5bT/okiKFFc=
github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng=
github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
github.com/mattn/go-runewidth v0.0.7/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
github.com/mattn/go-runewidth v0.0.12/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk=
github.com/mattn/go-shellwords v1.0.10/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
github.com/mattn/go-sqlite3 v1.14.7/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
github.com/mattn/go-sqlite3 v1.14.17 h1:mCRHCLDUBXgpKAqIKsaAaAsrAlbkeomtRFKXh2L6YIM=
github.com/mattn/go-sqlite3 v1.14.17/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
github.com/mattn/go-zglob v0.0.1/go.mod h1:9fxibJccNxU2cnpIKLRRFA7zX7qhkJIQWBb449FYHOo=
github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
github.com/matttproud/golang_protobuf_extensions v1.0.2/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw=
github.com/mdlayher/genetlink v1.3.2/go.mod h1:tcC3pkCrPUGIKKsCsp0B3AdaaKuHtaxoJRz3cc+528o=
github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
github.com/mdlayher/socket v0.4.1 h1:eM9y2/jlbs1M615oshPQOHZzj6R6wMT7bX5NPiQvn2U=
github.com/mdlayher/socket v0.4.1/go.mod h1:cAqeGjoufqdxWkD7DkpyS+wcefOtmu5OQ8KuoJGIReA=
github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
github.com/miekg/dns v1.1.25/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
github.com/miekg/dns v1.1.43/go.mod h1:+evo5L0630/F6ca/Z9+GAqzhjGyn8/c+TBaOyfEl0V4=
github.com/miekg/pkcs11 v1.0.2/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
github.com/miekg/pkcs11 v1.0.3/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws=
github.com/minio/highwayhash v1.0.2 h1:Aak5U0nElisjDCfPSG79Tgzkn2gl66NxOMspRrKnA/g=
github.com/minio/highwayhash v1.0.2/go.mod h1:BQskDq+xkJ12lmlUUi7U0M5Swg3EWR+dLTk+kldvVxY=
github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
github.com/minio/minio-go/v7 v7.0.33 h1:jLEHTp9jg2zWBa5w9W1i8WXq6o+oGRcjsdk9HbFgdlc=
github.com/minio/minio-go/v7 v7.0.33/go.mod h1:nCrRzjoSUQh8hgKKtu3Y708OLvRLtuASMg2/nvmbarw=
github.com/minio/sha256-simd v1.0.0 h1:v1ta+49hkWZyvaKwrQB8elexRqm6Y0aMLjCNsrYxo6g=
github.com/minio/sha256-simd v1.0.0/go.mod h1:OuYzVNI5vcoYIAmbIvHPl3N3jUzVedXbKy5RFepssQM=
github.com/mistifyio/go-zfs v2.1.2-0.20190413222219-f784269be439+incompatible h1:aKW/4cBs+yK6gpqU3K/oIwk9Q/XICqd3zOX/UFuvqmk=
github.com/mistifyio/go-zfs v2.1.2-0.20190413222219-f784269be439+incompatible/go.mod h1:8AuVvqP/mXw1px98n46wfvcGfQ4ci2FwoAjKYxuo3Z4=
github.com/mistifyio/go-zfs/v3 v3.0.1/go.mod h1:CzVgeB0RvF2EGzQnytKVvVSDwmKJXxkOTUGbNrTja/k=
github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS42BGNg=
github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
github.com/mitchellh/mapstructure v1.3.2/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f/go.mod h1:OkQIRizQZAeMln+1tSwduZz7+Af5oFlKirV/MSYes2A=
github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
github.com/mitchellh/reflectwalk v1.0.1/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
github.com/mndrix/tap-go v0.0.0-20171203230836-629fa407e90b/go.mod h1:pzzDgJWZ34fGzaAZGFW22KVZDfyrYW+QABMrWnJBnSs=
github.com/moby/ipvs v1.1.0 h1:ONN4pGaZQgAx+1Scz5RvWV4Q7Gb+mvfRh3NsPS+1XQQ=
github.com/moby/ipvs v1.1.0/go.mod h1:4VJMWuf098bsUMmZEiD4Tjk/O7mOn3l1PTD3s4OoYAs=
github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
github.com/moby/spdystream v0.2.0 h1:cjW1zVyyoiM0T7b6UoySUFqzXMoqRckQtXwGPiBhOM8=
github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
github.com/moby/sys/mountinfo v0.5.0/go.mod h1:3bMD3Rg+zkqx8MRYPi7Pyb0Ie97QEBmdxbhnCLlSvSU=
github.com/moby/sys/mountinfo v0.6.2 h1:BzJjoreD5BMFNmD9Rus6gdd1pLuecOFPt8wC+Vygl78=
github.com/moby/sys/mountinfo v0.6.2/go.mod h1:IJb6JQeOklcdMU9F5xQ8ZALD+CUr5VlGpwtX+VE0rpI=
github.com/moby/sys/sequential v0.5.0 h1:OPvI35Lzn9K04PBbCLW0g4LcFAJgHsvXsRyewg5lXtc=
github.com/moby/sys/sequential v0.5.0/go.mod h1:tH2cOOs5V9MlPiXcQzRC+eEyab644PWKGRYaaV5ZZlo=
github.com/moby/sys/signal v0.6.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn88Kg8Tg=
github.com/moby/sys/signal v0.7.0 h1:25RW3d5TnQEoKvRbEKUGay6DCQ46IxAVTT9CUMgmsSI=
github.com/moby/sys/signal v0.7.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn88Kg8Tg=
github.com/moby/sys/symlink v0.2.0/go.mod h1:7uZVF2dqJjG/NsClqul95CqKOBRQyYSNnJ6BMgR/gFs=
github.com/moby/term v0.0.0-20210610120745-9d4ed1856297/go.mod h1:vgPCkQMyxTZ7IDy8SXRufE172gr8+K/JE/7hHFxHW3A=
github.com/moby/term v0.0.0-20221205130635-1aeaba878587 h1:HfkjXDfhgVaN5rmueG8cL8KKeFNecRCXFhaJ2qZ5SKA=
github.com/moby/term v0.0.0-20221205130635-1aeaba878587/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9M+97sNutRR1RKhG96O6jWumTTnw=
github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
github.com/mreiferson/go-httpclient v0.0.0-20160630210159-31f0106b4474/go.mod h1:OQA4XLvDbMgS8P0CevmM4m9Q3Jq4phKUzcocxuGJ5m8=
github.com/mrunalp/fileutils v0.5.0 h1:NKzVxiH7eSk+OQ4M+ZYW1K6h27RUV3MI6NUTsHhU6Z4=
github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
github.com/mwitkow/go-proto-validators v0.0.0-20180403085117-0950a7990007/go.mod h1:m2XC9Qq0AlmmVksL6FktJCdTYyLk7V3fKyp0sl1yWQo=
github.com/mwitkow/go-proto-validators v0.2.0/go.mod h1:ZfA1hW+UH/2ZHOWvQ3HnQaU0DtnpXu850MZiy+YUgcc=
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
github.com/natefinch/lumberjack v2.0.0+incompatible h1:4QJd3OLAMgj7ph+yZTuX13Ld4UpgHp07nNdFX7mqFfM=
github.com/natefinch/lumberjack v2.0.0+incompatible/go.mod h1:Wi9p2TTF5DG5oU+6YfsmYQpsTIOm0B1VNzQg9Mw6nPk=
github.com/nats-io/jsm.go v0.0.31-0.20220317133147-fe318f464eee h1:+l6i7zS8N1LOokm7dzShezI9STRGrzp0O49Pw8Jetdk=
github.com/nats-io/jsm.go v0.0.31-0.20220317133147-fe318f464eee/go.mod h1:EKSYvbvWAoh0hIfuZ+ieWm8u0VOTRTeDfuQvNPKRqEg=
github.com/nats-io/jwt v0.3.0/go.mod h1:fRYCDE99xlTsqUzISS1Bi75UBJ6ljOJQOAAu5VglpSg=
github.com/nats-io/jwt v0.3.2/go.mod h1:/euKqTS1ZD+zzjYrY7pseZrTtWQSjujC7xjPc8wL6eU=
github.com/nats-io/jwt/v2 v2.2.1-0.20220113022732-58e87895b296/go.mod h1:0tqz9Hlu6bCBFLWAASKhE5vUA4c24L9KPUUgvwumE/k=
github.com/nats-io/jwt/v2 v2.4.1 h1:Y35W1dgbbz2SQUYDPCaclXcuqleVmpbRa7646Jf2EX4=
github.com/nats-io/jwt/v2 v2.4.1/go.mod h1:24BeQtRwxRV8ruvC4CojXlx/WQ/VjuwlYiH+vu/+ibI=
github.com/nats-io/nats-server/v2 v2.1.2/go.mod h1:Afk+wRZqkMQs/p45uXdrVLuab3gwv3Z8C4HTBu8GD/k=
github.com/nats-io/nats-server/v2 v2.7.5-0.20220309212130-5c0d1999ff72/go.mod h1:1vZ2Nijh8tcyNe8BDVyTviCd9NYzRbubQYiEHsvOQWc=
github.com/nats-io/nats-server/v2 v2.9.18 h1:00muGH0qu/7NAw1b/2eFcpIvdHcTghj6PFjUVhy8zEo=
github.com/nats-io/nats-server/v2 v2.9.18/go.mod h1:aTb/xtLCGKhfTFLxP591CMWfkdgBmcUUSkiSOe5A3gw=
github.com/nats-io/nats.go v1.9.1/go.mod h1:ZjDU1L/7fJ09jvUSRVBR2e7+RnLiiIQyqyzEE/Zbp4w=
github.com/nats-io/nats.go v1.13.1-0.20220308171302-2f2f6968e98d/go.mod h1:BPko4oXsySz4aSWeFgOHLZs3G4Jq4ZAyE6/zMCxRT6w=
github.com/nats-io/nats.go v1.27.1 h1:OuYnal9aKVSnOzLQIzf7554OXMCG7KbaTkCSBHRcSoo=
github.com/nats-io/nats.go v1.27.1/go.mod h1:XpbWUlOElGwTYbMR7imivs7jJj9GtK7ypv321Wp6pjc=
github.com/nats-io/nkeys v0.1.0/go.mod h1:xpnFELMwJABBLVhffcfd1MZx6VsNRFpEugbxziKVo7w=
github.com/nats-io/nkeys v0.1.3/go.mod h1:xpnFELMwJABBLVhffcfd1MZx6VsNRFpEugbxziKVo7w=
github.com/nats-io/nkeys v0.3.0/go.mod h1:gvUNGjVcM2IPr5rCsRsC6Wb3Hr2CQAm08dsxtV6A5y4=
github.com/nats-io/nkeys v0.4.4 h1:xvBJ8d69TznjcQl9t6//Q5xXuVhyYiSos6RPtvQNTwA=
github.com/nats-io/nkeys v0.4.4/go.mod h1:XUkxdLPTufzlihbamfzQ7mw/VGx6ObUs+0bN5sNvt64=
github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
github.com/ncw/swift v1.0.47/go.mod h1:23YIA4yWVnGwv2dQlN4bB7egfYX6YLn0Yo/S6zZO/ZM=
github.com/networkplumbing/go-nft v0.2.0/go.mod h1:HnnM+tYvlGAsMU7yoYwXEVLLiDW9gdMmb5HoGcwpuQs=
github.com/nishanths/predeclared v0.0.0-20200524104333-86fad755b4d3/go.mod h1:nt3d53pc1VYcphSCIaYAJtnPYnr3Zyn8fMq2wvPGPso=
github.com/nkovacs/streamquote v1.0.0/go.mod h1:BN+NaZ2CmdKqUuTUXUEm9j95B2TRbpOWpxbJYzzgUsc=
github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
github.com/oklog/oklog v0.3.2/go.mod h1:FCV+B7mhrz4o+ueLpx+KqkyXRGMWOYEvfiXtdGtbWGs=
github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
github.com/olekukonko/tablewriter v0.0.0-20170122224234-a0225b3f23b5/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
github.com/olekukonko/tablewriter v0.0.4/go.mod h1:zq6QwlOf5SlnkVbMSr5EoBv3636FWnp+qbPhuoO21uA=
github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
github.com/olivere/elastic/v7 v7.0.6/go.mod h1:nut831m8vw5KQbQxX1oXjj3/buiDpDZc5pqNVdH9xYk=
github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
github.com/onsi/ginkgo v1.10.3/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
github.com/onsi/ginkgo v1.13.0/go.mod h1:+REjRxOmWfHCjfv9TTWB1jD1Frx4XydAD3zm1lskyM0=
github.com/onsi/ginkgo v1.14.1/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
github.com/onsi/ginkgo v1.15.0/go.mod h1:hF8qUzuuC8DJGygJH3726JnCZX4MYbRB8yFfISqnKUg=
github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
github.com/onsi/ginkgo/v2 v2.1.4/go.mod h1:um6tUpWM/cxCK3/FK8BXqEiUMUwRgSM4JXG47RKZmLU=
github.com/onsi/ginkgo/v2 v2.1.6/go.mod h1:MEH45j8TBi6u9BMogfbp0stKC5cdGjumZj5Y7AG4VIk=
github.com/onsi/ginkgo/v2 v2.3.0/go.mod h1:Eew0uilEqZmIEZr8JrvYlvOM7Rr6xzTmMV8AyFNU9d0=
github.com/onsi/ginkgo/v2 v2.4.0/go.mod h1:iHkDK1fKGcBoEHT5W7YBq4RFWaQulw+caOMkAt4OrFo=
github.com/onsi/ginkgo/v2 v2.5.0/go.mod h1:Luc4sArBICYCS8THh8v3i3i5CuSZO+RaQRaJoeNwomw=
github.com/onsi/ginkgo/v2 v2.6.1/go.mod h1:yjiuMwPokqY1XauOgju45q3sJt6VzQ/Fict1LFVcsAo=
github.com/onsi/ginkgo/v2 v2.7.0/go.mod h1:yjiuMwPokqY1XauOgju45q3sJt6VzQ/Fict1LFVcsAo=
github.com/onsi/ginkgo/v2 v2.8.1/go.mod h1:N1/NbDngAFcSLdyZ+/aYTYGSlq9qMCS/cNKGJjy+csc=
github.com/onsi/ginkgo/v2 v2.9.0/go.mod h1:4xkjoL/tZv4SMWeww56BU5kAt19mVB47gTWxmrTcxyk=
github.com/onsi/ginkgo/v2 v2.9.1/go.mod h1:FEcmzVcCHl+4o9bQZVab+4dC9+j+91t2FHSzmGAPfuo=
github.com/onsi/ginkgo/v2 v2.11.0 h1:WgqUCUt/lT6yXoQ8Wef0fsNn5cAuMK7+KT9UFRz2tcU=
github.com/onsi/ginkgo/v2 v2.11.0/go.mod h1:ZhrRA5XmEE3x3rhlzamx/JJvujdZoJ2uvgI7kR0iZvM=
github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
github.com/onsi/gomega v1.10.5/go.mod h1:gza4q3jKQJijlu05nKWRCW/GavJumGt8aNRxWg7mt48=
github.com/onsi/gomega v1.14.0/go.mod h1:cIuvLEne0aoVhAgh/O6ac0Op8WWw9H6eYCriF+tEHG0=
github.com/onsi/gomega v1.15.0/go.mod h1:cIuvLEne0aoVhAgh/O6ac0Op8WWw9H6eYCriF+tEHG0=
github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro=
github.com/onsi/gomega v1.20.0/go.mod h1:DtrZpjmvpn2mPm4YWQa0/ALMDj9v4YxLgojwPeREyVo=
github.com/onsi/gomega v1.20.1/go.mod h1:DtrZpjmvpn2mPm4YWQa0/ALMDj9v4YxLgojwPeREyVo=
github.com/onsi/gomega v1.21.1/go.mod h1:iYAIXgPSaDHak0LCMA+AWBpIKBr8WZicMxnE8luStNc=
github.com/onsi/gomega v1.22.1/go.mod h1:x6n7VNe4hw0vkyYUM4mjIXx3JbLiPaBPNgB7PRQ1tuM=
github.com/onsi/gomega v1.24.0/go.mod h1:Z/NWtiqwBrwUt4/2loMmHL63EDLnYHmVbuBpDr2vQAg=
github.com/onsi/gomega v1.24.1/go.mod h1:3AOiACssS3/MajrniINInwbfOOtfZvplPzuRSmvt1jM=
github.com/onsi/gomega v1.24.2/go.mod h1:gs3J10IS7Z7r7eXRoNJIrNqU4ToQukCJhFtKrWgHWnk=
github.com/onsi/gomega v1.26.0/go.mod h1:r+zV744Re+DiYCIPRlYOTxn0YkOLcAnW8k1xXdMPGhM=
github.com/onsi/gomega v1.27.1/go.mod h1:aHX5xOykVYzWOV4WqQy0sy8BQptgukenXpCXfadcIAw=
github.com/onsi/gomega v1.27.3/go.mod h1:5vG284IBtfDAmDyrK+eGyZmUgUlmi+Wngqo557cZ6Gw=
github.com/onsi/gomega v1.27.4/go.mod h1:riYq/GJKh8hhoM01HN6Vmuy93AarCXCBGpvFDK3q3fQ=
github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI=
github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M=
github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
github.com/open-policy-agent/opa v0.42.2/go.mod h1:MrmoTi/BsKWT58kXlVayBb+rYVeaMwuBm3nYAN3923s=
github.com/opencontainers/go-digest v1.0.0-rc1/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
github.com/opencontainers/image-spec v1.0.2/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
github.com/opencontainers/image-spec v1.0.3-0.20211202183452-c5a74bcca799/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
github.com/opencontainers/image-spec v1.1.0-rc2/go.mod h1:3OVijpioIKYWTqjiG0zfF6wvoJ4fAXGbjdZuI2NgsRQ=
github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b/go.mod h1:3OVijpioIKYWTqjiG0zfF6wvoJ4fAXGbjdZuI2NgsRQ=
github.com/opencontainers/image-spec v1.1.0-rc3 h1:fzg1mXZFj8YdPeNkRXMg+zb88BFV0Ys52cJydRwBkb8=
github.com/opencontainers/image-spec v1.1.0-rc3/go.mod h1:X4pATf0uXsnn3g5aiGIsVnJBR4mxhKzfwmvK/B2NTm8=
github.com/opencontainers/runc v1.1.8 h1:zICRlc+C1XzivLc3nzE+cbJV4LIi8tib6YG0MqC6OqA=
github.com/opencontainers/runc v1.1.8/go.mod h1:CbUumNnWCuTGFukNXahoo/RFBZvDAgRh/smNYNOhA50=
github.com/opencontainers/runtime-spec v1.0.3-0.20220909204839-494a5a6aca78 h1:R5M2qXZiK/mWPMT4VldCOiSL9HIAMuxQZWdG0CSM5+4=
github.com/opencontainers/runtime-spec v1.0.3-0.20220909204839-494a5a6aca78/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
github.com/opencontainers/runtime-tools v0.9.0/go.mod h1:r3f7wjNzSs2extwzU3Y+6pKfobzPh+kKFJ3ofN+3nfs=
github.com/opencontainers/runtime-tools v0.9.1-0.20221107090550-2e043c6bd626/go.mod h1:BRHJJd0E+cx42OybVYSgUvZmU0B8P9gZuRXlZUP7TKI=
github.com/opencontainers/selinux v1.10.1 h1:09LIPVRP3uuZGQvgR+SgMSNBd1Eb3vlRbGqQpoHsF8w=
github.com/opencontainers/selinux v1.10.1/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI=
github.com/openshift/api v0.0.0-20200521101457-60c476765272/go.mod h1:TkhafijfTiRi1Q3120/ZSE4oIWKQ4DGRh3byPywv4Mw=
github.com/openshift/api v0.0.0-20200923080607-2a18526802e3/go.mod h1:Si/I9UGeRR3qzg01YWPmtlr0GeGk2fnuggXJRmjAZ6U=
github.com/openshift/build-machinery-go v0.0.0-20200424080330-082bf86082cc/go.mod h1:1CkcsT3aVebzRBzVTSbiKSkJMsC/CASqxesfqEMfJEc=
github.com/openshift/build-machinery-go v0.0.0-20200819073603-48aa266c95f7/go.mod h1:b1BuldmJlbA/xYtdZvKi+7j5YGB44qJUJDZ9zwiNCfE=
github.com/openshift/client-go v0.0.0-20200521150516-05eb9880269c/go.mod h1:kCMeo6IE4o4qvnepM9lgHQ4j/ZFfvY/N/2G/jpJdwm4=
github.com/openshift/library-go v0.0.0-20200924151131-575c4875cdbe/go.mod h1:dJqjuQMmC/T1nhi5yGbRf7qGxnO+vRa2j99y6oVYDZQ=
github.com/opentracing-contrib/go-observer v0.0.0-20170622124052-a52f23424492/go.mod h1:Ngi6UdF0k5OKD5t5wlmGhe/EDKPoUM3BXZSSfIuJbis=
github.com/opentracing/basictracer-go v1.0.0/go.mod h1:QfBfYuafItcjQuMwinw9GhYKwFXS9KnPs5lxoYwgW74=
github.com/opentracing/opentracing-go v1.0.2/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
github.com/openzipkin-contrib/zipkin-go-opentracing v0.4.5/go.mod h1:/wsWhb9smxSfWAKL3wpBW7V8scJMt8N8gnaMCS9E/cA=
github.com/openzipkin/zipkin-go v0.1.6/go.mod h1:QgAqvLzwWbR/WpD4A3cGpPtJrZXNIiJc5AZX7/PBEpw=
github.com/openzipkin/zipkin-go v0.2.1/go.mod h1:NaW6tEwdmWMaCDZzg8sh+IBNOxHMPnhQw8ySjnjRyN4=
github.com/openzipkin/zipkin-go v0.2.2/go.mod h1:NaW6tEwdmWMaCDZzg8sh+IBNOxHMPnhQw8ySjnjRyN4=
github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw=
github.com/otiai10/copy v1.7.0 h1:hVoPiN+t+7d2nzzwMiDHPSOogsWAStewq3TwU05+clE=
github.com/otiai10/copy v1.7.0/go.mod h1:rmRl6QPdJj6EiUqXQ/4Nn2lLXoNQjFCQbbNrxgc/t3U=
github.com/otiai10/curr v0.0.0-20150429015615-9b4961190c95/go.mod h1:9qAhocn7zKJG+0mI8eUu6xqkFDYS2kb2saOteoSB3cE=
github.com/otiai10/curr v1.0.0/go.mod h1:LskTG5wDwr8Rs+nNQ+1LlxRjAtTZZjtJW4rMXl6j4vs=
github.com/otiai10/mint v1.3.0/go.mod h1:F5AjcsTsWUqX+Na9fpHb52P8pcRX2CI6A3ctIT91xUo=
github.com/otiai10/mint v1.3.1/go.mod h1:/yxELlJQ0ufhjUwhshSj+wFjZ78CnZ48/1wtmBH1OTc=
github.com/otiai10/mint v1.3.3 h1:7JgpsBaN0uMkyju4tbYHu0mnM55hNKVYLsXmwr15NQI=
github.com/otiai10/mint v1.3.3/go.mod h1:/yxELlJQ0ufhjUwhshSj+wFjZ78CnZ48/1wtmBH1OTc=
github.com/pact-foundation/pact-go v1.0.4/go.mod h1:uExwJY4kCzNPcHRj+hCR/HBbOOIwwtUjcrb0b5/5kLM=
github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
github.com/pelletier/go-buffruneio v0.2.0/go.mod h1:JkE26KsDizTr40EUHkXVtNPvgGtbSNq5BcowyYOWdKo=
github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrapLU/GW4pbc=
github.com/pelletier/go-toml v1.9.3/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
github.com/pelletier/go-toml v1.9.4/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
github.com/performancecopilot/speed v3.0.0+incompatible/go.mod h1:/CLtqpZ5gBg1M9iaPbIdPPGyKcA8hKdoy6hAWba7Yac=
github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
github.com/peterh/liner v0.0.0-20170211195444-bf27d3ba8e1d/go.mod h1:xIteQHvHuaLYG9IFj6mSxM0fCKrs34IrEQUhOYuGPHc=
github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5/go.mod h1:iIss55rKnNBTvrwdmkUpLnDpZoAHvWaiq5+iMmen4AE=
github.com/pierrec/lz4 v1.0.2-0.20190131084431-473cd7ce01a1/go.mod h1:3/3N9NVKO0jef7pBehbT1qWhCMrIgbYNnFAZCqQ5LRc=
github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
github.com/pierrec/lz4 v2.6.0+incompatible h1:Ix9yFKn1nSPBLFl/yZknTp8TU5G4Ps0JDmguYK6iH1A=
github.com/pierrec/lz4 v2.6.0+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pkg/profile v1.2.1/go.mod h1:hJw3o1OdXxsrSjjVksARp5W95eeEaEfptyVZyv6JUPA=
github.com/pkg/profile v1.3.0/go.mod h1:hJw3o1OdXxsrSjjVksARp5W95eeEaEfptyVZyv6JUPA=
github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
github.com/pquerna/cachecontrol v0.1.0 h1:yJMy84ti9h/+OEWa752kBTKv4XC30OtVVHYv/8cTqKc=
github.com/pquerna/cachecontrol v0.1.0/go.mod h1:NrUG3Z7Rdu85UNR3vm7SOsl1nFIeSiQnrHV5K9mBcUI=
github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
github.com/projectcalico/api v0.0.0-20220129171754-5c0717447274/go.mod h1:F/7dfUo3xKZyNWvy1kqVyve3Yxh/BfwFLGOlH3N9euI=
github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.52.1/go.mod h1:f7HML3SGY4Bf10YMdSWKUf2BdIIzQqlAvYh84px05BQ=
github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
github.com/prometheus/client_golang v0.9.2/go.mod h1:OsXs2jCmiKlQ1lTBmv21f2mNfw4xf/QclQDMrYNZzcM=
github.com/prometheus/client_golang v0.9.3-0.20190127221311-3c4408c8b829/go.mod h1:p2iRAGwDERtqlqzRXnrOVns+ignqQo//hLXqYxZYVNs=
github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
github.com/prometheus/client_golang v1.3.0/go.mod h1:hJaj2vgQTGQmVCsAACORcieXFeDPbaTKGT+JTgUa3og=
github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
github.com/prometheus/client_golang v1.5.1/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
github.com/prometheus/client_golang v1.9.0/go.mod h1:FqZLKOZnGdFAhOK4nqGHa7D66IdsO+O441Eve7ptJDU=
github.com/prometheus/client_golang v1.10.0/go.mod h1:WJM3cc3yu7XKBKa/I8WeZm+V3eltZnBwfENSU7mdogU=
github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
github.com/prometheus/client_golang v1.11.1/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
github.com/prometheus/client_golang v1.12.2/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
github.com/prometheus/client_golang v1.13.0/go.mod h1:vTeo+zgvILHsnnj/39Ou/1fPN5nJFOEMgftOUOmlvYQ=
github.com/prometheus/client_golang v1.14.0/go.mod h1:8vpkKitgIVNcqrRBWh1C4TIUQgYNtG/XQE4E/Zae36Y=
github.com/prometheus/client_golang v1.16.0 h1:yk/hx9hDbrGHovbci4BY+pRMfSuuat626eFsHb7tmT8=
github.com/prometheus/client_golang v1.16.0/go.mod h1:Zsulrv/L9oM40tJ7T815tM89lFEugiJ9HzIqaAx4LKc=
github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
github.com/prometheus/client_model v0.0.0-20190115171406-56726106282f/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
github.com/prometheus/client_model v0.1.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
github.com/prometheus/client_model v0.4.0 h1:5lQXD3cAg1OXBf4Wq03gTrXHeaV0TQvGfUooCfx1yqY=
github.com/prometheus/client_model v0.4.0/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJEYF2imWWhWtMkYU=
github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
github.com/prometheus/common v0.0.0-20181126121408-4724e9255275/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
github.com/prometheus/common v0.2.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
github.com/prometheus/common v0.7.0/go.mod h1:DjGbpBbp5NYNiECxcL/VnbXCCaQpKd3tt26CguLLsqA=
github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8bs7vj7HSQ4=
github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
github.com/prometheus/common v0.15.0/go.mod h1:U+gB1OBLb1lF3O42bTCL+FK18tX9Oar16Clt/msog/s=
github.com/prometheus/common v0.18.0/go.mod h1:U+gB1OBLb1lF3O42bTCL+FK18tX9Oar16Clt/msog/s=
github.com/prometheus/common v0.24.0/go.mod h1:H6QK/N6XVT42whUeIdI3dp36w49c+/iMDk7UAI2qm7Q=
github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
github.com/prometheus/common v0.32.1/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
github.com/prometheus/common v0.37.0/go.mod h1:phzohg0JFMnBEFGxTDbfu3QyL5GI8gTQJFhYO5B3mfA=
github.com/prometheus/common v0.42.0 h1:EKsfXEYo4JpWMHH5cg+KOUWeuJSov1Id8zGR8eeI1YM=
github.com/prometheus/common v0.42.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc=
github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
github.com/prometheus/procfs v0.0.0-20181204211112-1dc9a6cbc91a/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
github.com/prometheus/procfs v0.0.0-20190117184657-bf6a532e95b1/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
github.com/prometheus/procfs v0.0.0-20190425082905-87a4384529e0/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
github.com/prometheus/procfs v0.2.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
github.com/prometheus/procfs v0.5.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
github.com/prometheus/procfs v0.8.0/go.mod h1:z7EfXMXOkbkqb9IINtpCn86r/to3BnA0uaxHdg830/4=
github.com/prometheus/procfs v0.10.1 h1:kYK1Va/YMlutzCGazswoHKo//tZVlFpKYh+PymziUAg=
github.com/prometheus/procfs v0.10.1/go.mod h1:nwNm2aOCAYw8uTR/9bWRREkZFxAUcWzPHWJq+XBB/FM=
github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
github.com/pseudomuto/protoc-gen-doc v1.4.1/go.mod h1:exDTOVwqpp30eV/EDPFLZy3Pwr2sn6hBC1WIYH/UbIg=
github.com/pseudomuto/protokit v0.2.0/go.mod h1:2PdH30hxVHsup8KpBTOXTBeMVhJZVio3Q8ViKSAXT0Q=
github.com/r3labs/diff/v2 v2.8.0/go.mod h1:I8noH9Fc2fjSaMxqF3G2lhDdC0b+JXCfyx85tWFM9kc=
github.com/rancher/dynamiclistener v0.3.6-rc2 h1:Y1nai+Xv+4qqlB3c+hmrY2uBo1EcCDU9kmN5hbnmZhA=
github.com/rancher/dynamiclistener v0.3.6-rc2/go.mod h1:wOh62hdJIgyqTdD/VAHO77UPKAbUsJJ5gYRjzgBL3Wo=
github.com/rancher/lasso v0.0.0-20221227210133-6ea88ca2fbcc h1:29VHrInLV4qSevvcvhBj5UhQWkPShxrxv4AahYg2Scw=
github.com/rancher/lasso v0.0.0-20221227210133-6ea88ca2fbcc/go.mod h1:dEfC9eFQigj95lv/JQ8K5e7+qQCacWs1aIA6nLxKzT8=
github.com/rancher/remotedialer v0.2.6-0.20201012155453-8b1b7bb7d05f/go.mod h1:dbzn9NF1JWbGEHL6Q/1KG4KFROILiY/j6wmfF1Np3fk=
github.com/rancher/remotedialer v0.3.0 h1:y1EO8JCsgZo0RcqTUp6U8FXcBAv27R+TLnWRcpvX1sM=
github.com/rancher/remotedialer v0.3.0/go.mod h1:BwwztuvViX2JrLLUwDlsYt5DiyUwHLlzynRwkZLAY0Q=
github.com/rancher/wharfie v0.6.2 h1:ZTrZ0suU0abWwLLf2zaqjhwpxK8+BkbnMocnU2u1bSQ=
github.com/rancher/wharfie v0.6.2/go.mod h1:7ii0+eehBwUEFaJMiRHWCbvN11bsfVHT1oc+P/6IBSg=
github.com/rancher/wins v0.1.1 h1:WyqxkAyCstwuv+04tdJiGODXv0De/lOyRHV6MJVfrUo=
github.com/rancher/wins v0.1.1/go.mod h1:SdPsn8b5PoVj1ozvjRc8VNyjNvOGSoQy4HkN5Q6yTqo=
github.com/rancher/wrangler v1.1.1-0.20230425173236-39a4707f0689 h1:otb4OjgXH2b8a4C9g76jCDuTF3opjaYffZ55SiVe7KU=
github.com/rancher/wrangler v1.1.1-0.20230425173236-39a4707f0689/go.mod h1:D6Tu6oVX8aGtCHsMCtYaysgVK3ad920MTSeAu7rzb5U=
github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
github.com/rogpeppe/fastuuid v1.1.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
github.com/rootless-containers/rootlesskit v1.0.1 h1:jepqW1txFSowKSMAEkVhWH3Oa1TCY9S400MVYe/6Iro=
github.com/rootless-containers/rootlesskit v1.0.1/go.mod h1:t2UAiYagxrJ+wmpFAUIZPcqsm4k2B7ve6g7lILKbloc=
github.com/rs/cors v1.7.0/go.mod h1:gFx+x8UowdsKA9AchylcLynDq+nNFfI8FkUZdN/jGCU=
github.com/rs/xid v1.4.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
github.com/rs/xid v1.5.0 h1:mKX4bl4iPYJtEIxp6CYiUuLQ/8DYMoz0PUdtGgMFRVc=
github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
github.com/rubiojr/go-vhd v0.0.0-20200706105327-02e210299021 h1:if3/24+h9Sq6eDx8UUz1SO9cT9tizyIsATfB7b4D3tc=
github.com/rubiojr/go-vhd v0.0.0-20200706105327-02e210299021/go.mod h1:DM5xW0nvfNNm2uytzsvhI3OnX8uzaRAg8UX/CnDqbto=
github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
github.com/russross/blackfriday v1.6.0/go.mod h1:ti0ldHuxg49ri4ksnFxlkCfN+hvslNlmVHqNRXXJNAY=
github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
github.com/safchain/ethtool v0.2.0/go.mod h1:WkKB1DnNtvsMlDmQ50sgwowDJV/hGbJSOvJoEXs1AJQ=
github.com/samuel/go-zookeeper v0.0.0-20190923202752-2cc03de413da/go.mod h1:gi+0XIa01GRL2eRQVjQkKGqKF3SF9vZR/HnPullcV2E=
github.com/santhosh-tekuri/jsonschema v1.2.4/go.mod h1:TEAUOeZSmIxTTuHatJzrvARHiuO9LYd+cIxzgEHCQI4=
github.com/sassoftware/go-rpmutils v0.0.0-20190420191620-a8f1baeba37b/go.mod h1:am+Fp8Bt506lA3Rk3QCmSqmYmLMnPDhdDUcosQCAx+I=
github.com/sclevine/agouti v3.0.0+incompatible/go.mod h1:b4WX9W9L1sfQKXeJf1mUTLZKJ48R1S7H23Ji7oFO5Bw=
github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
github.com/seccomp/libseccomp-golang v0.9.2-0.20220502022130-f33da4d89646 h1:RpforrEYXWkmGwJHIGnLZ3tTWStkjVVstwzNGqxX2Ds=
github.com/seccomp/libseccomp-golang v0.9.2-0.20220502022130-f33da4d89646/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
github.com/sethvargo/go-password v0.2.0/go.mod h1:Ym4Mr9JXLBycr02MFuVQ/0JHidNetSgbzutTr3zsYXE=
github.com/shengdoushi/base58 v1.0.0 h1:tGe4o6TmdXFJWoI31VoSWvuaKxf0Px3gqa3sUWhAxBs=
github.com/shengdoushi/base58 v1.0.0/go.mod h1:m5uIILfzcKMw6238iWAhP4l3s5+uXyF3+bJKUNhAL9I=
github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
github.com/sirupsen/logrus v1.3.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
github.com/smartystreets/assertions v1.0.0/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
github.com/smartystreets/go-aws-auth v0.0.0-20180515143844-0c1422d1fdb9/go.mod h1:SnhjPscd9TpLiy1LpzGSKh3bXCfxxXuqd9xmQJy3slM=
github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
github.com/smartystreets/gunit v1.0.0/go.mod h1:qwPWnhz6pn0NnRBP++URONOVyNkPyr4SauJk4cUOwJs=
github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
github.com/soheilhy/cmux v0.1.5-0.20210205191134-5ec6847320e5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
github.com/soheilhy/cmux v0.1.5 h1:jjzc5WVemNEDTLwv9tlmemhC73tI08BNOIGwBOo10Js=
github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
github.com/sony/gobreaker v0.4.1/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJOjmxWY=
github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4=
github.com/spf13/afero v1.3.4/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
github.com/spf13/cobra v0.0.2-0.20171109065643-2da4a54c5cee/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
github.com/spf13/cobra v1.0.0/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE=
github.com/spf13/cobra v1.1.1/go.mod h1:WnodtKOvamDL/PwE2M4iKs8aMDBZ5Q5klgD3qfVJQMI=
github.com/spf13/cobra v1.1.3/go.mod h1:pGADOWyqRD/YMrPZigI/zbliZ2wVD/23d+is3pSWzOo=
github.com/spf13/cobra v1.2.1/go.mod h1:ExllRjgxM/piMAM+3tAZvg8fsklGAf3tPfi+i8t68Nk=
github.com/spf13/cobra v1.4.0/go.mod h1:Wo4iy3BUC+X2Fybo0PDqwJIv3dNRiZLHQymsfxlB84g=
github.com/spf13/cobra v1.5.0/go.mod h1:dWXEIy2H428czQCjInthrTRUg7yKbok+2Qi/yBIJoUM=
github.com/spf13/cobra v1.6.0/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY=
github.com/spf13/cobra v1.6.1 h1:o94oiPyS4KD1mPy2fmcYYHHfCxLqYjJOhGsCHFZtEzA=
github.com/spf13/cobra v1.6.1/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY=
github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
github.com/spf13/pflag v1.0.1-0.20171106142849-4c012f6dcd95/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
github.com/spf13/viper v1.7.0/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5qpdg=
github.com/spf13/viper v1.8.1/go.mod h1:o0Pch8wJ9BVSWGQMbra6iw0oQ5oktSIBaujf1rJH9Ns=
github.com/src-d/gcfg v1.4.0/go.mod h1:p/UMsR43ujA89BJY9duynAwIpvqEujIH/jFlfL7jWoI=
github.com/stefanberger/go-pkcs11uri v0.0.0-20201008174630-78d3cae3a980/go.mod h1:AO3tvPzVZ/ayst6UlUKUv6rcPQInYe3IknH3jYhAKu8=
github.com/stoewer/go-strcase v1.2.0 h1:Z2iHWqGXH00XYgqDmNgQbIBxf3wrNq0F3feEy0ainaU=
github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
github.com/streadway/amqp v0.0.0-20190404075320-75d898a42a94/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw=
github.com/streadway/amqp v0.0.0-20190827072141-edfb9018d271/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw=
github.com/streadway/handy v0.0.0-20190108123426-d5acb3125c2a/go.mod h1:qNTQ5P5JnDBl6z3cMAg/SywNDC5ABu5ApDIw6lUbRmI=
github.com/streadway/quantile v0.0.0-20150917103942-b0c588724d25/go.mod h1:lbP8tGiBjZ5YWIc2fzuRpTaz0b/53vT6PEs3QuAWzuU=
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
github.com/stretchr/testify v0.0.0-20170130113145-4d4bfba8f1d1/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 h1:kdXcSzyDtseVEc4yCz2qF8ZrQvIDBJLl4S1c3GCXmoI=
github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
github.com/tchap/go-patricia/v2 v2.3.1/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
github.com/tigera/api v0.0.0-20220325204048-b3e0b35ba256/go.mod h1:6qWfgULooruKiC8eoGgyRjOh0K+h/q8bc7AvdUysAUo=
github.com/tigera/operator v1.28.1 h1:jFaO/3if3Lz1Plxc+QipJTUXIYen6TDC77c6y6afG2k=
github.com/tigera/operator v1.28.1/go.mod h1:XU62bZPxkA4iTDwz1qBGrodE9s8XaFMRfR1fTVgc9j0=
github.com/tj/assert v0.0.0-20171129193455-018094318fb0/go.mod h1:mZ9/Rh9oLWpLLDRpvE+3b7gP/C2YyLFYxNmcLnPTMe0=
github.com/tj/go-elastic v0.0.0-20171221160941-36157cbbebc2/go.mod h1:WjeM0Oo1eNAjXGDx2yma7uG2XoyRZTq1uv3M/o7imD0=
github.com/tj/go-kinesis v0.0.0-20171128231115-08b17f58cb1b/go.mod h1:/yhzCV0xPfx6jb1bBgRFjl5lytqVqZXEaeqWP8lTEao=
github.com/tj/go-spin v1.1.0/go.mod h1:Mg1mzmePZm4dva8Qz60H2lHwmJ2loum4VIrLgVnKwh4=
github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75 h1:6fotK7otjonDflCTK0BCfls4SPy3NcCVb5dqqmbRknE=
github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75/go.mod h1:KO6IkyS8Y3j8OdNO85qEYBsRPuteD+YciPomcXdrMnk=
github.com/tomasen/realip v0.0.0-20180522021738-f0c99a92ddce/go.mod h1:o8v6yHRoik09Xen7gje4m9ERNah1d1PPsVq1VEx9vE4=
github.com/tsenart/vegeta v12.7.0+incompatible/go.mod h1:Smz/ZWfhKRcyDDChZkG3CyTHdj87lHzio/HOCkbndXM=
github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
github.com/ulikunitz/xz v0.5.6/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
github.com/ulikunitz/xz v0.5.7/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
github.com/urfave/cli v1.19.1/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
github.com/urfave/cli v1.22.2/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
github.com/urfave/cli v1.22.4/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
github.com/urfave/cli v1.22.5/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
github.com/urfave/cli v1.22.12/go.mod h1:sSBEIC79qR6OvcmsD4U3KABeOTxDqQtdDnaFuUN30b8=
github.com/urfave/cli v1.22.14 h1:ebbhrRiGK2i4naQJr+1Xj92HXZCrK7MsyTS/ob3HnAk=
github.com/urfave/cli v1.22.14/go.mod h1:X0eDS6pD6Exaclxm99NJ3FiCDRED7vIHpx2mDOHLvkA=
github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
github.com/valyala/fasttemplate v1.0.1/go.mod h1:UQGH1tvbgY+Nz5t2n7tXsz52dQxojPUpymEIMZ47gx8=
github.com/vbatts/tar-split v0.11.2/go.mod h1:vV3ZuO2yWSVsz+pfFzDG/upWH1JhjOiEaWq6kXyQ3VI=
github.com/vbatts/tar-split v0.11.5 h1:3bHCTIheBm1qFTcgh9oPu+nNBtX+XJIupG/vacinCts=
github.com/vbatts/tar-split v0.11.5/go.mod h1:yZbwRsSeGjusneWgA781EKej9HF8vme8okylkAeNKLk=
github.com/vektah/gqlparser/v2 v2.4.5/go.mod h1:flJWIR04IMQPGz+BXLrORkrARBxv/rtyIAFvd/MceW0=
github.com/veraison/go-cose v1.0.0-rc.1/go.mod h1:7ziE85vSq4ScFTg6wyoMXjucIGOf4JkFEZi/an96Ct4=
github.com/vishvananda/netlink v1.0.0/go.mod h1:+SR5DhBJrl6ZM7CoCKvpw5BKroDKQ+PJqOg65H/2ktk=
github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
github.com/vishvananda/netlink v1.2.1-beta.2 h1:Llsql0lnQEbHj0I1OuKyp8otXp0r3q0mPkuhwHfStVs=
github.com/vishvananda/netlink v1.2.1-beta.2/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
github.com/vishvananda/netns v0.0.4 h1:Oeaw1EM2JMxD51g9uhtC0D7erkIjgmj8+JZc26m1YX8=
github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
github.com/vmihailenco/msgpack v4.0.4+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
github.com/vmware/govmomi v0.30.6 h1:O3tjSwQBy0XwI5uK1/yVIfQ1LP9bAECEDUfifnyGs9U=
github.com/vmware/govmomi v0.30.6/go.mod h1:epgoslm97rLECMV4D+08ORzUBEU7boFSepKjt7AYVGg=
github.com/weppos/publicsuffix-go v0.13.1-0.20210123135404-5fd73613514e/go.mod h1:HYux0V0Zi04bHNwOHy4cXJVz/TQjYonnF6aoYhj+3QE=
github.com/weppos/publicsuffix-go v0.15.1-0.20210511084619-b1f36a2d6c0b/go.mod h1:HYux0V0Zi04bHNwOHy4cXJVz/TQjYonnF6aoYhj+3QE=
github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
github.com/xanzy/go-gitlab v0.31.0/go.mod h1:sPLojNBn68fMUWSxIJtdVVIP8uSBYqesTfDUseX11Ug=
github.com/xanzy/ssh-agent v0.2.1/go.mod h1:mLlQY/MoOhWBj+gOGMQkOeiEvkx+8pJSI+0Bx9h2kr4=
github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
github.com/xhit/go-str2duration v1.2.0/go.mod h1:3cPSlfZlUHVlneIVfePFWcJZsuwf+P1v2SRTV4cUmp4=
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos=
github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
github.com/xiang90/probing v0.0.0-20221125231312-a49e3df8f510 h1:S2dVYn90KE98chqDkyE9Z4N61UnQd+KOfgp5Iu53llk=
github.com/xiang90/probing v0.0.0-20221125231312-a49e3df8f510/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
github.com/xlab/handysort v0.0.0-20150421192137-fb3537ed64a1/go.mod h1:QcJo0QPSfTONNIgpN5RA8prR7fF8nkF6cTWTcNerRO8=
github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
github.com/yashtewari/glob-intersection v0.1.0/go.mod h1:LK7pIC3piUjovexikBbJ26Yml7g8xa5bsjfx2v1fwok=
github.com/yl2chen/cidranger v1.0.2 h1:lbOWZVCG1tCRX4u24kuM1Tb4nHqWkDxwLdoS+SevawU=
github.com/yl2chen/cidranger v1.0.2/go.mod h1:9U1yz7WPYDwf0vpNWFaeRh0bjwz5RVgRy/9UEQfHl0g=
github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX5oPXxHm3bOH+xeAttToC8pqch2ScQN/JoXYupl6xs=
github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50/go.mod h1:NUSPSUX/bi6SeDMUh6brw0nXpxHnc96TguQh0+r/ssA=
github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f/go.mod h1:GlGEuHIJweS1mbCqG+7vt2nvWLzLLnRHbXz5JKd/Qbg=
github.com/ziutek/mymysql v1.5.4/go.mod h1:LMSpPZ6DbqWFxNCHW77HeMg9I646SAhApZ/wKdgO/C0=
github.com/zmap/rc2 v0.0.0-20131011165748-24b9757f5521/go.mod h1:3YZ9o3WnatTIZhuOtot4IcUfzoKVjUHqu6WALIyI0nE=
github.com/zmap/zcertificate v0.0.0-20180516150559-0e3d58b1bac4/go.mod h1:5iU54tB79AMBcySS0R2XIyZBAVmeHranShAFELYx7is=
github.com/zmap/zcrypto v0.0.0-20210123152837-9cf5beac6d91/go.mod h1:R/deQh6+tSWlgI9tb4jNmXxn8nSCabl5ZQsBX9//I/E=
github.com/zmap/zcrypto v0.0.0-20210511125630-18f1e0152cfc/go.mod h1:FM4U1E3NzlNMRnSUTU3P1UdukWhYGifqEsjk9fn7BCk=
github.com/zmap/zlint/v3 v3.1.0/go.mod h1:L7t8s3sEKkb0A2BxGy1IWrxt1ZATa1R4QfJZaQOD3zU=
go.elastic.co/apm v1.12.0/go.mod h1:v8Yf+VZ3NplRjQUWlvPG4EV/GGtDNCVUMaafrCnmGEM=
go.elastic.co/apm/module/apmelasticsearch v1.12.0/go.mod h1:9Xy9sEsFIuAuxpZWVipG7CT/aFVdbwlGhHlXSNbuG44=
go.elastic.co/apm/module/apmhttp v1.12.0/go.mod h1:9ry+uRvkUYdur2TvEuHMmu1stOlYymnrYaGJwO3fCI4=
go.elastic.co/fastjson v1.1.0/go.mod h1:boNGISWMjQsUPy/t6yqt2/1Wx4YNPSe+mZjlyw9vKKI=
go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4=
go.etcd.io/bbolt v1.3.7 h1:j+zJOnnEjF/kyHlDDgGnVL/AIqIJPq8UoB2GSNfkUfQ=
go.etcd.io/bbolt v1.3.7/go.mod h1:N9Mkw9X8x5fupy0IKsmuqVtoGDyxsaDlbk4Rd05IAQw=
go.etcd.io/etcd v0.0.0-20191023171146-3cf2f69b5738/go.mod h1:dnLIgRNXwCJa5e+c6mIZCrds/GIG4ncV9HhK5PX7jPg=
go.etcd.io/etcd/etcdctl/v3 v3.5.0-alpha.0/go.mod h1:YPwSaBciV5G6Gpt435AasAG3ROetZsKNUzibRa/++oo=
go.etcd.io/etcd/tests/v3 v3.5.0-alpha.0/go.mod h1:HnrHxjyCuZ8YDt8PYVyQQ5d1ZQfzJVEtQWllr5Vp/30=
go.etcd.io/etcd/v3 v3.5.0-alpha.0/go.mod h1:JZ79d3LV6NUfPjUxXrpiFAYcjhT+06qqw+i28snx8To=
go.etcd.io/gofail v0.1.0/go.mod h1:VZBCXYGZhHAinaBiiqYvuDynvahNsAyLFwB3kEHKz1M=
go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=
go.opencensus.io v0.15.0/go.mod h1:UffZAU+4sDEINUGP/B7UfBBkq4fqLu9zXAX7ke6CHW0=
go.opencensus.io v0.20.1/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
go.opencensus.io v0.20.2/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
go.opencensus.io v0.22.6/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
go.opentelemetry.io/contrib v0.20.0 h1:ubFQUn0VCZ0gPwIoJfBJVpeBlyRMxu8Mm/huKWYd9p0=
go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful v0.35.0 h1:KQjX0qQ8H21oBUAvFp4ZLKJMMLIluONvSPDAFIGmX58=
go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful v0.35.0/go.mod h1:DQYkU9srMFqLUTVA/7/WlRHdnYDB7wyMMlle2ktMjfI=
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.35.0 h1:xFSRQBbXF6VvYRf2lqMJXxoB72XI1K/azav8TekHHSw=
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.35.0/go.mod h1:h8TWwRAhQpOd0aM5nYsRD8+flnkj+526GEIVlarH7eY=
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.35.1 h1:sxoY9kG1s1WpSYNyzm24rlwH4lnRYFXUVVBmKMBfRgw=
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.35.1/go.mod h1:9NiG9I2aHTKkcxqCILhjtyNA1QEiCjdBACv4IvrFQ+c=
go.opentelemetry.io/contrib/propagators/b3 v1.13.0 h1:f17PBmZK60RoHvOpJVqEka8oS2EXjpjHquESD/8zZ50=
go.opentelemetry.io/otel v1.13.0 h1:1ZAKnNQKwBBxFtww/GwxNUyTf0AxkZzrukO8MeXqe4Y=
go.opentelemetry.io/otel v1.13.0/go.mod h1:FH3RtdZCzRkJYFTCsAKDy9l/XYjMdNv6QrkFFB8DvVg=
go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.13.0 h1:pa05sNT/P8OsIQ8mPZKTIyiBuzS/xDGLVx+DCt0y6Vs=
go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.13.0/go.mod h1:rqbht/LlhVBgn5+k3M5QK96K5Xb0DvXpMJ5SFQpY6uw=
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.13.0 h1:Any/nVxaoMq1T2w0W85d6w5COlLuCCgOYKQhJJWEMwQ=
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.13.0/go.mod h1:46vAP6RWfNn7EKov73l5KBFlNxz8kYlxR1woU+bJ4ZY=
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.13.0 h1:Wz7UQn7/eIqZVDJbuNEM6PmqeA71cWXrWcXekP5HZgU=
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.13.0/go.mod h1:OhH1xvgA5jZW2M/S4PcvtDlFE1VULRRBsibBrKuJQGI=
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.14.0/go.mod h1:+N7zNjIJv4K+DeX67XXET0P+eIciESgaFDBqh+ZJFS4=
go.opentelemetry.io/otel/metric v0.32.1 h1:ftff5LSBCIDwL0UkhBuDg8j9NNxx2IusvJ18q9h6RC4=
go.opentelemetry.io/otel/metric v0.32.1/go.mod h1:iLPP7FaKMAD5BIxJ2VX7f2KTuz//0QK2hEUyti5psqQ=
go.opentelemetry.io/otel/sdk v1.13.0 h1:BHib5g8MvdqS65yo2vV1s6Le42Hm6rrw08qU6yz5JaM=
go.opentelemetry.io/otel/sdk v1.13.0/go.mod h1:YLKPx5+6Vx/o1TCUYYs+bpymtkmazOMT6zoRrC7AQ7I=
go.opentelemetry.io/otel/trace v1.13.0 h1:CBgRZ6ntv+Amuj1jDsMhZtlAPT6gbyIRdaIzFhfBSdY=
go.opentelemetry.io/otel/trace v1.13.0/go.mod h1:muCvmmO9KKpvuXSf3KKAXXB2ygNYHQ+ZfI5X08d3tds=
go.opentelemetry.io/proto/otlp v0.19.0 h1:IVN6GR+mhC4s5yfcTbmzHYODqvWAp3ZedA2SJPI1Nnw=
go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
go.uber.org/atomic v1.10.0 h1:9qC72Qh0+3MqyJbAn8YU5xVq1frD8bn3JtD2oXtafVQ=
go.uber.org/atomic v1.10.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
go.uber.org/automaxprocs v1.4.0/go.mod h1:/mTEdr7LvHhs0v7mjdxDreTz1OG5zdZGqgOnhWiR/+Q=
go.uber.org/automaxprocs v1.5.1/go.mod h1:BF4eumQw0P9GtnuxxovUd06vwm1o18oMzFtK66vU6XU=
go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
go.uber.org/goleak v1.2.0/go.mod h1:XJYK+MuIchqpmGmUSAzotztawfKvYLUIgg7guXrwVUo=
go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
go.uber.org/goleak v1.2.1/go.mod h1:qlT2yGI9QafXHhZZLxlSuNsMw3FFLxBr+tBRlmO1xH4=
go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
go.uber.org/multierr v1.7.0/go.mod h1:7EAYxJLBy9rStEaz58O2t4Uvip6FSURkq8/ppBp95ak=
go.uber.org/multierr v1.9.0 h1:7fIwc/ZtS0q++VgcfqFDxSBZVv/Xo49/SYnDFupUwlI=
go.uber.org/multierr v1.9.0/go.mod h1:X2jQV1h+kxSjClGpnseKVIxpmcjrj7MNnI0bnlfKTVQ=
go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
go.uber.org/zap v1.13.0/go.mod h1:zwrFLgMcdUuIBviXEYEH1YKNaOBnKXsx2IPda5bBwHM=
go.uber.org/zap v1.16.0/go.mod h1:MA8QOfq0BHJwdXa996Y4dYkAqRKB8/1K1QMMZVaNZjQ=
go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
go.uber.org/zap v1.18.1/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60=
go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
gocloud.dev v0.19.0/go.mod h1:SmKwiR8YwIMMJvQBKLsC3fHNyMwXLw3PMDO+VVteJMI=
golang.org/x/crypto v0.0.0-20180501155221-613d6eafa307/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
golang.org/x/crypto v0.0.0-20190219172222-a4c6cb3142f2/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20190418165655-df01cb2cc480/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
golang.org/x/crypto v0.0.0-20191002192127-34f69633bfdc/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
golang.org/x/crypto v0.0.0-20191117063200-497ca9f6d64f/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
golang.org/x/crypto v0.0.0-20200414173820-0848c9571904/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
golang.org/x/crypto v0.0.0-20201124201722-c8d3bf9c5392/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
golang.org/x/crypto v0.0.0-20210314154223-e6e6c4f2bb5b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
golang.org/x/crypto v0.0.0-20210506145944-38f3c27a63bf/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
golang.org/x/crypto v0.0.0-20220112180741-5e0467b6c7ce/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
golang.org/x/crypto v0.0.0-20220314234659-1baeb1ce4c0b/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
golang.org/x/crypto v0.0.0-20220427172511-eb4f295cb31f/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
golang.org/x/exp v0.0.0-20200331195152-e8c3332aa8e5/go.mod h1:4M0jN8W1tt0AVLNr8HDosyJCDCDuyL9N9+3m7wDWgKw=
golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
golang.org/x/mod v0.6.0/go.mod h1:4mET923SAdbXp2ki8ey+zGs1SLqsuM2Y0uvdZR/fUNI=
golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
golang.org/x/mod v0.11.0 h1:bUO06HqtnRcc/7l71XBe4WcqTZ+3AH1J59zWDDwLKgU=
golang.org/x/mod v0.11.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
golang.org/x/oauth2 v0.0.0-20190402181905-9f3314589c9a/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
golang.org/x/oauth2 v0.0.0-20210427180440-81ed05c6b58c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
golang.org/x/oauth2 v0.0.0-20211005180243-6b3c2da341f1/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
golang.org/x/oauth2 v0.0.0-20220608161450-d0670ef3b1eb/go.mod h1:jaDAt6Dkxork7LmZnYtzbRWj0W47D86a3TGe0YHBvmE=
golang.org/x/oauth2 v0.0.0-20220622183110-fd043fe589d2/go.mod h1:jaDAt6Dkxork7LmZnYtzbRWj0W47D86a3TGe0YHBvmE=
golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
golang.org/x/oauth2 v0.0.0-20221014153046-6fdb5e3db783/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
golang.org/x/oauth2 v0.5.0/go.mod h1:9/XBHVqLaWO3/BRHs5jbpYCnOZVjj5V0ndyaAM7KB4I=
golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw=
golang.org/x/oauth2 v0.7.0/go.mod h1:hPLQkd9LyjfXTiRohC/41GhcFqxisoUQ99sCUOHO9x4=
golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
golang.org/x/oauth2 v0.10.0 h1:zHCpF2Khkwy4mMB4bv0U37YtJdTGW8jI0glAApi0Kh8=
golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI=
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20190412183630-56d357773e84/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o=
golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/time v0.0.0-20211116232009-f0f3c7e86c11/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
golang.org/x/tools v0.0.0-20190422233926-fe54fb35175b/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
golang.org/x/tools v0.0.0-20190614205625-5aca471b1d59/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
golang.org/x/tools v0.0.0-20190624222133-a101b041ded4/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
golang.org/x/tools v0.0.0-20190729092621-ff9f1409240a/go.mod h1:jcCCGcm9btYwXyDqrUWc6MKQKKGJCWEQ3AfLSRIbEuI=
golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20190907020128-2ca718005c18/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20191010075000-0337d82405ff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20191112195655-aa38f8e97acc/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20191118222007-07fc4c7f2b98/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
golang.org/x/tools v0.0.0-20200103221440-774c71fcf114/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
golang.org/x/tools v0.0.0-20200115044656-831fdb1e1868/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
golang.org/x/tools v0.0.0-20200426102838-f3a5411a4c3b/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
golang.org/x/tools v0.0.0-20200505023115-26f46d2f7ef8/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
golang.org/x/tools v0.0.0-20200509030707-2212a7e161a5/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
golang.org/x/tools v0.0.0-20200522201501-cb1345f3a375/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
golang.org/x/tools v0.0.0-20200616133436-c1934b75d054/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
golang.org/x/tools v0.0.0-20200717024301-6ddee64345a6/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
golang.org/x/tools v0.1.9/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
golang.org/x/tools v0.2.0/go.mod h1:y4OqIKeOV/fWJetJ8bXPU1sEVniLMIyDAZWeHdV+NTA=
golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
golang.org/x/tools v0.8.0/go.mod h1:JxBZ99ISMI5ViVkT1tr6tdNmXeTrcpVSD3vZ1RsRdN4=
golang.org/x/tools v0.10.0 h1:tvDr/iQoUqNdohiYm0LmmKcBk+q86lb9EprIUFhHHGg=
golang.org/x/tools v0.10.0/go.mod h1:UJwyiVBsOA2uwvK/e5OY3GTpDUJriEd+/YlqAwLPmyM=
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b h1:J1CaxgLerRR5lgx3wnr6L04cJFbWoceSK9JWBdglINo=
golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b/go.mod h1:tqur9LnfstdR9ep2LaJT4lFUl0EjlHtge+gAjmsHUG4=
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6 h1:CawjfCvYQH2OU3/TnxLx97WDSUDRABfT18pCOYwc2GE=
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6/go.mod h1:3rxYc4HtVcSG9gVaTs2GEBdehh+sYPOwKtyUWEOTb80=
gomodules.xyz/jsonpatch/v2 v2.2.0/go.mod h1:WXp+iVDkoLQqPudfQ9GBlwB2eZ5DKOnjQZCYdOS8GPY=
gonum.org/v1/gonum v0.0.0-20181121035319-3f7ecaa7e8ca/go.mod h1:Y+Yx5eoAFn32cQvJDxZx5Dpnq+c3wtXuadVZAcxbbBo=
gonum.org/v1/netlib v0.0.0-20181029234149-ec6d1f5cefe6/go.mod h1:wa6Ws7BG/ESfp6dHfk7C6KdzKA7wR7u/rKwOGE66zvw=
google.golang.org/api v0.60.0 h1:eq/zs5WPH4J9undYM9IP1O7dSr7Yh8Y0GtSCpzGzIUk=
google.golang.org/api v0.60.0/go.mod h1:d7rl65NZAkEQ90JFzqBjcRq1TVeG5ZoGV3sSpEnnVb4=
google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
google.golang.org/appengine v1.2.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
google.golang.org/appengine v1.6.2/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
google.golang.org/cloud v0.0.0-20151119220103-975617b05ea8/go.mod h1:0H1ncTHf11KCFhTc/+EFRbzSCOZx+VUbRMk55Yv5MYk=
google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21 h1:hrbNEivu7Zn1pxvHk6MBrq9iE22woVILTHqexqBxe6I=
google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
google.golang.org/genproto/googleapis/api v0.0.0-20230525234035-dd9d682886f9/go.mod h1:vHYtlOoi6TsQ3Uk2yxR7NI5z8uoV+3pZtR4jmHIkRig=
google.golang.org/genproto/googleapis/api v0.0.0-20230526203410-71b5a4ffd15e/go.mod h1:vHYtlOoi6TsQ3Uk2yxR7NI5z8uoV+3pZtR4jmHIkRig=
google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:vHYtlOoi6TsQ3Uk2yxR7NI5z8uoV+3pZtR4jmHIkRig=
google.golang.org/genproto/googleapis/api v0.0.0-20230711160842-782d3b101e98/go.mod h1:rsr7RhLuwsDKL7RmgDDCUc6yaGr1iqceVb5Wv6f6YvQ=
google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234030-28d5490b6b19/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
google.golang.org/genproto/googleapis/rpc v0.0.0-20230526203410-71b5a4ffd15e/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
google.golang.org/genproto/googleapis/rpc v0.0.0-20230706204954-ccb25ca9f130/go.mod h1:8mL13HKkDa+IuJ8yruA3ci0q+0vsUz4m//+ottjwS5o=
google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98/go.mod h1:TUfxEVdsvPg18p6AslUXFoLdpED4oBnGwyqk3dV1XzM=
google.golang.org/grpc v1.58.3 h1:BjnpXut1btbtgN/6sp+brB2Kbm2LjNXnidYujAVbSoQ=
google.golang.org/grpc v1.58.3/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
google.golang.org/protobuf v1.25.1-0.20200805231151-a709e31e5d12/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
google.golang.org/protobuf v1.29.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
google.golang.org/protobuf v1.29.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d/go.mod h1:cuepJuh7vyXfUyUwEgHQXw849cJrilpS5NeIjOWESAw=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
gopkg.in/cheggaaa/pb.v1 v1.0.28/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
gopkg.in/gcfg.v1 v1.2.3 h1:m8OOJ4ccYHnx2f4gQwpno8nAX5OGOh7RLaaz0pj3Ogs=
gopkg.in/gcfg.v1 v1.2.3/go.mod h1:yesOnuUOFQAhST5vPY4nbZsb/huCgGGXlipJsBn0b3o=
gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
gopkg.in/ini.v1 v1.51.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
gopkg.in/ini.v1 v1.62.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
gopkg.in/ldap.v2 v2.5.1/go.mod h1:oI0cpe/D7HRtBQl8aTg+ZmzFUAvu4lsv3eLXMLGFxWk=
gopkg.in/natefinch/lumberjack.v2 v2.0.0 h1:1Lc07Kr7qY4U2YPouBjpCLxpiyxIVoxqXgkXLknAOE8=
gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI=
gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
gopkg.in/src-d/go-billy.v4 v4.3.2/go.mod h1:nDjArDMp+XMs1aFAESLRjfGSgfvoYN0hDfzEk0GjC98=
gopkg.in/src-d/go-git-fixtures.v3 v3.5.0/go.mod h1:dLBcvytrw/TYZsNTWCnkNF2DSIlzWYqTe3rJR56Ac7g=
gopkg.in/src-d/go-git.v4 v4.13.1/go.mod h1:nx5NYcxdKxq5fpltdHnPa2Exj4Sx0EclMWZQbYDu2z8=
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
honnef.co/go/tools v0.1.4/go.mod h1:NgwopIslSNH47DimFoV78dnkksY2EFtX0ajyb3K/las=
howett.net/plist v0.0.0-20181124034731-591f970eefbb/go.mod h1:vMygbs4qMhSZSc4lCUl2OEE+rDiIIJAIdR4m7MiMcm0=
inet.af/tcpproxy v0.0.0-20200125044825-b6bb9b5b8252 h1:gmJCKidOfjKDUHF1jjke+I+2iQIyE3HNNxu2OKO/FUI=
inet.af/tcpproxy v0.0.0-20200125044825-b6bb9b5b8252/go.mod h1:zq+R+tLcdHugi7Jt+FtIQY6m6wtX34lr2CdQVH2fhW0=
k8s.io/gengo v0.0.0-20210813121822-485abfe95c7c/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
k8s.io/gengo v0.0.0-20220902162205-c0856e24416d h1:U9tB195lKdzwqicbJvyJeOXV7Klv+wNAWENRnXEGi08=
k8s.io/gengo v0.0.0-20220902162205-c0856e24416d/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f h1:2kWPakN3i/k81b0gvD5C5FJ2kxm1WrQFanWchyKuqGg=
k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f/go.mod h1:byini6yhqGC14c3ebc/QwanvYwhuMWF6yz2F8uwW8eg=
k8s.io/utils v0.0.0-20200324210504-a9aa75ae1b89/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
k8s.io/utils v0.0.0-20210722164352-7f3ee0f31471/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
k8s.io/utils v0.0.0-20210802155522-efc7438f0176/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
k8s.io/utils v0.0.0-20210819203725-bdf08cb9a70a/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
k8s.io/utils v0.0.0-20211116205334-6203023598ed/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
k8s.io/utils v0.0.0-20230209194617-a36077c30491/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 h1:qY1Ad8PODbnymg2pRbkyMT/ylpTrCM8P2RJ0yroCyIk=
k8s.io/utils v0.0.0-20230406110748-d93618cff8a2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
oras.land/oras-go v1.2.0/go.mod h1:pFNs7oHp2dYsYMSS82HaX5l4mpnGO7hbpPN6EWH2ltc=
pack.ag/amqp v0.11.2/go.mod h1:4/cbmt4EJXSKlG6LCfWHoqmN0uFdy5i/+YFz+fTfhV4=
rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.1.2 h1:trsWhjU5jZrx6UvFu4WzQDrN7Pga4a7Qg+zcfcj64PA=
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.1.2/go.mod h1:+qG7ISXqCDVVcyO8hLn12AKVYYUjM7ftlqsqmrhMZE0=
sigs.k8s.io/controller-runtime v0.9.6/go.mod h1:q6PpkM5vqQubEKUKOM6qr06oXGzOBcCby1DA9FbyZeA=
sigs.k8s.io/controller-runtime v0.9.7/go.mod h1:nExcHcQ2zvLMeoO9K7rOesGCmgu32srN5SENvpAEbGA=
sigs.k8s.io/controller-runtime v0.10.1 h1:+eLHgY/VrJWnfg6iXUqhCUqNXgPH1NZeP9drNAAgWlg=
sigs.k8s.io/controller-runtime v0.10.1/go.mod h1:CQp8eyUQZ/Q7PJvnIrB6/hgfTC1kBkGylwsLgOQi1WY=
sigs.k8s.io/controller-tools v0.6.2/go.mod h1:oaeGpjXn6+ZSEIQkUe/+3I40PNiDYp9aeawbt3xTgJ8=
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
sigs.k8s.io/kind v0.11.1/go.mod h1:fRpgVhtqAWrtLB9ED7zQahUimpUXuG/iHT88xYqEGIA=
sigs.k8s.io/structured-merge-diff/v4 v4.1.2/go.mod h1:j/nl6xW8vLS49O8YvXW1ocPhZawJtm+Yrr7PPRQ0Vg4=
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=
sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
sourcegraph.com/sourcegraph/appdash v0.0.0-20190731080439-ebfcffb1b5c0/go.mod h1:hI742Nqp5OhwiqlzhgfbWU4mW4yO10fP+LoT9WOswdU=
0707010000005A000081A4000000000000000000000001653C446F00006ADA000000000000000000000000000000000000001F00000000rke2-1.27.7+rke2r1/install.ps1<#
.SYNOPSIS
  Installs Rancher RKE2 to create Windows Worker Nodes.
.DESCRIPTION
  Run the script to install all Rancher RKE2 related needs.
.Parameter Channel
    Channel to use for fetching rke2 download URL.
    Defaults to 'stable'.`
.Parameter Method
    The installation method to use. Currently tar or choco installation supported.
    Default is on Windows systems is "tar".`
.Parameter Type
    Type of rke2 service. Only the "agent" type is supported on Windows.
    Default is "agent".`
.Parameter Version
    Version of rke2 to download from github.`
.Parameter TarPrefix
    Installation prefix when using the tar installation method. This needs to match the value of CATTLE_AGENT_BIN_PREFIX
    Default is C:/usr/local, unless C:/usr/local is read-only or has a dedicated mount point,
    in which case C:/opt/rke2 is used instead.`
.Parameter Commit
    Commit of RKE2 to download from temporary cloud storage.
    If set, this forces Method=tar.
    * (for developer & QA use only)`
.Parameter AgentImagesDir
    Installation path for airgap images when installing from CI commit.
    Default is C:/var/lib/rancher/rke2/agent/images`
.Parameter ArtifactPath
    If set, the install script will use the local path for sourcing the rke2.windows-$SUFFIX and sha256sum-$ARCH.txt files
    rather than the downloading the files from the internet.
    Default is not set.`
.EXAMPLE
  Usage:
    Invoke-WebRequest ((New-Object System.Net.WebClient).DownloadString('https://github.com/rancher/rke2/blob/master/install.ps1'))
    ./install.ps1
.EXAMPLE
  Usage:
    Invoke-WebRequest ((New-Object System.Net.WebClient).DownloadString('https://github.com/rancher/rke2/blob/master/install.ps1'))
    ./install.ps1 -Channel Latest
.EXAMPLE
  Usage:
    Invoke-WebRequest ((New-Object System.Net.WebClient).DownloadString('https://github.com/rancher/rke2/blob/master/install.ps1'))
    ./install.ps1 -Channel Latest -Method Tar
#>

[CmdletBinding()]
param (
    [Parameter()]
    [String]
    $Channel = "stable",
    [Parameter()]
    [ValidateSet("choco", "tar")]
    [String]
    $Method = "tar",
    [Parameter()]
    [ValidateSet("agent")]
    [String]
    $Type = "agent",
    [Parameter()]
    [String]
    $Version,
    [Parameter()]
    [String]
    $TarPrefix = "C:/usr/local",
    [Parameter()]
    [String]
    $Commit,
    [Parameter()]
    [String]
    $AgentImagesDir = "C:/var/lib/rancher/rke2/agent/images",
    [Parameter()]
    [String]
    $ArtifactPath = "",
    [Parameter()]
    [String]
    $ChannelUrl = "https://update.rke2.io/v1-release/channels"
)

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

function Write-InfoLog() {
    Write-Output "[INFO] $($args -join " ")"
}

function Write-WarnLog() {
    Write-Output "[WARN] $($args -join " ")"
}

function Write-DebugLog() {
    Write-Output "[DEBUG] $($args -join " ")"
}

# fatal logs the given argument at fatal log level.
function Write-FatalLog() {
    Write-Output "[ERROR] $($args -join " ")"
    if ([string]::IsNullOrEmpty($suffix)) {
        $archInfo = Get-ArchitectureInfo
        $suffix = $archInfo.Suffix
        Write-Output "[ALT] Please visit 'https://github.com/rancher/rke2/releases' directly and download the latest rke2.$suffix.tar.gz"
    }
    exit 1
}

function Confirm-WindowsFeatures {
    [CmdletBinding()]
    param (
        [Parameter(Mandatory = $true)]
        [String[]]
        $RequiredFeatures
    )
    foreach ($feature in $RequiredFeatures) {
        $f = Get-WindowsFeature -Name $feature
        if (-not $f.Installed) {
            Write-FatalLog "Windows feature: '$feature' is not installed. Please run: Install-WindowsFeature -Name $feature"
        }
        else {
            Write-InfoLog "Windows feature: '$feature' is installed. Installation will proceed."
        }
    }
}

# setup_env defines needed environment variables.
function Set-Environment() {
    # --- bail if we are not administrator ---
    $adminRole = [Security.Principal.WindowsBuiltInRole]::Administrator
    $currentRole = [Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()
    if (-NOT $currentRole.IsInRole($adminRole)) {
        Write-FatalLog "You need to be administrator to perform this install"
    }
    if ($env:CATTLE_AGENT_BIN_PREFIX) {
        $TarPrefix = $env:CATTLE_AGENT_BIN_PREFIX
        [System.Environment]::SetEnvironmentVariable('CATTLE_AGENT_BIN_PREFIX', $TarPrefix, 'Machine')
    }
    else {
        [System.Environment]::SetEnvironmentVariable('CATTLE_AGENT_BIN_PREFIX', $TarPrefix, 'Machine')
    }

Write-Host "Using $($Channel) channel of rke2 for installation"
}

# check_method_conflict will exit with an error if the user attempts to install
# via tar method on a host with existing chocolatey package.
function Test-MethodConflict() {
    if ($Method -eq "choco") {
        $ChocoPackages = choco list --localonly
        if ($ChocoPackages.Select -Like "rke2") {
            Write-FatalLog "Cannot perform $($Method): -tar install on host with existing RKE2 Choco Files - please run rke2-uninstall.ps1 first"
        }
    }
}

# setup_arch set arch and suffix,
# fatal if architecture not supported.
function Get-ArchitectureInfo() {
    $arch = $env:PROCESSOR_ARCHITECTURE.ToLower()
    if ("$arch" -ne "amd64") {
        Write-FatalLog "unsupported architecture $(env:PROCESSOR_ARCHITECTURE)"
        exit 1
    }
    return @{ Suffix = "windows-$arch"; Arch = "$arch" }
}

# get Windows Server Build Version
function Get-BuildVersion() {
    $buildVersion = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" -Name ReleaseId).ReleaseId
    if ("$buildVersion" -eq "2009") {
        $buildVersion = "20H2"
    }
    if ("$buildVersion" -eq "1809" -or "2022" -or "2004" -or "20H2") {
        return $buildVersion
    }
    else {
        Write-FatalLog "unsupported build version $buildVersion"
        exit 1
    }
}

# --- use desired rke2 version if defined or find version from channel ---
function Get-ReleaseVersion() {
    if ($Commit) {
        $Version = "commit $($Commit)"
    }
    elseif ($Version) {
        $Version = $Version
    }
    else {
        $versionUrl = "$ChannelUrl/$Channel"
        $result = New-Object System.Uri($(curl.exe -w "%{url_effective}" -L -s -S $versionUrl -o "$TMP_DIR/version.html"))
        $Version = $result.Segments | Select-Object -Last 1
        Remove-Item -Path "$TMP_DIR/version.html" -Force
    }
    return $Version
}

# download_checksums downloads the binary checksums from github or CI storage url
# and prepares the checksum value for later validation.
function Get-BinaryChecksums() {
    [CmdletBinding()]
    param (
        [Parameter()]
        [String]
        $CommitHash,
        [Parameter()]
        [String]
        $StorageUrl,
        [Parameter()]
        [String]
        $Rke2Version,
        [Parameter()]
        [String]
        $Rke2GitHubUrl,
        [Parameter()]
        [String]
        $TempBinaryChecksums
    )

$archInfo = Get-ArchitectureInfo
    $suffix = $archInfo.Suffix
    $arch = $archInfo.Arch
    $binaryChecksumsUrl = ""

if ($CommitHash) {
        $binaryChecksumsUrl = "$StorageUrl/rke2.$suffix-$CommitHash.tar.gz.sha256sum"
        Write-Host "downloading binary checksum for commit: $CommitHash at $binaryChecksumsUrl"
        curl.exe -sfL $binaryChecksumsUrl -o $TempBinaryChecksums

return Find-Checksum -ChecksumFilePath $TempBinaryChecksums -Pattern "rke2.$suffix.tar.gz"
    }
    else {
        $binaryChecksumsUrl = "$Rke2GitHubUrl/releases/download/$Rke2Version/sha256sum-$arch.txt"
        Write-Host "downloading binary checksum from $binaryChecksumsUrl"
        curl.exe -sfL $binaryChecksumsUrl -o $TempBinaryChecksums

return Find-Checksum -ChecksumFilePath $TempBinaryChecksums -Pattern "rke2.$suffix.tar.gz"
    }
}

# download_airgap_checksums downloads the checksum file for the airgap image tarball
# and prepares the checksum value for later validation.
function Get-ImageChecksums() {
    [CmdletBinding()]
    param (
        [Parameter()]
        [String]
        $CommitHash,
        [Parameter()]
        [String]
        $StorageUrl,
        [Parameter()]
        [String]
        $Rke2Version,
        [Parameter()]
        [String]
        $Rke2GitHubUrl,
        [Parameter()]
        [String]
        $TempImageChecksums
    )

$archInfo = Get-ArchitectureInfo
    $suffix = $archInfo.Suffix
    $arch = $archInfo.Arch
    $imageChecksumsUrl = ""

if ($CommitHash) {
        $imageChecksumsUrl = "$StorageUrl/rke2-images.$suffix-$CommitHash.tar.zst.sha256sum"
        Write-Host "downloading image checksum for commit: $CommitHash at $imageChecksumsUrl"
        curl.exe -sfL $imageChecksumsUrl -o $TempImageChecksums

return Find-Checksum -ChecksumFilePath $TempImageChecksums -Pattern "rke2-images.$suffix.tar.zst"
    }
    else {
        $imageChecksumsUrl = "$Rke2GitHubUrl/releases/download/$Rke2Version/sha256sum-$arch.txt"
        Write-Host "downloading image checksum from $imageChecksumsUrl"
        curl.exe -sfL $imageChecksumsUrl -o $TempImageChecksums

return Find-Checksum -ChecksumFilePath $TempImageChecksums -Pattern "rke2-windows-$BuildVersion-$arch-images.tar.gz"
    }
}
# download_tarball downloads binary from github or CI storage url.
function Get-BinaryTarball() {
    [CmdletBinding()]
    param (
        [Parameter()]
        [String]
        $CommitHash,
        [Parameter()]
        [String]
        $StorageUrl,
        [Parameter()]
        [String]
        $Rke2Version,
        [Parameter()]
        [String]
        $Rke2GitHubUrl,
        [Parameter()]
        [String]
        $TempTarball
    )

$archInfo = Get-ArchitectureInfo
    $suffix = $archInfo.Suffix

$tarballUrl = ""
    if ($CommitHash) {
        $tarballUrl = "$StorageUrl/rke2.$suffix-$CommitHash.tar.gz"
        Write-Host "downloading binary tarball for commit: $CommitHash at $tarballUrl"
        curl.exe -sfL $tarballUrl -o $TempTarball
    }
    else {
        $tarballUrl = "$Rke2GitHubUrl/releases/download/$Rke2Version/rke2.$suffix.tar.gz"
        Write-InfoLog "downloading binary tarball at $tarballUrl"
        curl.exe -sfL $tarballUrl -o $TempTarball
    }
}

# stage_local_checksums stages the binary local checksum hash for validation.
function Copy-LocalBinaryChecksums() {
    [CmdletBinding()]
    param (
        [Parameter()]
        [String]
        $CommitHash,
        [Parameter()]
        [String]
        $Path,
        [Parameter()]
        [String]
        $DestinationPath
    )  
    $archInfo = Get-ArchitectureInfo
    $suffix = $archInfo.Suffix    
    $arch = $archInfo.Arch

if ($CommitHash) {
        Write-InfoLog "staging local binary checksum from $Path/rke2.$suffix-$CommitHash.tar.gz.sha256sum"
        Copy-Item -Path "$Path/rke2.$suffix-$CommitHash.tar.gz.sha256sum" -Destination $DestinationPath -Force
        $expectedBinaryChecksum = Find-Checksum -ChecksumFilePath $DestinationPath -Pattern "rke2.$suffix.tar.gz"
        $expectedBinaryAirgapChecksum = ""
        if (Test-Path -Path "$Path/rke2.$suffix-$CommitHash.tar.gz" -PathType Leaf) {
            # TODO: Select-String
            $expectedBinaryAirgapChecksum = Find-Checksum -ChecksumFilePath $DestinationPath -Pattern "rke2.$suffix.tar.gz"
        }
        return @{ ExpectedBinaryChecksum = $expectedBinaryChecksum; ExpectedBinaryAirgapChecksum = $expectedBinaryAirgapChecksum }
    }
    else {
        Copy-Item -Path "$Path/sha256sum-$arch.txt" -Destination $DestinationPath -Force
        $expectedBinaryChecksum = Find-Checksum -ChecksumFilePath $DestinationPath -Pattern "rke2.$suffix.tar.gz"
        $expectedBinaryAirgapChecksum = ""
        if (Test-Path -Path "$Path/rke2.$suffix.tar.gz" -PathType Leaf) {
            # TODO: Select-String
            $expectedBinaryAirgapChecksum = Find-Checksum -ChecksumFilePath $DestinationPath -Pattern "rke2.$suffix.tar.gz"
        }
        return @{ ExpectedBinaryChecksum = $expectedBinaryChecksum; ExpectedBinaryAirgapChecksum = $expectedBinaryAirgapChecksum }
    }
     return @{ ExpectedBinaryChecksum = ""; ExpectedBinaryAirgapChecksum = "" }
}

function Copy-LocalImageChecksums() {
    [CmdletBinding()]
    param (
        [Parameter()]
        [String]
        $CommitHash,
        [Parameter()]
        [String]
        $Path,
        [Parameter()]
        [String]
        $DestinationPath
    )  
    $archInfo = Get-ArchitectureInfo
    $suffix = $archInfo.Suffix    
    $arch = $archInfo.Arch

if ($CommitHash) {
        if (Test-Path -Path "$Path/rke2-images.$suffix-$CommitHash.tar.zst" -PathType Leaf) {
            $expectedImageAirgapChecksum = ""
            $expectedImageChecksum = Find-Checksum -ChecksumFilePath $DestinationPath -Pattern "rke2-images.$suffix.tar.zst"
            Write-InfoLog "staging local image checksum from $Path/rke2-images.$suffix-$CommitHash.tar.zst.sha256sum"
            Copy-Item -Path "$Path/rke2-images.$suffix-$CommitHash.tar.zst.sha256sum" -Destination $DestinationPath -Force
            $expectedImageAirgapChecksum = Find-Checksum -ChecksumFilePath $TempImageChecksums -Pattern "rke2-images.$suffix.tar.zst"
            return @{ ExpectedImageChecksum = $expectedImageChecksum ; ExpectedImageAirgapChecksum = $expectedImageAirgapChecksum }
        }
    }
    # TODO: possibly add a condition where commithash is not set and no local checksums are present
    else {
        if (Test-Path -Path "$Path/rke2-windows-$BuildVersion-$arch-images.tar.gz" -PathType Leaf) {
            $expectedImageAirgapChecksum = ""
            $expectedImageChecksum = Find-Checksum -ChecksumFilePath $DestinationPath -Pattern "rke2-windows-$BuildVersion-$arch-images.tar.gz"
            Copy-Item -Path "$Path/sha256sum-$arch.txt" -Destination $DestinationPath -Force
            $expectedImageAirgapChecksum = Find-Checksum -ChecksumFilePath $TempImageChecksums -Pattern "rke2-windows-$BuildVersion-$arch-images.tar.gz"
            return @{ ExpectedImageChecksum = $expectedImageChecksum ; ExpectedImageAirgapChecksum = $expectedImageAirgapChecksum }
        }
        elseif (Test-Path -Path "$Path/rke2-windows-$BuildVersion-$arch-images.tar.zst" -PathType Leaf) {
            $expectedImageAirgapChecksum = ""
            $expectedImageChecksum = Find-Checksum -ChecksumFilePath $DestinationPath -Pattern "rke2-windows-$BuildVersion-$arch-images.tar.zst"
            Write-Host "staging local image checksums from $Path/sha256sum-$arch.txt"
            Copy-Item -Path "$Path/sha256sum-$arch.txt" -Destination $DestinationPath -Force
            $expectedImageAirgapChecksum = Find-Checksum -ChecksumFilePath $TempImageChecksums -Pattern "rke2-windows-$BuildVersion-$arch-images.tar.zst"
            return @{ ExpectedImageChecksum = $expectedImageChecksum ; ExpectedImageAirgapChecksum = $expectedImageAirgapChecksum }
        }
    }
    return @{ ExpectedImageChecksum = ""; ExpectedImageAirgapChecksum = "" }
}

# stage_local_tarball stages the local airgap binary tarball.
function Copy-LocalBinaryTarball() {
    [CmdletBinding()]
    param (
        [Parameter()]
        [String]
        $CommitHash,
        [Parameter()]
        [String]
        $Path,
        [Parameter()]
        [String]
        $DestinationPath
    )
    $archInfo = Get-ArchitectureInfo
    $suffix = $archInfo.Suffix

if (-Not $CommitHash) {
        Write-InfoLog "staging local binary tarball from $ArtifactPath/rke2.$suffix.tar.gz"
        Copy-Item -Path "$Path/rke2.$suffix.tar.gz" -Destination $DestinationPath -Force
    }
    elseif (Test-Path -Path "$Path/rke2.$suffix-$CommitHash.tar.zst" -PathType Leaf) {
        Write-InfoLog "staging local binary tarball from $ArtifactPath/rke2.$suffix-$CommitHash.tar.zst"
        Copy-Item -Path "$Path/rke2.$suffix-$CommitHash.tar.zst" -Destination $DestinationPath -Force
        ]    
    }
}

# stage_local_airgap_tarball stages the local checksum hash for validation.
function Copy-LocalAirgapTarball() {
    [CmdletBinding()]
    param (
        [Parameter()]
        [String]
        $CommitHash,
        [Parameter()]
        [String]
        $Path,
        [Parameter()]
        [String]
        $DestinationPath
    )

$archInfo = Get-ArchitectureInfo
    $arch = $archInfo.Arch
    $suffix = $archInfo.Suffix

if (-Not $CommitHash) {
        if (Test-Path -Path "$Path/rke2-windows-$BuildVersion-$arch-images.tar.zst" -PathType Leaf) {
            Write-InfoLog "staging local zst airgap image tarball from $Path/rke2-windows-$BuildVersion-$arch-images.tar.zst"
            Copy-Item -Path "$Path/rke2-windows-$BuildVersion-$arch-images.tar.zst" -Destination $DestinationPath -Force
        }
        elseif (Test-Path -Path "$Path/rke2-windows-$BuildVersion-$arch-images.tar.gz" -PathType Leaf) {
            Write-InfoLog "staging local gz airgap image tarball from $Path/rke2-windows-$BuildVersion-$arch-images.tar.gz"
            Copy-Item -Path "$Path/rke2-windows-$BuildVersion-$arch-images.tar.gz" -Destination $DestinationPath -Force
        }
    }
    elseif (Test-Path -Path "$Path/rke2-images.$suffix-$CommitHash.tar.zst" -PathType Leaf) {
        Write-InfoLog "staging local image tarball with commit $CommitHash from $Path/rke2-images.$suffix-$CommitHash.tar.zst"
        Copy-Item -Path "$Path/rke2-images.$suffix-$CommitHash.tar.zst" -Destination $DestinationPath -Force
    }
}

# verify_tarball verifies the downloaded installer checksum.
function Test-TarballChecksum() {
    [CmdletBinding()]
    param (
        [Parameter()]
        [String]
        $Tarball,
        [Parameter()]
        [String]
        $ExpectedChecksum
    )
    Write-InfoLog "verifying tarball"
    $actualChecksum = (Get-FileHash -Path $Tarball -Algorithm SHA256).Hash.ToLower()
    if ($ExpectedChecksum -ne $actualChecksum) {
        Write-FatalLog "downloaded sha256 does not match expected checksum: $ExpectedChecksum, instead got: $actualChecksum"
    }
}

# unpack_tarball extracts the tarball, correcting paths as necessary
function Expand-Tarball() {
    [CmdletBinding()]
    param (
        [Parameter()]
        [string]
        $InstallPath,
        [Parameter()]
        [String]
        $Tarball
    )
    Write-InfoLog "unpacking tarball file to $InstallPath"
    New-Item -Path $InstallPath -Type Directory -Force | Out-Null
    tar xzf "$Tarball" -C "$InstallPath"
}

function Find-Checksum() {
    [CmdletBinding()]
    param (
        [Parameter()]
        [String]
        $ChecksumFilePath,
        [Parameter()]
        [String]
        $Pattern
    )
    try {
        $matchInfo = Select-String -Path $ChecksumFilePath -Pattern $Pattern
        if ($matchInfo) {
            return $matchInfo.Line.Split(" ")[0]   
        }
        return ""
    }
    catch {
        Write-FatalLog "Checksum file wasn't found: $ChecksumFilePath"  
    }     
}

function Test-Download {
    [CmdletBinding()]
    param (
        [Parameter()]
        [string]
        $Url
    )

try {
        curl.exe --head -sfL $Url
        return $true
    } 
    catch { 
        return $false 
    }
}

# download_airgap_tarball downloads the airgap image tarball.
function Get-AirgapTarball() {
    [CmdletBinding()]
    param (
        [Parameter()]
        [String]
        $CommitHash,
        [Parameter()]
        [String]
        $StorageUrl,
        [Parameter()]
        [String]
        $TempAirgapTarball        
    )

if (-Not $CommitHash) {
        return
    }

$archInfo = Get-ArchitectureInfo
    $suffix = $archInfo.Suffix    
    $arch = $archInfo.Arch

if ($CommitHash) {
        $AirgapTarballUrl = "$StorageUrl/rke2-images.$suffix-$CommitHash.tar.zst"
        Write-InfoLog "downloading airgap tarball with commit $CommitHash from $AirgapTarballUrl"
        curl.exe -sfL $AirgapTarballUrl -o $TempAirgapTarball
    }
    # prepare for windows airgap image bug fix
    else {
        $AirgapTarballUrl = "$Rke2GitHubUrl/releases/download/$Rke2Version/rke2-windows-$BuildVersion-$arch-images.tar.gz"
        Write-InfoLog "downloading airgap tarball from $AirgapTarballUrl"
        curl.exe -sfL $AirgapTarballUrl -o $TempAirgapTarball
    }
}

# verify_airgap_tarball compares the airgap image tarball checksum to the value
# calculated by CI when the file was uploaded.
function Test-AirgapTarballChecksum() {
    [CmdletBinding()]
    param (
        [Parameter()]
        [String]
        $CommitHash,
        [Parameter()]
        [String]
        $ExpectedImageAirGapChecksum,
        [Parameter()]
        [String]
        $TempAirGapTarball
    )

if (-Not $CommitHash) {
        return
    }

if (-Not $ExpectedImageAirGapChecksum) {
        return
    }
    Write-InfoLog "verifying airgap tarball $TempAirGapTarball"
    $actualImageAirgapChecksum = (Get-FileHash -Algorithm SHA256 -Path "$TempAirGapTarball").Hash.ToLower()
    if ($ExpectedImageAirGapChecksum -ne $actualImageAirgapChecksum) {
        Write-FatalLog "downloaded sha256 does not match $ExpectedImageAirGapChecksum, got $actualImageAirgapChecksum"
    }
}

# install_airgap_tarball moves the airgap image tarball into place.
function Install-AirgapTarball() {
    [CmdletBinding()]
    param (
        [Parameter()]
        [String]
        $CommitHash,
        [Parameter()]
        [String]
        $InstallAgentImageDir,
        [Parameter()]
        [String]
        $TempAirgapTarball,
        [Parameter()]
        [String]
        $ExpectedImageAirGapChecksum,
        [Parameter()]
        [String]
        $TempImageChecksums
    )

if (-Not $CommitHash) {
        return
    }

if (-Not $ExpectedImageAirGapChecksum) {
        return
    }

$archInfo = Get-ArchitectureInfo
    $suffix = $archInfo.Suffix    
    $arch = $archInfo.Arch

if ( -Not (Test-Path $InstallAgentImageDir)) {
        New-Item -Path $InstallAgentImageDir -ItemType Directory | Out-null
    }
    if ($CommitHash) {
        Write-InfoLog "installing airgap tarball with commit $CommitHash to $InstallAgentImageDir"
        Move-Item -Path $TempAirgapTarball -Destination "$InstallAgentImageDir/rke2-images.$suffix-$CommitHash.tar.zst" -Force
    }
    # prepare for windows airgap image bug fix
    else {
        Write-InfoLog "installing airgap tarball to $InstallAgentImageDir"
        if ([IO.Path]::GetExtension($TempAirgapTarball) -eq ".zst") {
            Move-Item -Path $TempAirgapTarball -Destination "$InstallAgentImageDir/rke2-windows-$BuildVersion-$arch-images.tar.zst" -Force
        }
        elseif ([IO.Path]::GetExtension($TempAirgapTarball) -eq ".gz") {
            Move-Item -Path $TempAirgapTarball -Destination "$InstallAgentImageDir/rke2-windows-$BuildVersion-$arch-images.tar.gz" -Force
        }
    }
}

# Globals
$STORAGE_URL = "https://rke2-ci-builds.s3.amazonaws.com"
$INSTALL_RKE2_GITHUB_URL = "https://github.com/rancher/rke2"

Confirm-WindowsFeatures -RequiredFeatures @("Containers")
Set-Environment 
Test-MethodConflict

switch ($Method) {
    "tar" { 
        $temp = ""
        if ($env:TMP) {
            $temp = $env:TMP
        }
        elseif ($env:TEMP) {
            $temp = $env:TEMP
        }
        if (Test-Path "$temp/rke2-install") {
            Remove-Item -Path "$temp/rke2-install" -Force -Recurse
        }
        New-Item -Path $temp -Name rke2-install -ItemType Directory | Out-Null

$archInfo = Get-ArchitectureInfo
        $suffix = $archInfo.Suffix    
        $arch = $archInfo.Arch
        $BuildVersion = Get-BuildVersion        
        $TMP_DIR = Join-Path -Path $temp -ChildPath "rke2-install"
        $TMP_BINARY_CHECKSUMS = Join-Path -Path $TMP_DIR -ChildPath "rke2.checksums"
        $TMP_BINARY_TARBALL = Join-Path -Path $TMP_DIR -ChildPath "rke2.tarball"
        $TMP_AIRGAP_CHECKSUMS = Join-Path -Path $TMP_DIR -ChildPath "rke2-images.checksums"
        $TMP_AIRGAP_TARBALL = Join-Path -Path $TMP_DIR -ChildPath "rke2-images.tarball"

if ($ArtifactPath) {
            if ($Commit) {
                $binaryChecksums = Copy-LocalBinaryChecksums -CommitHash $Commit -Path $ArtifactPath -DestinationPath $TMP_BINARY_CHECKSUMS
                $imageChecksums = Copy-LocalImageChecksums -CommitHash $Commit -Path $ArtifactPath -DestinationPath $TMP_AIRGAP_CHECKSUMS
                $BINARY_CHECKSUM_EXPECTED = $binaryChecksums.ExpectedBinaryAirgapChecksum
                $AIRGAP_CHECKSUM_EXPECTED = $imageChecksums.ExpectedImageAirgapChecksum
                Copy-LocalAirgapTarball -Path $ArtifactPath -DestinationPath $TMP_AIRGAP_TARBALL
                Copy-LocalBinaryTarball -Path $ArtifactPath -DestinationPath $TMP_BINARY_TARBAL
            }
            else {
                $binaryChecksums = Copy-LocalBinaryChecksums -Path $ArtifactPath -DestinationPath $TMP_BINARY_CHECKSUMS
                $imageChecksums = Copy-LocalImageChecksums -Path $ArtifactPath -DestinationPath $TMP_AIRGAP_CHECKSUMS
                $BINARY_CHECKSUM_EXPECTED = $binaryChecksums.ExpectedBinaryAirgapChecksum
                $AIRGAP_CHECKSUM_EXPECTED = $imageChecksums.ExpectedImageAirgapChecksum
                Copy-LocalAirgapTarball -Path $ArtifactPath -DestinationPath $TMP_AIRGAP_TARBALL
                Copy-LocalBinaryTarball -Path $ArtifactPath -DestinationPath $TMP_BINARY_TARBALL
            }
        }
        else {
            $Version = Get-ReleaseVersion
            Write-InfoLog "using $Version as release"
            Write-InfoLog "Version: $Version `r`nStorage URL: $STORAGE_URL `r`nGithub URL: $INSTALL_RKE2_GITHUB_URL `r`nBinary Checksums: $TMP_BINARY_CHECKSUMS `r`nImage Checksums: $TMP_AIRGAP_CHECKSUMS"
            $AIRGAP_CHECKSUM_EXPECTED = Get-ImageChecksums -CommitHash $Commit -StorageUrl $STORAGE_URL -Rke2Version $Version -Rke2GitHubUrl $INSTALL_RKE2_GITHUB_URL -TempImageChecksums $TMP_AIRGAP_CHECKSUMS
            Get-AirgapTarball -CommitHash $Commit -StorageUrl $STORAGE_URL -TempAirgapTarball $TMP_AIRGAP_TARBALL
            $BINARY_CHECKSUM_EXPECTED = Get-BinaryChecksums -CommitHash $Commit -StorageUrl $STORAGE_URL -Rke2Version $Version -Rke2GitHubUrl $INSTALL_RKE2_GITHUB_URL -TempBinaryChecksums $TMP_BINARY_CHECKSUMS
            Get-BinaryTarball -CommitHash $Commit -StorageUrl $STORAGE_URL -Rke2Version $Version -Rke2GitHubUrl $INSTALL_RKE2_GITHUB_URL -TempTarball $TMP_BINARY_TARBALL
        }
        Test-AirgapTarballChecksum -CommitHash $Commit -ExpectedImageAirgapChecksum $AIRGAP_CHECKSUM_EXPECTED -TempAirGapTarball $TMP_AIRGAP_TARBALL
        Install-AirgapTarball -CommitHash $Commit -InstallAgentImageDir $AgentImagesDir -TempAirgapTarball $TMP_AIRGAP_TARBALL -ExpectedImageAirgapChecksum $AIRGAP_CHECKSUM_EXPECTED -TempImageChecksums $TMP_AIRGAP_CHECKSUMS
        Test-TarballChecksum -Tarball $TMP_BINARY_TARBALL -ExpectedChecksum $BINARY_CHECKSUM_EXPECTED
        Expand-Tarball -InstallPath $TarPrefix -Tarball $TMP_BINARY_TARBALL
        Write-InfoLog "install complete; you may want to run:  `$env:PATH+=`";$TarPrefix\bin;C:\var\lib\rancher\rke2\bin`""
    }
    "choco" {  
        Write-FatalLog "Currently unsupported installation method. $Method will be supported soon.."
    }
    Default {
        Write-FatalLog "Invalid installation method. $Method not supported."
    }
}
0707010000005B000081ED000000000000000000000001653C446F00005D61000000000000000000000000000000000000001E00000000rke2-1.27.7+rke2r1/install.sh#!/bin/sh

set -e

if [ "${DEBUG}" = 1 ]; then
    set -x
fi

# Usage:
#   curl ... | ENV_VAR=... sh -
#       or
#   ENV_VAR=... ./install.sh
#

# Environment variables:
#
#   - INSTALL_RKE2_CHANNEL
#     Channel to use for fetching rke2 download URL.
#     Defaults to 'stable'.
#
#   - INSTALL_RKE2_METHOD
#     The installation method to use.
#     Default is on RPM-based systems is "rpm", all else "tar".
#
#   - INSTALL_RKE2_TYPE
#     Type of rke2 service. Can be either "server" or "agent".
#     Default is "server".
#
#   - INSTALL_RKE2_EXEC
#     This is an alias for INSTALL_RKE2_TYPE, included for compatibility with K3s.
#     If both are set, INSTALL_RKE2_TYPE is preferred.
#
#   - INSTALL_RKE2_VERSION
#     Version of rke2 to download from github.
#
#   - INSTALL_RKE2_RPM_RELEASE_VERSION
#     Version of the rke2 RPM release to install.
#     Format would be like "1.el7" or "2.el8"
#
#   - INSTALL_RKE2_TAR_PREFIX
#     Installation prefix when using the tar installation method.
#     Default is /usr/local, unless /usr/local is read-only or has a dedicated mount point,
#     in which case /opt/rke2 is used instead.
#
#   - INSTALL_RKE2_COMMIT
#     Commit of RKE2 to download from temporary cloud storage.
#     For developer & QA use only
#
#   - INSTALL_RKE2_AGENT_IMAGES_DIR
#     Installation path for airgap images when installing from CI commit
#     Default is /var/lib/rancher/rke2/agent/images
#
#   - INSTALL_RKE2_ARTIFACT_PATH
#     If set, the install script will use the local path for sourcing the rke2.linux-$SUFFIX and sha256sum-$ARCH.txt files
#     rather than the downloading the files from the internet.
#     Default is not set.
#
#   - INSTALL_RKE2_SKIP_RELOAD
#     If set, the install script will skip reloading systemctl daemon after the tar has been extracted and systemd units
#     have been moved.
#     Default is not set.

# info logs the given argument at info log level.
info() {
    echo "[INFO] " "$@"
}

# warn logs the given argument at warn log level.
warn() {
    echo "[WARN] " "$@" >&2
}

# fatal logs the given argument at fatal log level.
fatal() {
    echo "[ERROR] " "$@" >&2
    if [ -n "${SUFFIX}" ]; then
        echo "[ALT] Please visit 'https://github.com/rancher/rke2/releases' directly and download the latest rke2.${SUFFIX}.tar.gz" >&2
    fi
    exit 1
}

# check_target_mountpoint return success if the target directory is on a dedicated mount point
check_target_mountpoint() {
    mountpoint -q "${INSTALL_RKE2_TAR_PREFIX}"
}

# check_target_ro returns success if the target directory is read-only
check_target_ro() {
    touch "${INSTALL_RKE2_TAR_PREFIX}"/.rke2-ro-test && rm -rf "${INSTALL_RKE2_TAR_PREFIX}"/.rke2-ro-test
    test $? -ne 0
}

# setup_env defines needed environment variables.
setup_env() {
    STORAGE_URL="https://rke2-ci-builds.s3.amazonaws.com"
    INSTALL_RKE2_GITHUB_URL="https://github.com/rancher/rke2"
    DEFAULT_TAR_PREFIX="/usr/local"
    # --- bail if we are not root ---
    if [ ! $(id -u) -eq 0 ]; then
        fatal "You need to be root to perform this install"
    fi

# --- make sure install channel has a value
    if [ -z "${INSTALL_RKE2_CHANNEL}" ]; then
        INSTALL_RKE2_CHANNEL="stable"
    fi

# --- make sure install type has a value
    if [ -z "${INSTALL_RKE2_TYPE}" ]; then
        INSTALL_RKE2_TYPE="${INSTALL_RKE2_EXEC:-server}"
    fi

# --- use rpm install method if available by default
    if [ -z "${INSTALL_RKE2_ARTIFACT_PATH}" ] && [ -z "${INSTALL_RKE2_COMMIT}" ] && [ -z "${INSTALL_RKE2_METHOD}" ] && command -v yum >/dev/null 2>&1; then
        INSTALL_RKE2_METHOD="rpm"
    fi

# --- install tarball to /usr/local by default, except if /usr/local is on a separate partition or is read-only
    # --- in which case we go into /opt/rke2.
    if [ -z "${INSTALL_RKE2_TAR_PREFIX}" ]; then
        INSTALL_RKE2_TAR_PREFIX=${DEFAULT_TAR_PREFIX}
        if check_target_mountpoint || check_target_ro; then
            INSTALL_RKE2_TAR_PREFIX="/opt/rke2"
            warn "${DEFAULT_TAR_PREFIX} is read-only or a mount point; installing to ${INSTALL_RKE2_TAR_PREFIX}"
        fi
    fi

if [ -z "${INSTALL_RKE2_AGENT_IMAGES_DIR}" ]; then
        INSTALL_RKE2_AGENT_IMAGES_DIR="/var/lib/rancher/rke2/agent/images"
    fi
}

# check_method_conflict will exit with an error if the user attempts to install
# via tar method on a host with existing RPMs.
check_method_conflict() {
     . /etc/os-release
    case ${INSTALL_RKE2_METHOD} in
    yum | rpm | dnf)
        if [ "${ID_LIKE%%[ ]*}" = "suse" ]; then
            if [ -f ${INSTALL_RKE2_TAR_PREFIX}/bin/rke2 ]; then
                fatal "Cannot perform ${INSTALL_RKE2_METHOD:-rpm} install on host with existing tarball installation - please run rke2-uninstall.sh first"
            fi
        fi
        return
        ;;
    *)
        if rpm -q rke2-common >/dev/null 2>&1; then
            fatal "Cannot perform ${INSTALL_RKE2_METHOD:-tar} install on host with existing RKE2 RPMs - please run rke2-uninstall.sh first"
        fi
        ;;
    esac
}

# setup_arch set arch and suffix,
# fatal if architecture not supported.
setup_arch() {
    case ${ARCH:=$(uname -m)} in
    x86_64|amd64)
        ARCH=amd64
        SUFFIX=$(uname -s | tr '[:upper:]' '[:lower:]')-${ARCH}
        ;;
    aarch64|arm64)
        ARCH=arm64
        SUFFIX=$(uname -s | tr '[:upper:]' '[:lower:]')-${ARCH}
        ;;
    s390x)
        ARCH=s390x
        SUFFIX=$(uname -s | tr '[:upper:]' '[:lower:]')-${ARCH}
        ;;
    *)
        fatal "unsupported architecture ${ARCH}"
        ;;
    esac
}

# verify_downloader verifies existence of
# network downloader executable.
verify_downloader() {
    cmd="$(command -v "${1}")"
    if [ -z "${cmd}" ]; then
        return 1
    fi
    if [ ! -x "${cmd}" ]; then
        return 1
    fi

# Set verified executable as our downloader program and return success
    DOWNLOADER=${cmd}
    return 0
}

# verify_fapolicyd verifies existence of
# fapolicyd and fagenrules executables and make sure that fapolicyd service is running.
verify_fapolicyd() {
    cmd="$(command -v "fapolicyd")"
    if [ -z "${cmd}" ]; then
        return 1
    fi
    cmd="$(command -v "fagenrules")"
    if [ -z "${cmd}" ]; then
        return 1
    fi
    systemctl is-active --quiet fapolicyd || return 1

return 0
}

# setup_tmp creates a temporary directory
# and cleans up when done.
setup_tmp() {
    TMP_DIR=$(mktemp -d -t rke2-install.XXXXXXXXXX)
    TMP_CHECKSUMS=${TMP_DIR}/rke2.checksums
    TMP_TARBALL=${TMP_DIR}/rke2.tarball
    TMP_AIRGAP_CHECKSUMS=${TMP_DIR}/rke2-images.checksums
    TMP_AIRGAP_TARBALL=${TMP_DIR}/rke2-images.tarball
    cleanup() {
        code=$?
        set +e
        trap - EXIT
        rm -rf "${TMP_DIR}"
        exit $code
    }
    trap cleanup INT EXIT
}

# --- use desired rke2 version if defined or find version from channel ---
get_release_version() {
    if [ -n "${INSTALL_RKE2_COMMIT}" ]; then
        version="commit ${INSTALL_RKE2_COMMIT}"
    elif [ -n "${INSTALL_RKE2_VERSION}" ]; then
        version=${INSTALL_RKE2_VERSION}
    else
        info "finding release for channel ${INSTALL_RKE2_CHANNEL}"
        INSTALL_RKE2_CHANNEL_URL=${INSTALL_RKE2_CHANNEL_URL:-'https://update.rke2.io/v1-release/channels'}
        version_url="${INSTALL_RKE2_CHANNEL_URL}/${INSTALL_RKE2_CHANNEL}"
        case ${DOWNLOADER} in
        *curl)
            version=$(${DOWNLOADER} -w "%{url_effective}" -L -s -S "${version_url}" -o /dev/null | sed -e 's|.*/||')
            ;;
        *wget)
            version=$(${DOWNLOADER} -SqO /dev/null "${version_url}" 2>&1 | grep -i Location | sed -e 's|.*/||')
            ;;
        *)
            fatal "Unsupported downloader executable '${DOWNLOADER}'"
            ;;
        esac
        INSTALL_RKE2_VERSION="${version}"
    fi
}

# check_download performs a HEAD request to see if a file exists at a given url
check_download() {
    case ${DOWNLOADER} in
    *curl)
        curl -o "/dev/null" -fsLI -X HEAD "$1"
        ;;
    *wget)
        wget -q --spider "$1"
        ;;
    *)
        fatal "downloader executable not supported: '${DOWNLOADER}'"
        ;;
    esac
}

# download downloads a file from a url using either curl or wget
download() {
    if [ $# -ne 2 ]; then
        fatal "download needs exactly 2 arguments"
    fi

case ${DOWNLOADER} in
    *curl)
        curl -o "$1" -fsSL "$2"
        ;;
    *wget)
        wget -qO "$1" "$2"
        ;;
    *)
        fatal "downloader executable not supported: '${DOWNLOADER}'"
        ;;
    esac

# Abort if download command failed
    if [ $? -ne 0 ]; then
        fatal "download failed"
    fi
}

# download_checksums downloads hash from github url.
download_checksums() {
    if [ -n "${INSTALL_RKE2_COMMIT}" ]; then
        CHECKSUMS_URL=${STORAGE_URL}/rke2.${SUFFIX}-${INSTALL_RKE2_COMMIT}.tar.gz.sha256sum
    else
        CHECKSUMS_URL=${INSTALL_RKE2_GITHUB_URL}/releases/download/${INSTALL_RKE2_VERSION}/sha256sum-${ARCH}.txt
    fi
    info "downloading checksums at ${CHECKSUMS_URL}"
    download "${TMP_CHECKSUMS}" "${CHECKSUMS_URL}"
    CHECKSUM_EXPECTED=$(grep "rke2.${SUFFIX}.tar.gz" "${TMP_CHECKSUMS}" | awk '{print $1}')
}

# download_tarball downloads binary from github url.
download_tarball() {
    if [ -n "${INSTALL_RKE2_COMMIT}" ]; then
        TARBALL_URL=${STORAGE_URL}/rke2.${SUFFIX}-${INSTALL_RKE2_COMMIT}.tar.gz
    else
        TARBALL_URL=${INSTALL_RKE2_GITHUB_URL}/releases/download/${INSTALL_RKE2_VERSION}/rke2.${SUFFIX}.tar.gz
    fi
    info "downloading tarball at ${TARBALL_URL}"
    download "${TMP_TARBALL}" "${TARBALL_URL}"
}

# download_dev_rpm downloads dev rpm from remote repository
download_dev_rpm() {
    if [ -z "${INSTALL_RKE2_COMMIT}" ]; then
        fatal 'Development rpm requires a commit hash'
    fi

DEST="${1}"
    RPM_FILE=$(basename "${DEST}")
    RPM_URL="${STORAGE_URL}/${RPM_FILE}"

info "downloading rpm at ${RPM_URL}"
    download "${DEST}" "${RPM_URL}"
}

# stage_local_checksums stages the local checksum hash for validation.
stage_local_checksums() {
    info "staging local checksums from ${INSTALL_RKE2_ARTIFACT_PATH}/sha256sum-${ARCH}.txt"
    cp -f "${INSTALL_RKE2_ARTIFACT_PATH}/sha256sum-${ARCH}.txt" "${TMP_CHECKSUMS}"
    CHECKSUM_EXPECTED=$(grep "rke2.${SUFFIX}.tar.gz" "${TMP_CHECKSUMS}" | awk '{print $1}')
    if [ -f "${INSTALL_RKE2_ARTIFACT_PATH}/rke2-images.${SUFFIX}.tar.zst" ]; then
        AIRGAP_CHECKSUM_EXPECTED=$(grep "rke2-images.${SUFFIX}.tar.zst" "${TMP_CHECKSUMS}" | awk '{print $1}')
    elif [ -f "${INSTALL_RKE2_ARTIFACT_PATH}/rke2-images.${SUFFIX}.tar.gz" ]; then
        AIRGAP_CHECKSUM_EXPECTED=$(grep "rke2-images.${SUFFIX}.tar.gz" "${TMP_CHECKSUMS}" | awk '{print $1}')
    fi
}

# stage_local_tarball stages the local tarball.
stage_local_tarball() {
    info "staging tarball from ${INSTALL_RKE2_ARTIFACT_PATH}/rke2.${SUFFIX}.tar.gz"
    cp -f "${INSTALL_RKE2_ARTIFACT_PATH}/rke2.${SUFFIX}.tar.gz" "${TMP_TARBALL}"
}

# stage_local_airgap_tarball stages the local checksum hash for validation.
stage_local_airgap_tarball() {
    if [ -f "${INSTALL_RKE2_ARTIFACT_PATH}/rke2-images.${SUFFIX}.tar.zst" ]; then
        info "staging zst airgap image tarball from ${INSTALL_RKE2_ARTIFACT_PATH}/rke2-images.${SUFFIX}.tar.zst"
        cp -f "${INSTALL_RKE2_ARTIFACT_PATH}/rke2-images.${SUFFIX}.tar.zst" "${TMP_AIRGAP_TARBALL}"
        AIRGAP_TARBALL_FORMAT=zst
    elif [ -f "${INSTALL_RKE2_ARTIFACT_PATH}/rke2-images.${SUFFIX}.tar.gz" ]; then
        info "staging gzip airgap image tarball from ${INSTALL_RKE2_ARTIFACT_PATH}/rke2-images.${SUFFIX}.tar.gz"
        cp -f "${INSTALL_RKE2_ARTIFACT_PATH}/rke2-images.${SUFFIX}.tar.gz" "${TMP_AIRGAP_TARBALL}"
        AIRGAP_TARBALL_FORMAT=gz
    fi
}

# verify_tarball verifies the downloaded installer checksum.
verify_tarball() {
    info "verifying tarball"
    CHECKSUM_ACTUAL=$(sha256sum "${TMP_TARBALL}" | awk '{print $1}')
    if [ "${CHECKSUM_EXPECTED}" != "${CHECKSUM_ACTUAL}" ]; then
        fatal "download sha256 does not match ${CHECKSUM_EXPECTED}, got ${CHECKSUM_ACTUAL}"
    fi
}

# unpack_tarball extracts the tarball, correcting paths and moving systemd units as necessary
unpack_tarball() {
    info "unpacking tarball file to ${INSTALL_RKE2_TAR_PREFIX}"
    mkdir -p ${INSTALL_RKE2_TAR_PREFIX}
    tar xzf "${TMP_TARBALL}" -C "${INSTALL_RKE2_TAR_PREFIX}"
    if [ "${INSTALL_RKE2_TAR_PREFIX}" != "${DEFAULT_TAR_PREFIX}" ]; then
        info "updating tarball contents to reflect install path"
        sed -i "s|${DEFAULT_TAR_PREFIX}|${INSTALL_RKE2_TAR_PREFIX}|" ${INSTALL_RKE2_TAR_PREFIX}/lib/systemd/system/rke2-*.service ${INSTALL_RKE2_TAR_PREFIX}/bin/rke2-uninstall.sh
        info "moving systemd units to /etc/systemd/system"
        mv -f ${INSTALL_RKE2_TAR_PREFIX}/lib/systemd/system/rke2-*.service /etc/systemd/system/
        info "install complete; you may want to run:  export PATH=\$PATH:${INSTALL_RKE2_TAR_PREFIX}/bin"
    fi
}

# download_airgap_checksums downloads the checksum file for the airgap image tarball
# and prepares the checksum value for later validation.
download_airgap_checksums() {
    if [ -z "${INSTALL_RKE2_COMMIT}" ]; then
        return
    fi
    AIRGAP_CHECKSUMS_URL=${STORAGE_URL}/rke2-images.${SUFFIX}-${INSTALL_RKE2_COMMIT}.tar.zst.sha256sum
    # try for zst first; if that fails use gz for older release branches
    if ! check_download "${AIRGAP_CHECKSUMS_URL}"; then
        AIRGAP_CHECKSUMS_URL=${STORAGE_URL}/rke2-images.${SUFFIX}-${INSTALL_RKE2_COMMIT}.tar.gz.sha256sum
    fi
    info "downloading airgap checksums at ${AIRGAP_CHECKSUMS_URL}"
    download "${TMP_AIRGAP_CHECKSUMS}" "${AIRGAP_CHECKSUMS_URL}"
    AIRGAP_CHECKSUM_EXPECTED=$(grep "rke2-images.${SUFFIX}.tar" "${TMP_AIRGAP_CHECKSUMS}" | awk '{print $1}')
}

# download_airgap_tarball downloads the airgap image tarball.
download_airgap_tarball() {
    if [ -z "${INSTALL_RKE2_COMMIT}" ]; then
        return
    fi
    AIRGAP_TARBALL_URL=${STORAGE_URL}/rke2-images.${SUFFIX}-${INSTALL_RKE2_COMMIT}.tar.zst
    # try for zst first; if that fails use gz for older release branches
    if ! check_download "${AIRGAP_TARBALL_URL}"; then
        AIRGAP_TARBALL_URL=${STORAGE_URL}/rke2-images.${SUFFIX}-${INSTALL_RKE2_COMMIT}.tar.gz
    fi
    info "downloading airgap tarball at ${AIRGAP_TARBALL_URL}"
    download "${TMP_AIRGAP_TARBALL}" "${AIRGAP_TARBALL_URL}"
}

# verify_airgap_tarball compares the airgap image tarball checksum to the value
# calculated by CI when the file was uploaded.
verify_airgap_tarball() {
    if [ -z "${AIRGAP_CHECKSUM_EXPECTED}" ]; then
        return
    fi
    info "verifying airgap tarball"
    AIRGAP_CHECKSUM_ACTUAL=$(sha256sum "${TMP_AIRGAP_TARBALL}" | awk '{print $1}')
    if [ "${AIRGAP_CHECKSUM_EXPECTED}" != "${AIRGAP_CHECKSUM_ACTUAL}" ]; then
        fatal "download sha256 does not match ${AIRGAP_CHECKSUM_EXPECTED}, got ${AIRGAP_CHECKSUM_ACTUAL}"
    fi
}

# install_airgap_tarball moves the airgap image tarball into place.
install_airgap_tarball() {
    if [ -z "${AIRGAP_CHECKSUM_EXPECTED}" ]; then
        return
    fi
    mkdir -p "${INSTALL_RKE2_AGENT_IMAGES_DIR}"
    # releases that provide zst artifacts can read from the compressed archive; older releases
    # that produce only gzip artifacts need to have the tarball decompressed ahead of time
    if grep -sqF '.tar.zst' "${TMP_AIRGAP_CHECKSUMS}" || [ "${AIRGAP_TARBALL_FORMAT}" = "zst" ]; then
        info "installing airgap tarball to ${INSTALL_RKE2_AGENT_IMAGES_DIR}"
        mv -f "${TMP_AIRGAP_TARBALL}" "${INSTALL_RKE2_AGENT_IMAGES_DIR}/rke2-images.${SUFFIX}.tar.zst"
    else
        info "decompressing airgap tarball to ${INSTALL_RKE2_AGENT_IMAGES_DIR}"
        gzip -dc "${TMP_AIRGAP_TARBALL}" > "${INSTALL_RKE2_AGENT_IMAGES_DIR}/rke2-images.${SUFFIX}.tar"
    fi
}

# install_dev_rpm orchestrates the installation of RKE2 unsigned development rpms
install_dev_rpm() {
    rpm_installer="${1:-yum}"
    distro="${2:-centos7}"

[ -z "${TMP_DIR}" ] && setup_tmp

case "${rpm_installer}" in
        *zypper*)
            ${rpm_installer} install --allow-unsigned-rpm -y \
                "${STORAGE_URL}/rke2-common-${INSTALL_RKE2_COMMIT}.${distro}.rpm" \
                "${STORAGE_URL}/rke2-${INSTALL_RKE2_TYPE}-${INSTALL_RKE2_COMMIT}.${distro}.rpm"
            ;;
        *)
            download_dev_rpm "${TMP_DIR}/rke2-common-${INSTALL_RKE2_COMMIT}.${distro}.rpm"
            download_dev_rpm "${TMP_DIR}/rke2-${INSTALL_RKE2_TYPE}-${INSTALL_RKE2_COMMIT}.${distro}.rpm"
            ${rpm_installer} install -y  "${TMP_DIR}"/*.rpm
            ;;
    esac

if [ -f "${INSTALL_RKE2_ARTIFACT_PATH}/rke2-images.${SUFFIX}.tar.zst" ]; then
        return
    fi

download_airgap_checksums
    download_airgap_tarball
    verify_airgap_tarball
    install_airgap_tarball
}

# do_install_rpm builds a yum repo config from the channel and version to be installed,
# and calls yum to install the required packages.
do_install_rpm() {
    . /etc/os-release
    if [ -r /etc/redhat-release ] || [ -r /etc/centos-release ] || [ -r /etc/oracle-release ] || [ "${ID_LIKE%%[ ]*}" = "suse"  ]; then
        repodir=/etc/yum.repos.d
        if [ -d /etc/zypp/repos.d ]; then
            repodir=/etc/zypp/repos.d
        fi
        if [ "${ID_LIKE%%[ ]*}" = "suse" ]; then
            # create the /var/lib/rpm-state in SLE systems to fix the prein selinux macro
            if [ "${TRANSACTIONAL_UPDATE=false}" != "true" ] && [ -x /usr/sbin/transactional-update ]; then
                transactional_update_run="transactional-update --no-selfupdate -d run"
            fi
            ${transactional_update_run} mkdir -p /var/lib/rpm-state
            # configure infix and rpm_installer
            rpm_site_infix=microos
            if [ "${VARIANT_ID:-}" = sle-micro ]; then
                rpm_site_infix=slemicro
                package_installer=zypper
            fi
            rpm_installer="zypper --gpg-auto-import-keys"
            if [ "${TRANSACTIONAL_UPDATE=false}" != "true" ] && [ -x /usr/sbin/transactional-update ]; then
                rpm_installer="transactional-update --no-selfupdate -d run ${rpm_installer}"
            fi
        else
            maj_ver=$(echo "$VERSION_ID" | sed -E -e "s/^([0-9]+)\.?[0-9]*$/\1/")
            case ${maj_ver} in
                7|8|9)
                    :
                    ;;
                *) # In certain cases, like installing on Fedora, maj_ver will end up being something that is not 7 or 8
                    maj_ver="7"
                    ;;
            esac
            rpm_site_infix=centos/${maj_ver}
            rpm_installer="yum"
        fi

fi
    case "${INSTALL_RKE2_CHANNEL}" in
        v*.*)
            # We are operating with a version-based channel, so we should parse our version out
            rke2_majmin=$(echo "${INSTALL_RKE2_CHANNEL}" | sed -E -e "s/^v([0-9]+\.[0-9]+).*/\1/")
            rke2_rpm_channel=$(echo "${INSTALL_RKE2_CHANNEL}" | sed -E -e "s/^v[0-9]+\.[0-9]+-(.*)/\1/")
            # If our regex fails to capture a "sane" channel out of the specified channel, fall back to `stable`
            if [ "${rke2_rpm_channel}" = ${INSTALL_RKE2_CHANNEL} ]; then
                info "using stable RPM repositories"
                rke2_rpm_channel="stable"
            fi
            ;;
        *)
            get_release_version
            rke2_majmin=$(echo "${INSTALL_RKE2_VERSION}" | sed -E -e "s/^v([0-9]+\.[0-9]+).*/\1/")
            rke2_rpm_channel=${1}
            ;;
    esac
    info "using ${rke2_majmin} series from channel ${rke2_rpm_channel}"
    rpm_site="rpm.rancher.io"
    if [ "${rke2_rpm_channel}" = "testing" ]; then
        rpm_site="rpm-${rke2_rpm_channel}.rancher.io"
    fi

rm -f ${repodir}/rancher-rke2*.repo
    cat <<-EOF >"${repodir}/rancher-rke2.repo"
[rancher-rke2-common-${rke2_rpm_channel}]
name=Rancher RKE2 Common (${1})
baseurl=https://${rpm_site}/rke2/${rke2_rpm_channel}/common/${rpm_site_infix}/noarch
enabled=1
gpgcheck=1
repo_gpgcheck=0
gpgkey=https://${rpm_site}/public.key
EOF

if [ -z "${INSTALL_RKE2_COMMIT}" ]; then
    cat <<-EOF >>"${repodir}/rancher-rke2.repo"
[rancher-rke2-${rke2_majmin}-${rke2_rpm_channel}]
name=Rancher RKE2 ${rke2_majmin} (${1})
baseurl=https://${rpm_site}/rke2/${rke2_rpm_channel}/${rke2_majmin}/${rpm_site_infix}/x86_64
enabled=1
gpgcheck=1
repo_gpgcheck=0
gpgkey=https://${rpm_site}/public.key
EOF
    fi

if rpm -q --quiet rke2-selinux; then 
            # remove rke2-selinux module in el9 before upgrade to allow container-selinux to upgrade safely
            if check_available_upgrades container-selinux && check_available_upgrades rke2-selinux; then
                MODULE_PRIORITY=$(semodule --list=full | grep rke2 | cut -f1 -d" ")
                if [ -n "${MODULE_PRIORITY}" ]; then
                    semodule -X $MODULE_PRIORITY -r rke2 || true
                fi
            fi
        fi

if [ -z "${INSTALL_RKE2_VERSION}" ] && [ -z "${INSTALL_RKE2_COMMIT}" ]; then
        ${rpm_installer} install -y "rke2-${INSTALL_RKE2_TYPE}"
    elif [ -n "${INSTALL_RKE2_COMMIT}" ]; then
        rel_distro="$(echo "${rpm_site_infix}" | tr -d /)"
        install_dev_rpm "${rpm_installer}" "${rel_distro}"
    else
        rke2_rpm_version=$(echo "${INSTALL_RKE2_VERSION}" | sed -E -e "s/[\+-]/~/g" | sed -E -e "s/v(.*)/\1/")
        if [ -n "${INSTALL_RKE2_RPM_RELEASE_VERSION}" ]; then
            ${rpm_installer} install -y "rke2-${INSTALL_RKE2_TYPE}-${rke2_rpm_version}-${INSTALL_RKE2_RPM_RELEASE_VERSION}"
        else
            ${rpm_installer} install -y "rke2-${INSTALL_RKE2_TYPE}-${rke2_rpm_version}"
        fi
    fi
}

check_available_upgrades() {
    . /etc/os-release
    set +e
    if [ "${ID_LIKE%%[ ]*}" = "suse" ]; then
        available_upgrades=$(zypper -q -t -s 11 se -s -u --type package $1 | tail -n 1 | grep -v "No matching" | awk '{print $3}')
    else
        available_upgrades=$(yum -q --refresh list $1 --upgrades | tail -n 1 | awk '{print $2}')
    fi
    set -e
    if [ -n "${available_upgrades}" ]; then
        return 0
    fi
    return 1
}

do_install_tar() {
    setup_tmp

if [ -n "${INSTALL_RKE2_ARTIFACT_PATH}" ]; then
        stage_local_checksums
        stage_local_airgap_tarball
        stage_local_tarball
    else
        get_release_version
        info "using ${INSTALL_RKE2_VERSION:-commit $INSTALL_RKE2_COMMIT} as release"
        download_airgap_checksums
        download_airgap_tarball
        download_checksums
        download_tarball
    fi

verify_airgap_tarball
    install_airgap_tarball
    verify_tarball
    unpack_tarball

if [ -z "${INSTALL_RKE2_SKIP_RELOAD}" ]; then
        systemctl daemon-reload
    fi
}

setup_fapolicy_rules() {
    if [ -r /etc/redhat-release ] || [ -r /etc/centos-release ] || [ -r /etc/oracle-release ] || [ -r /etc/rocky-release ]; then
        verify_fapolicyd || return 0
        # setting rke2 fapolicyd rules
        cat <<-EOF >>"/etc/fapolicyd/rules.d/80-rke2.rules"
allow perm=any all : dir=/var/lib/rancher/
allow perm=any all : dir=/opt/cni/
allow perm=any all : dir=/run/k3s/
allow perm=any all : dir=/var/lib/kubelet/
EOF
        if [ -z "${INSTALL_RKE2_SKIP_RELOAD}" ]; then
            fagenrules --load || fatal "failed to load rke2 fapolicyd rules"
            systemctl restart fapolicyd
        fi
    fi
}

do_install() {
    setup_env
    check_method_conflict
    setup_arch
    if [ -z "${INSTALL_RKE2_ARTIFACT_PATH}" ]; then
        verify_downloader curl || verify_downloader wget || fatal "can not find curl or wget for downloading files"
    fi

case ${INSTALL_RKE2_METHOD} in
    yum | rpm | dnf)
        do_install_rpm "${INSTALL_RKE2_CHANNEL}"
        ;;
    *)
        do_install_tar "${INSTALL_RKE2_CHANNEL}"
        ;;
    esac
    setup_fapolicy_rules
}

do_install
exit 0
0707010000005C000081A4000000000000000000000001653C446F000001FA000000000000000000000000000000000000001B00000000rke2-1.27.7+rke2r1/main.gopackage main

import (
	"os"

"github.com/k3s-io/k3s/pkg/configfilearg"
	"github.com/rancher/rke2/pkg/cli/cmds"
	"github.com/sirupsen/logrus"
	"github.com/urfave/cli"
)

func main() {
	app := cmds.NewApp()
	app.Commands = []cli.Command{
		cmds.NewServerCommand(),
		cmds.NewAgentCommand(),
		cmds.NewEtcdSnapshotCommand(),
		cmds.NewCertCommand(),
		cmds.NewSecretsEncryptCommand(),
		cmds.NewTokenCommand(),
	}

if err := app.Run(configfilearg.MustParse(os.Args)); err != nil {
		logrus.Fatal(err)
	}
}
0707010000005D000081A4000000000000000000000001653C446F00000254000000000000000000000000000000000000002900000000rke2-1.27.7+rke2r1/manifest-runtime.tmplimage: rancher/rke2-runtime:{{replace "+" "-" build.tag}}
manifests:
  - image: rancher/rke2-runtime:{{replace "+" "-" build.tag}}-linux-amd64
    platform: 
      architecture: amd64
      os: linux
  - image: rancher/rke2-runtime:{{replace "+" "-" build.tag}}-linux-arm64
    platform: 
      architecture: arm64
      os: linux
  - image: rancher/rke2-runtime:{{replace "+" "-" build.tag}}-windows-amd64
    platform: 
      architecture: amd64
      os: windows
  - image: rancher/rke2-runtime:{{replace "+" "-" build.tag}}-linux-s390x
    platform:
      architecture: s390x
      os: linux
0707010000005E000081A4000000000000000000000001653C446F000006E2000000000000000000000000000000000000001E00000000rke2-1.27.7+rke2r1/mkdocs.ymlsite_name: RKE2 - Rancher's Next Generation Kubernetes Distribution
repo_url: https://github.com/rancher/rke2
site_url: https://docs.rke2.io
strict: false
use_directory_urls: true
theme:
  name: material
  palette:
    primary: blue
  font:
    text: 'Work Sans'
  logo: 'assets/logo-stacked-white-rke2.svg'
  favicon: 'assets/favicon-32x32.png'
#google_analytics:
plugins:
  - search
  - markdownextradata: {}
markdown_extensions:
- codehilite
- admonition
- pymdownx.tabbed:
    alternate_style: true 
- pymdownx.superfences
- toc:
    permalink: true
nav:
  - index.md
  - Installation:
    - install/requirements.md
    - install/quickstart.md
    - install/ha.md
    - Install Options:
      - install/install_options/install_options.md
      - install/install_options/server_config.md
      - install/install_options/linux_agent_config.md
      - install/install_options/windows_agent_config.md
    - install/methods.md
    - install/network_options.md
    - install/containerd_registry_configuration.md
    - install/airgap.md
    - install/windows_airgap.md
    - install/linux_uninstall.md
    - install/windows_uninstall.md
  - Upgrades:
    - Overview: upgrade/upgrade.md
    - upgrade/basic_upgrade.md
    - upgrade/automated_upgrade.md
  - Security:
    - security/about_hardened_images.md
    - security/hardening_guide.md
    - security/cis_self_assessment16.md
    - security/cis_self_assessment123.md
    - security/fips_support.md
    - security/policies.md
    - security/pod_security_standards.md
    - security/selinux.md
    - security/secrets_encryption.md
  - Architecture:
    - architecture/architecture.md
  - cluster_access.md
  - backup_restore.md
  - networking.md
  - helm.md
  - advanced.md
  - subcommands.md
  - known_issues.md
0707010000005F000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001700000000rke2-1.27.7+rke2r1/pkg07070100000060000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001C00000000rke2-1.27.7+rke2r1/pkg/auth07070100000061000081A4000000000000000000000001653C446F000004B6000000000000000000000000000000000000002400000000rke2-1.27.7+rke2r1/pkg/auth/auth.gopackage auth

import (
	"context"

"github.com/k3s-io/k3s/pkg/util"
	"github.com/k3s-io/k3s/pkg/version"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apiserver/pkg/authentication/authenticator"
	"k8s.io/apiserver/pkg/authentication/group"
	"k8s.io/apiserver/pkg/authentication/request/bearertoken"
	"k8s.io/client-go/informers"
	"k8s.io/kubernetes/plugin/pkg/auth/authenticator/token/bootstrap"
)

// BootstrapTokenAuthenticator returns an authenticator to handle bootstrap tokens.
// This requires a secret lister, which will be created from the provided kubeconfig.
func BootstrapTokenAuthenticator(ctx context.Context, file string) (authenticator.Request, error) {
	k8s, err := util.GetClientSet(file)
	if err != nil {
		return nil, err
	}

factory := informers.NewSharedInformerFactory(k8s, 0)
	lister := factory.Core().V1().Secrets().Lister().Secrets(metav1.NamespaceSystem)
	audiences := authenticator.Audiences{version.Program}
	tokenAuth := authenticator.WrapAudienceAgnosticToken(audiences, bootstrap.NewTokenAuthenticator(lister))
	auth := bearertoken.New(tokenAuth)

go factory.Core().V1().Secrets().Informer().Run(ctx.Done())
	return group.NewAuthenticatedGroupAdder(auth), nil
}
07070100000062000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002100000000rke2-1.27.7+rke2r1/pkg/bootstrap07070100000063000081A4000000000000000000000001653C446F00003B6B000000000000000000000000000000000000002E00000000rke2-1.27.7+rke2r1/pkg/bootstrap/bootstrap.gopackage bootstrap

import (
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"io"
	"os"
	"path/filepath"
	"regexp"
	"runtime"
	"strings"

"github.com/google/go-containerregistry/pkg/authn"
	"github.com/google/go-containerregistry/pkg/name"
	v1 "github.com/google/go-containerregistry/pkg/v1"
	"github.com/google/go-containerregistry/pkg/v1/remote"
	helmv1 "github.com/k3s-io/helm-controller/pkg/apis/helm.cattle.io/v1"
	"github.com/k3s-io/k3s/pkg/cli/cmds"
	"github.com/k3s-io/k3s/pkg/daemons/agent"
	daemonconfig "github.com/k3s-io/k3s/pkg/daemons/config"
	"github.com/k3s-io/k3s/pkg/util"
	"github.com/pkg/errors"
	"github.com/rancher/rke2/pkg/images"
	"github.com/rancher/wharfie/pkg/credentialprovider/plugin"
	"github.com/rancher/wharfie/pkg/extract"
	"github.com/rancher/wharfie/pkg/registries"
	"github.com/rancher/wharfie/pkg/tarfile"
	"github.com/rancher/wrangler/pkg/merr"
	"github.com/rancher/wrangler/pkg/yaml"
	"github.com/sirupsen/logrus"
	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
)

var (
	releasePattern = regexp.MustCompile("^v[0-9]")
	helmChartGVK   = helmv1.SchemeGroupVersion.WithKind("HelmChart")
)

// binDirForDigest returns the path to dataDir/data/refDigest/bin.
func binDirForDigest(dataDir string, refDigest string) string {
	return filepath.Join(dataDir, "data", refDigest, "bin")
}

// chartsDirForDigest returns the path to dataDir/data/refDigest/charts.
func chartsDirForDigest(dataDir string, refDigest string) string {
	return filepath.Join(dataDir, "data", refDigest, "charts")
}

// manifestsDir returns the path to dataDir/server/manifests.
func manifestsDir(dataDir string) string {
	return filepath.Join(dataDir, "server", "manifests")
}

// imagesDir returns the path to dataDir/agent/images.
func imagesDir(dataDir string) string {
	return filepath.Join(dataDir, "agent", "images")
}

// symlinkBinDir returns the path to dataDir/bin.
// This will be symlinked to the current runtime bin dir.
func symlinkBinDir(dataDir string) string {
	return filepath.Join(dataDir, "bin")
}

// dirExists returns true if a directory exists at the given path.
func dirExists(dir string) bool {
	if s, err := os.Stat(dir); err == nil && s.IsDir() {
		return true
	}
	return false
}

// Stage extracts binaries and manifests from the runtime image specified in imageConf into the directory
// at dataDir. It attempts to load the runtime image from a tarball at dataDir/agent/images,
// falling back to a remote image pull if the image is not found within a tarball.
// Extraction is skipped if a bin directory for the specified image already exists.
// Unique image detection is accomplished by hashing the image name and tag, or the image digest,
// depending on what the runtime image reference points at.
// If the bin directory already exists, or content is successfully extracted, the bin directory path is returned.
func Stage(resolver *images.Resolver, nodeConfig *daemonconfig.Node, cfg cmds.Agent) (string, error) {
	var img v1.Image

ref, err := resolver.GetReference(images.Runtime)
	if err != nil {
		return "", err
	}

refDigest, err := releaseRefDigest(ref)
	if err != nil {
		return "", err
	}

refBinDir := binDirForDigest(cfg.DataDir, refDigest)
	refChartsDir := chartsDirForDigest(cfg.DataDir, refDigest)
	imagesDir := imagesDir(cfg.DataDir)

if dirExists(refBinDir) && dirExists(refChartsDir) {
		logrus.Infof("Runtime image %s bin and charts directories already exist; skipping extract", ref.Name())
	} else {
		// Try to use configured runtime image from an airgap tarball
		img, err = preloadBootstrapFromRuntime(imagesDir, resolver)
		if err != nil {
			return "", err
		}

// If we didn't find the requested image in a tarball, pull it from the remote registry.
		// Note that this will fail (potentially after a long delay) if the registry cannot be reached.
		if img == nil {
			registry, err := registries.GetPrivateRegistries(nodeConfig.AgentConfig.PrivateRegistry)
			if err != nil {
				return "", errors.Wrapf(err, "failed to load private registry configuration from %s", nodeConfig.AgentConfig.PrivateRegistry)
			}

// Try to enable Kubelet image credential provider plugins; fall back to legacy docker credentials
			if agent.ImageCredProvAvailable(&nodeConfig.AgentConfig) {
				plugins, err := plugin.RegisterCredentialProviderPlugins(nodeConfig.AgentConfig.ImageCredProvConfig, nodeConfig.AgentConfig.ImageCredProvBinDir)
				if err != nil {
					return "", err
				}
				registry.DefaultKeychain = plugins
			} else {
				registry.DefaultKeychain = authn.DefaultKeychain
			}

logrus.Infof("Pulling runtime image %s", ref.Name())
			img, err = registry.Image(ref, remote.WithPlatform(v1.Platform{Architecture: runtime.GOARCH, OS: runtime.GOOS}))
			if err != nil {
				return "", errors.Wrapf(err, "failed to get runtime image %s", ref.Name())
			}
		}

// Extract binaries and charts
		extractPaths := map[string]string{
			"/bin":    refBinDir,
			"/charts": refChartsDir,
		}
		if err := extract.ExtractDirs(img, extractPaths); err != nil {
			return "", errors.Wrap(err, "failed to extract runtime image")
		}
		// Ensure correct permissions on bin dir
		if err := os.Chmod(refBinDir, 0755); err != nil {
			return "", err
		}
	}

// ignore errors on symlink rewrite
	_ = os.RemoveAll(symlinkBinDir(cfg.DataDir))
	_ = os.Symlink(refBinDir, symlinkBinDir(cfg.DataDir))

return refBinDir, nil
}

// UpdateManifests copies the staged manifests into the server's manifests dir, and applies
// cluster configuration values to any HelmChart manifests found in the manifests directory.
func UpdateManifests(resolver *images.Resolver, nodeConfig *daemonconfig.Node, cfg cmds.Agent) error {
	ref, err := resolver.GetReference(images.Runtime)
	if err != nil {
		return err
	}

refDigest, err := releaseRefDigest(ref)
	if err != nil {
		return err
	}

refChartsDir := chartsDirForDigest(cfg.DataDir, refDigest)
	manifestsDir := manifestsDir(cfg.DataDir)

// TODO - instead of copying over then rewriting the manifests, we should template them as we
	// copy, only overwriting if they're different - and then make a second pass and rewrite any
	// user-provided manifests that weren't just copied over. This will work better with the deploy
	// controller's mtime-based change detection.

// Copy all charts into the manifests directory, since the K3s
	// deploy controller will delete them if they are disabled.
	if err := copyDir(manifestsDir, refChartsDir); err != nil {
		return errors.Wrap(err, "failed to copy runtime charts")
	}

// Fix up HelmCharts to pass through configured values.
	// This needs to be done every time in order to sync values from the CLI
	if err := setChartValues(manifestsDir, nodeConfig, cfg); err != nil {
		return errors.Wrap(err, "failed to rewrite HelmChart manifests to pass through CLI values")
	}
	return nil
}

// releaseRefDigest returns a unique name for an image reference.
// If the image refers to a tag that appears to be a version string, it returns the tag + the first 12 bytes of the SHA256 hash of the reference string.
// If the image refers to a digest, it returns the digest, without the alg prefix ("sha256:", etc).
// If neither of the above conditions are met (semver tag or digest), an error is raised.
func releaseRefDigest(ref name.Reference) (string, error) {
	if t, ok := ref.(name.Tag); ok && releasePattern.MatchString(t.TagStr()) {
		hash := sha256.Sum256([]byte(ref.String()))
		return t.TagStr() + "-" + hex.EncodeToString(hash[:])[:12], nil
	} else if d, ok := ref.(name.Digest); ok {
		str := d.DigestStr()
		parts := strings.SplitN(str, ":", 2)
		if len(parts) == 2 {
			return parts[1], nil
		}
		return parts[0], nil
	}
	return "", fmt.Errorf("Runtime image %s is not a not a reference to a digest or version tag matching pattern %s", ref.Name(), releasePattern)
}

// preloadBootstrapFromRuntime tries to load the runtime image from tarballs, using both the
// default registry, and the user-configured registry (on the off chance they've retagged the
// images in the tarball to match their private registry).
func preloadBootstrapFromRuntime(imagesDir string, resolver *images.Resolver) (v1.Image, error) {
	var refs []name.Reference
	runtimeRef, err := resolver.GetReference(images.Runtime)
	if err != nil {
		return nil, err
	}

if runtimeRef.Context().Registry.Name() == images.DefaultRegistry {
		// If the image is from the default registry, only check for that.
		refs = []name.Reference{runtimeRef}
	} else {
		// If the image is from a different registry, check the default first, then the configured registry.
		defaultRef, err := resolver.GetReference(images.Runtime, images.WithRegistry(images.DefaultRegistry))
		if err != nil {
			return nil, err
		}
		refs = []name.Reference{defaultRef, runtimeRef}
	}

for _, ref := range refs {
		img, err := tarfile.FindImage(imagesDir, ref)
		if img != nil {
			return img, err
		}
		if err != nil {
			logrus.Warnf("Failed to load runtime image %s from tarball: %v", ref.Name(), err)
		}
	}
	return nil, nil
}

// copyDir recursively copies files from source to destination. If the target
// file already exists, the current permissions, ownership, and xattrs will be
// retained, but the contents will be overwritten.
func copyDir(target, source string) error {
	entries, err := os.ReadDir(source)
	if err != nil {
		return fmt.Errorf("failed to read %s: %w", source, err)
	}

if err := os.MkdirAll(target, 0755); err != nil && !os.IsExist(err) {
		return err
	}

for _, entry := range entries {
		src := filepath.Join(source, entry.Name())
		tgt := filepath.Join(target, entry.Name())

fileInfo, err := entry.Info()
		if err != nil {
			return fmt.Errorf("failed to get file info for %s: %w", entry.Name(), err)
		}

switch {
		case entry.IsDir():
			if err := copyDir(tgt, src); err != nil {
				return err
			}
		case (fileInfo.Mode() & os.ModeType) == 0:
			if err := copyFile(tgt, src); err != nil {
				return err
			}
		default:
			logrus.Warnf("Skipping file with unsupported mode: %s: %s", src, fileInfo.Mode())
		}
	}
	return nil
}

// copyFile copies the the source file to the target, creating or truncating it as necessary.
func copyFile(target, source string) error {
	src, err := os.Open(source)
	if err != nil {
		return fmt.Errorf("failed to open source %s: %w", source, err)
	}
	defer src.Close()

tgt, err := os.OpenFile(target, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0644)
	if err != nil {
		return fmt.Errorf("failed to open target %s: %w", target, err)
	}
	defer tgt.Close()

_, err = io.Copy(tgt, src)
	return err
}

// setChartValues scans the directory at manifestDir. It attempts to load all manifests
// in that directory as HelmCharts. Any manifests that contain a HelmChart are modified to
// pass through settings to both the Helm job and the chart values.
// NOTE: This will probably fail if any manifest contains multiple documents. This should
// not matter for any of our packaged components, but may prevent this from working on user manifests.
func setChartValues(manifestsDir string, nodeConfig *daemonconfig.Node, cfg cmds.Agent) error {
	chartValues := map[string]string{
		"global.clusterCIDR":                  util.JoinIPNets(nodeConfig.AgentConfig.ClusterCIDRs),
		"global.clusterCIDRv4":                util.JoinIP4Nets(nodeConfig.AgentConfig.ClusterCIDRs),
		"global.clusterCIDRv6":                util.JoinIP6Nets(nodeConfig.AgentConfig.ClusterCIDRs),
		"global.clusterDNS":                   util.JoinIPs(nodeConfig.AgentConfig.ClusterDNSs),
		"global.clusterDomain":                nodeConfig.AgentConfig.ClusterDomain,
		"global.rke2DataDir":                  cfg.DataDir,
		"global.serviceCIDR":                  util.JoinIPNets(nodeConfig.AgentConfig.ServiceCIDRs),
		"global.systemDefaultRegistry":        nodeConfig.AgentConfig.SystemDefaultRegistry,
		"global.cattle.systemDefaultRegistry": nodeConfig.AgentConfig.SystemDefaultRegistry,
	}

files := map[string]os.FileInfo{}
	if err := filepath.Walk(manifestsDir, func(path string, info os.FileInfo, err error) error {
		if err != nil {
			return err
		}
		switch {
		case info.IsDir():
			return nil
		case strings.HasSuffix(path, ".yml"):
		case strings.HasSuffix(path, ".yaml"):
		default:
			return nil
		}
		files[path] = info
		return nil
	}); err != nil {
		return err
	}

var errs []error
	for fileName, info := range files {
		if err := rewriteChart(fileName, info, chartValues); err != nil {
			errs = append(errs, err)
		}
	}
	return merr.NewErrors(errs...)
}

// rewriteChart applies cluster configuration values to the file at fileName with associated info.
func rewriteChart(fileName string, info os.FileInfo, chartValues map[string]string) error {
	fh, err := os.OpenFile(fileName, os.O_RDWR, info.Mode())
	if err != nil {
		return errors.Wrapf(err, "failed to open manifest %s", fileName)
	}
	defer fh.Close()

// Ignore manifest if it cannot be decoded
	objs, err := yaml.ToObjects(fh)
	if err != nil {
		logrus.Warnf("Failed to decode manifest %s: %s", fileName, err)
		return nil
	}

var changed bool

OBJECTS:
	for _, obj := range objs {
		// Manipulate the HelmChart using Unstructured to avoid dropping unknown fields when rewriting the content.
		// Ref: https://github.com/rancher/rke2/issues/527
		unst, ok := obj.(*unstructured.Unstructured)

// Ignore object if it is not a HelmChart
		if !ok || unst.GroupVersionKind() != helmChartGVK {
			continue
		}

var contentChanged bool
		content := unst.UnstructuredContent()

// Generally we should avoid using Set on HelmCharts since it cannot be overridden by HelmChartConfig,
		// but in this case we need to do it in order to avoid potentially mangling the ValuesContent YAML by
		// blindly appending content to it in order to set values.
		for k, v := range chartValues {
			cv, _, err := unstructured.NestedString(content, "spec", "set", k)
			if err != nil {
				logrus.Warnf("Failed to get current value from %s/%s in %s: %v", unst.GetNamespace(), unst.GetName(), fileName, err)
				continue OBJECTS
			}
			if cv != v {
				if err := unstructured.SetNestedField(content, v, "spec", "set", k); err != nil {
					logrus.Warnf("Failed to write chart value to %s/%s in %s: %v", unst.GetNamespace(), unst.GetName(), fileName, err)
					continue OBJECTS
				}
				contentChanged = true
			}
		}

if contentChanged {
			changed = true
			unst.SetUnstructuredContent(content)
		}
	}

if !changed {
		logrus.Infof("No cluster configuration value changes necessary for manifest %s", fileName)
		return nil
	}

data, err := yaml.Export(objs...)
	if err != nil {
		return errors.Wrapf(err, "failed to export modified manifest %s", fileName)
	}

if _, err := fh.Seek(0, 0); err != nil {
		return errors.Wrapf(err, "failed to seek in manifest %s", fileName)
	}

if err := fh.Truncate(0); err != nil {
		return errors.Wrapf(err, "failed to truncate manifest %s", fileName)
	}

if _, err := fh.Write(data); err != nil {
		return errors.Wrapf(err, "failed to write modified manifest %s", fileName)
	}

if err := fh.Sync(); err != nil {
		return errors.Wrapf(err, "failed to sync modified manifest %s", fileName)
	}

logrus.Infof("Updated manifest %s to set cluster configuration values", fileName)
	return nil
}
07070100000064000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001B00000000rke2-1.27.7+rke2r1/pkg/cli07070100000065000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002000000000rke2-1.27.7+rke2r1/pkg/cli/cmds07070100000066000081A4000000000000000000000001653C446F00000BD5000000000000000000000000000000000000002900000000rke2-1.27.7+rke2r1/pkg/cli/cmds/agent.gopackage cmds

import (
	"github.com/k3s-io/k3s/pkg/cli/cmds"
	"github.com/k3s-io/k3s/pkg/configfilearg"
	"github.com/rancher/rke2/pkg/rke2"
	"github.com/rancher/rke2/pkg/windows"
	"github.com/urfave/cli"
)

var (
	k3sAgentBase = mustCmdFromK3S(cmds.NewAgentCommand(AgentRun), K3SFlagSet{
		"config":          copyFlag,
		"debug":           copyFlag,
		"v":               hideFlag,
		"vmodule":         hideFlag,
		"log":             hideFlag,
		"alsologtostderr": hideFlag,
		"data-dir": {
			Usage:   "(data) Folder to hold state",
			Default: rke2Path,
		},
		"token":                             copyFlag,
		"token-file":                        copyFlag,
		"node-name":                         copyFlag,
		"with-node-id":                      copyFlag,
		"node-label":                        copyFlag,
		"node-taint":                        copyFlag,
		"image-credential-provider-bin-dir": copyFlag,
		"image-credential-provider-config":  copyFlag,
		"docker":                            dropFlag,
		"container-runtime-endpoint":        copyFlag,
		"image-service-endpoint":            dropFlag,
		"pause-image":                       dropFlag,
		"private-registry":                  copyFlag,
		"node-ip":                           copyFlag,
		"node-external-ip":                  copyFlag,
		"resolv-conf":                       copyFlag,
		"flannel-iface":                     dropFlag,
		"flannel-conf":                      dropFlag,
		"flannel-cni-conf":                  dropFlag,
		"vpn-auth":                          dropFlag,
		"vpn-auth-file":                     dropFlag,
		"kubelet-arg":                       copyFlag,
		"kube-proxy-arg":                    copyFlag,
		"rootless":                          dropFlag,
		"prefer-bundled-bin":                dropFlag,
		"server":                            copyFlag,
		"protect-kernel-defaults":           copyFlag,
		"snapshotter":                       copyFlag,
		"selinux":                           copyFlag,
		"lb-server-port":                    copyFlag,
		"airgap-extra-registry":             copyFlag,
	})
	deprecatedFlags = []cli.Flag{
		&cli.StringFlag{
			Name:   "system-default-registry",
			Usage:  "(deprecated) This flag is no longer supported on agents",
			EnvVar: "RKE2_SYSTEM_DEFAULT_REGISTRY",
			Hidden: true,
		},
	}
)

func NewAgentCommand() cli.Command {
	cmd := k3sAgentBase
	cmd.Flags = append(cmd.Flags, commonFlag...)
	cmd.Flags = append(cmd.Flags, deprecatedFlags...)
	cmd.Subcommands = agentSubcommands()
	configfilearg.DefaultParser.ValidFlags[cmd.Name] = cmd.Flags
	return cmd
}

func agentSubcommands() cli.Commands {
	subcommands := []cli.Command{
		// subcommands used by both windows/linux, none yet
	}

// linux/windows only subcommands
	subcommands = append(subcommands, serviceSubcommand)

return subcommands
}

func AgentRun(clx *cli.Context) error {
	validateCloudProviderName(clx, Agent)
	validateProfile(clx, Agent)
	if err := windows.StartService(); err != nil {
		return err
	}
	return rke2.Agent(clx, config)
}
07070100000067000081A4000000000000000000000001653C446F0000007C000000000000000000000000000000000000003700000000rke2-1.27.7+rke2r1/pkg/cli/cmds/agent_service_linux.go//go:build !windows
// +build !windows

package cmds

import "github.com/urfave/cli"

var serviceSubcommand = cli.Command{}
07070100000068000081A4000000000000000000000001653C446F00000B86000000000000000000000000000000000000003900000000rke2-1.27.7+rke2r1/pkg/cli/cmds/agent_service_windows.go//go:build windows
// +build windows

package cmds

import (
	"errors"
	"os"
	"os/exec"
	"path/filepath"
	"time"
	"unsafe"

"github.com/k3s-io/k3s/pkg/cli/cmds"
	"github.com/k3s-io/k3s/pkg/version"
	"github.com/urfave/cli"
	syswin "golang.org/x/sys/windows"
	"golang.org/x/sys/windows/svc/mgr"
)

const (
	defaultServiceDescription = "Rancher Kubernetes Engine v2 (agent) see docs https://github.com/rancher/rke2#readme"
)

var serviceSubcommand = cli.Command{
	Name:   "service",
	Usage:  "Manage RKE2 as a Windows Service",
	Action: serviceAction,
	Flags: []cli.Flag{
		cmds.ConfigFlag,
		&cli.BoolFlag{
			Name:  "add",
			Usage: "add RKE2 as a Windows Service",
		},
		&cli.BoolFlag{
			Name:  "delete",
			Usage: "stop and delete RKE2 as a Windows Service",
		},
		&cli.StringFlag{
			Name:  "service-name",
			Usage: "name for the RKE2 service",
			Value: version.Program,
		},
	},
}

func serviceAction(ctx *cli.Context) error {
	add := ctx.Bool("add")
	del := ctx.Bool("delete")
	if (!add && !del) || (add && del) {
		return errors.New("service subcommand requires one of --add or --delete")
	}

if del {
		return deleteWindowsService(ctx.String("service-name"))
	}

return addWindowService(ctx.String("service-name"), ctx.String("config"))
}

func getServicePath() (string, error) {
	p, err := exec.LookPath(os.Args[0])
	if err != nil {
		return "", err
	}
	return filepath.Abs(p)
}

// inspiration https://github.com/containerd/containerd/blob/main/cmd/containerd/command/service_windows.go#L127
func addWindowService(serviceName, config string) error {
	p, err := getServicePath()
	if err != nil {
		return err
	}
	m, err := mgr.Connect()
	if err != nil {
		return err
	}
	defer m.Disconnect()

s, err := m.CreateService(serviceName, p, mgr.Config{
		ServiceType:  syswin.SERVICE_WIN32_OWN_PROCESS,
		StartType:    mgr.StartAutomatic,
		ErrorControl: mgr.ErrorNormal,
		DisplayName:  version.Program,
		Description:  defaultServiceDescription,
	}, "agent", "--config", config)
	if err != nil {
		return err
	}
	defer s.Close()

const (
		scActionRestart             = 1
		serviceConfigFailureActions = 2
	)

type scAction struct {
		Type  uint32
		Delay uint32
	}

t := []scAction{
		{Type: scActionRestart, Delay: uint32(30 * time.Second / time.Millisecond)}, // on failure restart every 30s
	}

type serviceFailureActions struct {
		ResetPeriod  uint32
		RebootMsg    *uint16
		Command      *uint16
		ActionsCount uint32
		Actions      uintptr
	}

lpInfo := serviceFailureActions{ResetPeriod: uint32(30), ActionsCount: uint32(1), Actions: uintptr(unsafe.Pointer(&t[0]))}
	return syswin.ChangeServiceConfig2(s.Handle, serviceConfigFailureActions, (*byte)(unsafe.Pointer(&lpInfo)))
}

func deleteWindowsService(serviceName string) error {
	m, err := mgr.Connect()
	if err != nil {
		return err
	}
	defer m.Disconnect()

s, err := m.OpenService(serviceName)
	if err != nil {
		return err
	}
	defer s.Close()

return s.Delete()
}
07070100000069000081A4000000000000000000000001653C446F00000601000000000000000000000000000000000000002800000000rke2-1.27.7+rke2r1/pkg/cli/cmds/cert.gopackage cmds

import (
	"io/ioutil"

"github.com/k3s-io/k3s/pkg/cli/cert"
	"github.com/k3s-io/k3s/pkg/cli/cmds"
	"github.com/k3s-io/k3s/pkg/configfilearg"
	"github.com/rancher/rke2/pkg/rke2"
	"github.com/urfave/cli"
)

func NewCertCommand() cli.Command {
	k3sOpts := K3SFlagSet{}
	subCommandOpts := map[string]K3SFlagSet{
		"rotate": {
			"alsologtostderr": copyFlag,
			"config":          copyFlag,
			"debug":           copyFlag,
			"log":             copyFlag,
			"service":         copyFlag,
			"data-dir": {
				Usage:   "(data) Folder to hold state",
				Default: rke2Path,
			},
		},
		"rotate-ca": {
			"server": {
				Default: "https://127.0.0.1:9345",
			},
			"path":  copyFlag,
			"force": copyFlag,
			"data-dir": {
				Usage:   "(data) Folder to hold state",
				Default: rke2Path,
			},
		},
	}

command := cmds.NewCertCommands(Rotate, cert.RotateCA)
	command.Usage = "Manage RKE2 certificates"
	configfilearg.DefaultParser.ValidFlags[command.Name] = command.Flags
	for i, subcommand := range command.Subcommands {
		if s, ok := subCommandOpts[subcommand.Name]; ok {
			k3sOpts.CopyInto(s)
			command.Subcommands[i] = mustCmdFromK3S(subcommand, s)
		} else {
			command.Subcommands[i] = mustCmdFromK3S(subcommand, k3sOpts)
		}
	}
	return mustCmdFromK3S(command, nil)
}

func Rotate(clx *cli.Context) error {
	dataDir := clx.String("data-dir")
	if dataDir == "" {
		dataDir = rke2Path
	}
	if err := ioutil.WriteFile(rke2.ForceRestartFile(dataDir), []byte{}, 0600); err != nil {
		return err
	}
	return cert.Rotate(clx)
}
0707010000006A000081A4000000000000000000000001653C446F000003C6000000000000000000000000000000000000002D00000000rke2-1.27.7+rke2r1/pkg/cli/cmds/cmds_test.gopackage cmds

import (
	"testing"

"github.com/urfave/cli"
)

// Test_NewCommands confirms that all the top-level commands can be created
// successfully without causing any panics in mustCmdFromK3S.  Covering this
// with a test allows us to catch K3s flag option mismatches in testing,
// instead of not noticing until the main command crashes in functional tests.
func Test_NewCommands(t *testing.T) {
	app := cli.NewApp()
	app.Name = "rke2"
	app.Commands = []cli.Command{
		NewServerCommand(),
		NewAgentCommand(),
		NewEtcdSnapshotCommand(),
		NewCertCommand(),
		NewSecretsEncryptCommand(),
		NewTokenCommand(),
	}

for _, command := range app.Commands {
		t.Logf("Testing command: %s", command.Name)
		app.Run([]string{app.Name, command.Name, "--help"})

for _, subcommand := range command.Subcommands {
			t.Logf("Testing subcommand: %s %s", command.Name, subcommand.Name)
			app.Run([]string{app.Name, command.Name, subcommand.Name, "--help"})
		}
	}
}
0707010000006B000081A4000000000000000000000001653C446F00000699000000000000000000000000000000000000003100000000rke2-1.27.7+rke2r1/pkg/cli/cmds/etcd_snapshot.gopackage cmds

import (
	"github.com/k3s-io/k3s/pkg/cli/cmds"
	"github.com/k3s-io/k3s/pkg/cli/etcdsnapshot"
	"github.com/k3s-io/k3s/pkg/configfilearg"
	"github.com/urfave/cli"
)

const defaultSnapshotRentention = 5

func NewEtcdSnapshotCommand() cli.Command {
	cmds.ServerConfig.ClusterInit = true
	k3sOpts := K3SFlagSet{
		"config":          copyFlag,
		"debug":           copyFlag,
		"log":             copyFlag,
		"alsologtostderr": copyFlag,
		"node-name":       copyFlag,
		"data-dir": {
			Usage:   "(data) Folder to hold state",
			Default: rke2Path,
		},
		"name":               copyFlag,
		"dir":                copyFlag,
		"snapshot-compress":  copyFlag,
		"s3":                 copyFlag,
		"s3-endpoint":        copyFlag,
		"s3-endpoint-ca":     copyFlag,
		"s3-skip-ssl-verify": copyFlag,
		"s3-access-key":      copyFlag,
		"s3-secret-key":      copyFlag,
		"s3-bucket":          copyFlag,
		"s3-region":          copyFlag,
		"s3-folder":          copyFlag,
		"s3-insecure":        copyFlag,
		"s3-timeout":         copyFlag,
	}
	subcommandOpts := map[string]K3SFlagSet{
		"ls": {
			"output": copyFlag,
		},
		"prune": {
			"snapshot-retention": copyFlag,
		},
	}

command := cmds.NewEtcdSnapshotCommands(
		etcdsnapshot.Delete,
		etcdsnapshot.List,
		etcdsnapshot.Prune,
		etcdsnapshot.Save)
	for i, subcommand := range command.Subcommands {
		if s, ok := subcommandOpts[subcommand.Name]; ok {
			k3sOpts.CopyInto(s)
			command.Subcommands[i] = mustCmdFromK3S(subcommand, s)
		} else {
			command.Subcommands[i] = mustCmdFromK3S(subcommand, k3sOpts)
		}
	}
	cmd := mustCmdFromK3S(command, k3sOpts)
	configfilearg.DefaultParser.ValidFlags[cmd.Name] = cmd.Flags
	return cmd
}
0707010000006C000081A4000000000000000000000001653C446F00001157000000000000000000000000000000000000002B00000000rke2-1.27.7+rke2r1/pkg/cli/cmds/k3sopts.gopackage cmds

import (
	"fmt"
	"strings"

"github.com/pkg/errors"
	"github.com/rancher/wrangler/pkg/merr"
	"github.com/urfave/cli"
)

var (
	copyFlag   = &K3SFlagOption{}
	dropFlag   = &K3SFlagOption{Drop: true}
	hideFlag   = &K3SFlagOption{Hide: true}
	ignoreFlag = &K3SFlagOption{Ignore: true}
)

// K3SFlagOption describes how a CLI flag from K3s should be wrapped.
type K3SFlagOption struct {
	Hide    bool
	Drop    bool
	Ignore  bool
	Usage   string
	Default string
}

// K3SFlagSet is a map of flag names to options
type K3SFlagSet map[string]*K3SFlagOption

// CopyInto copies flags from a source set into the destination
func (k K3SFlagSet) CopyInto(d K3SFlagSet) {
	for key, val := range k {
		d[key] = val
	}
}

func mustCmdFromK3S(cmd cli.Command, flagOpts K3SFlagSet) cli.Command {
	cmd, err := commandFromK3S(cmd, flagOpts)
	if err != nil {
		panic(errors.Wrapf(err, "failed to wrap command %q", cmd.Name))
	}
	return cmd
}

func commandFromK3S(cmd cli.Command, flagOpts K3SFlagSet) (cli.Command, error) {
	var (
		newFlags []cli.Flag
		seen     = map[string]bool{}
		errs     merr.Errors
	)

for _, flag := range cmd.Flags {
		name := parseName(flag)
		opt, ok := flagOpts[name]
		if !ok {
			errs = append(errs, fmt.Errorf("missing flag options for k3s flag %q", name))
			continue
		}
		seen[name] = true
		if opt == nil {
			opt = &K3SFlagOption{}
		}

if opt.Drop {
			continue
		}

if strFlag, ok := flag.(cli.StringFlag); ok {
			if opt.Usage != "" {
				strFlag.Usage = opt.Usage
			}
			if opt.Default != "" {
				strFlag.Value = opt.Default
			}
			if opt.Hide {
				strFlag.Hidden = true
			}
			flag = strFlag
		} else if strFlag, ok := flag.(*cli.StringFlag); ok {
			if opt.Usage != "" {
				strFlag.Usage = opt.Usage
			}
			if opt.Default != "" {
				strFlag.Value = opt.Default
			}
			if opt.Hide {
				strFlag.Hidden = true
			}
			flag = strFlag
		} else if strSliceFlag, ok := flag.(cli.StringSliceFlag); ok {
			if opt.Usage != "" {
				strSliceFlag.Usage = opt.Usage
			}
			if opt.Default != "" {
				slice := &cli.StringSlice{}
				parts := strings.Split(opt.Default, ",")
				for _, val := range parts {
					slice.Set(val)
				}
				strSliceFlag.Value = slice
			}
			if opt.Hide {
				strSliceFlag.Hidden = true
			}
			flag = strSliceFlag
		} else if strSliceFlag, ok := flag.(*cli.StringSliceFlag); ok {
			if opt.Usage != "" {
				strSliceFlag.Usage = opt.Usage
			}
			if opt.Default != "" {
				slice := &cli.StringSlice{}
				parts := strings.Split(opt.Default, ",")
				for _, val := range parts {
					slice.Set(val)
				}
				strSliceFlag.Value = slice
			}
			if opt.Hide {
				strSliceFlag.Hidden = true
			}
			flag = strSliceFlag
		} else if intFlag, ok := flag.(cli.IntFlag); ok {
			if opt.Usage != "" {
				intFlag.Usage = opt.Usage
			}
			if opt.Hide {
				intFlag.Hidden = true
			}
			flag = intFlag
		} else if intFlag, ok := flag.(*cli.IntFlag); ok {
			if opt.Usage != "" {
				intFlag.Usage = opt.Usage
			}
			if opt.Hide {
				intFlag.Hidden = true
			}
			flag = intFlag
		} else if boolFlag, ok := flag.(cli.BoolFlag); ok {
			if opt.Usage != "" {
				boolFlag.Usage = opt.Usage
			}
			if opt.Hide {
				boolFlag.Hidden = true
			}
			flag = boolFlag
		} else if boolFlag, ok := flag.(*cli.BoolFlag); ok {
			if opt.Usage != "" {
				boolFlag.Usage = opt.Usage
			}
			if opt.Hide {
				boolFlag.Hidden = true
			}
			flag = boolFlag
		} else if durationFlag, ok := flag.(*cli.DurationFlag); ok {
			if opt.Usage != "" {
				durationFlag.Usage = opt.Usage
			}
			if opt.Hide {
				durationFlag.Hidden = true
			}
			flag = durationFlag
		} else {
			errs = append(errs, fmt.Errorf("unsupported type %T for flag %q", flag, name))
		}

newFlags = append(newFlags, flag)
	}

for k, v := range flagOpts {
		if !seen[k] {
			if v != nil && v.Ignore {
				continue
			}
			errs = append(errs, fmt.Errorf("got flag options for unknown k3s flag %q", k))
			continue
		}
	}

cmd.Flags = newFlags
	return cmd, errs.Err()
}

// parseName returns a single primary flag name.
// Flags with short versions may be named "flag", "flag,f", "f,flag", "flag, f" and so on.
// This returns just the first long version, or the short version if no long is available.
func parseName(flag cli.Flag) string {
	names := strings.Split(flag.GetName(), ",")
	for _, n := range names {
		n = strings.TrimSpace(n)
		if len(n) > 1 {
			return n
		}
	}
	return strings.TrimSpace(names[0])
}
0707010000006D000081A4000000000000000000000001653C446F00000CA0000000000000000000000000000000000000003100000000rke2-1.27.7+rke2r1/pkg/cli/cmds/profile_linux.go//go:build !windows
// +build !windows

package cmds

import (
	"fmt"
	"io/ioutil"
	"os/user"
	"strconv"
	"strings"

"github.com/pkg/errors"
	"github.com/rancher/rke2/pkg/rke2"
	"github.com/sirupsen/logrus"
	"github.com/urfave/cli"
)

const (
	protectKernelDefaultsFlagName = "protect-kernel-defaults"
)

// kernelRuntimeParameters contains the names and values
// of the expected values from the Rancher Hardening guide
// for CIS 1.5 compliance.
var kernelRuntimeParameters = map[string]int{
	"vm.overcommit_memory": 1,
	"vm.panic_on_oom":      0,
	"kernel.panic":         10,
	"kernel.panic_on_oops": 1,
}

// sysctl retrieves the value of the given sysctl.
func sysctl(s string) (int, error) {
	s = strings.ReplaceAll(s, ".", "/")
	v, err := ioutil.ReadFile("/proc/sys/" + s)
	if err != nil {
		return 0, err
	}
	if len(v) < 2 || v[len(v)-1] != '\n' {
		return 0, fmt.Errorf("invalid contents: %s", s)
	}
	return strconv.Atoi(strings.Replace(string(v), "\n", "", -1))
}

// cisErrors holds errors reported during
// the start-up routine that checks for
// CIS compliance.
type cisErrors []error

// Error provides a string representation of the
// cisErrors type and satisfies the Error interface.
func (c cisErrors) Error() string {
	var err strings.Builder
	for _, e := range c {
		err.WriteString(e.Error() + "\n")
	}
	return err.String()
}

// validateCISReqs checks if the system is in compliance
// with CIS 1.5 benchmark requirements. The nodeType string
// is used to filter out tests that may only be relevant to servers
// or agents.
func validateCISReqs(role CLIRole) error {
	ce := make(cisErrors, 0)

// etcd user only needs to exist on servers
	if role == Server {
		if _, err := user.Lookup("etcd"); err != nil {
			ce = append(ce, errors.Wrap(err, "missing required"))
		}
		if _, err := user.LookupGroup("etcd"); err != nil {
			ce = append(ce, errors.Wrap(err, "missing required"))
		}
	}

for kp, pv := range kernelRuntimeParameters {
		cv, err := sysctl(kp)
		if err != nil {
			// Fail immediately if we cannot retrieve the current value,
			// since it is unlikely that we will be able to retrieve others
			// if this one failed.
			logrus.Fatal(err)
		}
		if cv != pv {
			ce = append(ce, fmt.Errorf("invalid kernel parameter value %s=%d - expected %d", kp, cv, pv))
		}
	}
	if len(ce) != 0 {
		return ce
	}
	return nil
}

// setCISFlags validates and sets any CLI flags necessary to ensure
// compliance with the profile.
func setCISFlags(clx *cli.Context) error {
	// If the user has specifically set this to false, raise an error
	if clx.IsSet(protectKernelDefaultsFlagName) && !clx.Bool(protectKernelDefaultsFlagName) {
		return fmt.Errorf("--%s must be true when using --profile=%s", protectKernelDefaultsFlagName, clx.String("profile"))
	}
	return clx.Set(protectKernelDefaultsFlagName, "true")
}

func validateProfile(clx *cli.Context, role CLIRole) {
	switch clx.String("profile") {
	case rke2.CISProfile123, rke2.CISProfile:
		if err := validateCISReqs(role); err != nil {
			logrus.Fatal(err)
		}
		if err := setCISFlags(clx); err != nil {
			logrus.Fatal(err)
		}
	case "":
		logrus.Warn("not running in CIS mode")
	default:
		logrus.Fatal("invalid value provided for --profile flag")
	}
}
0707010000006E000081A4000000000000000000000001653C446F00000092000000000000000000000000000000000000003300000000rke2-1.27.7+rke2r1/pkg/cli/cmds/profile_windows.go//go:build windows
// +build windows

package cmds

import (
	"github.com/urfave/cli"
)

func validateProfile(clx *cli.Context, role CLIRole) {
}
0707010000006F000081A4000000000000000000000001653C446F0000232C000000000000000000000000000000000000002800000000rke2-1.27.7+rke2r1/pkg/cli/cmds/root.gopackage cmds

import (
	"fmt"
	"os"
	"path/filepath"
	"runtime"
	"strings"

"github.com/k3s-io/k3s/pkg/version"
	"github.com/rancher/rke2/pkg/images"
	"github.com/rancher/rke2/pkg/rke2"
	"github.com/urfave/cli"
)

var (
	appName    = filepath.Base(os.Args[0])
	commonFlag = []cli.Flag{
		&cli.StringFlag{
			Name:        images.KubeAPIServer,
			Usage:       "(image) Override image to use for kube-apiserver",
			EnvVar:      "RKE2_KUBE_APISERVER_IMAGE",
			Destination: &config.Images.KubeAPIServer,
		},
		&cli.StringFlag{
			Name:        images.KubeControllerManager,
			Usage:       "(image) Override image to use for kube-controller-manager",
			EnvVar:      "RKE2_KUBE_CONTROLLER_MANAGER_IMAGE",
			Destination: &config.Images.KubeControllerManager,
		},
		&cli.StringFlag{
			Name:        images.CloudControllerManager,
			Usage:       "(image) Override image to use for cloud-controller-manager",
			EnvVar:      "RKE2_CLOUD_CONTROLLER_MANAGER_IMAGE",
			Destination: &config.Images.CloudControllerManager,
		},
		&cli.StringFlag{
			Name:        images.KubeProxy,
			Usage:       "(image) Override image to use for kube-proxy",
			EnvVar:      "RKE2_KUBE_PROXY_IMAGE",
			Destination: &config.Images.KubeProxy,
		},
		&cli.StringFlag{
			Name:        images.KubeScheduler,
			Usage:       "(image) Override image to use for kube-scheduler",
			EnvVar:      "RKE2_KUBE_SCHEDULER_IMAGE",
			Destination: &config.Images.KubeScheduler,
		},
		&cli.StringFlag{
			Name:        images.Pause,
			Usage:       "(image) Override image to use for pause",
			EnvVar:      "RKE2_PAUSE_IMAGE",
			Destination: &config.Images.Pause,
		},
		&cli.StringFlag{
			Name:        images.Runtime,
			Usage:       "(image) Override image to use for runtime binaries (containerd, kubectl, crictl, etc)",
			EnvVar:      "RKE2_RUNTIME_IMAGE",
			Destination: &config.Images.Runtime,
		},
		&cli.StringFlag{
			Name:        images.ETCD,
			Usage:       "(image) Override image to use for etcd",
			EnvVar:      "RKE2_ETCD_IMAGE",
			Destination: &config.Images.ETCD,
		},
		&cli.StringFlag{
			Name:        "kubelet-path",
			Usage:       "(experimental/agent) Override kubelet binary path",
			EnvVar:      "RKE2_KUBELET_PATH",
			Destination: &config.KubeletPath,
		},
		&cli.StringFlag{
			Name:        "cloud-provider-name",
			Usage:       "(cloud provider) Cloud provider name",
			EnvVar:      "RKE2_CLOUD_PROVIDER_NAME",
			Destination: &config.CloudProviderName,
		},
		&cli.StringFlag{
			Name:        "cloud-provider-config",
			Usage:       "(cloud provider) Cloud provider configuration file path",
			EnvVar:      "RKE2_CLOUD_PROVIDER_CONFIG",
			Destination: &config.CloudProviderConfig,
		},
		&cli.StringFlag{
			Name:   "profile",
			Usage:  "(security) Validate system configuration against the selected benchmark (valid items: cis, cis-1.23 (deprecated))",
			EnvVar: "RKE2_CIS_PROFILE",
		},
		&cli.StringFlag{
			Name:        "audit-policy-file",
			Usage:       "(security) Path to the file that defines the audit policy configuration",
			EnvVar:      "RKE2_AUDIT_POLICY_FILE",
			Destination: &config.AuditPolicyFile,
		},
		&cli.StringFlag{
			Name:        "pod-security-admission-config-file",
			Usage:       "(security) Path to the file that defines Pod Security Admission configuration",
			EnvVar:      "RKE2_POD_SECURITY_ADMISSION_CONFIG_FILE",
			Destination: &config.PodSecurityAdmissionConfigFile,
		},
		&cli.StringSliceFlag{
			Name:   "control-plane-resource-requests",
			Usage:  "(components) Control Plane resource requests",
			EnvVar: "RKE2_CONTROL_PLANE_RESOURCE_REQUESTS",
			Value:  &config.ControlPlaneResourceRequests,
		},
		&cli.StringSliceFlag{
			Name:   "control-plane-resource-limits",
			Usage:  "(components) Control Plane resource limits",
			EnvVar: "RKE2_CONTROL_PLANE_RESOURCE_LIMITS",
			Value:  &config.ControlPlaneResourceLimits,
		},
		&cli.StringSliceFlag{
			Name:   "control-plane-probe-configuration",
			Usage:  "(components) Control Plane Probe configuration",
			EnvVar: "RKE2_CONTROL_PLANE_PROBE_CONFIGURATION",
			Value:  &config.ControlPlaneProbeConf,
		},
		&cli.StringSliceFlag{
			Name:   rke2.KubeAPIServer + "-extra-mount",
			Usage:  "(components) " + rke2.KubeAPIServer + " extra volume mounts",
			EnvVar: "RKE2_" + strings.ToUpper(strings.ReplaceAll(rke2.KubeAPIServer, "-", "_")) + "_EXTRA_MOUNT",
			Value:  &config.ExtraMounts.KubeAPIServer,
		},
		&cli.StringSliceFlag{
			Name:   rke2.KubeScheduler + "-extra-mount",
			Usage:  "(components) " + rke2.KubeScheduler + " extra volume mounts",
			EnvVar: "RKE2_" + strings.ToUpper(strings.ReplaceAll(rke2.KubeScheduler, "-", "_")) + "_EXTRA_MOUNT",
			Value:  &config.ExtraMounts.KubeScheduler,
		},
		&cli.StringSliceFlag{
			Name:   rke2.KubeControllerManager + "-extra-mount",
			Usage:  "(components) " + rke2.KubeControllerManager + " extra volume mounts",
			EnvVar: "RKE2_" + strings.ToUpper(strings.ReplaceAll(rke2.KubeControllerManager, "-", "_")) + "_EXTRA_MOUNT",
			Value:  &config.ExtraMounts.KubeControllerManager,
		},
		&cli.StringSliceFlag{
			Name:   rke2.KubeProxy + "-extra-mount",
			Usage:  "(components) " + rke2.KubeProxy + " extra volume mounts",
			EnvVar: "RKE2_" + strings.ToUpper(strings.ReplaceAll(rke2.KubeProxy, "-", "_")) + "_EXTRA_MOUNT",
			Value:  &config.ExtraMounts.KubeProxy,
		},
		&cli.StringSliceFlag{
			Name:   rke2.Etcd + "-extra-mount",
			Usage:  "(components) " + rke2.Etcd + " extra volume mounts",
			EnvVar: "RKE2_" + strings.ToUpper(strings.ReplaceAll(rke2.Etcd, "-", "_")) + "_EXTRA_MOUNT",
			Value:  &config.ExtraMounts.Etcd,
		},
		&cli.StringSliceFlag{
			Name:   rke2.CloudControllerManager + "-extra-mount",
			Usage:  "(components) " + rke2.CloudControllerManager + " extra volume mounts",
			EnvVar: "RKE2_" + strings.ToUpper(strings.ReplaceAll(rke2.CloudControllerManager, "-", "_")) + "_EXTRA_MOUNT",
			Value:  &config.ExtraMounts.CloudControllerManager,
		},
		&cli.StringSliceFlag{
			Name:   rke2.KubeAPIServer + "-extra-env",
			Usage:  "(components) " + rke2.KubeAPIServer + " extra environment variables",
			EnvVar: "RKE2_" + strings.ToUpper(strings.ReplaceAll(rke2.KubeAPIServer, "-", "_")) + "_EXTRA_ENV",
			Value:  &config.ExtraEnv.KubeAPIServer,
		},
		&cli.StringSliceFlag{
			Name:   rke2.KubeScheduler + "-extra-env",
			Usage:  "(components) " + rke2.KubeScheduler + " extra environment variables",
			EnvVar: "RKE2_" + strings.ToUpper(strings.ReplaceAll(rke2.KubeScheduler, "-", "_")) + "_EXTRA_ENV",
			Value:  &config.ExtraEnv.KubeScheduler,
		},
		&cli.StringSliceFlag{
			Name:   rke2.KubeControllerManager + "-extra-env",
			Usage:  "(components) " + rke2.KubeControllerManager + " extra environment variables",
			EnvVar: "RKE2_" + strings.ToUpper(strings.ReplaceAll(rke2.KubeControllerManager, "-", "_")) + "_EXTRA_ENV",
			Value:  &config.ExtraEnv.KubeControllerManager,
		},
		&cli.StringSliceFlag{
			Name:   rke2.KubeProxy + "-extra-env",
			Usage:  "(components) " + rke2.KubeProxy + " extra environment variables",
			EnvVar: "RKE2_" + strings.ToUpper(strings.ReplaceAll(rke2.KubeProxy, "-", "_")) + "_EXTRA_ENV",
			Value:  &config.ExtraEnv.KubeProxy,
		},
		&cli.StringSliceFlag{
			Name:   rke2.Etcd + "-extra-env",
			Usage:  "(components) " + rke2.Etcd + " extra environment variables",
			EnvVar: "RKE2_" + strings.ToUpper(strings.ReplaceAll(rke2.Etcd, "-", "_")) + "_EXTRA_ENV",
			Value:  &config.ExtraEnv.Etcd,
		},
		&cli.StringSliceFlag{
			Name:   rke2.CloudControllerManager + "-extra-env",
			Usage:  "(components) " + rke2.CloudControllerManager + " extra environment variables",
			EnvVar: "RKE2_" + strings.ToUpper(strings.ReplaceAll(rke2.CloudControllerManager, "-", "_")) + "_EXTRA_ENV",
			Value:  &config.ExtraEnv.CloudControllerManager,
		},
	}
)

type CLIRole int64

const (
	Agent CLIRole = iota
	Server
)

func init() {
	// hack - force "file,dns" lookup order if go dns is used
	if os.Getenv("RES_OPTIONS") == "" {
		os.Setenv("RES_OPTIONS", " ")
	}
}

func validateCloudProviderName(clx *cli.Context, role CLIRole) {
	cloudProvider := clx.String("cloud-provider-name")
	cloudProviderDisables := map[string][]string{
		"rancher-vsphere": {"rancher-vsphere-cpi", "rancher-vsphere-csi"},
		"harvester":       {"harvester-cloud-provider", "harvester-csi-driver"},
	}

for providerName, disables := range cloudProviderDisables {
		if providerName == cloudProvider {
			clx.Set("cloud-provider-name", "external")
			if role == Server {
				clx.Set("disable-cloud-controller", "true")
			}
		} else {
			if role == Server {
				for _, disable := range disables {
					clx.Set("disable", disable)
				}
			}
		}
	}
}

func NewApp() *cli.App {
	app := cli.NewApp()
	app.Name = appName
	app.Usage = "Rancher Kubernetes Engine 2"
	app.Version = fmt.Sprintf("%s (%s)", version.Version, version.GitCommit)
	cli.VersionPrinter = func(c *cli.Context) {
		fmt.Printf("%s version %s\n", app.Name, app.Version)
		fmt.Printf("go version %s\n", runtime.Version())
	}

return app
}
07070100000070000081A4000000000000000000000001653C446F00000420000000000000000000000000000000000000003300000000rke2-1.27.7+rke2r1/pkg/cli/cmds/secrets_encrypt.gopackage cmds

import (
	"github.com/k3s-io/k3s/pkg/cli/cmds"
	"github.com/k3s-io/k3s/pkg/cli/secretsencrypt"
	"github.com/urfave/cli"
)

func NewSecretsEncryptCommand() cli.Command {
	k3sOpts := K3SFlagSet{
		"data-dir": copyFlag,
		"token":    copyFlag,
		"server": {
			Default: "https://127.0.0.1:9345",
		},
	}
	subcommandOpts := map[string]K3SFlagSet{
		"status": {
			"output": copyFlag,
		},
		"prepare": {
			"force": copyFlag,
		},
		"rotate": {
			"force": copyFlag,
		},
		"reencrypt": {
			"force": copyFlag,
			"skip":  copyFlag,
		},
	}

command := cmds.NewSecretsEncryptCommands(
		secretsencrypt.Status,
		secretsencrypt.Enable,
		secretsencrypt.Disable,
		secretsencrypt.Prepare,
		secretsencrypt.Rotate,
		secretsencrypt.Reencrypt)

for i, subcommand := range command.Subcommands {
		if s, ok := subcommandOpts[subcommand.Name]; ok {
			k3sOpts.CopyInto(s)
			command.Subcommands[i] = mustCmdFromK3S(subcommand, s)
		} else {
			command.Subcommands[i] = mustCmdFromK3S(subcommand, k3sOpts)
		}
	}
	return mustCmdFromK3S(command, nil)
}
07070100000071000081A4000000000000000000000001653C446F00001E47000000000000000000000000000000000000002A00000000rke2-1.27.7+rke2r1/pkg/cli/cmds/server.gopackage cmds

import (
	"strings"

"github.com/k3s-io/k3s/pkg/cli/cmds"
	"github.com/k3s-io/k3s/pkg/configfilearg"
	"github.com/rancher/rke2/pkg/rke2"
	"github.com/rancher/wrangler/pkg/slice"
	"github.com/sirupsen/logrus"
	"github.com/urfave/cli"
)

const (
	rke2Path = "/var/lib/rancher/rke2"
)

var (
	DisableItems = []string{"rke2-coredns", "rke2-ingress-nginx", "rke2-metrics-server"}
	CNIItems     = []string{"calico", "canal", "cilium"}

config = rke2.Config{}

serverFlag = []cli.Flag{
		&cli.StringSliceFlag{
			Name:   "cni",
			Usage:  "(networking) CNI Plugins to deploy, one of none, " + strings.Join(CNIItems, ", ") + "; optionally with multus as the first value to enable the multus meta-plugin (default: canal)",
			EnvVar: "RKE2_CNI",
		},
		&cli.BoolFlag{
			Name:   "enable-servicelb",
			Usage:  "(components) Enable rke2 default cloud controller manager's service controller",
			EnvVar: "RKE2_ENABLE_SERVICELB",
		},
	}

k3sServerBase = mustCmdFromK3S(cmds.NewServerCommand(ServerRun), K3SFlagSet{
		"config":            copyFlag,
		"debug":             copyFlag,
		"v":                 hideFlag,
		"vmodule":           hideFlag,
		"log":               hideFlag,
		"alsologtostderr":   hideFlag,
		"bind-address":      copyFlag,
		"https-listen-port": dropFlag,
		"advertise-address": copyFlag,
		"advertise-port":    dropFlag,
		"tls-san":           copyFlag,
		"tls-san-security":  copyFlag,
		"data-dir": {
			Usage:   "(data) Folder to hold state",
			Default: rke2Path,
		},
		"disable-agent":                     hideFlag,
		"cluster-cidr":                      copyFlag,
		"service-cidr":                      copyFlag,
		"cluster-init":                      dropFlag,
		"cluster-reset":                     copyFlag,
		"cluster-reset-restore-path":        copyFlag,
		"cluster-dns":                       copyFlag,
		"cluster-domain":                    copyFlag,
		"flannel-backend":                   dropFlag,
		"vpn-auth":                          dropFlag,
		"vpn-auth-file":                     dropFlag,
		"token":                             copyFlag,
		"token-file":                        copyFlag,
		"write-kubeconfig":                  copyFlag,
		"write-kubeconfig-mode":             copyFlag,
		"kube-apiserver-arg":                copyFlag,
		"etcd-arg":                          copyFlag,
		"kube-scheduler-arg":                copyFlag,
		"kube-controller-arg":               dropFlag, // deprecated version of kube-controller-manager-arg
		"kube-controller-manager-arg":       copyFlag,
		"kube-cloud-controller-manager-arg": copyFlag,
		"kube-cloud-controller-arg":         dropFlag, // deprecated version of kube-cloud-controller-manager-arg
		"datastore-endpoint":                dropFlag,
		"datastore-cafile":                  dropFlag,
		"datastore-certfile":                dropFlag,
		"datastore-keyfile":                 dropFlag,
		"default-local-storage-path":        dropFlag,
		"disable": {
			Usage: "(components) Do not deploy packaged components and delete any deployed components (valid items: " + strings.Join(DisableItems, ", ") + ")",
		},
		"disable-scheduler":                 copyFlag,
		"disable-cloud-controller":          copyFlag,
		"disable-network-policy":            dropFlag,
		"disable-kube-proxy":                copyFlag,
		"disable-apiserver":                 copyFlag,
		"disable-controller-manager":        copyFlag,
		"disable-etcd":                      copyFlag,
		"etcd-disable-snapshots":            copyFlag,
		"etcd-snapshot-schedule-cron":       copyFlag,
		"etcd-snapshot-retention":           copyFlag,
		"etcd-snapshot-dir":                 copyFlag,
		"etcd-snapshot-name":                copyFlag,
		"etcd-snapshot-compress":            copyFlag,
		"node-name":                         copyFlag,
		"with-node-id":                      copyFlag,
		"node-label":                        copyFlag,
		"node-taint":                        copyFlag,
		"image-credential-provider-bin-dir": copyFlag,
		"image-credential-provider-config":  copyFlag,
		"docker":                            dropFlag,
		"container-runtime-endpoint":        copyFlag,
		"image-service-endpoint":            dropFlag,
		"pause-image":                       dropFlag,
		"private-registry":                  copyFlag,
		"system-default-registry":           copyFlag,
		"node-ip":                           copyFlag,
		"node-external-ip":                  copyFlag,
		"resolv-conf":                       copyFlag,
		"flannel-iface":                     dropFlag,
		"flannel-conf":                      dropFlag,
		"flannel-cni-conf":                  dropFlag,
		"flannel-ipv6-masq":                 dropFlag,
		"flannel-external-ip":               dropFlag,
		"multi-cluster-cidr":                hideFlag,
		"egress-selector-mode":              copyFlag,
		"kubelet-arg":                       copyFlag,
		"kube-proxy-arg":                    copyFlag,
		"rootless":                          dropFlag,
		"prefer-bundled-bin":                dropFlag,
		"agent-token":                       copyFlag,
		"agent-token-file":                  copyFlag,
		"server":                            copyFlag,
		"secrets-encryption":                hideFlag,
		"protect-kernel-defaults":           copyFlag,
		"snapshotter":                       copyFlag,
		"selinux":                           copyFlag,
		"lb-server-port":                    copyFlag,
		"service-node-port-range":           copyFlag,
		"etcd-expose-metrics":               copyFlag,
		"airgap-extra-registry":             copyFlag,
		"etcd-s3":                           copyFlag,
		"etcd-s3-endpoint":                  copyFlag,
		"etcd-s3-endpoint-ca":               copyFlag,
		"etcd-s3-skip-ssl-verify":           copyFlag,
		"etcd-s3-access-key":                copyFlag,
		"etcd-s3-secret-key":                copyFlag,
		"etcd-s3-bucket":                    copyFlag,
		"etcd-s3-region":                    copyFlag,
		"etcd-s3-folder":                    copyFlag,
		"etcd-s3-insecure":                  copyFlag,
		"etcd-s3-timeout":                   copyFlag,
		"disable-helm-controller":           dropFlag,
		"helm-job-image":                    copyFlag,
		"enable-pprof":                      copyFlag,
		"servicelb-namespace":               copyFlag,
	})
)

func NewServerCommand() cli.Command {
	cmd := k3sServerBase
	cmd.Flags = append(cmd.Flags, serverFlag...)
	cmd.Flags = append(cmd.Flags, commonFlag...)
	configfilearg.DefaultParser.ValidFlags[cmd.Name] = cmd.Flags
	return cmd
}

func ServerRun(clx *cli.Context) error {
	validateCloudProviderName(clx, Server)
	validateProfile(clx, Server)
	validateCNI(clx)
	return rke2.Server(clx, config)
}

func validateCNI(clx *cli.Context) {
	cnis := []string{}
	for _, cni := range clx.StringSlice("cni") {
		for _, v := range strings.Split(cni, ",") {
			cnis = append(cnis, v)
		}
	}

switch len(cnis) {
	case 0:
		cnis = append(cnis, "canal")
		fallthrough
	case 1:
		if cnis[0] == "multus" {
			logrus.Fatal("invalid value provided for --cni flag: multus must be used alongside another primary cni selection")
		}
		clx.Set("disable", "rke2-multus")
	case 2:
		if cnis[0] == "multus" {
			cnis = cnis[1:]
		} else {
			logrus.Fatal("invalid values provided for --cni flag: may only provide multiple values if multus is the first value")
		}
	default:
		logrus.Fatal("invalid values provided for --cni flag: may not provide more than two values")
	}

switch {
	case cnis[0] == "none":
		fallthrough
	case slice.ContainsString(CNIItems, cnis[0]):
		for _, d := range CNIItems {
			if cnis[0] != d {
				clx.Set("disable", "rke2-"+d)
				clx.Set("disable", "rke2-"+d+"-crd")
			}
		}
	default:
		logrus.Fatal("invalid value provided for --cni flag")
	}
}
07070100000072000081A4000000000000000000000001653C446F00000495000000000000000000000000000000000000002900000000rke2-1.27.7+rke2r1/pkg/cli/cmds/token.gopackage cmds

import (
	"github.com/k3s-io/k3s/pkg/cli/cmds"
	"github.com/k3s-io/k3s/pkg/cli/token"
	"github.com/k3s-io/k3s/pkg/configfilearg"
	"github.com/urfave/cli"
)

func NewTokenCommand() cli.Command {
	k3sOpts := K3SFlagSet{
		"kubeconfig": copyFlag,
		"data-dir": {
			Usage:   "(data) Folder to hold state",
			Default: rke2Path,
		},
	}
	subCommandOpts := map[string]K3SFlagSet{
		"create": {
			"description": copyFlag,
			"groups":      copyFlag,
			"ttl":         copyFlag,
			"usages":      copyFlag,
		},
		"list": {
			"output": copyFlag,
		},
		"rotate": {
			"token":     copyFlag,
			"new-token": copyFlag,
			"server": {
				Default: "https://127.0.0.1:9345",
			},
		},
	}

command := cmds.NewTokenCommands(token.Create, token.Delete, token.Generate, token.List, token.Rotate)
	configfilearg.DefaultParser.ValidFlags[command.Name] = command.Flags
	for i, subcommand := range command.Subcommands {
		if s, ok := subCommandOpts[subcommand.Name]; ok {
			k3sOpts.CopyInto(s)
			command.Subcommands[i] = mustCmdFromK3S(subcommand, s)
		} else {
			command.Subcommands[i] = mustCmdFromK3S(subcommand, k3sOpts)
		}
	}
	return mustCmdFromK3S(command, nil)
}
07070100000073000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002400000000rke2-1.27.7+rke2r1/pkg/cli/defaults07070100000074000081A4000000000000000000000001653C446F00000502000000000000000000000000000000000000003000000000rke2-1.27.7+rke2r1/pkg/cli/defaults/defaults.gopackage defaults

import (
	"io/ioutil"
	"os"
	"path/filepath"

"github.com/k3s-io/k3s/pkg/cli/cmds"
	"github.com/pkg/errors"
	"github.com/urfave/cli"
	"google.golang.org/grpc/grpclog"
)

func Set(_ *cli.Context, dataDir string) error {
	logsDir := filepath.Join(dataDir, "agent", "logs")
	if err := os.MkdirAll(logsDir, 0755); err != nil {
		return errors.Wrapf(err, "failed to create directory %s", logsDir)
	}

cmds.ServerConfig.ClusterInit = true
	cmds.ServerConfig.DisableNPC = true
	cmds.ServerConfig.FlannelBackend = "none"
	cmds.ServerConfig.AdvertisePort = 6443
	cmds.ServerConfig.SupervisorPort = 9345
	cmds.ServerConfig.HTTPSPort = 6443
	cmds.ServerConfig.APIServerPort = 6443
	cmds.ServerConfig.APIServerBindAddress = "0.0.0.0"
	cmds.ServerConfig.ExtraAPIArgs = append(
		[]string{
			"enable-admission-plugins=NodeRestriction",
		},
		cmds.ServerConfig.ExtraAPIArgs...)
	cmds.AgentConfig.ExtraKubeletArgs = append(
		[]string{
			"stderrthreshold=FATAL",
			"log-file-max-size=50",
			"alsologtostderr=false",
			"logtostderr=false",
			"log-file=" + filepath.Join(logsDir, "kubelet.log"),
		},
		cmds.AgentConfig.ExtraKubeletArgs...)

if !cmds.Debug {
		l := grpclog.NewLoggerV2(ioutil.Discard, ioutil.Discard, os.Stderr)
		grpclog.SetLoggerV2(l)
	}

return nil
}
07070100000075000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002300000000rke2-1.27.7+rke2r1/pkg/controllers07070100000076000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000003400000000rke2-1.27.7+rke2r1/pkg/controllers/cisnetworkpolicy07070100000077000081A4000000000000000000000001653C446F0000122B000000000000000000000000000000000000004200000000rke2-1.27.7+rke2r1/pkg/controllers/cisnetworkpolicy/controller.gopackage cisnetworkpolicy

import (
	"context"
	"net"
	"sort"

"github.com/k3s-io/k3s/pkg/server"
	"github.com/pkg/errors"
	coreclient "github.com/rancher/wrangler/pkg/generated/controllers/core/v1"
	"github.com/sirupsen/logrus"
	core "k8s.io/api/core/v1"
	netv1 "k8s.io/api/networking/v1"
	apierrors "k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/client-go/kubernetes"
	"k8s.io/client-go/util/retry"
)

const (
	flannelPresenceLabel         = "flannel.alpha.coreos.com/public-ip"
	flannelHostNetworkPolicyName = "rke2-flannel-host-networking"
)

func Controller(ctx context.Context, sc *server.Context) error {
	return register(ctx, sc.Core.Core().V1().Node(), sc.K8s)
}

func register(ctx context.Context,
	nodes coreclient.NodeController,
	k8s kubernetes.Interface,
) error {
	h := &handler{
		ctx: ctx,
		k8s: k8s,
	}
	logrus.Debugf("CISNetworkPolicyController: Registering controller hooks")
	nodes.OnChange(ctx, "cisnetworkpolicy-node", h.handle)
	nodes.OnRemove(ctx, "cisnetworkpolicy-node", h.handle)
	return nil
}

type handler struct {
	ctx context.Context
	k8s kubernetes.Interface
}

func (h *handler) handle(key string, node *core.Node) (*core.Node, error) {
	if node == nil {
		return nil, nil
	}

return h.reconcileFlannelHostNetworkPolicy(key, node)
}

func (h *handler) reconcileFlannelHostNetworkPolicy(_ string, _ *core.Node) (*core.Node, error) {
	var np *netv1.NetworkPolicy
	var npIR *netv1.NetworkPolicyIngressRule

npIR, err := h.generateHostNetworkPolicyIngressRule()
	if err != nil {
		return nil, err
	}

np = h.generateHostNetworkingNetworkPolicy(npIR)

var namespaces = []string{
		metav1.NamespaceSystem,
		metav1.NamespaceDefault,
		metav1.NamespacePublic,
	}

for _, namespace := range namespaces {
		err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
			if npGet, err := h.k8s.NetworkingV1().NetworkPolicies(namespace).Get(h.ctx, flannelHostNetworkPolicyName, metav1.GetOptions{}); err != nil {
				if apierrors.IsNotFound(err) {
					if _, err := h.k8s.NetworkingV1().NetworkPolicies(namespace).Create(h.ctx, np, metav1.CreateOptions{}); err != nil {
						if !apierrors.IsAlreadyExists(err) {
							logrus.Errorf("CISNetworkPolicyController: Error creating network policy in namespace %s: %v", namespace, err)
							return err
						}
					}
				} else {
					logrus.Errorf("CISNetworkPolicyController: Error getting network policy network policy in namespace %s: %v", namespace, err)
					return err
				}
			} else {
				npGet = npGet.DeepCopy()
				npGet.Spec.Ingress[0] = *npIR
				_, err := h.k8s.NetworkingV1().NetworkPolicies(namespace).Update(h.ctx, npGet, metav1.UpdateOptions{})
				if err != nil {
					return err
				}
			}
			return nil
		})
		if err != nil {
			return nil, errors.Wrapf(err, "CISNetworkPolicyController: error working on network policy in namespace %s", namespace)
		}
	}
	logrus.Debugf("CISNetworkPolicyController: Handled node change")
	return nil, nil
}

func (h *handler) generateHostNetworkingNetworkPolicy(networkPolicyIngressRule *netv1.NetworkPolicyIngressRule) *netv1.NetworkPolicy {
	np := &netv1.NetworkPolicy{
		ObjectMeta: metav1.ObjectMeta{
			Name: flannelHostNetworkPolicyName,
		},
		Spec: netv1.NetworkPolicySpec{
			PodSelector: metav1.LabelSelector{},
			Ingress: []netv1.NetworkPolicyIngressRule{
				*networkPolicyIngressRule,
			},
			PolicyTypes: []netv1.PolicyType{
				netv1.PolicyTypeIngress,
			},
		},
	}

return np
}

func (h *handler) generateHostNetworkPolicyIngressRule() (*netv1.NetworkPolicyIngressRule, error) {
	var npIR netv1.NetworkPolicyIngressRule

nodes, err := h.k8s.CoreV1().Nodes().List(h.ctx, metav1.ListOptions{})
	if err != nil {
		return &npIR, errors.Wrap(err, "CISNetworkPolicyController: problem listing nodes")
	}

for _, node := range nodes.Items {
		if _, ok := node.Annotations[flannelPresenceLabel]; !ok {
			logrus.Debugf("CISNetworkPolicyController: node=%v doesn't have flannel label, skipping", node.Name)
			continue
		}
		podCIDRFirstIP, _, err := net.ParseCIDR(node.Spec.PodCIDR)
		if err != nil {
			logrus.Debugf("CISNetworkPolicyController: node=%+v", node)
			logrus.Errorf("CISNetworkPolicyController: couldn't parse PodCIDR(%v) for node %v err=%v", node.Spec.PodCIDR, node.Name, err)
			continue
		}
		ipBlock := netv1.IPBlock{
			CIDR: podCIDRFirstIP.String() + "/32",
		}
		npIR.From = append(npIR.From, netv1.NetworkPolicyPeer{IPBlock: &ipBlock})
	}

// sort ipblocks so it always appears in a certain order
	sort.Slice(npIR.From, func(i, j int) bool {
		return npIR.From[i].IPBlock.CIDR < npIR.From[j].IPBlock.CIDR
	})

return &npIR, nil
}
07070100000078000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001E00000000rke2-1.27.7+rke2r1/pkg/images07070100000079000081A4000000000000000000000001653C446F00001E3E000000000000000000000000000000000000002800000000rke2-1.27.7+rke2r1/pkg/images/images.gopackage images

import (
	"fmt"
	"io/ioutil"
	"os"
	"path/filepath"
	"strings"

"github.com/google/go-containerregistry/pkg/name"
	"github.com/pkg/errors"
	"github.com/sirupsen/logrus"
)

// Image defaults overridden by config passed in and ImageOverrideConfig below
const (
	Runtime                = "runtime-image"
	KubeAPIServer          = "kube-apiserver-image"
	KubeControllerManager  = "kube-controller-manager-image"
	KubeProxy              = "kube-proxy-image"
	KubeScheduler          = "kube-scheduler-image"
	ETCD                   = "etcd-image"
	Pause                  = "pause-image"
	CloudControllerManager = "cloud-controller-manager-image"
)

// These defaults are overridden at build time and do not need to be updated here
var (
	DefaultRegistry                    = name.DefaultRegistry
	DefaultEtcdImage                   = "rancher/hardened-etcd"
	DefaultKubernetesImage             = "rancher/hardened-kubernetes"
	DefaultPauseImage                  = "rancher/pause"
	DefaultRuntimeImage                = "rancher/rke2-runtime"
	DefaultCloudControllerManagerImage = "rancher/rke2-cloud-provider"
)

// ResolverOpt is an option to modify image resolution behavior.
type ResolverOpt func(name.Reference) (name.Reference, error)

// Resolver provides functionality to resolve an RKE2 image name to a reference.
type Resolver struct {
	registry  name.Registry
	overrides map[string]name.Reference
}

// ImageOverrideConfig stores configuration from the CLI.
type ImageOverrideConfig struct {
	SystemDefaultRegistry  string
	KubeAPIServer          string
	KubeControllerManager  string
	KubeProxy              string
	KubeScheduler          string
	Pause                  string
	Runtime                string
	ETCD                   string
	CloudControllerManager string
}

// NewResolver creates a new image resolver, with options to modify the resolver behavior.
func NewResolver(c ImageOverrideConfig) (*Resolver, error) {
	registry, err := name.NewRegistry(DefaultRegistry)
	if err != nil {
		return nil, err
	}

r := Resolver{
		registry:  registry,
		overrides: map[string]name.Reference{},
	}

// Validate and set image overrides from config
	config := [...]struct {
		i string
		n string
	}{
		{ETCD, c.ETCD},
		{KubeAPIServer, c.KubeAPIServer},
		{KubeControllerManager, c.KubeControllerManager},
		{KubeProxy, c.KubeProxy},
		{KubeScheduler, c.KubeScheduler},
		{Pause, c.Pause},
		{Runtime, c.Runtime},
		{CloudControllerManager, c.CloudControllerManager},
	}
	for _, s := range config {
		if err := r.ParseAndSetOverride(s.i, s.n); err != nil {
			return nil, errors.Wrapf(err, "failed to parse %s", s.i)
		}
	}

// validate and set system-default-registry from config
	if c.SystemDefaultRegistry != "" {
		registry, err := name.NewRegistry(c.SystemDefaultRegistry)
		if err != nil {
			return nil, errors.Wrap(err, "failed to parse system-default-registry")
		}
		r.registry = registry
	}
	return &r, nil
}

// ParseAndSetDefaultRegistry updates the default registry, if it can be parsed
// as a valid Registry
func (r *Resolver) ParseAndSetDefaultRegistry(s string) error {
	registry, err := name.NewRegistry(s)
	if err != nil {
		return errors.Wrap(err, "failed to parse system-default-registry")
	}
	r.registry = registry
	return nil
}

// ParseAndSetOverride sets an image override from a string, if it can be parsed as
// a valid Reference.
func (r *Resolver) ParseAndSetOverride(i, n string) error {
	n = strings.TrimSpace(n)
	if n == "" {
		return nil
	}
	ref, err := name.ParseReference(n, name.WeakValidation)
	if err != nil {
		return err
	}
	r.overrides[i] = ref
	return nil
}

// SetOverride set an image override from a Reference. If the reference is nil,
// the override is cleared.
func (r *Resolver) SetOverride(i string, n name.Reference) {
	if n == nil {
		delete(r.overrides, i)
	} else {
		r.overrides[i] = n
	}
}

// GetReference returns a reference to an image. If an override is set it is used,
// otherwise the compile-time default is retrieved and default-registry settings applied.
// Options can be passed to modify the reference before it is returned.
func (r *Resolver) GetReference(i string, opts ...ResolverOpt) (name.Reference, error) {
	var ref name.Reference
	if o, ok := r.overrides[i]; ok {
		// Use override if set
		ref = o
	} else {
		// No override; get compile-time default
		d, err := getDefaultImage(i)
		if err != nil {
			return nil, err
		}
		ref = d

// Apply registry override
		d, err = setRegistry(ref, r.registry)
		if err != nil {
			return nil, err
		}
		ref = d
	}

// Apply additional options
	for _, o := range opts {
		r, err := o(ref)
		if err != nil {
			return nil, err
		}
		ref = r
	}
	return ref, nil
}

func (r *Resolver) MustGetReference(i string, opts ...ResolverOpt) name.Reference {
	ref, err := r.GetReference(i, opts...)
	if err != nil {
		logrus.Fatalf("Failed to get image reference for %s: %v", i, err)
	}
	return ref
}

// WithRegistry overrides the registry when resolving the reference to an image.
func WithRegistry(s string) ResolverOpt {
	return func(r name.Reference) (name.Reference, error) {
		registry, err := name.NewRegistry(s)
		if err != nil {
			return nil, err
		}
		s, err := setRegistry(r, registry)
		if err != nil {
			return nil, err
		}
		return s, nil
	}
}

// setRegistry sets the registry on an image reference. This is necessary
// because the Reference type doesn't expose the Registry field.
func setRegistry(ref name.Reference, registry name.Registry) (name.Reference, error) {
	if t, ok := ref.(name.Tag); ok {
		t.Registry = registry
		return t, nil
	} else if d, ok := ref.(name.Digest); ok {
		d.Registry = registry
		return d, nil
	}
	return ref, errors.Errorf("unhandled Reference type: %T", ref)
}

// getDefaultImage gets the compile-time default image for a given name.
func getDefaultImage(i string) (name.Reference, error) {
	var s string
	switch i {
	case ETCD:
		s = DefaultEtcdImage
	case Runtime:
		s = DefaultRuntimeImage
	case Pause:
		s = DefaultPauseImage
	case CloudControllerManager:
		s = DefaultCloudControllerManagerImage
	case KubeAPIServer, KubeControllerManager, KubeProxy, KubeScheduler:
		s = DefaultKubernetesImage
	default:
		return nil, fmt.Errorf("unknown image %s", i)
	}

return name.ParseReference(s, name.WeakValidation)
}

// Pull checks for preloaded images in dir. If they are available, nothing is done.
// If they are not available, it adds the image to name.txt in dir.
// This is used to get K3s to pre-pull images for static pods.
func Pull(dir, name string, image name.Reference) error {
	if dir == "" {
		return nil
	}

if imagesExist, err := checkPreloadedImages(dir); err != nil {
		return err
	} else if imagesExist {
		return nil
	}

if err := os.MkdirAll(dir, 0755); err != nil {
		return err
	}

dest := filepath.Join(dir, name+".txt")
	return ioutil.WriteFile(dest, []byte(image.Name()+"\n"), 0644)
}

// checkPreloadedImages returns true if there are any files in dir that do not
// end with a .txt extension. The presence of at least one such file is presumed to
// indicate that there is an airgap image tarball available.
func checkPreloadedImages(dir string) (bool, error) {
	if _, err := os.Stat(dir); err != nil {
		if os.IsNotExist(err) {
			return false, nil
		}
		logrus.Errorf("unable to stat image directory %s: %v", dir, err)
		return false, err
	}

fileInfos, err := ioutil.ReadDir(dir)
	if err != nil {
		logrus.Errorf("unable to list images in %s: %v", dir, err)
		return false, nil
	}
	for _, fileInfo := range fileInfos {
		if fileInfo.IsDir() {
			continue
		}
		// return true if there is a file that doesn't end with .txt
		if !strings.HasSuffix(fileInfo.Name(), ".txt") {
			return true, nil
		}
	}
	return false, nil
}
0707010000007A000081A4000000000000000000000001653C446F000009CB000000000000000000000000000000000000002D00000000rke2-1.27.7+rke2r1/pkg/images/images_test.gopackage images

import (
	"io/ioutil"
	"os"
	"testing"

"github.com/google/go-containerregistry/pkg/name"
)

func Test_UnitPull(t *testing.T) {
	type args struct {
		dir   string
		name  string
		image name.Reference
	}
	tests := []struct {
		name        string
		args        args
		setup       func(a *args) error
		teardown    func(a *args) error
		wantTxtFile bool
		wantErr     bool
	}{
		{
			name: "Pull with no directory",
			args: args{
				name: KubeScheduler,
			},
			setup:    func(a *args) error { return nil },
			teardown: func(a *args) error { return nil },
		},
		{
			name: "Pull with nonexistent directory",
			args: args{
				dir:  "/tmp/DEADBEEF",
				name: KubeScheduler,
			},
			setup: func(a *args) error {
				var err error
				a.image, err = getDefaultImage(KubeScheduler)
				return err
			},
			teardown: func(a *args) error {
				return os.RemoveAll(a.dir)
			},

wantTxtFile: true,
		},
		{
			name: "Pull with no image in directory",
			args: args{
				name: KubeScheduler,
			},
			setup: func(a *args) error {
				var err error
				a.image, err = getDefaultImage(KubeScheduler)
				if err != nil {
					return err
				}
				a.dir, err = os.MkdirTemp("", "*")
				return err
			},
			teardown: func(a *args) error {
				return os.RemoveAll(a.dir)
			},

wantTxtFile: true,
		},
		{
			name: "Pull with fake image in directory",
			args: args{
				name: "kube-scheduler",
			},
			setup: func(a *args) error {
				var err error
				a.image, err = getDefaultImage(KubeScheduler)
				if err != nil {
					return err
				}
				a.dir, err = os.MkdirTemp("", "*")
				tempImage := a.dir + "/" + a.name + ".image"
				ioutil.WriteFile(tempImage, []byte(a.image.Name()+"\n"), 0644)
				return err
			},
			teardown: func(a *args) error {
				return os.RemoveAll(a.dir)
			},
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {

if err := tt.setup(&tt.args); err != nil {
				t.Errorf("Setup for Pull() failed = %v", err)
			}
			if err := Pull(tt.args.dir, tt.args.name, tt.args.image); (err != nil) != tt.wantErr {
				t.Errorf("Pull() error = %v, wantErr %v", err, tt.wantErr)
			}
			if tt.wantTxtFile {
				fileName := tt.args.name + ".txt"
				if _, err := os.Stat(tt.args.dir + "/" + fileName); os.IsNotExist(err) {
					t.Errorf("File generate by Pull() %s, does not exists, wantFile %v", fileName, tt.wantTxtFile)
				}
			}
			if err := tt.teardown(&tt.args); err != nil {
				t.Errorf("Teardown for Pull() failed = %v", err)
			}
		})
	}
}
0707010000007B000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001F00000000rke2-1.27.7+rke2r1/pkg/logging0707010000007C000081A4000000000000000000000001653C446F000009BF000000000000000000000000000000000000002A00000000rke2-1.27.7+rke2r1/pkg/logging/logging.gopackage logging

import (
	"flag"
	"io"
	"os"
	"strings"

"github.com/natefinch/lumberjack"
	"github.com/spf13/pflag"
	cliflag "k8s.io/component-base/cli/flag"
	"k8s.io/klog/v2"
)

var (
	packageFlags  = pflag.NewFlagSet("logging", pflag.ContinueOnError)
	defaultValues = map[string]string{}
)

// init binds klog flags (except v/vmodule) into the pflag flagset and applies normalization from upstream, and
// memoize default values so that they can be reset when reusing the flag parser.
// Refs:
// * https://github.com/kubernetes/kubernetes/blob/release-1.25/staging/src/k8s.io/component-base/logs/logs.go#L49
// * https://github.com/kubernetes/kubernetes/blob/release-1.25/staging/src/k8s.io/component-base/logs/logs.go#L83
func init() {
	packageFlags.SetNormalizeFunc(cliflag.WordSepNormalizeFunc)
	fs := flag.NewFlagSet("logging", flag.ContinueOnError)
	klog.InitFlags(fs)
	fs.VisitAll(func(f *flag.Flag) {
		if !strings.HasPrefix(f.Name, "v") {
			pf := pflag.PFlagFromGoFlag(f)
			defaultValues[pf.Name] = pf.DefValue
			packageFlags.AddFlag(pf)
		}
	})
}

// ExtractFromArgs extracts the legacy klog flags from an args list, and returns both the remaining args,
// and a similarly configured log writer configured using the klog flag values.
func ExtractFromArgs(args []string) ([]string, io.Writer) {
	// reset values to default
	for name, value := range defaultValues {
		packageFlags.Set(name, value)
	}

// filter out and set klog flags
	extraArgs := []string{}
	for _, arg := range args {
		name := strings.TrimPrefix(arg, "--")
		split := strings.SplitN(name, "=", 2)
		if flag := packageFlags.Lookup(split[0]); flag != nil {
			var val string
			if len(split) > 1 {
				val = split[1]
			} else {
				val = flag.NoOptDefVal
			}
			flag.Value.Set(val)
			continue
		}
		extraArgs = append(extraArgs, arg)
	}

// Ignore errors on retrieving flag values; accepting the default is fine
	alsoToStderr, _ := packageFlags.GetBool("alsologtostderr")
	filename, _ := packageFlags.GetString("log-file")
	maxSize, _ := packageFlags.GetUint64("log-file-max-size")
	toStderr, _ := packageFlags.GetBool("logtostderr")

if filename == "" {
		if toStderr || alsoToStderr {
			return extraArgs, os.Stderr
		}
		return extraArgs, io.Discard
	}

logger := &lumberjack.Logger{
		Filename:   filename,
		MaxSize:    int(maxSize),
		MaxBackups: 3,
		MaxAge:     28,
		Compress:   true,
	}

if alsoToStderr {
		return extraArgs, io.MultiWriter(os.Stderr, logger)
	}

return extraArgs, logger
}
0707010000007D000081A4000000000000000000000001653C446F000006AB000000000000000000000000000000000000002F00000000rke2-1.27.7+rke2r1/pkg/logging/logging_test.gopackage logging

import (
	"fmt"
	"reflect"
	"testing"
)

func Test_UnitExtractFromArgs(t *testing.T) {
	tests := []struct {
		name           string
		args           []string
		wantArgs       []string
		wantLoggerType string
	}{
		{
			name:           "Test 1",
			args:           []string{},
			wantArgs:       []string{},
			wantLoggerType: "*os.File",
		},
		{
			name:           "Test 2",
			args:           []string{"log-file=/dev/null"},
			wantArgs:       []string{},
			wantLoggerType: "*lumberjack.Logger",
		},
		{
			name:           "Test 3",
			args:           []string{"logtostderr=false"},
			wantArgs:       []string{},
			wantLoggerType: "io.discard",
		},
		{
			name:           "Test 4",
			args:           []string{"logtostderr"},
			wantArgs:       []string{},
			wantLoggerType: "*os.File",
		},
		{
			name:           "Test 5",
			args:           []string{"log-file=/dev/null", "alsologtostderr"},
			wantArgs:       []string{},
			wantLoggerType: "*io.multiWriter",
		},
		{
			name:           "Test 6",
			args:           []string{"v=6", "logtostderr=false", "one-output=true", "address=0.0.0.0", "anonymous-auth"},
			wantArgs:       []string{"v=6", "address=0.0.0.0", "anonymous-auth"},
			wantLoggerType: "io.discard",
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			gotArgs, gotLogger := ExtractFromArgs(tt.args)
			if !reflect.DeepEqual(gotArgs, tt.wantArgs) {
				t.Errorf("ExtractFromArgs() gotArgs = %+v\nWant = %+v", gotArgs, tt.wantArgs)
			}
			if gotLoggerType := fmt.Sprintf("%T", gotLogger); gotLoggerType != tt.wantLoggerType {
				t.Errorf("ExtractFromArgs() gotLogger = %+v\nWant = %+v", gotLoggerType, tt.wantLoggerType)
			}
		})
	}
}
0707010000007E000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002800000000rke2-1.27.7+rke2r1/pkg/pebinaryexecutor0707010000007F000081A4000000000000000000000001653C446F00002450000000000000000000000000000000000000003400000000rke2-1.27.7+rke2r1/pkg/pebinaryexecutor/pebinary.go//go:build windows
// +build windows

package pebinaryexecutor

import (
	"context"
	"fmt"
	"net/http"
	"os"
	"os/exec"
	"path/filepath"
	"sort"
	"strings"
	"time"

"github.com/Microsoft/hcsshim"
	"github.com/Microsoft/hcsshim/hcn"
	"github.com/k3s-io/helm-controller/pkg/generated/controllers/helm.cattle.io"
	"github.com/k3s-io/k3s/pkg/cli/cmds"
	daemonconfig "github.com/k3s-io/k3s/pkg/daemons/config"
	"github.com/k3s-io/k3s/pkg/daemons/executor"
	"github.com/rancher/rke2/pkg/bootstrap"
	"github.com/rancher/rke2/pkg/images"
	"github.com/rancher/rke2/pkg/logging"
	win "github.com/rancher/rke2/pkg/windows"
	"github.com/sirupsen/logrus"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apiserver/pkg/authentication/authenticator"
	"k8s.io/client-go/rest"
	"k8s.io/client-go/tools/clientcmd"
)

var (
	ssldirs = []string{
		"/etc/ssl/certs",
		"/etc/pki/tls/certs",
		"/etc/ca-certificates",
		"/usr/local/share/ca-certificates",
		"/usr/share/ca-certificates",
	}
)

type PEBinaryConfig struct {
	ManifestsDir        string
	ImagesDir           string
	Resolver            *images.Resolver
	CloudProvider       *CloudProviderConfig
	CISMode             bool
	DataDir             string
	AuditPolicyFile     string
	KubeletPath         string
	KubeConfigKubeProxy string
	DisableETCD         bool
	IsServer            bool
	CNI                 string
	CNIConfig           win.Calico
}

type CloudProviderConfig struct {
	Name string
	Path string
}

const (
	CNINone   = "none"
	CNICalico = "calico"
	CNICilium = "cilium"
	CNICanal  = "canal"
)

// Bootstrap prepares the binary executor to run components by setting the system default registry
// and staging the kubelet and containerd binaries.  On servers, it also ensures that manifests are
// copied in to place and in sync with the system configuration.
func (p *PEBinaryConfig) Bootstrap(ctx context.Context, nodeConfig *daemonconfig.Node, cfg cmds.Agent) error {
	// On servers this is set to an initial value from the CLI when the resolver is created, so that
	// static pod manifests can be created before the agent bootstrap is complete. The agent itself
	// really only needs to know about the runtime and pause images, all of which are configured after the
	// default registry has been set by the server.
	if nodeConfig.AgentConfig.SystemDefaultRegistry != "" {
		if err := p.Resolver.ParseAndSetDefaultRegistry(nodeConfig.AgentConfig.SystemDefaultRegistry); err != nil {
			return err
		}
	}

pauseImage, err := p.Resolver.GetReference(images.Pause)
	if err != nil {
		return err
	}
	nodeConfig.AgentConfig.PauseImage = pauseImage.Name()

setWindowsAgentSpecificSettings(p.DataDir, nodeConfig)
	// stage bootstrap content from runtime image
	execPath, err := bootstrap.Stage(p.Resolver, nodeConfig, cfg)
	if err != nil {
		return err
	}
	if err := os.Setenv("PATH", execPath+":"+os.Getenv("PATH")); err != nil {
		return err
	}

if p.IsServer {
		return bootstrap.UpdateManifests(p.Resolver, nodeConfig, cfg)
	}

restConfig, err := clientcmd.BuildConfigFromFlags("", nodeConfig.AgentConfig.KubeConfigK3sController)

p.CNI, err = getCniType(restConfig)
	if err != nil {
		return err
	}

switch p.CNI {
	case "", CNICalico:
		if err := p.CNIConfig.Setup(ctx, nodeConfig, restConfig, p.DataDir); err != nil {
			return err
		}
	case CNINone:
		logrus.Info("Skipping CNI setup")
	default:
		logrus.Fatal("Unsupported CNI: ", p.CNI)
	}

// required to initialize KubeProxy
	p.KubeConfigKubeProxy = nodeConfig.AgentConfig.KubeConfigKubeProxy

logrus.Infof("Windows bootstrap okay. Exiting setup.")
	return nil
}

// Kubelet starts the kubelet in a subprocess with watching goroutine.
func (p *PEBinaryConfig) Kubelet(ctx context.Context, args []string) error {
	extraArgs := map[string]string{
		"file-check-frequency":     "5s",
		"sync-frequency":           "30s",
		"cgroups-per-qos":          "false",
		"enforce-node-allocatable": "",
		"resolv-conf":              "",
		"hairpin-mode":             "promiscuous-bridge",
	}
	if p.CloudProvider != nil {
		extraArgs["cloud-provider"] = p.CloudProvider.Name
		extraArgs["cloud-config"] = p.CloudProvider.Path
	}

args = append(getArgs(extraArgs), args...)
	args, logOut := logging.ExtractFromArgs(args)

var cleanArgs []string
	for _, arg := range args {
		if strings.Contains(arg, "eviction-hard") || strings.Contains(arg, "eviction-minimum-reclaim") {
			continue
		}
		cleanArgs = append(cleanArgs, arg)
	}

logrus.Infof("Running RKE2 kubelet %v", cleanArgs)
	go func() {
		for {
			cniCtx, cancel := context.WithCancel(ctx)
			if p.CNI != CNINone {
				go func() {
					if err := p.CNIConfig.Start(cniCtx); err != nil {
						logrus.Errorf("error in cni start: %s", err)
					}
				}()
			}

cmd := exec.CommandContext(ctx, p.KubeletPath, cleanArgs...)
			cmd.Stdout = logOut
			cmd.Stderr = logOut
			if err := cmd.Run(); err != nil {
				logrus.Errorf("Kubelet exited: %v", err)
			}
			cancel()
			time.Sleep(5 * time.Second)
		}
	}()
	return nil
}

// KubeProxy starts the kubeproxy in a subprocess with watching goroutine.
func (p *PEBinaryConfig) KubeProxy(ctx context.Context, args []string) error {
	if p.CNI == CNINone {
		return nil
	}

extraArgs := map[string]string{
		"network-name": p.CNIConfig.CNICfg.OverlayNetName,
		"bind-address": p.CNIConfig.CNICfg.IP,
	}

if err := hcn.DSRSupported(); err == nil {
		logrus.Infof("WinDSR support is enabled")
		extraArgs["feature-gates"] = addFeatureGate(extraArgs["feature-gates"], "WinDSR=true")
		extraArgs["enable-dsr"] = "true"
	}

if p.CNIConfig.CNICfg.Name == "Calico" {
		var vip string
		for range time.Tick(time.Second * 5) {
			endpoint, err := hcsshim.GetHNSEndpointByName("Calico_ep")
			if err != nil {
				logrus.WithError(err).Warning("can't find Calico_ep HNS endpoint, retrying")
				continue
			}
			vip = endpoint.IPAddress.String()
			break
		}
		extraArgs["source-vip"] = vip
	}

logrus.Infof("Deleting HNS policies before kube-proxy starts.")
	policies, _ := hcsshim.HNSListPolicyListRequest()
	for _, policy := range policies {
		policy.Delete()
	}

args = append(getArgs(extraArgs), args...)

logrus.Infof("Running RKE2 kube-proxy %s", args)
	go func() {
		for {
			cmd := exec.CommandContext(ctx, filepath.Join("c:\\", p.DataDir, "bin", "kube-proxy.exe"), args...)
			cmd.Stdout = os.Stdout
			cmd.Stderr = os.Stderr
			err := cmd.Run()
			logrus.Errorf("kube-proxy exited: %v", err)
			time.Sleep(5 * time.Second)
		}
	}()

return nil
}

// APIServerHandlers isn't supported in the binary executor.
func (p *PEBinaryConfig) APIServerHandlers(ctx context.Context) (authenticator.Request, http.Handler, error) {
	panic("kube-api-server is unsupported on windows")
}

// APIServer isn't supported in the binary executor.
func (p *PEBinaryConfig) APIServer(ctx context.Context, etcdReady <-chan struct{}, args []string) error {
	panic("kube-api-server is unsupported on windows")
}

// Scheduler isn't supported in the binary executor.
func (p *PEBinaryConfig) Scheduler(ctx context.Context, apiReady <-chan struct{}, args []string) error {
	panic("kube-scheduler is unsupported on windows")
}

// ControllerManager isn't supported in the binary executor.
func (p *PEBinaryConfig) ControllerManager(ctx context.Context, apiReady <-chan struct{}, args []string) error {
	panic("kube-controller-manager is unsupported on windows")
}

// CurrentETCDOptions isn't supported in the binary executor.
func (p *PEBinaryConfig) CurrentETCDOptions() (opts executor.InitialOptions, err error) {
	panic("etcd options are unsupported on windows")
}

// CloudControllerManager isn't supported in the binary executor.
func (p *PEBinaryConfig) CloudControllerManager(ctx context.Context, ccmRBACReady <-chan struct{}, args []string) error {
	panic("cloud-controller-manager is unsupported on windows.")
}

// ETCD isn't supported in the binary executor.
func (p *PEBinaryConfig) ETCD(ctx context.Context, args executor.ETCDConfig, extraArgs []string) error {
	panic("etcd is unsupported on windows")
}

// addFeatureGate adds a feature gate with the correct syntax.
func addFeatureGate(current, new string) string {
	if current == "" {
		return new
	}
	return current + "," + new
}

// getArgs concerts a map to the correct args list format.
func getArgs(argsMap map[string]string) []string {
	var args []string
	for arg, value := range argsMap {
		cmd := fmt.Sprintf("--%s=%s", arg, value)
		args = append(args, cmd)
	}
	sort.Strings(args)
	return args
}

func getCniType(restConfig *rest.Config) (string, error) {
	hc, err := helm.NewFactoryFromConfig(restConfig)
	if err != nil {
		return "", err
	}
	hl, err := hc.Helm().V1().HelmChart().List(metav1.NamespaceSystem, metav1.ListOptions{})
	if err != nil {
		return "", err
	}
	for _, h := range hl.Items {
		switch h.Name {
		case win.CalicoChart:
			return CNICalico, nil
		case "rke2-cilium":
			return CNICilium, nil
		case "rke2-canal":
			return CNICanal, nil
		}
	}
	return CNINone, nil
}

// setWindowsAgentSpecificSettings configures the correct paths needed for Windows
func setWindowsAgentSpecificSettings(dataDir string, nodeConfig *daemonconfig.Node) {
	nodeConfig.AgentConfig.CNIBinDir = filepath.Join("c:\\", dataDir, "bin")
	nodeConfig.AgentConfig.CNIConfDir = filepath.Join("c:\\", dataDir, "agent", "etc", "cni")
}
07070100000080000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002300000000rke2-1.27.7+rke2r1/pkg/podexecutor07070100000081000081A4000000000000000000000001653C446F000000E4000000000000000000000000000000000000003400000000rke2-1.27.7+rke2r1/pkg/podexecutor/command_linux.go//go:build linux
// +build linux

package podexecutor

import (
	"os/exec"
	"syscall"
)

func addDeathSig(cmd *exec.Cmd) {
	// not supported in this OS
	cmd.SysProcAttr = &syscall.SysProcAttr{
		Pdeathsig: syscall.SIGKILL,
	}
}
07070100000082000081A4000000000000000000000001653C446F0000008A000000000000000000000000000000000000003400000000rke2-1.27.7+rke2r1/pkg/podexecutor/command_other.go//go:build !linux
// +build !linux

package podexecutor

import "os/exec"

func addDeathSig(_ *exec.Cmd) {
	// not supported in this OS
}
07070100000083000081A4000000000000000000000001653C446F0000579B000000000000000000000000000000000000003000000000rke2-1.27.7+rke2r1/pkg/podexecutor/staticpod.go//go:build linux
// +build linux

package podexecutor

import (
	"context"
	"encoding/json"
	"io/ioutil"
	"net/http"
	"os"
	"os/exec"
	"os/user"
	"path/filepath"
	"strconv"
	"strings"
	"time"

"github.com/k3s-io/k3s/pkg/agent/cri"
	"github.com/k3s-io/k3s/pkg/cli/cmds"
	daemonconfig "github.com/k3s-io/k3s/pkg/daemons/config"
	"github.com/k3s-io/k3s/pkg/daemons/executor"
	"github.com/k3s-io/k3s/pkg/util"
	"github.com/pkg/errors"
	"github.com/rancher/rke2/pkg/auth"
	"github.com/rancher/rke2/pkg/bootstrap"
	"github.com/rancher/rke2/pkg/images"
	"github.com/rancher/rke2/pkg/logging"
	"github.com/rancher/rke2/pkg/staticpod"
	"github.com/sirupsen/logrus"
	v1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/wait"
	auditv1 "k8s.io/apiserver/pkg/apis/audit/v1"
	"k8s.io/apiserver/pkg/authentication/authenticator"
	runtimeapi "k8s.io/cri-api/pkg/apis/runtime/v1"
	"sigs.k8s.io/yaml"
)

var (
	ssldirs = []string{
		"/etc/ssl/certs",
		"/etc/pki/tls/certs",
		"/etc/ca-certificates",
		"/usr/local/share/ca-certificates",
		"/usr/share/ca-certificates",
	}
	defaultAuditPolicyFile = "/etc/rancher/rke2/audit-policy.yaml"
)

type ControlPlaneResources struct {
	KubeAPIServerCPURequest             string
	KubeAPIServerCPULimit               string
	KubeAPIServerMemoryRequest          string
	KubeAPIServerMemoryLimit            string
	KubeSchedulerCPURequest             string
	KubeSchedulerCPULimit               string
	KubeSchedulerMemoryRequest          string
	KubeSchedulerMemoryLimit            string
	KubeControllerManagerCPURequest     string
	KubeControllerManagerCPULimit       string
	KubeControllerManagerMemoryRequest  string
	KubeControllerManagerMemoryLimit    string
	KubeProxyCPURequest                 string
	KubeProxyCPULimit                   string
	KubeProxyMemoryRequest              string
	KubeProxyMemoryLimit                string
	EtcdCPURequest                      string
	EtcdCPULimit                        string
	EtcdMemoryRequest                   string
	EtcdMemoryLimit                     string
	CloudControllerManagerCPURequest    string
	CloudControllerManagerCPULimit      string
	CloudControllerManagerMemoryRequest string
	CloudControllerManagerMemoryLimit   string
}

type ControlPlaneEnv struct {
	KubeAPIServer          []string
	KubeScheduler          []string
	KubeControllerManager  []string
	KubeProxy              []string
	Etcd                   []string
	CloudControllerManager []string
}

type ControlPlaneMounts struct {
	KubeAPIServer          []string
	KubeScheduler          []string
	KubeControllerManager  []string
	KubeProxy              []string
	Etcd                   []string
	CloudControllerManager []string
}

type ControlPlaneProbeConfs struct {
	KubeAPIServer          staticpod.ProbeConfs
	KubeScheduler          staticpod.ProbeConfs
	KubeControllerManager  staticpod.ProbeConfs
	KubeProxy              staticpod.ProbeConfs
	Etcd                   staticpod.ProbeConfs
	CloudControllerManager staticpod.ProbeConfs
}

type StaticPodConfig struct {
	ControlPlaneResources
	ControlPlaneProbeConfs
	ControlPlaneEnv
	ControlPlaneMounts
	ManifestsDir    string
	ImagesDir       string
	Resolver        *images.Resolver
	CloudProvider   *CloudProviderConfig
	DataDir         string
	AuditPolicyFile string
	PSAConfigFile   string
	KubeletPath     string
	RuntimeEndpoint string
	KubeProxyChan   chan struct{}
	CISMode         bool
	DisableETCD     bool
	IsServer        bool

stopKubelet context.CancelFunc
}

type CloudProviderConfig struct {
	Name string
	Path string
}

// Bootstrap prepares the static executor to run components by setting the system default registry
// and staging the kubelet and containerd binaries.  On servers, it also ensures that manifests are
// copied in to place and in sync with the system configuration.
func (s *StaticPodConfig) Bootstrap(_ context.Context, nodeConfig *daemonconfig.Node, cfg cmds.Agent) error {
	// On servers this is set to an initial value from the CLI when the resolver is created, so that
	// static pod manifests can be created before the agent bootstrap is complete. The agent itself
	// really only needs to know about the runtime and pause images, all of which are configured after the
	// default registry has been set by the server.
	if nodeConfig.AgentConfig.SystemDefaultRegistry != "" {
		if err := s.Resolver.ParseAndSetDefaultRegistry(nodeConfig.AgentConfig.SystemDefaultRegistry); err != nil {
			return err
		}
	}
	pauseImage, err := s.Resolver.GetReference(images.Pause)
	if err != nil {
		return err
	}
	nodeConfig.AgentConfig.PauseImage = pauseImage.Name()

// stage bootstrap content from runtime image
	execPath, err := bootstrap.Stage(s.Resolver, nodeConfig, cfg)
	if err != nil {
		return err
	}
	if err := os.Setenv("PATH", execPath+":"+os.Getenv("PATH")); err != nil {
		return err
	}
	if s.IsServer {
		return bootstrap.UpdateManifests(s.Resolver, nodeConfig, cfg)
	}
	return nil
}

// Kubelet starts the kubelet in a subprocess with watching goroutine.
func (s *StaticPodConfig) Kubelet(ctx context.Context, args []string) error {
	extraArgs := []string{
		"--volume-plugin-dir=/var/lib/kubelet/volumeplugins",
		"--file-check-frequency=5s",
		"--sync-frequency=30s",
	}
	if s.CloudProvider != nil {
		extraArgs = append(extraArgs,
			"--cloud-provider="+s.CloudProvider.Name,
			"--cloud-config="+s.CloudProvider.Path,
		)
	}

args = append(extraArgs, args...)
	args, logOut := logging.ExtractFromArgs(args)
	ctx, cancel := context.WithCancel(ctx)
	s.stopKubelet = cancel

go func() {
		wait.PollImmediateInfiniteWithContext(ctx, 5*time.Second, func(ctx context.Context) (bool, error) {
			cmd := exec.CommandContext(ctx, s.KubeletPath, args...)
			cmd.Stdout = logOut
			cmd.Stderr = logOut
			addDeathSig(cmd)

err := cmd.Run()
			logrus.Errorf("Kubelet exited: %v", err)

return false, nil
		})
	}()

go s.cleanupKubeProxy()

return nil
}

// KubeProxy starts Kube Proxy as a static pod.
func (s *StaticPodConfig) KubeProxy(_ context.Context, args []string) error {
	// close the channel so that the cleanup goroutine does not remove the pod manifest
	close(s.KubeProxyChan)

image, err := s.Resolver.GetReference(images.KubeProxy)
	if err != nil {
		return err
	}
	if err := images.Pull(s.ImagesDir, images.KubeProxy, image); err != nil {
		return err
	}

return staticpod.Run(s.ManifestsDir, staticpod.Args{
		Command:       "kube-proxy",
		Args:          args,
		Image:         image,
		CISMode:       s.CISMode,
		HealthPort:    10256,
		HealthProto:   "HTTP",
		CPURequest:    s.ControlPlaneResources.KubeProxyCPURequest,
		CPULimit:      s.ControlPlaneResources.KubeProxyCPULimit,
		MemoryRequest: s.ControlPlaneResources.KubeProxyMemoryRequest,
		MemoryLimit:   s.ControlPlaneResources.KubeProxyMemoryLimit,
		ExtraEnv:      s.ControlPlaneEnv.KubeProxy,
		ExtraMounts:   s.ControlPlaneMounts.KubeProxy,
		ProbeConfs:    s.ControlPlaneProbeConfs.KubeProxy,
		Privileged:    true,
	})
}

// APIServerHandlers returning the authenticator and request handler for requests to the apiserver endpoint.
func (s *StaticPodConfig) APIServerHandlers(ctx context.Context) (authenticator.Request, http.Handler, error) {
	var tokenauth authenticator.Request
	kubeConfigAPIServer := filepath.Join(s.DataDir, "server", "cred", "api-server.kubeconfig")
	err := util.WaitForAPIServerReady(ctx, kubeConfigAPIServer, util.DefaultAPIServerReadyTimeout)
	if err == nil {
		tokenauth, err = auth.BootstrapTokenAuthenticator(ctx, kubeConfigAPIServer)
	}
	return tokenauth, http.NotFoundHandler(), err
}

// APIServer sets up the apiserver static pod once etcd is available.
func (s *StaticPodConfig) APIServer(_ context.Context, etcdReady <-chan struct{}, args []string) error {
	image, err := s.Resolver.GetReference(images.KubeAPIServer)
	if err != nil {
		return err
	}
	if err := images.Pull(s.ImagesDir, images.KubeAPIServer, image); err != nil {
		return err
	}
	if err := staticpod.Remove(s.ManifestsDir, "kube-apiserver"); err != nil {
		return err
	}

auditLogFile := ""
	kubeletPreferredAddressTypesFound := false
	for i, arg := range args {
		switch name, value, _ := strings.Cut(arg, "="); name {
		case "--advertise-port", "--basic-auth-file":
			// This is an option k3s adds that does not exist upstream
			args = append(args[:i], args[i+1:]...)
		case "--audit-log-path":
			auditLogFile = value
		case "--kubelet-preferred-address-types":
			kubeletPreferredAddressTypesFound = true
		}
	}
	if !kubeletPreferredAddressTypesFound {
		args = append([]string{"--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname"}, args...)
	}

if s.CloudProvider != nil {
		extraArgs := []string{
			"--cloud-provider=" + s.CloudProvider.Name,
			"--cloud-config=" + s.CloudProvider.Path,
		}
		args = append(extraArgs, args...)
	}
	if s.CISMode && s.AuditPolicyFile == "" {
		s.AuditPolicyFile = defaultAuditPolicyFile
	}

if s.AuditPolicyFile != "" {
		if err := writeDefaultPolicyFile(s.AuditPolicyFile); err != nil {
			return err
		}
		extraArgs := []string{
			"--audit-policy-file=" + s.AuditPolicyFile,
			"--audit-log-maxage=30",
			"--audit-log-maxbackup=10",
			"--audit-log-maxsize=100",
		}
		if auditLogFile == "" {
			auditLogFile = filepath.Join(s.DataDir, "server/logs/audit.log")
			extraArgs = append(extraArgs, "--audit-log-path="+auditLogFile)
		}
		args = append(extraArgs, args...)
	}

args = append([]string{"--admission-control-config-file=" + s.PSAConfigFile}, args...)

files := []string{}
	excludeFiles := []string{}
	if !s.DisableETCD {
		files = append(files, etcdNameFile(s.DataDir))
	}
	dirs := onlyExisting(ssldirs)
	if auditLogFile != "" && auditLogFile != "-" {
		dirs = append(dirs, filepath.Dir(auditLogFile))
		excludeFiles = append(excludeFiles, auditLogFile)
	}

return after(etcdReady, func() error {
		return staticpod.Run(s.ManifestsDir, staticpod.Args{
			Command:       "kube-apiserver",
			Args:          args,
			Image:         image,
			Dirs:          dirs,
			CISMode:       s.CISMode,
			CPURequest:    s.ControlPlaneResources.KubeAPIServerCPURequest,
			CPULimit:      s.ControlPlaneResources.KubeAPIServerCPULimit,
			MemoryRequest: s.ControlPlaneResources.KubeAPIServerMemoryRequest,
			MemoryLimit:   s.ControlPlaneResources.KubeAPIServerMemoryLimit,
			ExtraEnv:      s.ControlPlaneEnv.KubeAPIServer,
			ExtraMounts:   s.ControlPlaneMounts.KubeAPIServer,
			ProbeConfs:    s.ControlPlaneProbeConfs.KubeAPIServer,
			Files:         files,
			ExcludeFiles:  excludeFiles,
			HealthExec: []string{
				"kubectl",
				"get",
				"--server=https://localhost:6443/",
				"--client-certificate=" + s.DataDir + "/server/tls/client-kube-apiserver.crt",
				"--client-key=" + s.DataDir + "/server/tls/client-kube-apiserver.key",
				"--certificate-authority=" + s.DataDir + "/server/tls/server-ca.crt",
				"--raw=/livez",
			},
			ReadyExec: []string{
				"kubectl",
				"get",
				"--server=https://localhost:6443/",
				"--client-certificate=" + s.DataDir + "/server/tls/client-kube-apiserver.crt",
				"--client-key=" + s.DataDir + "/server/tls/client-kube-apiserver.key",
				"--certificate-authority=" + s.DataDir + "/server/tls/server-ca.crt",
				"--raw=/readyz",
			},
		})
	})
}

var permitPortSharingFlag = []string{"--permit-port-sharing=true"}

// Scheduler starts the kube-scheduler static pod, once the apiserver is available.
func (s *StaticPodConfig) Scheduler(_ context.Context, apiReady <-chan struct{}, args []string) error {
	image, err := s.Resolver.GetReference(images.KubeScheduler)
	if err != nil {
		return err
	}
	if err := images.Pull(s.ImagesDir, images.KubeScheduler, image); err != nil {
		return err
	}
	files := []string{}
	if !s.DisableETCD {
		files = append(files, etcdNameFile(s.DataDir))
	}
	args = append(permitPortSharingFlag, args...)
	return after(apiReady, func() error {
		return staticpod.Run(s.ManifestsDir, staticpod.Args{
			Command:       "kube-scheduler",
			Args:          args,
			Image:         image,
			CISMode:       s.CISMode,
			HealthPort:    10259,
			HealthProto:   "HTTPS",
			CPURequest:    s.ControlPlaneResources.KubeSchedulerCPURequest,
			CPULimit:      s.ControlPlaneResources.KubeSchedulerCPULimit,
			MemoryRequest: s.ControlPlaneResources.KubeSchedulerMemoryRequest,
			MemoryLimit:   s.ControlPlaneResources.KubeSchedulerMemoryLimit,
			ExtraEnv:      s.ControlPlaneEnv.KubeScheduler,
			ExtraMounts:   s.ControlPlaneMounts.KubeScheduler,
			ProbeConfs:    s.ControlPlaneProbeConfs.KubeScheduler,
			Files:         files,
		})
	})
}

// onlyExisting filters out paths from the list that cannot be accessed
func onlyExisting(paths []string) []string {
	existing := []string{}
	for _, path := range paths {
		if _, err := os.Stat(path); err == nil {
			existing = append(existing, path)
		}
	}
	return existing
}

// after calls a function after a message is received from a channel.
func after(after <-chan struct{}, f func() error) error {
	go func() {
		<-after
		if err := f(); err != nil {
			logrus.Fatal(err)
		}
	}()
	return nil
}

// ControllerManager starts the kube-controller-manager static pod, once the apiserver is available.
func (s *StaticPodConfig) ControllerManager(_ context.Context, apiReady <-chan struct{}, args []string) error {
	image, err := s.Resolver.GetReference(images.KubeControllerManager)
	if err != nil {
		return err
	}
	if err := images.Pull(s.ImagesDir, images.KubeControllerManager, image); err != nil {
		return err
	}
	if s.CloudProvider != nil {
		extraArgs := []string{
			"--cloud-provider=" + s.CloudProvider.Name,
			"--cloud-config=" + s.CloudProvider.Path,
		}
		args = append(extraArgs, args...)
	}
	args = append(permitPortSharingFlag, args...)

files := []string{}
	if !s.DisableETCD {
		files = append(files, etcdNameFile(s.DataDir))
	}
	return after(apiReady, func() error {
		extraArgs := []string{
			"--flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins",
			"--terminated-pod-gc-threshold=1000",
		}
		args = append(extraArgs, args...)
		return staticpod.Run(s.ManifestsDir, staticpod.Args{
			Command:       "kube-controller-manager",
			Args:          args,
			Image:         image,
			Dirs:          onlyExisting(ssldirs),
			CISMode:       s.CISMode,
			HealthPort:    10257,
			HealthProto:   "HTTPS",
			CPURequest:    s.ControlPlaneResources.KubeControllerManagerCPURequest,
			CPULimit:      s.ControlPlaneResources.KubeControllerManagerCPULimit,
			MemoryRequest: s.ControlPlaneResources.KubeControllerManagerMemoryRequest,
			MemoryLimit:   s.ControlPlaneResources.KubeControllerManagerMemoryLimit,
			ExtraEnv:      s.ControlPlaneEnv.KubeControllerManager,
			ExtraMounts:   s.ControlPlaneMounts.KubeControllerManager,
			ProbeConfs:    s.ControlPlaneProbeConfs.KubeControllerManager,
			Files:         files,
		})
	})
}

// CloudControllerManager starts the cloud-controller-manager static pod, once the cloud controller manager RBAC
// (and subsequently, the api server) is available.
func (s *StaticPodConfig) CloudControllerManager(_ context.Context, ccmRBACReady <-chan struct{}, args []string) error {
	image, err := s.Resolver.GetReference(images.CloudControllerManager)
	if err != nil {
		return err
	}
	if err := images.Pull(s.ImagesDir, images.CloudControllerManager, image); err != nil {
		return err
	}
	return after(ccmRBACReady, func() error {
		return staticpod.Run(s.ManifestsDir, staticpod.Args{
			Command:       "cloud-controller-manager",
			Args:          args,
			Image:         image,
			Dirs:          onlyExisting(ssldirs),
			CISMode:       s.CISMode,
			HealthPort:    10258,
			HealthProto:   "HTTPS",
			CPURequest:    s.ControlPlaneResources.CloudControllerManagerCPURequest,
			CPULimit:      s.ControlPlaneResources.CloudControllerManagerCPULimit,
			MemoryRequest: s.ControlPlaneResources.CloudControllerManagerMemoryRequest,
			MemoryLimit:   s.ControlPlaneResources.CloudControllerManagerMemoryLimit,
			ExtraEnv:      s.ControlPlaneEnv.CloudControllerManager,
			ExtraMounts:   s.ControlPlaneMounts.CloudControllerManager,
			ProbeConfs:    s.ControlPlaneProbeConfs.CloudControllerManager,
			Files:         []string{},
		})
	})
}

// CurrentETCDOptions retrieves the etcd configuration from the static pod definition at etcd.yaml
// in the manifests directory, if it exists.
func (s *StaticPodConfig) CurrentETCDOptions() (opts executor.InitialOptions, err error) {
	bytes, err := ioutil.ReadFile(filepath.Join(s.ManifestsDir, "etcd.yaml"))
	if os.IsNotExist(err) {
		return opts, nil
	}

pod := &v1.Pod{}
	if err := yaml.Unmarshal(bytes, pod); err != nil {
		return opts, err
	}

v, ok := pod.Annotations["etcd.k3s.io/initial"]
	if ok {
		return opts, json.NewDecoder(strings.NewReader(v)).Decode(&opts)
	}

return opts, nil
}

// ETCD starts the etcd static pod.
func (s *StaticPodConfig) ETCD(ctx context.Context, args executor.ETCDConfig, extraArgs []string) error {
	image, err := s.Resolver.GetReference(images.ETCD)
	if err != nil {
		return err
	}
	if err := images.Pull(s.ImagesDir, images.ETCD, image); err != nil {
		return err
	}

initial, err := json.Marshal(args.InitialOptions)
	if err != nil {
		return err
	}

confFile, err := args.ToConfigFile(extraArgs)
	if err != nil {
		return err
	}

spa := staticpod.Args{
		Annotations: map[string]string{
			"etcd.k3s.io/initial": string(initial),
		},
		Command: "etcd",
		Args: []string{
			"--config-file=" + confFile,
		},
		Image: image,
		Dirs:  []string{args.DataDir},
		Files: []string{
			args.ServerTrust.CertFile,
			args.ServerTrust.KeyFile,
			args.ServerTrust.TrustedCAFile,
			args.PeerTrust.CertFile,
			args.PeerTrust.KeyFile,
			args.PeerTrust.TrustedCAFile,
		},
		CISMode:       s.CISMode,
		HealthPort:    2381,
		HealthPath:    "/health?serializable=true",
		HealthProto:   "HTTP",
		CPURequest:    s.ControlPlaneResources.EtcdCPURequest,
		CPULimit:      s.ControlPlaneResources.EtcdCPULimit,
		MemoryRequest: s.ControlPlaneResources.EtcdMemoryRequest,
		MemoryLimit:   s.ControlPlaneResources.EtcdMemoryLimit,
		ExtraEnv:      s.ControlPlaneEnv.Etcd,
		ExtraMounts:   s.ControlPlaneMounts.Etcd,
		ProbeConfs:    s.ControlPlaneProbeConfs.Etcd,
	}

if s.CISMode {
		etcdUser, err := user.Lookup("etcd")
		if err != nil {
			return err
		}
		uid, err := strconv.ParseInt(etcdUser.Uid, 10, 64)
		if err != nil {
			return err
		}
		gid, err := strconv.ParseInt(etcdUser.Gid, 10, 64)
		if err != nil {
			return err
		}
		if spa.SecurityContext == nil {
			spa.SecurityContext = &v1.PodSecurityContext{}
		}
		spa.SecurityContext.RunAsUser = &uid
		spa.SecurityContext.RunAsGroup = &gid

for _, p := range []string{args.DataDir, filepath.Dir(args.ServerTrust.CertFile)} {
			if err := chownr(p, int(uid), int(gid)); err != nil {
				return err
			}
		}
	}

if cmds.AgentConfig.EnableSELinux {
		if spa.SecurityContext == nil {
			spa.SecurityContext = &v1.PodSecurityContext{}
		}
		if spa.SecurityContext.SELinuxOptions == nil {
			spa.SecurityContext.SELinuxOptions = &v1.SELinuxOptions{
				Type: "rke2_service_db_t",
			}
		}
	}

// If performing a cluster-reset, ensure that the kubelet and etcd are stopped when the context is cancelled at the end of the cluster-reset process.
	if args.ForceNewCluster {
		go func() {
			<-ctx.Done()
			logrus.Infof("Shutting down kubelet and etcd")
			if s.stopKubelet != nil {
				s.stopKubelet()
			}
			if err := s.stopEtcd(); err != nil {
				logrus.Errorf("Failed to stop etcd: %v", err)
			}
		}()
	}

return staticpod.Run(s.ManifestsDir, spa)
}

// stopEtcd searches the container runtime endpoint for the etcd static pod, and terminates it.
func (s *StaticPodConfig) stopEtcd() error {
	ctx := context.Background()
	conn, err := cri.Connection(ctx, s.RuntimeEndpoint)
	if err != nil {
		return errors.Wrap(err, "failed to connect to cri")
	}
	cRuntime := runtimeapi.NewRuntimeServiceClient(conn)
	defer conn.Close()

filter := &runtimeapi.PodSandboxFilter{
		LabelSelector: map[string]string{
			"component":                   "etcd",
			"io.kubernetes.pod.namespace": "kube-system",
			"tier":                        "control-plane",
		},
	}
	resp, err := cRuntime.ListPodSandbox(ctx, &runtimeapi.ListPodSandboxRequest{Filter: filter})
	if err != nil {
		return errors.Wrap(err, "failed to list pods")
	}

for _, pod := range resp.Items {
		if pod.Annotations["kubernetes.io/config.source"] != "file" {
			continue
		}
		if _, err := cRuntime.RemovePodSandbox(ctx, &runtimeapi.RemovePodSandboxRequest{PodSandboxId: pod.Id}); err != nil {
			return errors.Wrap(err, "failed to terminate pod")
		}
	}

return nil
}

// cleanupKubeProxy waits to see if kube-proxy is run. If kube-proxy does not run and
// close the channel within one minute of this goroutine being started by the kubelet
// runner, then the kube-proxy static pod manifest is removed from disk. The kubelet will
// clean up the static pod soon after.
func (s *StaticPodConfig) cleanupKubeProxy() {
	select {
	case <-s.KubeProxyChan:
		return
	case <-time.After(time.Minute * 1):
		if err := staticpod.Remove(s.ManifestsDir, "kube-proxy"); err != nil {
			logrus.Error(err)
		}
	}
}

// chownr recursively changes the ownership of the given
// path to the given user ID and group ID.
func chownr(path string, uid, gid int) error {
	return filepath.Walk(path, func(name string, info os.FileInfo, err error) error {
		if err == nil {
			err = os.Chown(name, uid, gid)
		}
		return err
	})
}

func etcdNameFile(dataDir string) string {
	return filepath.Join(dataDir, "server", "db", "etcd", "name")
}

func writeDefaultPolicyFile(policyFilePath string) error {
	auditPolicy := auditv1.Policy{
		TypeMeta: metav1.TypeMeta{
			Kind:       "Policy",
			APIVersion: "audit.k8s.io/v1",
		},
		ObjectMeta: metav1.ObjectMeta{},
		Rules: []auditv1.PolicyRule{
			{
				Level: "None",
			},
		},
	}
	bytes, err := yaml.Marshal(auditPolicy)
	if err != nil {
		return err
	}
	return writeIfNotExists(policyFilePath, bytes)
}

// writeIfNotExists writes content to a file at a given path, but only if the file does not already exist
func writeIfNotExists(path string, content []byte) error {
	dir := filepath.Dir(path)
	if err := os.MkdirAll(dir, 0755); err != nil {
		return err
	}
	file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600)
	if err != nil {
		if os.IsExist(err) {
			return nil
		}
		return err
	}
	defer file.Close()
	_, err = file.Write(content)
	return err
}
07070100000084000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001C00000000rke2-1.27.7+rke2r1/pkg/rke207070100000085000081A4000000000000000000000001653C446F0000062D000000000000000000000000000000000000002B00000000rke2-1.27.7+rke2r1/pkg/rke2/clusterrole.gopackage rke2

import (
	"context"
	"sync"

"github.com/k3s-io/k3s/pkg/cli/cmds"
	"github.com/sirupsen/logrus"
	genericapiserver "k8s.io/apiserver/pkg/server"
	"k8s.io/client-go/tools/clientcmd"
	rbacrest "k8s.io/kubernetes/pkg/registry/rbac/rest"
)

// setClusterRoles applies common clusterroles and clusterrolebindings that are critical
// to the function of internal controllers.
func setClusterRoles() cmds.StartupHook {
	return func(ctx context.Context, wg *sync.WaitGroup, args cmds.StartupHookArgs) error {
		go func() {
			defer wg.Done()
			<-args.APIServerReady
			logrus.Info("Applying Cluster Role Bindings")

config, err := clientcmd.BuildConfigFromFlags("", args.KubeConfigSupervisor)
			if err != nil {
				logrus.Fatalf("clusterrole: new k8s client: %v", err)
			}

stopChan := make(chan struct{})
			defer close(stopChan)

// kube-apiserver has a post-start hook that reconciles the built-in cluster RBAC on every startup.
			// We're reusing that here to bootstrap our own roles and bindings.
			hookContext := genericapiserver.PostStartHookContext{
				LoopbackClientConfig: config,
				StopCh:               stopChan,
			}

policy := rbacrest.PolicyData{
				ClusterRoles:        clusterRoles(),
				ClusterRoleBindings: clusterRoleBindings(),
				Roles:               roles(),
				RoleBindings:        roleBindings(),
			}
			if err := policy.EnsureRBACPolicy()(hookContext); err != nil {
				logrus.Fatalf("clusterrole: EnsureRBACPolicy failed: %v", err)
			}

logrus.Info("Cluster Role Bindings applied successfully")
		}()
		return nil
	}
}
07070100000086000081A4000000000000000000000001653C446F00001FB1000000000000000000000000000000000000003500000000rke2-1.27.7+rke2r1/pkg/rke2/clusterrole_bootstrap.gopackage rke2

import (
	rbacv1 "k8s.io/api/rbac/v1"
	"k8s.io/apimachinery/pkg/api/meta"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"
	rbacv1helpers "k8s.io/kubernetes/pkg/apis/rbac/v1"
)

const (
	kubeletAPIServerRoleBindingName = "kube-apiserver-kubelet-admin"
	kubeProxyName                   = "system:kube-proxy"
	tunnelControllerName            = "system:rke2-controller"
	cloudControllerManagerName      = "rke2-cloud-controller-manager"

appsGroup         = "apps"
	coordinationGroup = "coordination.k8s.io"
	helmGroup         = "helm.cattle.io"
	legacyGroup       = ""
	networkingGroup   = "networking.k8s.io"
	discoveryGroup    = "discovery.k8s.io"
)

var (
	label      = map[string]string{"rke2.io/bootstrapping": "rbac-defaults"}
	annotation = map[string]string{rbacv1.AutoUpdateAnnotationKey: "true"}
)

// clusterRoles returns a list of clusterrolebindings to bootstrap
func clusterRoles() []rbacv1.ClusterRole {
	roles := []rbacv1.ClusterRole{
		{
			ObjectMeta: metav1.ObjectMeta{Name: kubeProxyName},
			Rules: []rbacv1.PolicyRule{
				rbacv1helpers.NewRule("get", "list").Groups(legacyGroup).Resources("nodes").RuleOrDie(),
			},
		},
		{
			ObjectMeta: metav1.ObjectMeta{Name: tunnelControllerName},
			Rules: []rbacv1.PolicyRule{
				rbacv1helpers.NewRule("get").Groups(legacyGroup).Resources("nodes").RuleOrDie(),
				rbacv1helpers.NewRule("list", "watch").Groups(legacyGroup).Resources("namespaces").RuleOrDie(),
				rbacv1helpers.NewRule("list", "watch").Groups(networkingGroup).Resources("networkpolicies").RuleOrDie(),
				rbacv1helpers.NewRule("list", "watch", "get").Groups(legacyGroup).Resources("endpoints", "pods").RuleOrDie(),
				rbacv1helpers.NewRule("create").Groups(legacyGroup).Resources("serviceaccounts/token").RuleOrDie(),
				rbacv1helpers.NewRule("list", "get").Groups(helmGroup).Resources("helmcharts", "helmchartconfigs").RuleOrDie(),
			},
		},
		{
			// this should be kept in sync with the ClusterRole in k3s:
			// https://github.com/k3s-io/k3s/blob/master/manifests/ccm.yaml
			ObjectMeta: metav1.ObjectMeta{Name: cloudControllerManagerName},
			Rules: []rbacv1.PolicyRule{
				rbacv1helpers.NewRule("get", "create", "update").Groups(coordinationGroup).Resources("leases").RuleOrDie(),
				rbacv1helpers.NewRule("create", "patch", "update").Groups(legacyGroup).Resources("events").RuleOrDie(),
				rbacv1helpers.NewRule("*").Groups(legacyGroup).Resources("nodes").RuleOrDie(),
				rbacv1helpers.NewRule("patch").Groups(legacyGroup).Resources("nodes/status", "services/status").RuleOrDie(),
				rbacv1helpers.NewRule("get", "list", "watch", "patch", "update").Groups(legacyGroup).Resources("services", "pods").RuleOrDie(),
				rbacv1helpers.NewRule("create", "get").Groups(legacyGroup).Resources("serviceaccounts").RuleOrDie(),
				rbacv1helpers.NewRule("create", "get").Groups("").Resources("namespaces").RuleOrDie(),
				rbacv1helpers.NewRule("*").Groups(appsGroup).Resources("daemonsets").RuleOrDie(),
				rbacv1helpers.NewRule("get", "list", "watch").Groups(discoveryGroup).Resources("endpointslices").RuleOrDie(),
			},
		},
	}
	addClusterRoleLabel(roles)
	return roles
}

// clusterRoleBindings returns a list of clusterrolebindings to bootstrap
func clusterRoleBindings() []rbacv1.ClusterRoleBinding {
	rolebindings := []rbacv1.ClusterRoleBinding{
		// https://github.com/kubernetes/kubernetes/issues/65939#issuecomment-403218465
		ClusterRoleBindingName(rbacv1helpers.NewClusterBinding("system:kubelet-api-admin").Users("kube-apiserver"), kubeletAPIServerRoleBindingName).BindingOrDie(),
		ClusterRoleBindingNamespacedUsers(ClusterRoleBindingName(rbacv1helpers.NewClusterBinding("system:auth-delegator"), cloudControllerManagerName+"-auth-delegator"), metav1.NamespaceSystem, cloudControllerManagerName).BindingOrDie(),
		ClusterRoleBindingNamespacedUsers(rbacv1helpers.NewClusterBinding(cloudControllerManagerName), metav1.NamespaceSystem, cloudControllerManagerName).BindingOrDie(),
		rbacv1helpers.NewClusterBinding(kubeProxyName).Users(kubeProxyName).BindingOrDie(),
		rbacv1helpers.NewClusterBinding(tunnelControllerName).Users(tunnelControllerName).BindingOrDie(),
	}
	addClusterRoleBindingLabel(rolebindings)
	return rolebindings
}

// roles returns a map of namespace to roles to bootstrap into that namespace
func roles() map[string][]rbacv1.Role {
	return nil
}

// roleBindings returns a map of namespace to rolebindings to bootstrap into that namespace
func roleBindings() map[string][]rbacv1.RoleBinding {
	ccmAuthReader := RoleBindingNamespacedUsers(RoleBindingName(rbacv1helpers.NewRoleBinding("extension-apiserver-authentication-reader", metav1.NamespaceSystem), cloudControllerManagerName+"-authentication-reader"), metav1.NamespaceSystem, cloudControllerManagerName).BindingOrDie()
	addDefaultMetadata(&ccmAuthReader)
	return map[string][]rbacv1.RoleBinding{
		metav1.NamespaceSystem: {
			ccmAuthReader,
		},
	}
}

// RoleBindingNamespacedUsers adds namespaced users to a RoleBindingBuilder's Subjects list.
// For some reason the core helpers don't have any methods for adding namespaced users, only namespaced service accounts.
func RoleBindingNamespacedUsers(r *rbacv1helpers.RoleBindingBuilder, namespace string, users ...string) *rbacv1helpers.RoleBindingBuilder {
	for _, user := range users {
		r.RoleBinding.Subjects = append(r.RoleBinding.Subjects, rbacv1.Subject{Kind: rbacv1.UserKind, Namespace: namespace, Name: user})
	}
	return r
}

// RoleBindingName sets the name on a RoleBindingBuilder's policy.
// The ClusterRoleBindingBuilder sets the ClusterRoleBinding name to the same as ClusterRole it's binding to without
// providing any way to override it.
func RoleBindingName(r *rbacv1helpers.RoleBindingBuilder, name string) *rbacv1helpers.RoleBindingBuilder {
	r.RoleBinding.ObjectMeta.Name = name
	return r
}

// ClusterRoleBindingNamespacedUsers adds namespaced users to a ClusterRoleBindingBuilder's Subjects list.
// For some reason the core helpers don't have any methods for adding namespaced users, only namespaced service accounts.
func ClusterRoleBindingNamespacedUsers(r *rbacv1helpers.ClusterRoleBindingBuilder, namespace string, users ...string) *rbacv1helpers.ClusterRoleBindingBuilder {
	for _, user := range users {
		r.ClusterRoleBinding.Subjects = append(r.ClusterRoleBinding.Subjects, rbacv1.Subject{Kind: rbacv1.UserKind, Namespace: namespace, Name: user})
	}
	return r
}

// ClusterRoleBindingName sets the name on a ClusterRoleBindingBuilder's policy.
// The ClusterRoleBindingBuilder sets the ClusterRoleBinding name to the same as ClusterRole it's binding to without
// providing any way to override it.
func ClusterRoleBindingName(r *rbacv1helpers.ClusterRoleBindingBuilder, name string) *rbacv1helpers.ClusterRoleBindingBuilder {
	r.ClusterRoleBinding.ObjectMeta.Name = name
	return r
}

// cribbed from k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
func addDefaultMetadata(obj runtime.Object) {
	metadata, err := meta.Accessor(obj)
	if err != nil {
		// if this happens, then some static code is broken
		panic(err)
	}

labels := metadata.GetLabels()
	if labels == nil {
		labels = map[string]string{}
	}
	for k, v := range label {
		labels[k] = v
	}
	metadata.SetLabels(labels)

annotations := metadata.GetAnnotations()
	if annotations == nil {
		annotations = map[string]string{}
	}
	for k, v := range annotation {
		annotations[k] = v
	}
	metadata.SetAnnotations(annotations)
}

// cribbed from k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
func addClusterRoleLabel(roles []rbacv1.ClusterRole) {
	for i := range roles {
		addDefaultMetadata(&roles[i])
	}
}

// cribbed from k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
func addClusterRoleBindingLabel(rolebindings []rbacv1.ClusterRoleBinding) {
	for i := range rolebindings {
		addDefaultMetadata(&rolebindings[i])
	}
}

// cribbed from k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
func addRoleLabel(roles []rbacv1.Role) {
	for i := range roles {
		addDefaultMetadata(&roles[i])
	}
}
07070100000087000081A4000000000000000000000001653C446F000001A5000000000000000000000000000000000000002200000000rke2-1.27.7+rke2r1/pkg/rke2/kp.gopackage rke2

import (
	"context"
	"sync"

"github.com/k3s-io/k3s/pkg/cli/cmds"
)

const kubeProxyChart = "rke2-kube-proxy"

func setKubeProxyDisabled() cmds.StartupHook {
	return func(ctx context.Context, wg *sync.WaitGroup, args cmds.StartupHookArgs) error {
		go func() {
			defer wg.Done()
			<-args.APIServerReady
			args.Skips[kubeProxyChart] = true
			args.Disables[kubeProxyChart] = true
		}()
		return nil
	}
}
07070100000088000081A4000000000000000000000001653C446F000028EC000000000000000000000000000000000000002200000000rke2-1.27.7+rke2r1/pkg/rke2/np.gopackage rke2

import (
	"context"
	"fmt"
	"sync"
	"time"

"github.com/k3s-io/k3s/pkg/cli/cmds"

"github.com/sirupsen/logrus"
	corev1 "k8s.io/api/core/v1"
	v1 "k8s.io/api/networking/v1"
	apierrors "k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/intstr"
	"k8s.io/client-go/kubernetes"
	"k8s.io/client-go/tools/clientcmd"
	"k8s.io/client-go/transport"
	"k8s.io/client-go/util/retry"
)

const (
	namespaceAnnotationNetworkPolicy        = "np.rke2.io"
	namespaceAnnotationNetworkDNSPolicy     = "np.rke2.io/dns"
	namespaceAnnotationNetworkIngressPolicy = "np.rke2.io/ingress"

defaultNetworkPolicyName        = "default-network-policy"
	defaultNetworkDNSPolicyName     = "default-network-dns-policy"
	defaultNetworkIngressPolicyName = "default-network-ingress-policy"

defaultTimeout     = 30
	cisAnnotationValue = "resolved"
)

// networkPolicy specifies a base level network policy applied
// to the 3 primary namespace: kube-system, kube-public, and default.
// This policy only allows for intra-namespace traffic.
var networkPolicy = v1.NetworkPolicy{
	ObjectMeta: metav1.ObjectMeta{
		Name: defaultNetworkPolicyName,
	},
	Spec: v1.NetworkPolicySpec{
		PodSelector: metav1.LabelSelector{}, // empty to match all pods
		PolicyTypes: []v1.PolicyType{
			v1.PolicyTypeIngress,
		},
		Ingress: []v1.NetworkPolicyIngressRule{
			{
				From: []v1.NetworkPolicyPeer{
					{
						PodSelector: &metav1.LabelSelector{}, // empty to match all pods
					},
				},
			},
		},
	},
}

var (
	tcp = corev1.ProtocolTCP
	udp = corev1.ProtocolUDP
)

// networkDNSPolicy allows for all DNS traffic
// into the kube-system namespace.
var networkDNSPolicy = v1.NetworkPolicy{
	ObjectMeta: metav1.ObjectMeta{
		Name: defaultNetworkDNSPolicyName,
	},
	Spec: v1.NetworkPolicySpec{
		PodSelector: metav1.LabelSelector{
			MatchLabels: map[string]string{
				"k8s-app": "kube-dns",
			},
		},
		PolicyTypes: []v1.PolicyType{
			v1.PolicyTypeIngress,
		},
		Ingress: []v1.NetworkPolicyIngressRule{
			{
				Ports: []v1.NetworkPolicyPort{
					{
						Protocol: &tcp,
						Port: &intstr.IntOrString{
							IntVal: int32(53),
						},
					},
					{
						Protocol: &udp,
						Port: &intstr.IntOrString{
							IntVal: int32(53),
						},
					},
				},
			},
		},
		Egress: []v1.NetworkPolicyEgressRule{},
	},
}

// networkIngressPolicy allows for all http and https traffic
// into the kube-system namespace to the ingress controller pods.
var networkIngressPolicy = v1.NetworkPolicy{
	ObjectMeta: metav1.ObjectMeta{
		Name: defaultNetworkIngressPolicyName,
	},
	Spec: v1.NetworkPolicySpec{
		PodSelector: metav1.LabelSelector{
			MatchLabels: map[string]string{
				"app.kubernetes.io/name": "rke2-ingress-nginx",
			},
		},
		PolicyTypes: []v1.PolicyType{
			v1.PolicyTypeIngress,
		},
		Ingress: []v1.NetworkPolicyIngressRule{
			{
				Ports: []v1.NetworkPolicyPort{
					{
						Protocol: &tcp,
						Port: &intstr.IntOrString{
							IntVal: int32(80),
						},
					},
					{
						Protocol: &tcp,
						Port: &intstr.IntOrString{
							IntVal: int32(443),
						},
					},
				},
			},
		},
		Egress: []v1.NetworkPolicyEgressRule{},
	},
}

// setNetworkPolicy applies the default network policy for the given namespace and updates
// the given namespaces' annotation. First, the namespaces' annotation is checked for existence.
// If the annotation exists, we move on. If the annotation doesn't exist, we check to see if the
// policy exists. If it does, we delete it, and create the new default policy.
func setNetworkPolicy(ctx context.Context, namespace string, cs *kubernetes.Clientset) error {
	ns, err := cs.CoreV1().Namespaces().Get(ctx, namespace, metav1.GetOptions{})
	if err != nil {
		return fmt.Errorf("networkPolicy: get %s - %w", namespace, err)
	}
	if ns.Annotations == nil {
		ns.Annotations = make(map[string]string)
	}
	if _, ok := ns.Annotations[namespaceAnnotationNetworkPolicy]; !ok {
		if _, err := cs.NetworkingV1().NetworkPolicies(namespace).Get(ctx, defaultNetworkPolicyName, metav1.GetOptions{}); err == nil {
			if err := cs.NetworkingV1().NetworkPolicies(namespace).Delete(ctx, defaultNetworkPolicyName, metav1.DeleteOptions{}); err != nil {
				if !apierrors.IsNotFound(err) {
					return err
				}
			}
		}
		if _, err := cs.NetworkingV1().NetworkPolicies(namespace).Create(ctx, &networkPolicy, metav1.CreateOptions{}); err != nil {
			if !apierrors.IsAlreadyExists(err) {
				return err
			}
		}
		ns.Annotations[namespaceAnnotationNetworkPolicy] = cisAnnotationValue

if err := retry.RetryOnConflict(retry.DefaultBackoff, func() error {
			if _, err := cs.CoreV1().Namespaces().Update(ctx, ns, metav1.UpdateOptions{}); err != nil {
				if apierrors.IsConflict(err) {
					return updateNamespaceRef(ctx, cs, ns)
				}
				return err
			}
			return nil
		}); err != nil {
			logrus.Fatalf("networkPolicy: update namespace: %s - %s", ns.Name, err.Error())
		}
	}
	return nil
}

// setNetworkDNSPolicy sets the default DNS policy allowing the
// required DNS traffic.
func setNetworkDNSPolicy(ctx context.Context, cs *kubernetes.Clientset) error {
	ns, err := cs.CoreV1().Namespaces().Get(ctx, metav1.NamespaceSystem, metav1.GetOptions{})
	if err != nil {
		return fmt.Errorf("networkPolicy: get %s - %w", metav1.NamespaceSystem, err)
	}
	if ns.Annotations == nil {
		ns.Annotations = make(map[string]string)
	}
	if _, ok := ns.Annotations[namespaceAnnotationNetworkDNSPolicy]; !ok {
		if _, err := cs.NetworkingV1().NetworkPolicies(metav1.NamespaceSystem).Get(ctx, defaultNetworkDNSPolicyName, metav1.GetOptions{}); err == nil {
			if err := cs.NetworkingV1().NetworkPolicies(metav1.NamespaceSystem).Delete(ctx, defaultNetworkDNSPolicyName, metav1.DeleteOptions{}); err != nil {
				if !apierrors.IsNotFound(err) {
					return err
				}
			}
		}
		if _, err := cs.NetworkingV1().NetworkPolicies(metav1.NamespaceSystem).Create(ctx, &networkDNSPolicy, metav1.CreateOptions{}); err != nil {
			if !apierrors.IsAlreadyExists(err) {
				return err
			}
		}
		ns.Annotations[namespaceAnnotationNetworkDNSPolicy] = cisAnnotationValue

// setNetworkIngressPolicy sets the default Ingress policy allowing the
// required HTTP/HTTPS traffic to ingress nginx pods.
func setNetworkIngressPolicy(ctx context.Context, cs *kubernetes.Clientset) error {
	ns, err := cs.CoreV1().Namespaces().Get(ctx, metav1.NamespaceSystem, metav1.GetOptions{})
	if err != nil {
		return fmt.Errorf("networkPolicy: get %s - %w", metav1.NamespaceSystem, err)
	}
	if ns.Annotations == nil {
		ns.Annotations = make(map[string]string)
	}
	if _, ok := ns.Annotations[namespaceAnnotationNetworkIngressPolicy]; !ok {
		if _, err := cs.NetworkingV1().NetworkPolicies(metav1.NamespaceSystem).Get(ctx, defaultNetworkIngressPolicyName, metav1.GetOptions{}); err == nil {
			if err := cs.NetworkingV1().NetworkPolicies(metav1.NamespaceSystem).Delete(ctx, defaultNetworkIngressPolicyName, metav1.DeleteOptions{}); err != nil {
				if !apierrors.IsNotFound(err) {
					return err
				}
			}
		}
		if _, err := cs.NetworkingV1().NetworkPolicies(metav1.NamespaceSystem).Create(ctx, &networkIngressPolicy, metav1.CreateOptions{}); err != nil {
			if !apierrors.IsAlreadyExists(err) {
				return err
			}
		}
		ns.Annotations[namespaceAnnotationNetworkIngressPolicy] = cisAnnotationValue

// setNetworkPolicies applies a default network policy across the 3 primary namespaces.
func setNetworkPolicies(cisMode bool, namespaces []string) cmds.StartupHook {
	return func(ctx context.Context, wg *sync.WaitGroup, args cmds.StartupHookArgs) error {
		// check if we're running in CIS mode and if so,
		// apply the network policy.
		if !cisMode {
			wg.Done()
			return nil
		}

logrus.Info("Applying network policies...")
		go func() {
			defer wg.Done()
			<-args.APIServerReady
			cs, err := newClient(args.KubeConfigSupervisor, nil)
			if err != nil {
				logrus.Fatalf("networkPolicy: new k8s client: %s", err.Error())
			}
			for _, namespace := range namespaces {
				if err := setNetworkPolicy(ctx, namespace, cs); err != nil {
					logrus.Fatal(err)
				}
			}
			if err := setNetworkDNSPolicy(ctx, cs); err != nil {
				logrus.Fatal(err)
			}

if err := setNetworkIngressPolicy(ctx, cs); err != nil {
				logrus.Fatal(err)
			}

logrus.Info("Applying network policies complete")
		}()

return nil
	}
}

// updateNamespaceRef retrieves the most recent revision of Namespace ns, copies over any annotations from
// the passed revision of the Namespace to the most recent revision, and updates the pointer to refer to the
// most recent revision. This get/change/update pattern is required to alter an object
// that may have changed since it was retrieved.
func updateNamespaceRef(ctx context.Context, cs *kubernetes.Clientset, ns *corev1.Namespace) error {
	logrus.Info("updating namespace: " + ns.Name)
	newNS, err := cs.CoreV1().Namespaces().Get(ctx, ns.Name, metav1.GetOptions{})
	if err != nil {
		return err
	}
	if newNS.Annotations == nil {
		newNS.Annotations = make(map[string]string, len(ns.Annotations))
	}
	// copy annotations, since we may have changed them
	for k, v := range ns.Annotations {
		newNS.Annotations[k] = v
	}
	*ns = *newNS
	return nil
}

// newClient create a new Kubernetes client from configuration.
func newClient(kubeConfigPath string, k8sWrapTransport transport.WrapperFunc) (*kubernetes.Clientset, error) {
	config, err := clientcmd.BuildConfigFromFlags("", kubeConfigPath)
	if err != nil {
		return nil, err
	}
	if k8sWrapTransport != nil {
		config.WrapTransport = k8sWrapTransport
	}
	config.Timeout = time.Second * defaultTimeout
	return kubernetes.NewForConfig(config)
}
07070100000089000081A4000000000000000000000001653C446F000008DF000000000000000000000000000000000000002300000000rke2-1.27.7+rke2r1/pkg/rke2/psa.gopackage rke2

import (
	"io/ioutil"
	"os"
	"path/filepath"

"github.com/pkg/errors"
	"github.com/sirupsen/logrus"
)

const (
	defaultPSAConfigFile = "/etc/rancher/rke2/rke2-pss.yaml"
)

// setPSAs sets the default PSA's based on the mode that RKE2 is running in. There is either CIS or non
// CIS mode. For CIS mode, a default PSA configuration with enforcement for restricted will be applied
// for non CIS mode, a default PSA configuration will be applied that has privileged restriction
func setPSAs(cisMode bool) error {
	logrus.Info("Applying Pod Security Admission Configuration")
	configDir := filepath.Dir(defaultPSAConfigFile)
	if err := os.MkdirAll(configDir, 0755); err != nil {
		return err
	}
	if !cisMode { // non-CIS mode
		psaConfig := unrestrictedPSAConfig()
		if err := ioutil.WriteFile(defaultPSAConfigFile, []byte(psaConfig), 0600); err != nil {
			return errors.Wrapf(err, "psa: failed to write psa unrestricted config")
		}

} else { // CIS mode
		psaConfig := restrictedPSAConfig()
		if err := ioutil.WriteFile(defaultPSAConfigFile, []byte(psaConfig), 0600); err != nil {
			return errors.Wrapf(err, "psa: failed to write psa restricted config")
		}
	}
	return nil
}

func restrictedPSAConfig() string {
	psRestrictedConfig := `apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: PodSecurity
  configuration:
    apiVersion: pod-security.admission.config.k8s.io/v1beta1
    kind: PodSecurityConfiguration
    defaults:
      enforce: "restricted"
      enforce-version: "latest"
      audit: "restricted"
      audit-version: "latest"
      warn: "restricted"
      warn-version: "latest"
    exemptions:
      usernames: []
      runtimeClasses: []
      namespaces: [kube-system, cis-operator-system, tigera-operator]`
	return psRestrictedConfig
}

func unrestrictedPSAConfig() string {
	psUnrestrictedConfig := `apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: PodSecurity
  configuration:
    apiVersion: pod-security.admission.config.k8s.io/v1beta1
    kind: PodSecurityConfiguration
    defaults:
      enforce: "privileged"
      enforce-version: "latest"
    exemptions:
      usernames: []
      runtimeClasses: []
      namespaces: []`
	return psUnrestrictedConfig
}
0707010000008A000081A4000000000000000000000001653C446F00003287000000000000000000000000000000000000002400000000rke2-1.27.7+rke2r1/pkg/rke2/rke2.gopackage rke2

import (
	"context"
	"fmt"
	"io/ioutil"
	"os"
	"os/exec"
	"path/filepath"
	"strings"
	"time"

"github.com/k3s-io/k3s/pkg/agent/config"
	"github.com/k3s-io/k3s/pkg/agent/cri"
	"github.com/k3s-io/k3s/pkg/cli/agent"
	"github.com/k3s-io/k3s/pkg/cli/cmds"
	"github.com/k3s-io/k3s/pkg/cli/server"
	daemonconfig "github.com/k3s-io/k3s/pkg/daemons/config"
	"github.com/k3s-io/k3s/pkg/daemons/executor"
	rawServer "github.com/k3s-io/k3s/pkg/server"
	"github.com/natefinch/lumberjack"
	"github.com/pkg/errors"
	"github.com/rancher/rke2/pkg/controllers/cisnetworkpolicy"
	"github.com/rancher/rke2/pkg/images"
	"github.com/sirupsen/logrus"
	"github.com/urfave/cli"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/wait"
	runtimeapi "k8s.io/cri-api/pkg/apis/runtime/v1"
)

type Config struct {
	AuditPolicyFile                string
	PodSecurityAdmissionConfigFile string
	CloudProviderConfig            string
	CloudProviderName              string
	Images                         images.ImageOverrideConfig
	KubeletPath                    string
	ControlPlaneResourceRequests   cli.StringSlice
	ControlPlaneResourceLimits     cli.StringSlice
	ControlPlaneProbeConf          cli.StringSlice
	ExtraMounts                    ExtraMounts
	ExtraEnv                       ExtraEnv
}

type ExtraMounts struct {
	KubeAPIServer          cli.StringSlice
	KubeScheduler          cli.StringSlice
	KubeControllerManager  cli.StringSlice
	KubeProxy              cli.StringSlice
	Etcd                   cli.StringSlice
	CloudControllerManager cli.StringSlice
}

type ExtraEnv struct {
	KubeAPIServer          cli.StringSlice
	KubeScheduler          cli.StringSlice
	KubeControllerManager  cli.StringSlice
	KubeProxy              cli.StringSlice
	Etcd                   cli.StringSlice
	CloudControllerManager cli.StringSlice
}

// Valid CIS Profile versions
const (
	CISProfile123          = "cis-1.23"
	CISProfile             = "cis"
	defaultAuditPolicyFile = "/etc/rancher/rke2/audit-policy.yaml"
	containerdSock         = "/run/k3s/containerd/containerd.sock"
	KubeAPIServer          = "kube-apiserver"
	KubeScheduler          = "kube-scheduler"
	KubeControllerManager  = "kube-controller-manager"
	KubeProxy              = "kube-proxy"
	Etcd                   = "etcd"
	CloudControllerManager = "cloud-controller-manager"
)

func Server(clx *cli.Context, cfg Config) error {
	if err := setup(clx, cfg, true); err != nil {
		return err
	}

if err := clx.Set("secrets-encryption", "true"); err != nil {
		return err
	}

// Disable all disableable k3s packaged components. In addition to manifests,
	// this also disables several integrated controllers.
	disableItems := strings.Split(cmds.DisableItems, ",")
	for _, item := range disableItems {
		item = strings.TrimSpace(item)
		if clx.Bool("enable-" + item) {
			continue
		}
		if err := clx.Set("disable", item); err != nil {
			return err
		}
	}
	cisMode := isCISMode(clx)
	defaultNamespaces := []string{
		metav1.NamespaceSystem,
		metav1.NamespaceDefault,
		metav1.NamespacePublic,
	}
	dataDir := clx.String("data-dir")
	cmds.ServerConfig.StartupHooks = append(cmds.ServerConfig.StartupHooks,
		reconcileStaticPods(cmds.AgentConfig.ContainerRuntimeEndpoint, dataDir),
		setNetworkPolicies(cisMode, defaultNamespaces),
		setClusterRoles(),
		restrictServiceAccounts(cisMode, defaultNamespaces),
		setKubeProxyDisabled(),
		cleanupStaticPodsOnSelfDelete(dataDir),
	)

var leaderControllers rawServer.CustomControllers

if cisMode {
		leaderControllers = append(leaderControllers, cisnetworkpolicy.Controller)
	}

return server.RunWithControllers(clx, leaderControllers, rawServer.CustomControllers{})
}

func Agent(clx *cli.Context, cfg Config) error {
	if err := setup(clx, cfg, false); err != nil {
		return err
	}
	return agent.Run(clx)
}

func setup(clx *cli.Context, cfg Config, isServer bool) error {
	dataDir := clx.String("data-dir")
	clusterReset := clx.Bool("cluster-reset")
	clusterResetRestorePath := clx.String("cluster-reset-restore-path")
	containerRuntimeEndpoint := clx.String("container-runtime-endpoint")

ex, err := initExecutor(clx, cfg, isServer)
	if err != nil {
		return err
	}
	executor.Set(ex)

// check for force restart file
	var forceRestart bool
	if _, err := os.Stat(ForceRestartFile(dataDir)); err != nil {
		if !os.IsNotExist(err) {
			return err
		}
	} else {
		forceRestart = true
		os.Remove(ForceRestartFile(dataDir))
	}

// check for missing db name file on a server running etcd, indicating we're rejoining after cluster reset on a different node
	if _, err := os.Stat(etcdNameFile(dataDir)); err != nil && os.IsNotExist(err) && isServer && !clx.Bool("disable-etcd") {
		clusterReset = true
	}

disabledItems := map[string]bool{
		"cloud-controller-manager": !isServer || forceRestart || clx.Bool("disable-cloud-controller"),
		"etcd":                     !isServer || forceRestart || clx.Bool("disable-etcd"),
		"kube-apiserver":           !isServer || forceRestart || clx.Bool("disable-apiserver"),
		"kube-controller-manager":  !isServer || forceRestart || clx.Bool("disable-controller-manager"),
		"kube-scheduler":           !isServer || forceRestart || clx.Bool("disable-scheduler"),
	}
	// adding force restart file when cluster reset restore path is passed
	if clusterResetRestorePath != "" {
		forceRestartFile := ForceRestartFile(dataDir)
		if err := os.MkdirAll(dataDir, 0755); err != nil {
			return err
		}
		if err := ioutil.WriteFile(forceRestartFile, []byte(""), 0600); err != nil {
			return err
		}
	}
	return removeDisabledPods(dataDir, containerRuntimeEndpoint, disabledItems, clusterReset)
}

func ForceRestartFile(dataDir string) string {
	return filepath.Join(dataDir, "force-restart")
}

func etcdNameFile(dataDir string) string {
	return filepath.Join(dataDir, "server", "db", "etcd", "name")
}

func podManifestsDir(dataDir string) string {
	return filepath.Join(dataDir, "agent", config.DefaultPodManifestPath)
}

func binDir(dataDir string) string {
	return filepath.Join(dataDir, "bin")
}

// removeDisabledPods deletes the pod manifests for any disabled pods, as well as ensuring that the containers themselves are terminated.
//
// TODO: move this into the podexecutor package, this logic is specific to that executor and should be there instead of here.
func removeDisabledPods(dataDir, containerRuntimeEndpoint string, disabledItems map[string]bool, clusterReset bool) error {
	terminatePods := false
	execPath := binDir(dataDir)
	manifestDir := podManifestsDir(dataDir)

// no need to clean up static pods if this is a clean install (bin or manifests dirs missing)
	for _, path := range []string{execPath, manifestDir} {
		if _, err := os.Stat(path); os.IsNotExist(err) {
			return nil
		}
	}

// ensure etcd and the apiserver are terminated if doing a cluster-reset, and force pod
	// termination even if there are no manifests on disk
	if clusterReset {
		disabledItems["etcd"] = true
		disabledItems["kube-apiserver"] = true
		terminatePods = true
	}

// check to see if there are manifests for any disabled components. If there are no manifests for
	// disabled components, and termination wasn't forced by cluster-reset, termination is skipped.
	for component, disabled := range disabledItems {
		if disabled {
			manifestName := filepath.Join(manifestDir, component+".yaml")
			if _, err := os.Stat(manifestName); err == nil {
				terminatePods = true
			}
		}
	}

if terminatePods {
		logrus.Infof("Static pod cleanup in progress")
		// delete manifests for disabled items
		for component, disabled := range disabledItems {
			if disabled {
				manifestName := filepath.Join(manifestDir, component+".yaml")
				if err := os.RemoveAll(manifestName); err != nil {
					return errors.Wrapf(err, "unable to delete %s manifest", component)
				}
			}
		}

ctx, cancel := context.WithTimeout(context.Background(), (5 * time.Minute))
		defer cancel()

containerdErr := make(chan error)

// start containerd, if necessary. The command will be terminated automatically when the context is cancelled.
		if containerRuntimeEndpoint == "" {
			containerdCmd := exec.CommandContext(ctx, filepath.Join(execPath, "containerd"))
			go startContainerd(ctx, dataDir, containerdErr, containerdCmd)
		}
		// terminate any running containers from the disabled items list
		go terminateRunningContainers(ctx, containerRuntimeEndpoint, disabledItems, containerdErr)

for {
			select {
			case err := <-containerdErr:
				if err != nil {
					return errors.Wrap(err, "temporary containerd process exited unexpectedly")
				}
			case <-ctx.Done():
				return errors.New("static pod cleanup timed out")
			}
			logrus.Info("Static pod cleanup completed successfully")
			break
		}
	}

return nil
}

func isCISMode(clx *cli.Context) bool {
	profile := clx.String("profile")
	if profile == CISProfile123 {
		logrus.Warn("cis-1.23 profile is deprecated and will be removed in v1.29. Please use cis instead.")
	}
	return profile == CISProfile123 || profile == CISProfile
}

// TODO: move this into the podexecutor package, this logic is specific to that executor and should be there instead of here.
func startContainerd(_ context.Context, dataDir string, errChan chan error, cmd *exec.Cmd) {
	args := []string{
		"-c", filepath.Join(dataDir, "agent", "etc", "containerd", "config.toml"),
		"-a", containerdSock,
		"--state", filepath.Dir(containerdSock),
		"--root", filepath.Join(dataDir, "agent", "containerd"),
	}

logFile := filepath.Join(dataDir, "agent", "containerd", "containerd.log")
	logrus.Infof("Logging temporary containerd to %s", logFile)
	logOut := &lumberjack.Logger{
		Filename:   logFile,
		MaxSize:    50,
		MaxBackups: 3,
		MaxAge:     28,
		Compress:   true,
	}

env := []string{}
	cenv := []string{}

for _, e := range os.Environ() {
		pair := strings.SplitN(e, "=", 2)
		switch {
		case pair[0] == "NOTIFY_SOCKET":
			// elide NOTIFY_SOCKET to prevent spurious notifications to systemd
		case pair[0] == "CONTAINERD_LOG_LEVEL":
			// Turn CONTAINERD_LOG_LEVEL variable into log-level flag
			args = append(args, "--log-level", pair[1])
		case strings.HasPrefix(pair[0], "CONTAINERD_"):
			// Strip variables with CONTAINERD_ prefix before passing through
			// This allows doing things like setting a proxy for image pulls by setting
			// CONTAINERD_https_proxy=http://proxy.example.com:8080
			pair[0] = strings.TrimPrefix(pair[0], "CONTAINERD_")
			cenv = append(cenv, strings.Join(pair, "="))
		case pair[0] == "PATH":
			env = append(env, fmt.Sprintf("PATH=%s:%s", binDir(dataDir), pair[1]))
		default:
			env = append(env, strings.Join(pair, "="))
		}
	}

cmd.Args = append(cmd.Args, args...)
	cmd.Env = append(env, cenv...)
	cmd.Stdout = logOut
	cmd.Stderr = logOut

logrus.Infof("Running temporary containerd %s", daemonconfig.ArgString(cmd.Args))
	errChan <- cmd.Run()
}

// TODO: move this into the podexecutor package, this logic is specific to that executor and should be there instead of here.
func terminateRunningContainers(ctx context.Context, containerRuntimeEndpoint string, disabledItems map[string]bool, containerdErr chan error) {
	if containerRuntimeEndpoint == "" {
		containerRuntimeEndpoint = containerdSock
	}

// send on the subprocess error channel to wake up the select
	// loop and shut everything down when the poll completes
	containerdErr <- wait.PollUntilWithContext(ctx, 10*time.Second, func(ctx context.Context) (bool, error) {
		conn, err := cri.Connection(ctx, containerRuntimeEndpoint)
		if err != nil {
			logrus.Warnf("Failed to open CRI connection: %v", err)
			return false, nil
		}
		defer conn.Close()

// List all pods in the kube-system namespace; it's faster than asking for them one by
		// one since we're going to be iterating over a list of components.
		cRuntime := runtimeapi.NewRuntimeServiceClient(conn)
		filter := &runtimeapi.PodSandboxFilter{LabelSelector: map[string]string{"io.kubernetes.pod.namespace": metav1.NamespaceSystem}}
		resp, err := cRuntime.ListPodSandbox(ctx, &runtimeapi.ListPodSandboxRequest{Filter: filter})
		if err != nil {
			logrus.Warnf("Failed to list pods: %v", err)
			return false, nil
		}

for component, disabled := range disabledItems {
			var found bool
			for _, pod := range resp.Items {
				if disabled && pod.Labels["component"] == component && pod.Annotations["kubernetes.io/config.source"] == "file" {
					found = true
					logrus.Infof("Removing pod %s", pod.Metadata.Name)
					if _, err := cRuntime.RemovePodSandbox(ctx, &runtimeapi.RemovePodSandboxRequest{PodSandboxId: pod.Id}); err != nil {
						logrus.Warnf("Failed to remove pod %s: %v", pod.Id, err)
					}
				}
			}
			// no pods found for this component or not disabled, remove it from the list to be checked
			if !found || !disabled {
				delete(disabledItems, component)
			}
		}

// once all disabled components have been removed, stop polling
		return len(disabledItems) == 0, nil
	})
}
0707010000008B000081A4000000000000000000000001653C446F00004B26000000000000000000000000000000000000002A00000000rke2-1.27.7+rke2r1/pkg/rke2/rke2_linux.go//go:build linux
// +build linux

package rke2

import (
	"bytes"
	"context"
	"fmt"
	"io/ioutil"
	"net/http"
	"os/exec"
	"path/filepath"
	"strconv"
	"strings"
	"time"

"github.com/k3s-io/k3s/pkg/agent/config"
	"github.com/k3s-io/k3s/pkg/cli/cmds"
	"github.com/k3s-io/k3s/pkg/cluster/managed"
	"github.com/k3s-io/k3s/pkg/etcd"
	"github.com/pkg/errors"
	"github.com/rancher/rke2/pkg/cli/defaults"
	"github.com/rancher/rke2/pkg/images"
	"github.com/rancher/rke2/pkg/podexecutor"
	"github.com/sirupsen/logrus"
	"github.com/urfave/cli"
)

const (
	CPURequest    = "cpu-request"
	CPULimit      = "cpu-limit"
	MemoryRequest = "memory-request"
	MemoryLimit   = "memory-limit"

Readiness = "readiness"
	Liveness  = "liveness"
	Startup   = "startup"

InitialDelaySeconds = "initial-delay-seconds"
	TimeoutSeconds      = "timeout-seconds"
	FailureThreshold    = "failure-threshold"
	PeriodSeconds       = "period-seconds"
)

func initExecutor(clx *cli.Context, cfg Config, isServer bool) (*podexecutor.StaticPodConfig, error) {
	// This flag will only be set on servers, on agents this is a no-op and the
	// resolver's default registry will get updated later when bootstrapping
	cfg.Images.SystemDefaultRegistry = clx.String("system-default-registry")
	resolver, err := images.NewResolver(cfg.Images)
	if err != nil {
		return nil, err
	}

dataDir := clx.String("data-dir")
	if err := defaults.Set(clx, dataDir); err != nil {
		return nil, err
	}

agentManifestsDir := filepath.Join(dataDir, "agent", config.DefaultPodManifestPath)
	agentImagesDir := filepath.Join(dataDir, "agent", "images")

managed.RegisterDriver(&etcd.ETCD{})

if clx.IsSet("cloud-provider-config") || clx.IsSet("cloud-provider-name") {
		if clx.IsSet("node-external-ip") {
			return nil, errors.New("can't set node-external-ip while using cloud provider")
		}
		cmds.ServerConfig.DisableCCM = true
	}
	var cpConfig *podexecutor.CloudProviderConfig
	if cfg.CloudProviderConfig != "" && cfg.CloudProviderName == "" {
		return nil, fmt.Errorf("--cloud-provider-config requires --cloud-provider-name to be provided")
	}
	if cfg.CloudProviderName != "" {
		cpConfig = &podexecutor.CloudProviderConfig{
			Name: cfg.CloudProviderName,
			Path: cfg.CloudProviderConfig,
		}
		if clx.String("node-name") == "" && cfg.CloudProviderName == "aws" {
			fqdn := hostnameFromMetadataEndpoint(context.Background())
			if fqdn == "" {
				hostFQDN, err := hostnameFQDN()
				if err != nil {
					return nil, err
				}
				fqdn = hostFQDN
			}
			if err := clx.Set("node-name", fqdn); err != nil {
				return nil, err
			}
		}
	}

if cfg.KubeletPath == "" {
		cfg.KubeletPath = "kubelet"
	}

controlPlaneResources, err := parseControlPlaneResources(cfg)
	if err != nil {
		return nil, err
	}

controlPlaneProbeConfs, err := parseControlPlaneProbeConfs(cfg)
	if err != nil {
		return nil, err
	}

extraEnv, err := parseControlPlaneEnv(cfg)
	if err != nil {
		return nil, err
	}

extraMounts, err := parseControlPlaneMounts(cfg)
	if err != nil {
		return nil, err
	}
	// Adding PSAs
	podSecurityConfigFile := clx.String("pod-security-admission-config-file")
	if podSecurityConfigFile == "" {
		if err := setPSAs(isCISMode(clx)); err != nil {
			return nil, err
		}
		podSecurityConfigFile = defaultPSAConfigFile
	}

containerRuntimeEndpoint := cmds.AgentConfig.ContainerRuntimeEndpoint
	if containerRuntimeEndpoint == "" {
		containerRuntimeEndpoint = containerdSock
	}

return &podexecutor.StaticPodConfig{
		Resolver:               resolver,
		ImagesDir:              agentImagesDir,
		ManifestsDir:           agentManifestsDir,
		CISMode:                isCISMode(clx),
		CloudProvider:          cpConfig,
		DataDir:                dataDir,
		AuditPolicyFile:        clx.String("audit-policy-file"),
		PSAConfigFile:          podSecurityConfigFile,
		KubeletPath:            cfg.KubeletPath,
		RuntimeEndpoint:        containerRuntimeEndpoint,
		KubeProxyChan:          make(chan struct{}),
		DisableETCD:            clx.Bool("disable-etcd"),
		IsServer:               isServer,
		ControlPlaneResources:  *controlPlaneResources,
		ControlPlaneProbeConfs: *controlPlaneProbeConfs,
		ControlPlaneEnv:        *extraEnv,
		ControlPlaneMounts:     *extraMounts,
	}, nil
}

func parseControlPlaneResources(cfg Config) (*podexecutor.ControlPlaneResources, error) {
	var controlPlaneResources podexecutor.ControlPlaneResources
	// resources is a map of the component (kube-apiserver, kube-controller-manager, etc.) to a map[string]*string,
	// where the key of the downstream map is the `cpu-request`, `cpu-limit`, `memory-request`, or `memory-limit` and
	// the value corresponds to a pointer to the component resources array
	var resources = map[string]map[string]*string{
		KubeAPIServer: {
			CPURequest:    &controlPlaneResources.KubeAPIServerCPURequest,
			CPULimit:      &controlPlaneResources.KubeAPIServerCPULimit,
			MemoryRequest: &controlPlaneResources.KubeAPIServerMemoryRequest,
			MemoryLimit:   &controlPlaneResources.KubeAPIServerMemoryLimit,
		},
		KubeScheduler: {
			CPURequest:    &controlPlaneResources.KubeSchedulerCPURequest,
			CPULimit:      &controlPlaneResources.KubeSchedulerCPULimit,
			MemoryRequest: &controlPlaneResources.KubeSchedulerMemoryRequest,
			MemoryLimit:   &controlPlaneResources.KubeSchedulerMemoryLimit,
		},
		KubeControllerManager: {
			CPURequest:    &controlPlaneResources.KubeControllerManagerCPURequest,
			CPULimit:      &controlPlaneResources.KubeControllerManagerCPULimit,
			MemoryRequest: &controlPlaneResources.KubeControllerManagerMemoryRequest,
			MemoryLimit:   &controlPlaneResources.KubeControllerManagerMemoryLimit,
		},
		KubeProxy: {
			CPURequest:    &controlPlaneResources.KubeProxyCPURequest,
			CPULimit:      &controlPlaneResources.KubeProxyCPULimit,
			MemoryRequest: &controlPlaneResources.KubeProxyMemoryRequest,
			MemoryLimit:   &controlPlaneResources.KubeProxyMemoryLimit,
		},
		Etcd: {
			CPURequest:    &controlPlaneResources.EtcdCPURequest,
			CPULimit:      &controlPlaneResources.EtcdCPULimit,
			MemoryRequest: &controlPlaneResources.EtcdMemoryRequest,
			MemoryLimit:   &controlPlaneResources.EtcdMemoryLimit,
		},
		CloudControllerManager: {
			CPURequest:    &controlPlaneResources.CloudControllerManagerCPURequest,
			CPULimit:      &controlPlaneResources.CloudControllerManagerCPULimit,
			MemoryRequest: &controlPlaneResources.CloudControllerManagerMemoryRequest,
			MemoryLimit:   &controlPlaneResources.CloudControllerManagerMemoryLimit,
		},
	}

// defaultResources contains a map of default resources for each component, used if not explicitly configured.
	var defaultResources = map[string]map[string]string{
		KubeAPIServer: {
			CPURequest:    "250m",
			MemoryRequest: "1024Mi",
		},
		KubeScheduler: {
			CPURequest:    "100m",
			MemoryRequest: "128Mi",
		},
		KubeControllerManager: {
			CPURequest:    "200m",
			MemoryRequest: "256Mi",
		},
		KubeProxy: {
			CPURequest:    "250m",
			MemoryRequest: "128Mi",
		},
		Etcd: {
			CPURequest:    "200m",
			MemoryRequest: "512Mi",
		},
		CloudControllerManager: {
			CPURequest:    "100m",
			MemoryRequest: "128Mi",
		},
	}

var parsedRequestsLimits = make(map[string]string)

for _, requests := range cfg.ControlPlaneResourceRequests {
		for _, rawRequest := range strings.Split(requests, ",") {
			v := strings.SplitN(rawRequest, "=", 2)
			if len(v) != 2 {
				return nil, fmt.Errorf("incorrectly formatted control plane resource request specified: %s", rawRequest)
			}
			parsedRequestsLimits[v[0]+"-request"] = v[1]
		}
	}

for _, limits := range cfg.ControlPlaneResourceLimits {
		for _, rawLimit := range strings.Split(limits, ",") {
			v := strings.SplitN(rawLimit, "=", 2)
			if len(v) != 2 {
				return nil, fmt.Errorf("incorrectly formatted control plane resource limit specified: %s", rawLimit)
			}
			parsedRequestsLimits[v[0]+"-limit"] = v[1]
		}
	}

for component, request := range resources {
		for resource, target := range request {
			k := component + "-" + resource
			if val, ok := parsedRequestsLimits[k]; ok {
				*target = val
			} else if val, ok := defaultResources[component][resource]; ok {
				*target = val
			}
		}
	}

return &controlPlaneResources, nil
}

func parseControlPlaneProbeConfs(cfg Config) (*podexecutor.ControlPlaneProbeConfs, error) {
	var controlPlaneProbes podexecutor.ControlPlaneProbeConfs
	// probes is a map of the component (kube-apiserver, kube-controller-manager, etc.) probe type, and setting, where
	// the value corresponds to a pointer to the component probes array.
	var probes = map[string]map[string]map[string]*int32{
		KubeAPIServer: {
			Liveness: {
				InitialDelaySeconds: &controlPlaneProbes.KubeAPIServer.Liveness.InitialDelaySeconds,
				TimeoutSeconds:      &controlPlaneProbes.KubeAPIServer.Liveness.TimeoutSeconds,
				FailureThreshold:    &controlPlaneProbes.KubeAPIServer.Liveness.FailureThreshold,
				PeriodSeconds:       &controlPlaneProbes.KubeAPIServer.Liveness.PeriodSeconds,
			},
			Readiness: {
				InitialDelaySeconds: &controlPlaneProbes.KubeAPIServer.Readiness.InitialDelaySeconds,
				TimeoutSeconds:      &controlPlaneProbes.KubeAPIServer.Readiness.TimeoutSeconds,
				FailureThreshold:    &controlPlaneProbes.KubeAPIServer.Readiness.FailureThreshold,
				PeriodSeconds:       &controlPlaneProbes.KubeAPIServer.Readiness.PeriodSeconds,
			},
			Startup: {
				InitialDelaySeconds: &controlPlaneProbes.KubeAPIServer.Startup.InitialDelaySeconds,
				TimeoutSeconds:      &controlPlaneProbes.KubeAPIServer.Startup.TimeoutSeconds,
				FailureThreshold:    &controlPlaneProbes.KubeAPIServer.Startup.FailureThreshold,
				PeriodSeconds:       &controlPlaneProbes.KubeAPIServer.Startup.PeriodSeconds,
			},
		},
		KubeScheduler: {
			Liveness: {
				InitialDelaySeconds: &controlPlaneProbes.KubeScheduler.Liveness.InitialDelaySeconds,
				TimeoutSeconds:      &controlPlaneProbes.KubeScheduler.Liveness.TimeoutSeconds,
				FailureThreshold:    &controlPlaneProbes.KubeScheduler.Liveness.FailureThreshold,
				PeriodSeconds:       &controlPlaneProbes.KubeScheduler.Liveness.PeriodSeconds,
			},
			Readiness: {
				InitialDelaySeconds: &controlPlaneProbes.KubeScheduler.Readiness.InitialDelaySeconds,
				TimeoutSeconds:      &controlPlaneProbes.KubeScheduler.Readiness.TimeoutSeconds,
				FailureThreshold:    &controlPlaneProbes.KubeScheduler.Readiness.FailureThreshold,
				PeriodSeconds:       &controlPlaneProbes.KubeScheduler.Readiness.PeriodSeconds,
			},
			Startup: {
				InitialDelaySeconds: &controlPlaneProbes.KubeScheduler.Startup.InitialDelaySeconds,
				TimeoutSeconds:      &controlPlaneProbes.KubeScheduler.Startup.TimeoutSeconds,
				FailureThreshold:    &controlPlaneProbes.KubeScheduler.Startup.FailureThreshold,
				PeriodSeconds:       &controlPlaneProbes.KubeScheduler.Startup.PeriodSeconds,
			},
		},
		KubeControllerManager: {
			Liveness: {
				InitialDelaySeconds: &controlPlaneProbes.KubeControllerManager.Liveness.InitialDelaySeconds,
				TimeoutSeconds:      &controlPlaneProbes.KubeControllerManager.Liveness.TimeoutSeconds,
				FailureThreshold:    &controlPlaneProbes.KubeControllerManager.Liveness.FailureThreshold,
				PeriodSeconds:       &controlPlaneProbes.KubeControllerManager.Liveness.PeriodSeconds,
			},
			Readiness: {
				InitialDelaySeconds: &controlPlaneProbes.KubeControllerManager.Readiness.InitialDelaySeconds,
				TimeoutSeconds:      &controlPlaneProbes.KubeControllerManager.Readiness.TimeoutSeconds,
				FailureThreshold:    &controlPlaneProbes.KubeControllerManager.Readiness.FailureThreshold,
				PeriodSeconds:       &controlPlaneProbes.KubeControllerManager.Readiness.PeriodSeconds,
			},
			Startup: {
				InitialDelaySeconds: &controlPlaneProbes.KubeControllerManager.Startup.InitialDelaySeconds,
				TimeoutSeconds:      &controlPlaneProbes.KubeControllerManager.Startup.TimeoutSeconds,
				FailureThreshold:    &controlPlaneProbes.KubeControllerManager.Startup.FailureThreshold,
				PeriodSeconds:       &controlPlaneProbes.KubeControllerManager.Startup.PeriodSeconds,
			},
		},
		KubeProxy: {
			Liveness: {
				InitialDelaySeconds: &controlPlaneProbes.KubeProxy.Liveness.InitialDelaySeconds,
				TimeoutSeconds:      &controlPlaneProbes.KubeProxy.Liveness.TimeoutSeconds,
				FailureThreshold:    &controlPlaneProbes.KubeProxy.Liveness.FailureThreshold,
				PeriodSeconds:       &controlPlaneProbes.KubeProxy.Liveness.PeriodSeconds,
			},
			Readiness: {
				InitialDelaySeconds: &controlPlaneProbes.KubeProxy.Readiness.InitialDelaySeconds,
				TimeoutSeconds:      &controlPlaneProbes.KubeProxy.Readiness.TimeoutSeconds,
				FailureThreshold:    &controlPlaneProbes.KubeProxy.Readiness.FailureThreshold,
				PeriodSeconds:       &controlPlaneProbes.KubeProxy.Readiness.PeriodSeconds,
			},
			Startup: {
				InitialDelaySeconds: &controlPlaneProbes.KubeProxy.Startup.InitialDelaySeconds,
				TimeoutSeconds:      &controlPlaneProbes.KubeProxy.Startup.TimeoutSeconds,
				FailureThreshold:    &controlPlaneProbes.KubeProxy.Startup.FailureThreshold,
				PeriodSeconds:       &controlPlaneProbes.KubeProxy.Startup.PeriodSeconds,
			},
		},
		Etcd: {
			Liveness: {
				InitialDelaySeconds: &controlPlaneProbes.Etcd.Liveness.InitialDelaySeconds,
				TimeoutSeconds:      &controlPlaneProbes.Etcd.Liveness.TimeoutSeconds,
				FailureThreshold:    &controlPlaneProbes.Etcd.Liveness.FailureThreshold,
				PeriodSeconds:       &controlPlaneProbes.Etcd.Liveness.PeriodSeconds,
			},
			Readiness: {
				InitialDelaySeconds: &controlPlaneProbes.Etcd.Readiness.InitialDelaySeconds,
				TimeoutSeconds:      &controlPlaneProbes.Etcd.Readiness.TimeoutSeconds,
				FailureThreshold:    &controlPlaneProbes.Etcd.Readiness.FailureThreshold,
				PeriodSeconds:       &controlPlaneProbes.Etcd.Readiness.PeriodSeconds,
			},
			Startup: {
				InitialDelaySeconds: &controlPlaneProbes.Etcd.Startup.InitialDelaySeconds,
				TimeoutSeconds:      &controlPlaneProbes.Etcd.Startup.TimeoutSeconds,
				FailureThreshold:    &controlPlaneProbes.Etcd.Startup.FailureThreshold,
				PeriodSeconds:       &controlPlaneProbes.Etcd.Startup.PeriodSeconds,
			},
		},
		CloudControllerManager: {
			Liveness: {
				InitialDelaySeconds: &controlPlaneProbes.CloudControllerManager.Liveness.InitialDelaySeconds,
				TimeoutSeconds:      &controlPlaneProbes.CloudControllerManager.Liveness.TimeoutSeconds,
				FailureThreshold:    &controlPlaneProbes.CloudControllerManager.Liveness.FailureThreshold,
				PeriodSeconds:       &controlPlaneProbes.CloudControllerManager.Liveness.PeriodSeconds,
			},
			Readiness: {
				InitialDelaySeconds: &controlPlaneProbes.CloudControllerManager.Readiness.InitialDelaySeconds,
				TimeoutSeconds:      &controlPlaneProbes.CloudControllerManager.Readiness.TimeoutSeconds,
				FailureThreshold:    &controlPlaneProbes.CloudControllerManager.Readiness.FailureThreshold,
				PeriodSeconds:       &controlPlaneProbes.CloudControllerManager.Readiness.PeriodSeconds,
			},
			Startup: {
				InitialDelaySeconds: &controlPlaneProbes.CloudControllerManager.Startup.InitialDelaySeconds,
				TimeoutSeconds:      &controlPlaneProbes.CloudControllerManager.Startup.TimeoutSeconds,
				FailureThreshold:    &controlPlaneProbes.CloudControllerManager.Startup.FailureThreshold,
				PeriodSeconds:       &controlPlaneProbes.CloudControllerManager.Startup.PeriodSeconds,
			},
		},
	}

// defaultProbeConf contains a map of default probe settings for each type, used if not explicitly configured.
	var defaultProbeConf = map[string]map[string]int32{
		// https://github.com/kubernetes/kubernetes/blob/v1.24.0/cmd/kubeadm/app/util/staticpod/utils.go#L246
		Liveness: {
			InitialDelaySeconds: 10,
			TimeoutSeconds:      15,
			FailureThreshold:    8,
			PeriodSeconds:       10,
		},
		// https://github.com/kubernetes/kubernetes/blob/v1.24.0/cmd/kubeadm/app/util/staticpod/utils.go#L252
		Readiness: {
			InitialDelaySeconds: 0,
			TimeoutSeconds:      15,
			FailureThreshold:    3,
			PeriodSeconds:       1,
		},
		// https://github.com/kubernetes/kubernetes/blob/v1.24.0/cmd/kubeadm/app/util/staticpod/utils.go#L259
		Startup: {
			InitialDelaySeconds: 10,
			TimeoutSeconds:      5,
			FailureThreshold:    24,
			PeriodSeconds:       10,
		},
	}

var parsedProbeConf = make(map[string]int32)

for _, conf := range cfg.ControlPlaneProbeConf {
		for _, rawConf := range strings.Split(conf, ",") {
			v := strings.SplitN(rawConf, "=", 2)
			if len(v) != 2 {
				return nil, fmt.Errorf("incorrectly formatted control probe config specified: %s", rawConf)
			}
			val, err := strconv.ParseInt(v[1], 10, 32)
			if err != nil || val < 0 {
				return nil, fmt.Errorf("invalid control plane probe config value specified: %s", rawConf)
			}
			parsedProbeConf[v[0]] = int32(val)
		}
	}

for component, probe := range probes {
		for probeName, conf := range probe {
			for threshold, target := range conf {
				k := component + "-" + probeName + "-" + threshold
				if val, ok := parsedProbeConf[k]; ok {
					*target = val
				} else if val, ok := defaultProbeConf[probeName][threshold]; ok {
					*target = val
				}
			}
		}
	}

return &controlPlaneProbes, nil
}

func parseControlPlaneEnv(cfg Config) (*podexecutor.ControlPlaneEnv, error) {
	return &podexecutor.ControlPlaneEnv{
		KubeAPIServer:          cfg.ExtraEnv.KubeAPIServer.Value(),
		KubeScheduler:          cfg.ExtraEnv.KubeScheduler.Value(),
		KubeControllerManager:  cfg.ExtraEnv.KubeControllerManager.Value(),
		KubeProxy:              cfg.ExtraEnv.KubeProxy.Value(),
		Etcd:                   cfg.ExtraEnv.Etcd.Value(),
		CloudControllerManager: cfg.ExtraEnv.CloudControllerManager.Value(),
	}, nil
}

func parseControlPlaneMounts(cfg Config) (*podexecutor.ControlPlaneMounts, error) {
	return &podexecutor.ControlPlaneMounts{
		KubeAPIServer:          cfg.ExtraMounts.KubeAPIServer.Value(),
		KubeScheduler:          cfg.ExtraMounts.KubeScheduler.Value(),
		KubeControllerManager:  cfg.ExtraMounts.KubeControllerManager.Value(),
		KubeProxy:              cfg.ExtraMounts.KubeProxy.Value(),
		Etcd:                   cfg.ExtraMounts.Etcd.Value(),
		CloudControllerManager: cfg.ExtraMounts.CloudControllerManager.Value(),
	}, nil
}

func hostnameFQDN() (string, error) {
	cmd := exec.Command("hostname", "-f")

var b bytes.Buffer
	cmd.Stdout = &b

if err := cmd.Run(); err != nil {
		return "", err
	}

return strings.TrimSpace(b.String()), nil
}

func hostnameFromMetadataEndpoint(ctx context.Context) string {
	ctx, cancel := context.WithTimeout(ctx, time.Second)
	defer cancel()

req, err := http.NewRequestWithContext(ctx, http.MethodGet, "http://169.254.169.254/latest/meta-data/local-hostname", nil)
	if err != nil {
		logrus.Debugf("Failed to create request for metadata endpoint: %v", err)
		return ""
	}

resp, err := http.DefaultClient.Do(req)
	if err != nil {
		logrus.Debugf("Failed to get local-hostname from metadata endpoint: %v", err)
		return ""
	}
	defer resp.Body.Close()

if resp.StatusCode != http.StatusOK {
		logrus.Debugf("Metadata endpoint returned unacceptable status code %d", resp.StatusCode)
		return ""
	}

b, err := ioutil.ReadAll(resp.Body)
	if err != nil {
		logrus.Debugf("Failed to read response body from metadata endpoint: %v", err)
		return ""
	}

return strings.TrimSpace(string(b))
}
0707010000008C000081A4000000000000000000000001653C446F000014D5000000000000000000000000000000000000002F00000000rke2-1.27.7+rke2r1/pkg/rke2/rke2_linux_test.go//go:build linux
// +build linux

package rke2

import (
	"flag"
	"reflect"
	"testing"

"github.com/rancher/rke2/pkg/podexecutor"
	"github.com/rancher/rke2/pkg/staticpod"
	"github.com/urfave/cli"
)

func Test_UnitInitExecutor(t *testing.T) {
	type args struct {
		clx      *cli.Context
		cfg      Config
		isServer bool
	}
	tests := []struct {
		name    string
		args    args
		want    *podexecutor.StaticPodConfig
		wantErr bool
	}{
		{
			name: "agent",
			args: args{
				clx: cli.NewContext(nil, flag.NewFlagSet("test", 0), nil),
				cfg: Config{
					ControlPlaneProbeConf:        []string{"kube-proxy-startup-initial-delay-seconds=42"},
					ControlPlaneResourceLimits:   []string{"kube-proxy-cpu=123m"},
					ControlPlaneResourceRequests: []string{"kube-proxy-memory=123Mi"},
					ExtraEnv:                     ExtraEnv{KubeProxy: []string{"FOO=BAR"}},
					ExtraMounts:                  ExtraMounts{KubeProxy: []string{"/foo=/bar"}},
				},
				isServer: false,
			},
			want: &podexecutor.StaticPodConfig{
				ControlPlaneProbeConfs: podexecutor.ControlPlaneProbeConfs{
					KubeProxy: staticpod.ProbeConfs{
						Startup: staticpod.ProbeConf{
							InitialDelaySeconds: 42,
						},
					},
				},
				ControlPlaneResources: podexecutor.ControlPlaneResources{
					KubeProxyCPULimit:      "123m",
					KubeProxyMemoryRequest: "123Mi",
				},
				ControlPlaneEnv: podexecutor.ControlPlaneEnv{
					KubeProxy: []string{"FOO=BAR"},
				},
				ControlPlaneMounts: podexecutor.ControlPlaneMounts{
					KubeProxy: []string{"/foo=/bar"},
				},
			},
			wantErr: false,
		},
		{
			name: "server",
			args: args{
				clx: cli.NewContext(nil, flag.NewFlagSet("test", 0), nil),
				cfg: Config{
					ControlPlaneProbeConf:        []string{"kube-proxy-startup-initial-delay-seconds=123"},
					ControlPlaneResourceLimits:   []string{"kube-proxy-cpu=42m"},
					ControlPlaneResourceRequests: []string{"kube-proxy-memory=42Mi"},
					ExtraEnv:                     ExtraEnv{KubeProxy: []string{"BAZ=BOP"}},
					ExtraMounts:                  ExtraMounts{KubeProxy: []string{"/baz=/bop"}},
				},
				isServer: true,
			},
			want: &podexecutor.StaticPodConfig{
				ControlPlaneProbeConfs: podexecutor.ControlPlaneProbeConfs{
					KubeProxy: staticpod.ProbeConfs{
						Startup: staticpod.ProbeConf{
							InitialDelaySeconds: 123,
						},
					},
				},
				ControlPlaneResources: podexecutor.ControlPlaneResources{
					KubeProxyCPULimit:      "42m",
					KubeProxyMemoryRequest: "42Mi",
				},
				ControlPlaneEnv: podexecutor.ControlPlaneEnv{
					KubeProxy: []string{"BAZ=BOP"},
				},
				ControlPlaneMounts: podexecutor.ControlPlaneMounts{
					KubeProxy: []string{"/baz=/bop"},
				},
			},
			wantErr: false,
		},
		{
			name: "bad probe conf",
			args: args{
				clx: cli.NewContext(nil, flag.NewFlagSet("test", 0), nil),
				cfg: Config{
					ControlPlaneProbeConf: []string{"kube-proxy-startup-initial-delay-seconds=-123"},
				},
			},
			wantErr: true,
		},
		{
			name: "bad control plane limits",
			args: args{
				clx: cli.NewContext(nil, flag.NewFlagSet("test", 0), nil),
				cfg: Config{
					ControlPlaneResourceLimits: []string{"kube-proxy-cpu"},
				},
			},
			wantErr: true,
		},
		{
			name: "bad control plane requests",
			args: args{
				clx: cli.NewContext(nil, flag.NewFlagSet("test", 0), nil),
				cfg: Config{
					ControlPlaneResourceRequests: []string{"kube-proxy-memory"},
				},
			},
			wantErr: true,
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got, err := initExecutor(tt.args.clx, tt.args.cfg, tt.args.isServer)
			if (err != nil) != tt.wantErr {
				t.Errorf("initExecutor() error = %v, wantErr %v", err, tt.wantErr)
				return
			}
			// Don't check the returned struct if we expected an error
			if tt.wantErr {
				return
			}
			if !reflect.DeepEqual(got.ControlPlaneProbeConfs.KubeProxy.Startup.InitialDelaySeconds, tt.want.ControlPlaneProbeConfs.KubeProxy.Startup.InitialDelaySeconds) {
				t.Errorf("initExecutor() kube-proxy-startup-initial-delay-seconds = %+v\nWant = %+v",
					got.ControlPlaneProbeConfs.KubeProxy.Startup.InitialDelaySeconds,
					tt.want.ControlPlaneProbeConfs.KubeProxy.Startup.InitialDelaySeconds)
			}
			if !reflect.DeepEqual(got.ControlPlaneResources.KubeProxyCPULimit, tt.want.ControlPlaneResources.KubeProxyCPULimit) {
				t.Errorf("initExecutor() kube-proxy-cpu = %+v\nWant = %+v",
					got.ControlPlaneResources.KubeProxyCPULimit,
					tt.want.ControlPlaneResources.KubeProxyCPULimit)
			}
			if !reflect.DeepEqual(got.ControlPlaneResources.KubeProxyMemoryRequest, tt.want.ControlPlaneResources.KubeProxyMemoryRequest) {
				t.Errorf("initExecutor() kube-proxy-memory = %+v\nWant = %+v",
					got.ControlPlaneResources.KubeProxyMemoryRequest,
					tt.want.ControlPlaneResources.KubeProxyMemoryRequest)
			}
			if !reflect.DeepEqual(got.ControlPlaneEnv.KubeProxy, tt.want.ControlPlaneEnv.KubeProxy) {
				t.Errorf("initExecutor() kube-proxy extra-env = %+v\nWant = %+v",
					got.ControlPlaneEnv.KubeProxy,
					tt.want.ControlPlaneEnv.KubeProxy)
			}
			if !reflect.DeepEqual(got.ControlPlaneMounts.KubeProxy, tt.want.ControlPlaneMounts.KubeProxy) {
				t.Errorf("initExecutor() kube-proxy extra-mounts = %+v\nWant = %+v",
					got.ControlPlaneMounts.KubeProxy,
					tt.want.ControlPlaneMounts.KubeProxy)
			}
		})
	}
}
0707010000008D000081A4000000000000000000000001653C446F000008D2000000000000000000000000000000000000002C00000000rke2-1.27.7+rke2r1/pkg/rke2/rke2_windows.go//go:build windows
// +build windows

package rke2

import (
	"fmt"
	"path/filepath"

func initExecutor(clx *cli.Context, cfg Config, isServer bool) (*pebinaryexecutor.PEBinaryConfig, error) {
	// This flag will only be set on servers, on agents this is a no-op and the
	// resolver's default registry will get updated later when bootstrapping
	cfg.Images.SystemDefaultRegistry = clx.String("system-default-registry")
	resolver, err := images.NewResolver(cfg.Images)
	if err != nil {
		return nil, err
	}

dataDir := clx.String("data-dir")
	if err := defaults.Set(clx, dataDir); err != nil {
		return nil, err
	}

agentManifestsDir := filepath.Join(dataDir, "agent", config.DefaultPodManifestPath)
	agentImagesDir := filepath.Join(dataDir, "agent", "images")

managed.RegisterDriver(&etcd.ETCD{})

if cfg.KubeletPath == "" {
		cfg.KubeletPath = "kubelet"
	}

return &pebinaryexecutor.PEBinaryConfig{
		Resolver:        resolver,
		ImagesDir:       agentImagesDir,
		ManifestsDir:    agentManifestsDir,
		CISMode:         isCISMode(clx),
		CloudProvider:   cpConfig,
		DataDir:         dataDir,
		AuditPolicyFile: clx.String("audit-policy-file"),
		KubeletPath:     cfg.KubeletPath,
		DisableETCD:     clx.Bool("disable-etcd"),
		IsServer:        isServer,
		CNI:             "",
	}, nil
}
0707010000008E000081A4000000000000000000000001653C446F00000BB3000000000000000000000000000000000000002E00000000rke2-1.27.7+rke2r1/pkg/rke2/serviceaccount.gopackage rke2

import (
	"context"
	"sync"
	"time"

"github.com/k3s-io/k3s/pkg/cli/cmds"

"github.com/sirupsen/logrus"
	v1 "k8s.io/api/core/v1"
	apierrors "k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/wait"
	"k8s.io/client-go/kubernetes"
	"k8s.io/client-go/util/retry"
	"k8s.io/kubernetes/plugin/pkg/admission/serviceaccount"
)

func retryError(err error) bool {
	return apierrors.IsNotFound(err)
}

// updateServiceAccountRef retrieves the most recent revision of Service Account sa
// and updates the pointer to refer to the most recent revision. This get/change/update pattern
// is required to alter an object that may have changed since it was retrieved.
func updateServiceAccountRef(ctx context.Context, namespace string, cs kubernetes.Interface, sa *v1.ServiceAccount) error {
	logrus.Info("updating service account: " + sa.Name)
	newSA, err := cs.CoreV1().ServiceAccounts(namespace).Get(ctx, sa.Name, metav1.GetOptions{})
	if err != nil {
		return err
	}
	*sa = *newSA
	return nil
}

func restrictServiceAccount(ctx context.Context, namespace string, cs kubernetes.Interface) error {
	var backoff = wait.Backoff{
		Steps:    10,
		Duration: 5 * time.Second,
	}
	// There are two race conditions this function avoids, a race on getting the initial sa because it does not yet exist,
	// and a race between nodes to update the same sa, resulting in a conflict error
	return retry.OnError(backoff, retryError, func() error {
		sa, err := cs.CoreV1().ServiceAccounts(namespace).Get(ctx, serviceaccount.DefaultServiceAccountName, metav1.GetOptions{})
		if err != nil {
			return err
		}
		return retry.RetryOnConflict(retry.DefaultBackoff, func() error {
			var automount bool
			sa.AutomountServiceAccountToken = &automount
			if _, err = cs.CoreV1().ServiceAccounts(namespace).Update(ctx, sa, metav1.UpdateOptions{}); err != nil {
				if apierrors.IsConflict(err) {
					if getErr := updateServiceAccountRef(ctx, namespace, cs, sa); getErr != nil {
						return getErr
					}
				}
				return err
			}
			return nil
		})
	})
}

// restrictServiceAccounts disables automount across the 3 primary namespaces.
func restrictServiceAccounts(cisMode bool, namespaces []string) cmds.StartupHook {
	return func(ctx context.Context, wg *sync.WaitGroup, args cmds.StartupHookArgs) error {
		if !cisMode {
			wg.Done()
			return nil
		}

logrus.Info("Restricting automount...")
		go func() {
			defer wg.Done()
			<-args.APIServerReady
			cs, err := newClient(args.KubeConfigSupervisor, nil)
			if err != nil {
				logrus.Fatalf("serviceAccount: new k8s client: %s", err.Error())
			}
			nps := append(namespaces, "kube-node-lease")
			for _, namespace := range nps {
				if err := restrictServiceAccount(ctx, namespace, cs); err != nil {
					logrus.Fatalf("serviceAccount: namespace %s %s", namespace, err.Error())
				}
			}
			logrus.Info("Restricting automount for default serviceAccounts complete")
		}()

return nil
	}
}
0707010000008F000081A4000000000000000000000001653C446F00000C86000000000000000000000000000000000000003300000000rke2-1.27.7+rke2r1/pkg/rke2/serviceaccount_test.gopackage rke2

import (
	"context"
	"testing"

v1 "k8s.io/api/core/v1"
	k8serrors "k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"
	"k8s.io/apimachinery/pkg/runtime/schema"
	"k8s.io/client-go/kubernetes/fake"
	k8stesting "k8s.io/client-go/testing"
	"k8s.io/utils/pointer"
)

var testServiceAccountEmpty = &v1.ServiceAccount{
	ObjectMeta: metav1.ObjectMeta{
		Name: "default",
	},
}
var testServiceAccountFilled = &v1.ServiceAccount{
	ObjectMeta: metav1.ObjectMeta{
		Name: "default",
	},
	AutomountServiceAccountToken: pointer.BoolPtr(false),
}

func addClientReactors(cs *fake.Clientset, verb string, pass bool) *fake.Clientset {
	switch verb {
	case "get":
		if pass {
			cs.AddReactor(verb, "serviceaccounts",
				func(action k8stesting.Action) (handled bool, ret runtime.Object, err error) {
					return true, testServiceAccountEmpty, nil
				},
			)
		} else {
			cs.AddReactor(verb, "serviceaccounts",
				func(action k8stesting.Action) (handled bool, ret runtime.Object, err error) {
					return true, &v1.ServiceAccount{},
						k8serrors.NewNotFound(
							schema.GroupResource{Resource: "sa"},
							"sa-get",
						)
				},
			)
		}
	case "update":
		if pass {
			cs.AddReactor(verb, "serviceaccounts",
				func(action k8stesting.Action) (handled bool, ret runtime.Object, err error) {
					return true, testServiceAccountFilled, nil
				},
			)
		} else {
			cs.AddReactor(verb, "serviceaccounts",
				func(action k8stesting.Action) (handled bool, ret runtime.Object, err error) {
					return true, &v1.ServiceAccount{},
						k8serrors.NewConflict(
							schema.GroupResource{Resource: "sa"},
							"sa-update",
							nil,
						)
				},
			)
		}
	}
	return cs
}

func Test_UnitrestrictServiceAccount(t *testing.T) {
	type args struct {
		ctx       context.Context
		namespace string
		cs        *fake.Clientset
	}
	tests := []struct {
		name    string
		args    args
		setup   func(*fake.Clientset)
		wantErr bool
	}{
		{
			name: "Succeed on get and update",
			args: args{
				ctx:       context.Background(),
				namespace: "default",
				cs:        &fake.Clientset{},
			},
			setup: func(cs *fake.Clientset) {
				addClientReactors(cs, "get", true)
				addClientReactors(cs, "update", true)
			},
			wantErr: false,
		},
		{
			name: "Fail on get",
			args: args{
				ctx:       context.Background(),
				namespace: "default",
				cs:        &fake.Clientset{},
			},
			setup: func(cs *fake.Clientset) {
				addClientReactors(cs, "get", false)
				addClientReactors(cs, "update", false)
			},
			wantErr: true,
		},
		{
			name: "Fail on update",
			args: args{
				ctx:       context.Background(),
				namespace: "default",
				cs:        &fake.Clientset{},
			},
			setup: func(cs *fake.Clientset) {
				addClientReactors(cs, "get", true)
				addClientReactors(cs, "update", false)
			},
			wantErr: true,
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			tt.setup(tt.args.cs)
			if err := restrictServiceAccount(tt.args.ctx, tt.args.namespace, tt.args.cs); (err != nil) != tt.wantErr {
				t.Errorf("restrictServiceAccount() error = %v, wantErr %v", err, tt.wantErr)
			}
		})
	}
}
07070100000090000081A4000000000000000000000001653C446F00000CD8000000000000000000000000000000000000002300000000rke2-1.27.7+rke2r1/pkg/rke2/spc.gopackage rke2

import (
	"context"
	"fmt"
	"os"
	"path/filepath"
	"sync"

"github.com/k3s-io/k3s/pkg/cli/cmds"
	"github.com/k3s-io/k3s/pkg/version"
	"github.com/pkg/errors"
	"github.com/sirupsen/logrus"
	v1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/fields"
	"k8s.io/apimachinery/pkg/runtime"
	"k8s.io/apimachinery/pkg/watch"
	"k8s.io/client-go/kubernetes"
	"k8s.io/client-go/tools/cache"
	toolswatch "k8s.io/client-go/tools/watch"
)

var (
	removalAnnotation = "etcd." + version.Program + ".cattle.io/remove"
)

// cleanupStaticPodsOnSelfDelete returns a StartupHook that will start a
// goroutine to watch for deletion of the local node, and trigger static pod
// cleanup when this occurs.
func cleanupStaticPodsOnSelfDelete(dataDir string) cmds.StartupHook {
	return func(ctx context.Context, wg *sync.WaitGroup, args cmds.StartupHookArgs) error {
		go func() {
			defer wg.Done()
			<-args.APIServerReady
			cs, err := newClient(args.KubeConfigSupervisor, nil)
			if err != nil {
				logrus.Fatalf("spc: new k8s client: %s", err.Error())
			}
			go watchForSelfDelete(ctx, dataDir, cs)
		}()
		return nil
	}
}

// watchForSelfDelete watches for delete of the local node. When a delete event
// is found, it calls static pod cleanup.  Much of this is cribbed from
// kubernetes/cmd/kube-proxy/app/server_others.go
func watchForSelfDelete(ctx context.Context, dataDir string, client kubernetes.Interface) {
	nodeName := os.Getenv("NODE_NAME")
	logrus.Infof("Watching for delete of %s Node object", nodeName)
	fieldSelector := fields.Set{metav1.ObjectNameField: nodeName}.String()
	lw := &cache.ListWatch{
		ListFunc: func(options metav1.ListOptions) (object runtime.Object, e error) {
			options.FieldSelector = fieldSelector
			return client.CoreV1().Nodes().List(ctx, options)
		},
		WatchFunc: func(options metav1.ListOptions) (i watch.Interface, e error) {
			options.FieldSelector = fieldSelector
			return client.CoreV1().Nodes().Watch(ctx, options)
		},
	}
	condition := func(event watch.Event) (bool, error) {
		if n, ok := event.Object.(*v1.Node); ok {
			if n.ObjectMeta.DeletionTimestamp != nil || n.Annotations[removalAnnotation] == "true" {
				return true, nil
			}
			return false, nil
		}
		return false, fmt.Errorf("event object not of type Node")
	}

_, err := toolswatch.UntilWithSync(ctx, lw, &v1.Node{}, nil, condition)
	if err != nil && !errors.Is(err, context.Canceled) {
		logrus.Errorf("spc: failed to wait for node deletion: %v", err)
		return
	}

logrus.Infof("Local Node deleted or removed from etcd cluster, cleaning up server static pods")
	if err := cleanupStaticPods(dataDir); err != nil {
		logrus.Errorf("spc: failed to clean up static pods: %v", err)
	}
}

// cleanupStaticPods deletes all the control-plane and etc static pod manifests.
func cleanupStaticPods(dataDir string) error {
	components := []string{"kube-apiserver", "kube-scheduler", "kube-controller-manager", "cloud-controller-manager", "etcd"}
	manifestDir := podManifestsDir(dataDir)
	for _, component := range components {
		manifestName := filepath.Join(manifestDir, component+".yaml")
		if err := os.RemoveAll(manifestName); err != nil {
			return errors.Wrapf(err, "unable to delete %s manifest", component)
		}
	}
	return nil
}
07070100000091000081A4000000000000000000000001653C446F000018EA000000000000000000000000000000000000002300000000rke2-1.27.7+rke2r1/pkg/rke2/spw.gopackage rke2

// TODO: move this into the podexecutor package, this logic is specific to that executor and should be there instead of here.

import (
	"context"
	"os"
	"path/filepath"
	"sync"
	"time"

"github.com/k3s-io/k3s/pkg/agent/cri"
	"github.com/k3s-io/k3s/pkg/cli/cmds"
	"github.com/pkg/errors"
	"github.com/sirupsen/logrus"
	v1 "k8s.io/api/core/v1"
	"k8s.io/apimachinery/pkg/util/wait"
	"k8s.io/apimachinery/pkg/util/yaml"
	runtimeapi "k8s.io/cri-api/pkg/apis/runtime/v1"
	crierror "k8s.io/cri-api/pkg/errors"
	kubecontainer "k8s.io/kubernetes/pkg/kubelet/container"
	runtimeutil "k8s.io/kubernetes/pkg/kubelet/kuberuntime/util"
	netutils "k8s.io/utils/net"
)

type containerInfo struct {
	Config *runtimeapi.ContainerConfig `json:"config,omitempty"`
}

// reconcileStaticPods validates that the running pods for etcd and kube-apiserver match the static pod
// manifests provided in /var/lib/rancher/rke2/agent/pod-manifests. If any old pods are found, they are
// manually terminated, as the kubelet cannot be relied upon to terminate old pod when the apiserver is
// not available.
func reconcileStaticPods(containerRuntimeEndpoint, dataDir string) cmds.StartupHook {
	return func(ctx context.Context, wg *sync.WaitGroup, args cmds.StartupHookArgs) error {
		go func() {
			defer wg.Done()
			if err := wait.PollImmediateWithContext(ctx, 20*time.Second, 30*time.Minute, func(ctx context.Context) (bool, error) {
				if containerRuntimeEndpoint == "" {
					containerRuntimeEndpoint = containerdSock
				}
				conn, err := cri.Connection(ctx, containerRuntimeEndpoint)
				if err != nil {
					logrus.Infof("Waiting for cri connection: %v", err)
					return false, nil
				}
				cRuntime := runtimeapi.NewRuntimeServiceClient(conn)
				defer conn.Close()

manifestDir := podManifestsDir(dataDir)

for _, pod := range []string{"etcd", "kube-apiserver"} {
					manifestFile := filepath.Join(manifestDir, pod+".yaml")
					if err := checkManifestDeployed(ctx, cRuntime, manifestFile); err != nil {
						if errors.Is(err, os.ErrNotExist) {
							// Since split-role servers exist, we don't care if no manifest is found
							continue
						}
						logrus.Infof("Pod for %s not synced (%v), retrying", pod, err)
						return false, nil
					}
					logrus.Infof("Pod for %s is synced", pod)
				}
				return true, nil
			}); err != nil {
				logrus.Fatalf("Failed waiting for static pods to sync: %v", err)
			}
		}()
		return nil
	}
}

// checkManifestDeployed verifies that a single pod for this manifest is running with the current pod uid.
// Pod sandboxes with a different uid are removed and an error returned indicating that cleanup is in progress.
func checkManifestDeployed(ctx context.Context, cRuntime runtimeapi.RuntimeServiceClient, manifestFile string) error {
	f, err := os.Open(manifestFile)
	if err != nil {
		return errors.Wrap(err, "failed to open manifest")
	}
	defer f.Close()

pod := &v1.Pod{}
	decoder := yaml.NewYAMLToJSONDecoder(f)
	err = decoder.Decode(pod)
	if err != nil {
		return errors.Wrap(err, "failed to decode manifest")
	}

filter := &runtimeapi.PodSandboxFilter{
		LabelSelector: map[string]string{
			"component":                   pod.Labels["component"],
			"io.kubernetes.pod.namespace": pod.Namespace,
			"tier":                        pod.Labels["tier"],
		},
	}
	resp, err := cRuntime.ListPodSandbox(ctx, &runtimeapi.ListPodSandboxRequest{Filter: filter})
	if err != nil {
		return errors.Wrap(err, "failed to list pod sandboxes")
	}

podStatus := &kubecontainer.PodStatus{
		ID:              pod.UID,
		Name:            pod.Name,
		Namespace:       pod.Namespace,
		SandboxStatuses: []*runtimeapi.PodSandboxStatus{},
	}

// Get detailed pod sandbox status for any sandboxes associated with the current pod,
	// so that we can use kubelet runtime logic to determine which is the latest.
	// Ref: https://github.com/kubernetes/kubernetes/blob/v1.28.2/pkg/kubelet/kuberuntime/kuberuntime_manager.go#L1404
	matchingPodIdx := 0
	for _, podSandbox := range resp.Items {
		if podSandbox.Labels["io.kubernetes.pod.uid"] != string(pod.UID) {
			continue
		}
		statusResp, err := cRuntime.PodSandboxStatus(ctx, &runtimeapi.PodSandboxStatusRequest{PodSandboxId: podSandbox.Id})
		if crierror.IsNotFound(err) {
			continue
		}
		if err != nil {
			return errors.Wrap(err, "failed to get pod sandbox status")
		}
		podStatus.SandboxStatuses = append(podStatus.SandboxStatuses, statusResp.Status)
		// only get pod IP from the latest sandbox
		if matchingPodIdx == 0 && statusResp.Status.State == runtimeapi.PodSandboxState_SANDBOX_READY {
			podStatus.IPs = determinePodSandboxIPs(statusResp.Status)
		}
		matchingPodIdx++
	}

// Use kubelet runtime logic to find the latest pod sandbox
	newSandboxNeeded, _, sandboxID := runtimeutil.PodSandboxChanged(pod, podStatus)

// Remove any pod sandboxes that are not the latest
	var sandboxRemoved bool
	for _, podSandbox := range resp.Items {
		if podSandbox.Labels["io.kubernetes.pod.uid"] != string(pod.UID) || (sandboxID != "" && sandboxID != podSandbox.Id) {
			sandboxRemoved = true
			if _, err := cRuntime.RemovePodSandbox(ctx, &runtimeapi.RemovePodSandboxRequest{PodSandboxId: podSandbox.Id}); err != nil {
				logrus.Warnf("Failed to remove old %s pod sandbox: %v", pod.Name, err)
			}
		}
	}

if sandboxRemoved {
		return errors.New("waiting for termination of old pod sandbox")
	}
	if newSandboxNeeded {
		if sandboxID != "" {
			return errors.New("pod sandbox has changed")
		}
		return errors.New("pod sandbox not found")
	}
	return nil
}

// determinePodSandboxIP determines the IP addresses of the given pod sandbox.
// The list may be empty if the pod uses host networking.
// Ref: https://github.com/kubernetes/kubernetes/blob/v1.28.2/pkg/kubelet/kuberuntime/kuberuntime_sandbox.go#L305
func determinePodSandboxIPs(podSandbox *runtimeapi.PodSandboxStatus) []string {
	podIPs := make([]string, 0)
	if podSandbox.Network == nil {
		return podIPs
	}

// pick primary IP
	if len(podSandbox.Network.Ip) != 0 {
		if netutils.ParseIPSloppy(podSandbox.Network.Ip) == nil {
			return nil
		}
		podIPs = append(podIPs, podSandbox.Network.Ip)
	}

// pick additional ips, if cri reported them
	for _, podIP := range podSandbox.Network.AdditionalIps {
		if nil == netutils.ParseIPSloppy(podIP.Ip) {
			return nil
		}
		podIPs = append(podIPs, podIP.Ip)
	}

return podIPs
}
07070100000092000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002100000000rke2-1.27.7+rke2r1/pkg/staticpod07070100000093000081A4000000000000000000000001653C446F000033EE000000000000000000000000000000000000002E00000000rke2-1.27.7+rke2r1/pkg/staticpod/staticpod.gopackage staticpod

import (
	"bytes"
	"crypto/md5"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"io"
	"io/fs"
	"io/ioutil"
	"os"
	"path/filepath"
	"sort"
	"strings"

"github.com/google/go-containerregistry/pkg/name"
	"github.com/k3s-io/k3s/pkg/cli/cmds"
	"github.com/pkg/errors"
	"github.com/sirupsen/logrus"
	v1 "k8s.io/api/core/v1"
	"k8s.io/apimachinery/pkg/api/resource"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/types"
	"k8s.io/apimachinery/pkg/util/intstr"
	"k8s.io/client-go/tools/clientcmd"
	"k8s.io/kubernetes/pkg/util/hash"
	"sigs.k8s.io/yaml"
)

const (
	extraMountPrefix = "extra-mount"
)

type ProbeConf struct {
	InitialDelaySeconds int32
	TimeoutSeconds      int32
	FailureThreshold    int32
	PeriodSeconds       int32
}

type ProbeConfs struct {
	Liveness  ProbeConf
	Readiness ProbeConf
	Startup   ProbeConf
}

type Args struct {
	Command         string
	Args            []string
	Image           name.Reference
	Dirs            []string
	Files           []string
	CISMode         bool // CIS requires that the manifest be saved with 600 permissions
	ExcludeFiles    []string
	HealthExec      []string
	HealthPort      int32
	HealthProto     string
	HealthPath      string
	ReadyExec       []string
	ReadyPort       int32
	ReadyProto      string
	ReadyPath       string
	CPURequest      string
	CPULimit        string
	MemoryRequest   string
	MemoryLimit     string
	ExtraMounts     []string
	ExtraEnv        []string
	ProbeConfs      ProbeConfs
	SecurityContext *v1.PodSecurityContext
	Annotations     map[string]string
	Privileged      bool
}

// Remove cleans up the static pod manifest for the given command from the specified directory.
// It does not actually stop or remove the static pod from the container runtime.
func Remove(dir, command string) error {
	manifestPath := filepath.Join(dir, command+".yaml")
	if err := os.Remove(manifestPath); err != nil && !errors.Is(err, os.ErrNotExist) {
		return errors.Wrapf(err, "failed to remove %s static pod manifest", command)
	}
	logrus.Infof("Removed %s static pod manifest", command)
	return nil
}

// Run writes a static pod manifest for the given command into the specified directory.
// Note that it does not actually run the command; the kubelet is responsible for picking up
// the manifest and creating container to run it.
func Run(dir string, args Args) error {
	if cmds.AgentConfig.EnableSELinux {
		if args.SecurityContext == nil {
			args.SecurityContext = &v1.PodSecurityContext{}
		}
		if args.SecurityContext.SELinuxOptions == nil {
			args.SecurityContext.SELinuxOptions = &v1.SELinuxOptions{
				Type: "rke2_service_t",
			}
		}
	}
	files, err := readFiles(args.Args, args.ExcludeFiles)
	if err != nil {
		return err
	}

args.Files = append(args.Files, files...)
	pod, err := pod(args)
	if err != nil {
		return err
	}

manifestPath := filepath.Join(dir, args.Command+".yaml")

// We hash the completed pod manifest use that as the UID; this mimics what upstream does:
	// https://github.com/kubernetes/kubernetes/blob/v1.24.0/pkg/kubelet/config/common.go#L58-68
	// We manually terminate static pods with incorrect UIDs, as the kubelet cannot be relied
	// upon to clean up the old one while the apiserver is down.
	// See https://github.com/rancher/rke2/issues/3387 and https://github.com/rancher/rke2/issues/3725
	hasher := md5.New()
	hash.DeepHashObject(hasher, pod)
	fmt.Fprintf(hasher, "file:%s", manifestPath)
	pod.UID = types.UID(hex.EncodeToString(hasher.Sum(nil)[0:]))

b, err := yaml.Marshal(pod)
	if err != nil {
		return err
	}
	if args.CISMode {
		return writeFile(manifestPath, b, 0600)
	}
	return writeFile(manifestPath, b, 0644)
}

func writeFile(dest string, content []byte, perm fs.FileMode) error {
	name := filepath.Base(dest)
	dir := filepath.Dir(dest)
	if err := os.MkdirAll(dir, 0700); err != nil {
		return err
	}

existing, err := ioutil.ReadFile(dest)
	if err == nil && bytes.Equal(existing, content) {
		return nil
	}

// Create the new manifest in a temporary directory up one level from the static pods dir and then
	// rename it into place.  Creating manifests in the destination directory risks the Kubelet
	// picking them up when they're partially written, or creating duplicate pods if it picks it up
	// before the temp file is renamed over the existing file.
	tmpdir, err := os.MkdirTemp(filepath.Dir(dir), name)
	if err != nil {
		return err
	}
	defer os.RemoveAll(tmpdir)

tmp := filepath.Join(tmpdir, name)
	if err := os.WriteFile(tmp, content, perm); err != nil {
		return err
	}
	return os.Rename(tmp, dest)
}

func hashFiles(files []string) (string, error) {
	h := sha256.New()
	for _, file := range files {
		f, err := os.Open(file)
		if err != nil {
			return "", err
		}
		_, err = io.Copy(h, f)
		f.Close()
		if err != nil {
			return "", err
		}
	}

return hex.EncodeToString(h.Sum(nil)), nil
}

func pod(args Args) (*v1.Pod, error) {
	filehash, err := hashFiles(args.Files)
	if err != nil {
		return nil, err
	}

p := &v1.Pod{
		TypeMeta: metav1.TypeMeta{
			APIVersion: "v1",
			Kind:       "Pod",
		},
		ObjectMeta: metav1.ObjectMeta{
			Name:      args.Command,
			Namespace: "kube-system",
			Labels: map[string]string{
				"component": args.Command,
				"tier":      "control-plane",
			},
			Annotations: args.Annotations,
		},
		Spec: v1.PodSpec{
			Containers: []v1.Container{
				{
					Name:    args.Command,
					Image:   args.Image.Name(),
					Command: []string{args.Command},
					Args:    args.Args,
					Env: []v1.EnvVar{
						{
							Name:  "FILE_HASH",
							Value: filehash,
						},
					},
					Resources: v1.ResourceRequirements{
						Requests: v1.ResourceList{},
						Limits:   v1.ResourceList{},
					},
					LivenessProbe:   livenessProbe(args),
					ReadinessProbe:  readinessProbe(args),
					StartupProbe:    startupProbe(args),
					ImagePullPolicy: v1.PullIfNotPresent,
					SecurityContext: &v1.SecurityContext{
						Privileged: &args.Privileged,
					},
				},
			},
			HostNetwork:       true,
			PriorityClassName: "system-cluster-critical",
			SecurityContext:   args.SecurityContext,
		},
	}

if args.CPURequest != "" {
		if cpuRequest, err := resource.ParseQuantity(args.CPURequest); err != nil {
			logrus.Errorf("error parsing cpu request for static pod %s: %v", args.Command, err)
		} else {
			p.Spec.Containers[0].Resources.Requests[v1.ResourceCPU] = cpuRequest
		}
	}

if args.CPULimit != "" {
		if cpuLimit, err := resource.ParseQuantity(args.CPULimit); err != nil {
			logrus.Errorf("error parsing cpu limit for static pod %s: %v", args.Command, err)
		} else {
			p.Spec.Containers[0].Resources.Limits[v1.ResourceCPU] = cpuLimit
		}
	}

if args.MemoryRequest != "" {
		if memoryRequest, err := resource.ParseQuantity(args.MemoryRequest); err != nil {
			logrus.Errorf("error parsing memory request for static pod %s: %v", args.Command, err)
		} else {
			p.Spec.Containers[0].Resources.Requests[v1.ResourceMemory] = memoryRequest
		}
	}

if args.MemoryLimit != "" {
		if memoryLimit, err := resource.ParseQuantity(args.MemoryLimit); err != nil {
			logrus.Errorf("error parsing memory limit for static pod %s: %v", args.Command, err)
		} else {
			p.Spec.Containers[0].Resources.Limits[v1.ResourceMemory] = memoryLimit
		}
	}

for _, env := range os.Environ() {
		parts := strings.SplitN(env, "=", 2)
		if !strings.Contains(strings.ToLower(parts[0]), "proxy") {
			continue
		}
		if len(parts) == 1 {
			p.Spec.Containers[0].Env = append(p.Spec.Containers[0].Env, v1.EnvVar{
				Name: parts[0],
			})
		} else {
			p.Spec.Containers[0].Env = append(p.Spec.Containers[0].Env, v1.EnvVar{
				Name:  parts[0],
				Value: parts[1],
			})
		}
	}

addVolumes(p, args.Dirs, true)
	addVolumes(p, args.Files, false)

addExtraMounts(p, args.ExtraMounts)
	addExtraEnv(p, args.ExtraEnv)

return p, nil
}

func addVolumes(p *v1.Pod, src []string, dir bool) {
	var (
		prefix     = "dir"
		sourceType = v1.HostPathDirectoryOrCreate
		readOnly   = false
	)
	if !dir {
		prefix = "file"
		sourceType = v1.HostPathFile
		readOnly = true
	}

for i, src := range src {
		name := fmt.Sprintf("%s%d", prefix, i)
		p.Spec.Volumes = append(p.Spec.Volumes, v1.Volume{
			Name: name,
			VolumeSource: v1.VolumeSource{
				HostPath: &v1.HostPathVolumeSource{
					Path: src,
					Type: &sourceType,
				},
			},
		})
		p.Spec.Containers[0].VolumeMounts = append(p.Spec.Containers[0].VolumeMounts, v1.VolumeMount{
			Name:      name,
			ReadOnly:  readOnly,
			MountPath: src,
		})
	}
}

func addExtraMounts(p *v1.Pod, extraMounts []string) {
	var (
		sourceType = v1.HostPathDirectoryOrCreate
	)

for i, rawMount := range extraMounts {
		mount := strings.Split(rawMount, ":")
		var ro bool
		switch len(mount) {
		case 2: // In the case of 2 elements, we expect this to be a traditional source:dest volume mount and should noop.
		case 3:
			switch strings.ToLower(mount[2]) {
			case "ro":
				ro = true
			case "rw":
				ro = false
			default:
				logrus.Errorf("unknown mount option: %s encountered in extra mount %s for pod %s", mount[2], rawMount, p.Name)
				continue
			}
		default:
			logrus.Errorf("mount for pod %s %s was not valid", p.Name, rawMount)
			continue
		}

name := fmt.Sprintf("%s-%d", extraMountPrefix, i)
		p.Spec.Volumes = append(p.Spec.Volumes, v1.Volume{
			Name: name,
			VolumeSource: v1.VolumeSource{
				HostPath: &v1.HostPathVolumeSource{
					Path: mount[0],
					Type: &sourceType,
				},
			},
		})
		p.Spec.Containers[0].VolumeMounts = append(p.Spec.Containers[0].VolumeMounts, v1.VolumeMount{
			Name:      name,
			ReadOnly:  ro,
			MountPath: mount[1],
		})
	}
}

func addExtraEnv(p *v1.Pod, extraEnv []string) {
	for _, rawEnv := range extraEnv {
		env := strings.SplitN(rawEnv, "=", 2)
		if len(env) != 2 {
			logrus.Errorf("environment variable for pod %s %s was not valid", p.Name, rawEnv)
			continue
		}
		p.Spec.Containers[0].Env = append(p.Spec.Containers[0].Env, v1.EnvVar{
			Name:  env[0],
			Value: env[1],
		})
	}
}

func readFiles(args, excludeFiles []string) ([]string, error) {
	files := map[string]bool{}
	excludes := map[string]bool{}

for _, file := range excludeFiles {
		excludes[file] = true
	}

for _, arg := range args {
		parts := strings.SplitN(arg, "=", 2)
		if len(parts) == 2 && strings.HasPrefix(parts[1], string(os.PathSeparator)) {
			if stat, err := os.Stat(parts[1]); err == nil && !stat.IsDir() && !excludes[parts[1]] {
				files[parts[1]] = true

if parts[0] == "--kubeconfig" {
					certs, err := kubeconfigFiles(parts[1])
					if err != nil {
						return nil, err
					}
					for _, cert := range certs {
						files[cert] = true
					}
				}
			}
		}
	}

var result []string
	for k := range files {
		result = append(result, k)
	}
	sort.Strings(result)
	return result, nil
}

func kubeconfigFiles(kubeconfig string) ([]string, error) {
	var result []string

kc, err := clientcmd.LoadFromFile(kubeconfig)
	if err != nil {
		return nil, err
	}

for _, cluster := range kc.Clusters {
		if cluster.CertificateAuthority != "" {
			result = append(result, cluster.CertificateAuthority)
		}
	}

for _, auth := range kc.AuthInfos {
		if auth.ClientKey != "" {
			result = append(result, auth.ClientKey)
		}
		if auth.ClientCertificate != "" {
			result = append(result, auth.ClientCertificate)
		}
	}

return result, nil
}

// livenessProbe returns a Probe, using the Health values from the provided pod args,
// and the appropriate thresholds for liveness probing.
func livenessProbe(args Args) *v1.Probe {
	return createProbe(args.HealthExec, args.HealthPath, args.HealthProto, args.HealthPort, args.ProbeConfs.Liveness)
}

// readinessProbe returns a Probe, using the Ready values from the provided pod args,
// and the appropriate thresholds for readiness probing.
func readinessProbe(args Args) *v1.Probe {
	return createProbe(args.ReadyExec, args.ReadyPath, args.ReadyProto, args.ReadyPort, args.ProbeConfs.Readiness)
}

// startupProbe returns a Probe, using the Health values from the provided pod args,
// and the appropriate thresholds for startup probing.
func startupProbe(args Args) *v1.Probe {
	return createProbe(args.HealthExec, args.HealthPath, args.HealthProto, args.HealthPort, args.ProbeConfs.Startup)
}

// createProbe creates a Probe using the provided configuration.
// If command is set, an ExecAction Probe is returned.
// If command is empty but port is set, a HTTPGetAction Probe is returned.
// If neither is set, no Probe is returned.
func createProbe(command []string, path, scheme string, port int32, conf ProbeConf) *v1.Probe {
	probe := &v1.Probe{
		InitialDelaySeconds: conf.InitialDelaySeconds,
		TimeoutSeconds:      conf.TimeoutSeconds,
		FailureThreshold:    conf.FailureThreshold,
		PeriodSeconds:       conf.PeriodSeconds,
	}
	if len(command) != 0 {
		probe.Exec = &v1.ExecAction{
			Command: command,
		}
		if probe.PeriodSeconds < 5 {
			probe.PeriodSeconds = 5
		}
		return probe
	} else if port != 0 {
		probe.HTTPGet = &v1.HTTPGetAction{
			Path:   path,
			Host:   "localhost",
			Scheme: v1.URIScheme(scheme),
			Port: intstr.IntOrString{
				IntVal: port,
			},
		}
		if probe.HTTPGet.Scheme == "" {
			probe.HTTPGet.Scheme = v1.URISchemeHTTPS
		}
		if probe.HTTPGet.Path == "" {
			probe.HTTPGet.Path = "/healthz"
		}
		return probe
	}
	return nil
}
07070100000094000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001F00000000rke2-1.27.7+rke2r1/pkg/windows07070100000095000081A4000000000000000000000001653C446F00003933000000000000000000000000000000000000002900000000rke2-1.27.7+rke2r1/pkg/windows/calico.go//go:build windows
// +build windows

package windows

import (
	"context"
	"fmt"
	"os"
	"os/exec"
	"path/filepath"
	"strings"
	"text/template"
	"time"

"github.com/k3s-io/helm-controller/pkg/generated/controllers/helm.cattle.io"
	daemonconfig "github.com/k3s-io/k3s/pkg/daemons/config"
	"github.com/k3s-io/k3s/pkg/version"
	"github.com/pkg/errors"
	"github.com/sirupsen/logrus"
	opv1 "github.com/tigera/operator/api/v1"
	authv1 "k8s.io/api/authentication/v1"
	apierrors "k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/client-go/kubernetes"
	"k8s.io/client-go/rest"
	"sigs.k8s.io/yaml"

"k8s.io/utils/pointer"
)

var (
	replaceSlashWin = template.FuncMap{
		"replace": func(s string) string {
			return strings.ReplaceAll(s, "\\", "\\\\")
		},
	}

calicoKubeConfigTemplate = template.Must(template.New("CalicoKubeconfig").Parse(`apiVersion: v1
kind: Config
clusters:
- name: kubernetes
  cluster:
    certificate-authority: {{ .KubeConfig.CertificateAuthority }}
    server: {{ .KubeConfig.Server }}
contexts:
- name: calico-windows@kubernetes
  context:
    cluster: kubernetes
    namespace: kube-system
    user: calico-windows
current-context: calico-windows@kubernetes
users:
- name: calico-windows
  user:
    token: {{ .KubeConfig.Token }}
`))

// Config following definition from https://github.com/projectcalico/calico/blob/master/cni-plugin/pkg/types/types.go#L65-L131
	calicoConfigTemplate = template.Must(template.New("CalicoConfig").Funcs(replaceSlashWin).Parse(`{
  "name": "{{ .Name }}",
  "windows_use_single_network": true,
  "cniVersion": "{{ .CNI.Version }}",
  "type": "calico",
  "mode": "{{ .Mode }}",
  "vxlan_mac_prefix":  "{{ .Felix.MacPrefix }}",
  "vxlan_vni": {{ .Felix.Vxlanvni }},
  "policy": {
    "type": "k8s"
  },
  "log_level": "info",
  "capabilities": {"dns": true},
  "DNS": {
    "Nameservers": [
		"{{ .DNSServers }}"
    ],
    "Search":  [
      "svc.cluster.local"
    ]
  },
  "nodename_file": "{{ replace .NodeNameFile }}",
  "datastore_type": "{{ .DatastoreType }}",
  "etcd_endpoints": "{{ .ETCDEndpoints }}",
  "etcd_key_file": "{{ .ETCDKeyFile }}",
  "etcd_cert_file": "{{ .ETCDCertFile }}",
  "etcd_ca_cert_file": "{{ .ETCDCaCertFile }}",
  "kubernetes": {
    "kubeconfig": "{{ replace .KubeConfig.Path }}"
  },
  "ipam": {
    "type": "{{ .CNI.IpamType }}",
    "subnet": "usePodCidr"
  },
  "policies":  [
    {
      "Name":  "EndpointPolicy",
      "Value":  {
        "Type":  "OutBoundNAT",
        "ExceptionList":  [
          "{{ .ServiceCIDR }}"
        ]
      }
    },
    {
      "Name":  "EndpointPolicy",
      "Value":  {
        "Type":  "SDNROUTE",
        "DestinationPrefix":  "{{ .ServiceCIDR }}",
        {{- if eq .Mode "vxlan" }}
        "NeedEncap": true
	{{- else }}
        "NeedEncap": false
	{{- end }}
      }
    }
  ]
}
`))
)

type Calico struct {
	CNICfg  *CalicoConfig
	DataDir string
}

const (
	CalicoConfigName       = "10-calico.conf"
	CalicoKubeConfigName   = "calico.kubeconfig"
	CalicoNodeNameFileName = "calico_node_name"
	CalicoHnsNetworkName   = "External"
	CalicoSystemNamespace  = "calico-system"
	CalicoChart            = "rke2-calico"
	calicoNode             = "calico-node"
	calicoLogPath          = "C:\\var\\log\\"
)

// Setup creates the basic configuration required by the CNI.
func (c *Calico) Setup(ctx context.Context, nodeConfig *daemonconfig.Node, restConfig *rest.Config, dataDir string) error {
	c.DataDir = dataDir

if err := c.initializeConfig(ctx, nodeConfig, restConfig); err != nil {
		return err
	}

if err := c.overrideCalicoConfigByHelm(restConfig); err != nil {
		return err
	}

if err := c.writeConfigFiles(nodeConfig.AgentConfig.CNIConfDir, nodeConfig.AgentConfig.NodeName); err != nil {
		return err
	}

logrus.Info("Generating HNS networks, please wait")
	return c.generateCalicoNetworks()
}

// initializeConfig sets the default configuration in CNIConfig
func (c *Calico) initializeConfig(ctx context.Context, nodeConfig *daemonconfig.Node, restConfig *rest.Config) error {
	platformType, err := platformType()
	if err != nil {
		return err
	}

c.CNICfg = &CalicoConfig{
		Name:                  "Calico",
		OverlayNetName:        "Calico",
		Hostname:              nodeConfig.AgentConfig.NodeName,
		NodeNameFile:          filepath.Join("c:\\", c.DataDir, "agent", CalicoNodeNameFileName),
		KubeNetwork:           "Calico.*",
		Mode:                  "vxlan",
		ServiceCIDR:           nodeConfig.AgentConfig.ServiceCIDR.String(),
		DNSServers:            nodeConfig.AgentConfig.ClusterDNS.String(),
		DNSSearch:             "svc." + nodeConfig.AgentConfig.ClusterDomain,
		DatastoreType:         "kubernetes",
		Platform:              platformType,
		IP:                    nodeConfig.AgentConfig.NodeIP,
		IPAutoDetectionMethod: "first-found",
		Felix: FelixConfig{
			Metadataaddr: "none",
			Vxlanvni:     "4096",
			MacPrefix:    "0E-2A",
		},
		CNI: CalicoCNIConfig{
			BinDir:   nodeConfig.AgentConfig.CNIBinDir,
			ConfDir:  nodeConfig.AgentConfig.CNIConfDir,
			IpamType: "calico-ipam",
			Version:  "0.3.1",
		},
	}

c.CNICfg.KubeConfig, err = c.createKubeConfig(ctx, restConfig)
	if err != nil {
		return err
	}

return nil
}

// writeConfigFiles writes the three required files by Calico
func (c *Calico) writeConfigFiles(CNIConfDir string, NodeName string) error {

// Create CalicoKubeConfig and CIPAutoDetectionMethodalicoConfig files
	if err := c.renderCalicoConfig(c.CNICfg.KubeConfig.Path, calicoKubeConfigTemplate); err != nil {
		return err
	}

if err := c.renderCalicoConfig(filepath.Join(CNIConfDir, CalicoConfigName), calicoConfigTemplate); err != nil {
		return err
	}

return os.WriteFile(filepath.Join("c:\\", c.DataDir, "agent", CalicoNodeNameFileName), []byte(NodeName), 0644)
}

// renderCalicoConfig creates the file and then renders the template using Calico Config parameters
func (c *Calico) renderCalicoConfig(path string, toRender *template.Template) error {
	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
		return err
	}
	output, err := os.Create(path)
	if err != nil {
		return err
	}

defer output.Close()
	toRender.Execute(output, c.CNICfg)

return nil
}

// createCalicoKubeConfig creates all needed for Calico to contact kube-api
func (c *Calico) createKubeConfig(ctx context.Context, restConfig *rest.Config) (*CalicoKubeConfig, error) {

// Fill all information except for the token
	calicoKubeConfig := CalicoKubeConfig{
		Server:               "https://127.0.0.1:6443",
		CertificateAuthority: filepath.Join("c:\\", c.DataDir, "agent", "server-ca.crt"),
		Path:                 filepath.Join("c:\\", c.DataDir, "agent", CalicoKubeConfigName),
	}

// Generate the token request
	req := authv1.TokenRequest{
		Spec: authv1.TokenRequestSpec{
			Audiences:         []string{version.Program},
			ExpirationSeconds: pointer.Int64(60 * 60 * 24 * 365),
		},
	}

// Register the token in the Calico service account
	client, err := kubernetes.NewForConfig(restConfig)
	if err != nil {
		return nil, err
	}
	serviceAccounts := client.CoreV1().ServiceAccounts(CalicoSystemNamespace)
	token, err := serviceAccounts.CreateToken(ctx, calicoNode, &req, metav1.CreateOptions{})
	if err != nil {
		return nil, errors.Wrapf(err, "failed to create token for service account (%s/%s)", CalicoSystemNamespace, calicoNode)
	}

calicoKubeConfig.Token = token.Status.Token

return &calicoKubeConfig, nil
}

// Start starts the CNI services on the Windows node.
func (c *Calico) Start(ctx context.Context) error {
	if err := os.MkdirAll(calicoLogPath, 0755); err != nil {
		return fmt.Errorf("error creating %s directory: %v", calicoLogPath, err)
	}
	for {
		if err := startCalico(ctx, c.CNICfg); err != nil {
			time.Sleep(5 * time.Second)
			logrus.Errorf("Calico exited: %v. Retrying", err)
			continue
		}
		break
	}
	go startFelix(ctx, c.CNICfg)
	if c.CNICfg.Mode == "windows-bgp" {
		go startConfd(ctx, c.CNICfg)
	}

return nil
}

// generateCalicoNetworks creates the overlay networks for internode networking
func (c *Calico) generateCalicoNetworks() error {
	if err := deleteAllNetworks(); err != nil {
		return err
	}

// There are four ways to select the vxlan interface. In order of priority:
	// 1 - VXLAN_ADAPTER env variable
	// 2 - c.CNICfg.Interface which set if NodeAddressAutodetection is set (Calico HelmChart)
	// 3 - nodeIP if defined
	// 4 - None of the above. In that case, by default the interface with the default route is picked
	networkAdapter := os.Getenv("VXLAN_ADAPTER")
	if networkAdapter == "" {
		if c.CNICfg.Interface != "" {
			networkAdapter = c.CNICfg.Interface
		}

if c.CNICfg.Interface == "" && c.CNICfg.IP != "" {
			iFace, err := findInterface(c.CNICfg.IP)
			if err != nil {
				return err
			}
			networkAdapter = iFace
		}
	}

mgmt, err := createHnsNetwork(c.CNICfg.Mode, networkAdapter)
	if err != nil {
		return err
	}

if c.CNICfg.Platform == "ec2" || c.CNICfg.Platform == "gce" {
		logrus.Debugf("recreating metadata route because platform is: %s", c.CNICfg.Platform)
		if err := setMetaDataServerRoute(mgmt); err != nil {
			return err
		}
	}
	return nil
}

// overrideCalicoConfigByHelm overrides the default values set for calico if a Chart exists
func (c *Calico) overrideCalicoConfigByHelm(restConfig *rest.Config) error {
	hc, err := helm.NewFactoryFromConfig(restConfig)
	if err != nil {
		return err
	}

cniChartConfig, err := hc.Helm().V1().HelmChartConfig().Get(metav1.NamespaceSystem, CalicoChart, metav1.GetOptions{})
	if err != nil {
		if apierrors.IsNotFound(err) {
			return nil
		}
		return fmt.Errorf("failed to check for %s HelmChartConfig", CalicoChart)
	}
	if cniChartConfig == nil {
		logrus.Debug("no CNI related HelmChartConfig found")
		return nil
	}
	overrides := CalicoInstallation{}
	if err := yaml.Unmarshal([]byte(cniChartConfig.Spec.ValuesContent), &overrides); err != nil {
		return err
	}
	// Marshal for clean debug logs, otherwise it's all pointers
	b, err := yaml.Marshal(overrides)
	if err != nil {
		return err
	}
	logrus.Debugf("calico override found: %s\n", string(b))
	if nodeV4 := overrides.Installation.CalicoNetwork.NodeAddressAutodetectionV4; nodeV4 != nil {
		c.CNICfg.IPAutoDetectionMethod, c.CNICfg.Interface, err = findCalicoInterface(nodeV4)
		if err != nil {
			return err
		}
	}
	if bgpEnabled := overrides.Installation.CalicoNetwork.BGP; bgpEnabled != nil {
		if *bgpEnabled == opv1.BGPEnabled {
			c.CNICfg.Mode = "windows-bgp"
		}
	}
	return nil
}

func findCalicoInterface(nodeV4 *opv1.NodeAddressAutodetection) (IPAutoDetectionMethod, calicoInterface string, err error) {
	IPAutoDetectionMethod, err = nodeAddressAutodetection(*nodeV4)
	if err != nil {
		return "", "", err
	}

if strings.Contains(IPAutoDetectionMethod, "cidrs") {
		calicoInterface, err = findInterfaceCIDR(nodeV4.CIDRS)
		if err != nil {
			return "", "", err
		}
	}

if strings.Contains(IPAutoDetectionMethod, "interface") {
		calicoInterface, err = findInterfaceRegEx(nodeV4.Interface)
		if err != nil {
			return "", "", err
		}
	}
	if strings.Contains(IPAutoDetectionMethod, "can-reach") {
		calicoInterface, err = findInterfaceReach(nodeV4.CanReach)
		if err != nil {
			return "", "", err
		}
	}
	return
}

func startConfd(ctx context.Context, config *CalicoConfig) {
	outputFile, err := os.Create(calicoLogPath + "confd.log")
	if err != nil {
		logrus.Fatalf("error creating confd.log: %v", err)
		return
	}
	defer outputFile.Close()

specificEnvs := []string{
		fmt.Sprintf("PATH=%s", os.Getenv("PATH")),
	}

args := []string{
		"-confd",
		fmt.Sprintf("-confd-confdir=%s", filepath.Join(config.CNI.BinDir, "confd")),
	}

logrus.Infof("Confd Envs: %s", append(generateGeneralCalicoEnvs(config), specificEnvs...))
	cmd := exec.CommandContext(ctx, "calico-node.exe", args...)
	cmd.Env = append(generateGeneralCalicoEnvs(config), specificEnvs...)
	cmd.Stdout = outputFile
	cmd.Stderr = outputFile
	_ = os.Chdir(filepath.Join(config.CNI.BinDir, "confd"))
	_ = cmd.Run()
	logrus.Error("Confd exited")
}

func startFelix(ctx context.Context, config *CalicoConfig) {
	outputFile, err := os.Create(calicoLogPath + "felix.log")
	if err != nil {
		logrus.Fatalf("error creating felix.log: %v", err)
		return
	}
	defer outputFile.Close()

specificEnvs := []string{
		fmt.Sprintf("FELIX_FELIXHOSTNAME=%s", config.Hostname),
		fmt.Sprintf("FELIX_VXLANVNI=%s", config.Felix.Vxlanvni),
		fmt.Sprintf("FELIX_DATASTORETYPE=%s", config.DatastoreType),
	}

// Add OS variables related to Felix. As they come after, they'll overwrite the previous ones
	for _, env := range os.Environ() {
		if strings.HasPrefix(env, "FELIX_") {
			specificEnvs = append(specificEnvs, env)
		}
	}

args := []string{
		"-felix",
	}

logrus.Infof("Felix Envs: %s", append(generateGeneralCalicoEnvs(config), specificEnvs...))
	cmd := exec.CommandContext(ctx, "calico-node.exe", args...)
	cmd.Env = append(generateGeneralCalicoEnvs(config), specificEnvs...)
	cmd.Stdout = outputFile
	cmd.Stderr = outputFile
	_ = cmd.Run()
	logrus.Error("Felix exited")
}

func startCalico(ctx context.Context, config *CalicoConfig) error {
	outputFile, err := os.Create(calicoLogPath + "calico-node.log")
	if err != nil {
		return fmt.Errorf("error creating calico-node.log: %v", err)
	}
	defer outputFile.Close()
	specificEnvs := []string{
		fmt.Sprintf("CALICO_NODENAME_FILE=%s", config.NodeNameFile),
		fmt.Sprintf("CALICO_NETWORKING_BACKEND=%s", config.Mode),
		fmt.Sprintf("CALICO_DATASTORE_TYPE=%s", config.DatastoreType),
		fmt.Sprintf("IP_AUTODETECTION_METHOD=%s", config.IPAutoDetectionMethod),
		fmt.Sprintf("VXLAN_VNI=%s", config.Felix.Vxlanvni),
	}

// Add OS variables related to Calico. As they come after, they'll overwrite the previous ones
	for _, env := range os.Environ() {
		if strings.HasPrefix(env, "CALICO_") {
			specificEnvs = append(specificEnvs, env)
		}
	}

args := []string{
		"-startup",
	}
	logrus.Infof("Calico Envs: %s", append(generateGeneralCalicoEnvs(config), specificEnvs...))
	cmd := exec.CommandContext(ctx, "calico-node.exe", args...)
	cmd.Env = append(generateGeneralCalicoEnvs(config), specificEnvs...)
	cmd.Stdout = outputFile
	cmd.Stderr = outputFile
	if err := cmd.Run(); err != nil {
		return err
	}
	return nil
}

func generateGeneralCalicoEnvs(config *CalicoConfig) []string {
	return []string{
		fmt.Sprintf("KUBE_NETWORK=%s", config.KubeNetwork),
		fmt.Sprintf("KUBECONFIG=%s", config.KubeConfig.Path),
		fmt.Sprintf("NODENAME=%s", config.Hostname),
		fmt.Sprintf("CALICO_K8S_NODE_REF=%s", config.Hostname),

fmt.Sprintf("IP=%s", config.IP),
		fmt.Sprintf("USE_POD_CIDR=%t", autoConfigureIpam(config.CNI.IpamType)),
	}
}
07070100000096000081A4000000000000000000000001653C446F00000063000000000000000000000000000000000000003000000000rke2-1.27.7+rke2r1/pkg/windows/service_linux.go//go:build !windows
// +build !windows

package windows

func StartService() error {
	return nil
}
07070100000097000081A4000000000000000000000001653C446F0000095B000000000000000000000000000000000000003200000000rke2-1.27.7+rke2r1/pkg/windows/service_windows.go//go:build windows
// +build windows

package windows

import (
	"os"
	"time"

"golang.org/x/sys/windows"

"github.com/k3s-io/k3s/pkg/version"
	"github.com/pkg/errors"
	"github.com/rancher/wins/pkg/logs"
	"github.com/rancher/wins/pkg/profilings"
	"github.com/rancher/wrangler/pkg/signals"
	"github.com/sirupsen/logrus"
	"golang.org/x/sys/windows/svc"
)

type service struct{}

var Service = &service{}

func (h *service) Execute(_ []string, requests <-chan svc.ChangeRequest, statuses chan<- svc.Status) (bool, uint32) {
	statuses <- svc.Status{State: svc.StartPending}
	statuses <- svc.Status{State: svc.Running, Accepts: svc.AcceptStop | svc.AcceptShutdown}
	for c := range requests {
		switch c.Cmd {
		case svc.Cmd(windows.SERVICE_CONTROL_PARAMCHANGE):
			statuses <- c.CurrentStatus
		case svc.Interrogate:
			statuses <- c.CurrentStatus
		case svc.Stop, svc.Shutdown:
			statuses <- svc.Status{State: svc.StopPending}
			if !signals.RequestShutdown() {
				logrus.Infof("Windows Service is shutting down")
				statuses <- svc.Status{State: svc.Stopped}
				os.Exit(0)
			}

logrus.Infof("Windows Service is shutting down gracefully")
			time.Sleep(10 * time.Second) // give context time to cancel
			statuses <- svc.Status{State: svc.StopPending}
			statuses <- svc.Status{State: svc.Stopped}
			return false, 0
		}
	}
	return false, 0
}
func StartService() error {

if ok, err := svc.IsWindowsService(); err != nil || !ok {
		return err
	}

// ETW tracing
	etw, err := logs.NewEtwProviderHook(version.Program)
	if err != nil {
		return errors.Wrap(err, "could not create ETW provider logrus hook")
	}
	logrus.AddHook(etw)

el, err := logs.NewEventLogHook(version.Program)
	if err != nil {
		return errors.Wrap(err, "could not create eventlog logrus hook")
	}
	logrus.AddHook(el)

// Creates a Win32 event defined on a Global scope at stackdump-{pid} that can be signaled by
	// built-in administrators of the Windows machine or by the local system.
	// If this Win32 event (Global//stackdump-{pid}) is signaled, a goroutine launched by this call
	// will dump the current stack trace into {windowsTemporaryDirectory}/{default.WindowsServiceName}.{pid}.stack.logs
	profilings.SetupDumpStacks(version.Program, os.Getpid())

go func() {
		if err := svc.Run(version.Program, Service); err != nil {
			logrus.Fatalf("Windows Service error, exiting: %s", err)
		}
	}()

return nil
}
07070100000098000081A4000000000000000000000001653C446F0000073E000000000000000000000000000000000000002800000000rke2-1.27.7+rke2r1/pkg/windows/types.go//go:build windows
// +build windows

package windows

import (
	opv1 "github.com/tigera/operator/api/v1"
)

type FelixConfig struct {
	Metadataaddr    string
	Vxlanvni        string
	MacPrefix       string
	LogSeverityFile string
	LogSeveritySys  string
}

type CalicoCNIConfig struct {
	BinDir       string
	ConfDir      string
	IpamType     string
	ConfFileName string
	Version      string
}

type CalicoConfig struct {
	Name                  string
	OverlayNetName        string
	Mode                  string
	Hostname              string
	KubeNetwork           string
	ServiceCIDR           string
	DNSServers            string
	DNSSearch             string
	DatastoreType         string
	NodeNameFile          string
	Platform              string
	StartUpValidIPTimeout int
	IP                    string
	IPAutoDetectionMethod string
	LogDir                string
	Felix                 FelixConfig
	CNI                   CalicoCNIConfig
	ETCDEndpoints         string
	ETCDKeyFile           string
	ETCDCertFile          string
	ETCDCaCertFile        string
	KubeConfig            *CalicoKubeConfig
	Interface             string
}

type CalicoKubeConfig struct {
	CertificateAuthority string
	Server               string
	Token                string
	Path                 string
}

// Stub of Calico configuration used to extract user-provided overrides
// Based off of https://github.com/tigera/operator/blob/master/api/v1/installation_types.go
type CalicoInstallation struct {
	Installation CalicoInstallationSpec `json:"installation,omitempty"`
}

type CalicoInstallationSpec struct {
	CalicoNetwork            opv1.CalicoNetworkSpec `json:"calicoNetwork,omitempty"`
	FlexVolumePath           string                 `json:"flexVolumePath,omitempty"`
	ControlPlaneNodeSelector map[string]string      `json:"controlPlaneNodeSelector,omitempty"`
}
07070100000099000081A4000000000000000000000001653C446F00001ED0000000000000000000000000000000000000002800000000rke2-1.27.7+rke2r1/pkg/windows/utils.go//go:build windows
// +build windows

package windows

import (
	"encoding/json"
	"fmt"
	"net"
	"net/http"
	"net/url"
	"regexp"
	"strings"
	"time"

"github.com/Microsoft/hcsshim"
	wapi "github.com/iamacarpet/go-win64api"
	"github.com/libp2p/go-netroute"
	"github.com/pkg/errors"
	"github.com/sirupsen/logrus"
	opv1 "github.com/tigera/operator/api/v1"
)

// createHnsNetwork creates the network that will connect nodes and returns its managementIP
func createHnsNetwork(backend string, networkAdapter string) (string, error) {
	var network hcsshim.HNSNetwork
	if backend == "vxlan" {
		// Ignoring the return because both true and false without an error represent that the firewall rule was created or already exists
		if _, err := wapi.FirewallRuleAdd("OverlayTraffic4789UDP", "Overlay network traffic UDP", "", "4789", wapi.NET_FW_IP_PROTOCOL_UDP, wapi.NET_FW_PROFILE2_ALL); err != nil {
			return "", fmt.Errorf("error creating firewall rules: %v", err)
		}
		logrus.Infof("Creating VXLAN network using the vxlanAdapter: %s", networkAdapter)
		network = hcsshim.HNSNetwork{
			Type:               "Overlay",
			Name:               CalicoHnsNetworkName,
			NetworkAdapterName: networkAdapter,
			Subnets: []hcsshim.Subnet{
				{
					AddressPrefix:  "192.168.255.0/30",
					GatewayAddress: "192.168.255.1",
					Policies: []json.RawMessage{
						[]byte("{ \"Type\": \"VSID\", \"VSID\": 9999 }"),
					},
				},
			},
		}
	} else {
		network = hcsshim.HNSNetwork{
			Type:               "L2Bridge",
			Name:               CalicoHnsNetworkName,
			NetworkAdapterName: networkAdapter,
			Subnets: []hcsshim.Subnet{
				{
					AddressPrefix:  "192.168.255.0/30",
					GatewayAddress: "192.168.255.1",
				},
			},
		}
	}

if _, err := network.Create(); err != nil {
		return "", fmt.Errorf("error creating the %s network: %v", CalicoHnsNetworkName, err)
	}

// Check if network exists. If it does not after 5 minutes, fail
	for start := time.Now(); time.Since(start) < 5*time.Minute; {
		network, err := hcsshim.GetHNSNetworkByName(CalicoHnsNetworkName)
		if err == nil {
			return network.ManagementIP, nil
		}
	}

return "", fmt.Errorf("failed to create %s network", CalicoHnsNetworkName)
}

// nodeAddressAutodetection processes the HelmChartConfig info and returns the nodeAddressAutodetection method expected by Calico config
func nodeAddressAutodetection(autoDetect opv1.NodeAddressAutodetection) (string, error) {
	if autoDetect.FirstFound != nil && *autoDetect.FirstFound {
		return "first-found", nil
	}

if autoDetect.CanReach != "" {
		return "can-reach=" + autoDetect.CanReach, nil
	}

if autoDetect.Interface != "" {
		return "interface=" + autoDetect.Interface, nil
	}

if len(autoDetect.CIDRS) > 0 {
		return "cidrs=" + strings.Join(autoDetect.CIDRS, ","), nil
	}

return "", errors.New("the passed autoDetect value is not supported")
}

// deleteAllNetworks deletes all hns networks
func deleteAllNetworks() error {
	networks, err := hcsshim.HNSListNetworkRequest("GET", "", "")
	if err != nil {
		return err
	}

for _, network := range networks {
		if network.Name != "nat" {
			_, err = network.Delete()
			if err != nil {
				return err
			}
		}
	}

return nil
}

// platformType returns the platform where we are running
func platformType() (string, error) {
	aksNet, _ := hcsshim.GetHNSNetworkByName("azure")
	if aksNet != nil {
		return "aks", nil
	}

eksNet, _ := hcsshim.GetHNSNetworkByName("vpcbr*")
	if eksNet != nil {
		return "eks", nil
	}

// EC2
	ec2Resp, err := http.Get("http://169.254.169.254/latest/meta-data/local-hostname")
	if err != nil && hasTimedOut(err) {
		return "", err
	}
	if ec2Resp != nil {
		defer ec2Resp.Body.Close()
		if ec2Resp.StatusCode == http.StatusOK {
			return "ec2", nil
		}
	}

// GCE
	client := &http.Client{}
	req, err := http.NewRequest("GET", "http://metadata.google.internal/computeMetadata/v1/instance/hostname", nil)
	if err != nil {
		return "", err
	}
	req.Header.Add("Metadata-Flavor", "Google")
	gceResp, err := client.Do(req)
	if err != nil && hasTimedOut(err) {
		return "", err
	}
	if gceResp != nil {
		defer gceResp.Body.Close()
		if gceResp.StatusCode == http.StatusOK {
			return "gce", nil
		}
	}

return "bare-metal", nil
}

func hasTimedOut(err error) bool {
	switch err := err.(type) {
	case *url.Error:
		if err, ok := err.Err.(net.Error); ok && err.Timeout() {
			return true
		}
	case net.Error:
		if err.Timeout() {
			return true
		}
	case *net.OpError:
		if err.Timeout() {
			return true
		}
	}
	errTxt := "use of closed network connection"
	if err != nil && strings.Contains(err.Error(), errTxt) {
		return true
	}
	return false
}

func autoConfigureIpam(it string) bool {
	if it == "host-local" {
		return true
	}
	return false
}

// setMetaDataServerRoute returns the metadata server for gce and ec2
func setMetaDataServerRoute(mgmt string) error {
	ip := net.ParseIP(mgmt)
	if ip == nil {
		return fmt.Errorf("not a valid ip")
	}

metaIp := net.ParseIP("169.254.169.254/32")
	router, err := netroute.New()
	if err != nil {
		return err
	}

_, _, preferredSrc, err := router.Route(ip)
	if err != nil {
		return err
	}

_, _, _, err = router.RouteWithSrc(nil, preferredSrc, metaIp) // input not used on windows
	return err
}

// findInterfaceRegEx finds the interface that matches the regex
func findInterfaceRegEx(expression string) (string, error) {
	// We remove any whitespace character
	ifRegexes := regexp.MustCompile(`\s*,\s*`).Split(expression, -1)

// Prepare the regex expression (e.g. (eth.?)|( wlan0)|( docker*))
	includeRegexes, err := regexp.Compile("(" + strings.Join(ifRegexes, ")|(") + ")")

iFaces, err := net.Interfaces()
	if err != nil {
		fmt.Println(err)
	}
	for _, iFace := range iFaces {
		include := includeRegexes.MatchString(iFace.Name)
		if include {
			return iFace.Name, nil
		}
	}

return "", fmt.Errorf("no interface matches the set expression")
}

// findInterfaceReach finds the interface used to reach the dest
func findInterfaceReach(dest string) (string, error) {
	destUdpAddress := fmt.Sprintf("[%s]:80", dest)
	conn, err := net.Dial("udp4", destUdpAddress)
	if err != nil {
		return "", err
	}
	defer conn.Close()

localAddress := conn.LocalAddr()
	if localAddress == nil {
		return "", fmt.Errorf("no interface can route IP: %s", dest)
	}

foundIf, err := findInterface(strings.Split(localAddress.String(), ":")[0])
	if err != nil {
		return "", err
	}

return foundIf, nil
}

// findInterfaceCIDR returns the name of the interface whose IP is in the passed CIDR
func findInterfaceCIDR(cidrs []string) (string, error) {
	var foundIf string

for _, cidr := range cidrs {
		_, network, err := net.ParseCIDR(cidr)
		if err != nil {
			return "", err
		}
		interfaces, err := net.Interfaces()
		if err != nil {
			return "", err
		}

for _, i := range interfaces {
			addrs, err := i.Addrs()
			if err != nil {
				return "", err
			}
			for _, addr := range addrs {
				address := strings.Split(addr.String(), "/")[0]
				if network.Contains(net.ParseIP(address)) {
					if (foundIf != "") && (foundIf != i.Name) {
						return "", fmt.Errorf("the passed CIDRs are routed in different interfaces")
					}
					foundIf = i.Name
				}
			}
		}
	}

if foundIf == "" {
		logrus.Errorf("no interface routes cidrs: %v", cidrs)
	}

return foundIf, nil
}

// findInterface returns the name of the interface that contains the passed ip
func findInterface(ip string) (string, error) {
	iFaces, err := net.Interfaces()
	if err != nil {
		return "", err
	}

for _, iFace := range iFaces {
		addrs, err := iFace.Addrs()
		if err != nil {
			return "", err
		}
		logrus.Debugf("evaluating if the interface: %s with addresses %v, contains ip: %s", iFace.Name, addrs, ip)
		for _, addr := range addrs {
			if strings.Contains(addr.String(), ip) {
				return iFace.Name, nil
			}
		}
	}

return "", fmt.Errorf("no interface has the ip: %s", ip)
}
0707010000009A000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001B00000000rke2-1.27.7+rke2r1/scripts0707010000009B000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002200000000rke2-1.27.7+rke2r1/scripts/airgap0707010000009C000081A4000000000000000000000001653C446F000000A9000000000000000000000000000000000000003900000000rke2-1.27.7+rke2r1/scripts/airgap/dnsNodeCache-test.yamlapiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: rke2-coredns
  namespace: kube-system
spec:
  valuesContent: |-
    nodelocal:
      enabled: true
0707010000009D000081A4000000000000000000000001653C446F0000013B000000000000000000000000000000000000003900000000rke2-1.27.7+rke2r1/scripts/airgap/loadbalancer-test.yamlapiVersion: v1
kind: Service
metadata:
  name: lb-test
  namespace: kube-system
spec:
  type: LoadBalancer
  selector:
    app.kubernetes.io/name: rke2-ingress-nginx
  ports:
  - name: http
    protocol: TCP
    port: 8080
    targetPort: http
  - name: https
    protocol: TCP
    port: 8443
    targetPort: https
0707010000009E000081ED000000000000000000000001653C446F00000154000000000000000000000000000000000000002100000000rke2-1.27.7+rke2r1/scripts/build#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh
mkdir -p build/images

./scripts/build-binary
./scripts/build-windows-binary
./scripts/build-images
./scripts/build-windows-images
./scripts/package-bundle
./scripts/package-windows-bundle
./scripts/dev-runtime-image
./scripts/dev-rpm
./scripts/build-image-test
0707010000009F000081ED000000000000000000000001653C446F00000ABA000000000000000000000000000000000000002800000000rke2-1.27.7+rke2r1/scripts/build-binary#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

if [ -z "${GODEBUG}" ]; then
    EXTRA_LDFLAGS="${EXTRA_LDFLAGS} -w"
    DEBUG_GO_GCFLAGS=""
    DEBUG_TAGS=""
else
    DEBUG_GO_GCFLAGS='-gcflags=all=-N -l'
fi

REVISION=$(git rev-parse HEAD)$(if ! git diff --no-ext-diff --quiet --exit-code; then echo .dirty; fi)
RELEASE=${PROG}.${GOOS}-${GOARCH}

BUILDTAGS="selinux netgo osusergo no_stage static_build sqlite_omit_load_extension no_embedded_executor no_cri_dockerd"
GO_BUILDTAGS="${GO_BUILDTAGS} ${BUILDTAGS} ${DEBUG_TAGS}"

VERSION_FLAGS="
    -X ${K3S_PKG}/pkg/version.GitCommit=${REVISION}
    -X ${K3S_PKG}/pkg/version.Program=${PROG}
    -X ${K3S_PKG}/pkg/version.Version=${VERSION}
    -X ${RKE2_PKG}/pkg/images.DefaultRegistry=${REGISTRY}
    -X ${RKE2_PKG}/pkg/images.DefaultEtcdImage=rancher/hardened-etcd:${ETCD_VERSION}-build20230802
    -X ${RKE2_PKG}/pkg/images.DefaultKubernetesImage=rancher/hardened-kubernetes:${KUBERNETES_IMAGE_TAG}
    -X ${RKE2_PKG}/pkg/images.DefaultPauseImage=rancher/mirrored-pause:${PAUSE_VERSION}
    -X ${RKE2_PKG}/pkg/images.DefaultRuntimeImage=${REPO}/${PROG}-runtime:${DOCKERIZED_VERSION}
    -X ${RKE2_PKG}/pkg/images.DefaultCloudControllerManagerImage=rancher/rke2-cloud-provider:${CCM_VERSION}
"

#STATIC_FLAGS='-extldflags "-static -Wl,--fatal-warnings"'
### ON GLIBC SYSTEMS YOU WILL SEE LINKER WARNINGS #####################################################################
# github.com/rancher/rke2
#/usr/bin/ld: /tmp/go-link-743463534/000027.o: in function `nvmlInit_dl':
#/home/jacob/go/pkg/mod/github.com/mindprince/gonvml@v0.0.0-20190828220739-9ebdce4bb989/bindings.go:152: warning: Using 'dlopen' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
### THESE CAN BE SAFELY IGNORED UNLESS YOU ARE TRYING TO LEVERAGE NVIDIA METRICS FROM CADVISOR AND YOU HAPPEN TO BE ###
### RUNNING RKE2 ON A SYSTEM OTHER THAN THE ONE WHICH IS WAS BUILT THAT ALSO HAS AN INCOMPATIBLE GLIBC ################
STATIC_FLAGS='-extldflags "-static"'

GO_LDFLAGS="${STATIC_FLAGS} ${EXTRA_LDFLAGS}"
echo ${DEBUG_GO_GCFLAGS}

# passing boringcrypto to GOEXPERIMENT variable to build with goboring library
GOEXPERIMENT=boringcrypto go build \
    -tags "${GO_BUILDTAGS}" \
    ${GO_GCFLAGS} ${GO_BUILD_FLAGS} \
    -o bin/${PROG} \
    -ldflags "${GO_LDFLAGS} ${VERSION_FLAGS}" \
    ${GO_TAGS}

# assert that rke2 is fully statically linked
if type -a go-assert-static.sh >/dev/null 2>&1; then
    go-assert-static.sh bin/${PROG}
fi

if [ "${GOARCH}" = "amd64" ]; then
    # assert that rke2 is linked to goboring
    if type -a go-assert-boring.sh >/dev/null 2>&1; then
        go-assert-boring.sh bin/${PROG}
    fi
fi
070701000000A0000081ED000000000000000000000001653C446F000004E6000000000000000000000000000000000000002F00000000rke2-1.27.7+rke2r1/scripts/build-image-runtime#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

DOCKER_BUILDKIT=${DOCKER_BUILDKIT:-1} docker image build \
    --build-arg TAG=${VERSION} \
    --build-arg KUBERNETES_VERSION=${KUBERNETES_VERSION} \
    --build-arg MAJOR=${VERSION_MAJOR} \
    --build-arg MINOR=${VERSION_MINOR} \
    --build-arg DAPPER_HOST_ARCH=${GOARCH} \
    --build-arg CACHEBUST="$(date +%s%N)" \
    --tag ${REPO}/${PROG}-runtime:${DOCKERIZED_VERSION} \
    --tag ${REPO}/${PROG}-runtime:${DOCKERIZED_VERSION}-${GOOS}-${GOARCH} \
    --target runtime \
    --file Dockerfile \
    .

if [ "${GOARCH}" != "s390x" ] && [ "${GOARCH}" != "arm64" ]; then
  DOCKER_BUILDKIT=${DOCKER_BUILDKIT:-1} docker image build \
      --build-arg TAG=${VERSION} \
      --build-arg KUBERNETES_VERSION=${KUBERNETES_VERSION} \
      --build-arg MAJOR=${VERSION_MAJOR} \
      --build-arg MINOR=${VERSION_MINOR} \
      --build-arg CACHEBUST="$(date +%s%N)" \
      --tag ${REPO}/${PROG}-runtime:${DOCKERIZED_VERSION}-windows-amd64 \
      --target windows-runtime \
      --file Dockerfile.windows \
      .
fi
mkdir -p build/images
docker image save \
    --output build/images/${PROG}-runtime.tar \
    ${REPO}/${PROG}-runtime:${DOCKERIZED_VERSION}-${GOOS}-${GOARCH}
070701000000A1000081ED000000000000000000000001653C446F000001F1000000000000000000000000000000000000002C00000000rke2-1.27.7+rke2r1/scripts/build-image-test#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

if [ "${GOARCH}" == "s390x" ] || [ "${GOARCH}" == "arm64" ]; then
    exit 0
fi

DOCKER_BUILDKIT=${DOCKER_BUILDKIT:-1} docker image build \
    --build-arg TAG=${VERSION} \
    --build-arg KUBERNETES_VERSION=${KUBERNETES_VERSION} \
    --build-arg CACHEBUST="$(date +%s%N)" \
    --tag ${REPO}/${PROG}-test:${DOCKERIZED_VERSION} \
    --tag ${REPO}/${PROG}-test:${DOCKERIZED_VERSION}-${GOARCH} \
    --target test \
.
070701000000A2000081ED000000000000000000000001653C446F000013F0000000000000000000000000000000000000002800000000rke2-1.27.7+rke2r1/scripts/build-images#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

./scripts/build-image-runtime

awk '{print $1}' << EOF > build/images-core.txt
    ${REGISTRY}/${REPO}/${PROG}-runtime:${DOCKERIZED_VERSION}
EOF

xargs -n1 -t docker image pull --quiet << EOF >> build/images-core.txt
    ${REGISTRY}/rancher/hardened-kubernetes:${KUBERNETES_IMAGE_TAG}
    ${REGISTRY}/rancher/hardened-coredns:v1.10.1-build20230607
    ${REGISTRY}/rancher/hardened-cluster-autoscaler:v1.8.6-build20230609
    ${REGISTRY}/rancher/hardened-dns-node-cache:1.22.20-build20230607
    ${REGISTRY}/rancher/hardened-etcd:${ETCD_VERSION}-build20230802
    ${REGISTRY}/rancher/hardened-k8s-metrics-server:v0.6.3-build20230607
    ${REGISTRY}/rancher/klipper-helm:v0.8.2-build20230815
    ${REGISTRY}/rancher/klipper-lb:v0.4.4
    ${REGISTRY}/rancher/mirrored-pause:${PAUSE_VERSION}
    ${REGISTRY}/rancher/mirrored-ingress-nginx-kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794
    ${REGISTRY}/rancher/nginx-ingress-controller:nginx-1.9.3-hardened1
    ${REGISTRY}/rancher/rke2-cloud-provider:${CCM_VERSION}
    ${REGISTRY}/rancher/mirrored-sig-storage-snapshot-controller:v6.2.1
    ${REGISTRY}/rancher/mirrored-sig-storage-snapshot-validation-webhook:v6.2.2
EOF

xargs -n1 -t docker image pull --quiet << EOF > build/images-canal.txt
    ${REGISTRY}/rancher/hardened-calico:v3.26.1-build20230802
    ${REGISTRY}/rancher/hardened-flannel:v0.22.1-build20230802
EOF

if [ "${GOARCH}" != "s390x" ] && [ "${GOARCH}" != "arm64" ]; then
xargs -n1 -t docker image pull --quiet << EOF > build/images-cilium.txt
    ${REGISTRY}/rancher/mirrored-cilium-certgen:v0.1.9
    ${REGISTRY}/rancher/mirrored-cilium-cilium:v1.14.2
    ${REGISTRY}/rancher/mirrored-cilium-cilium-envoy:v1.25.9-e198a2824d309024cb91fb6a984445e73033291d
    ${REGISTRY}/rancher/mirrored-cilium-cilium-etcd-operator:v2.0.7
    ${REGISTRY}/rancher/mirrored-cilium-clustermesh-apiserver:v1.14.2
    ${REGISTRY}/rancher/mirrored-cilium-hubble-relay:v1.14.2
    ${REGISTRY}/rancher/mirrored-cilium-hubble-ui:v0.12.0
    ${REGISTRY}/rancher/mirrored-cilium-hubble-ui-backend:v0.12.0
    ${REGISTRY}/rancher/mirrored-cilium-kvstoremesh:v1.14.2
    ${REGISTRY}/rancher/mirrored-cilium-operator-aws:v1.14.2
    ${REGISTRY}/rancher/mirrored-cilium-operator-azure:v1.14.2
    ${REGISTRY}/rancher/mirrored-cilium-operator-generic:v1.14.2
    ${REGISTRY}/rancher/hardened-cni-plugins:v1.2.0-build20230523
EOF

xargs -n1 -t docker image pull --quiet << EOF > build/images-calico.txt
    ${REGISTRY}/rancher/mirrored-calico-operator:v1.30.4
    ${REGISTRY}/rancher/mirrored-calico-ctl:v3.26.1
    ${REGISTRY}/rancher/mirrored-calico-kube-controllers:v3.26.1
    ${REGISTRY}/rancher/mirrored-calico-typha:v3.26.1
    ${REGISTRY}/rancher/mirrored-calico-node:v3.26.1
    ${REGISTRY}/rancher/mirrored-calico-pod2daemon-flexvol:v3.26.1
    ${REGISTRY}/rancher/mirrored-calico-cni:v3.26.1
    ${REGISTRY}/rancher/mirrored-calico-apiserver:v3.26.1
EOF

xargs -n1 -t docker image pull --quiet << EOF > build/images-vsphere.txt
    ${REGISTRY}/rancher/mirrored-cloud-provider-vsphere-cpi-release-manager:v1.26.1
    ${REGISTRY}/rancher/mirrored-cloud-provider-vsphere-csi-release-driver:v3.0.1
    ${REGISTRY}/rancher/mirrored-cloud-provider-vsphere-csi-release-syncer:v3.0.1
    ${REGISTRY}/rancher/mirrored-sig-storage-csi-node-driver-registrar:v2.7.0
    ${REGISTRY}/rancher/mirrored-sig-storage-csi-resizer:v1.7.0
    ${REGISTRY}/rancher/mirrored-sig-storage-livenessprobe:v2.9.0
    ${REGISTRY}/rancher/mirrored-sig-storage-csi-attacher:v4.2.0
    ${REGISTRY}/rancher/mirrored-sig-storage-csi-provisioner:v3.4.0
EOF

xargs -n1 -t docker image pull --quiet << EOF > build/images-multus.txt
    ${REGISTRY}/rancher/hardened-multus-cni:v4.0.2-build20230811
    ${REGISTRY}/rancher/hardened-cni-plugins:v1.2.0-build20230523
    ${REGISTRY}/rancher/hardened-sriov-network-operator:v1.2.0-build20230607
    ${REGISTRY}/rancher/hardened-sriov-network-config-daemon:v1.2.0-build20230607
    ${REGISTRY}/rancher/hardened-sriov-network-device-plugin:v3.5.1-build20230607
    ${REGISTRY}/rancher/hardened-sriov-cni:v2.6.3-build20230607
    ${REGISTRY}/rancher/hardened-ib-sriov-cni:v1.0.2-build20230607
    ${REGISTRY}/rancher/hardened-sriov-network-resources-injector:v1.5-build20230607
    ${REGISTRY}/rancher/hardened-sriov-network-webhook:v1.2.0-build20230607
    ${REGISTRY}/rancher/hardened-whereabouts:v0.6.2-build20230717
EOF

xargs -n1 -t docker image pull --quiet << EOF > build/images-harvester.txt
    ${REGISTRY}/rancher/harvester-cloud-provider:v0.2.0
    ${REGISTRY}/rancher/mirrored-kube-vip-kube-vip-iptables:v0.6.0
    ${REGISTRY}/rancher/harvester-csi-driver:v0.1.5
    ${REGISTRY}/rancher/longhornio-csi-node-driver-registrar:v2.3.0
    ${REGISTRY}/rancher/longhornio-csi-resizer:v1.2.0
    ${REGISTRY}/rancher/longhornio-csi-provisioner:v2.1.2
    ${REGISTRY}/rancher/longhornio-csi-attacher:v3.2.1
EOF
fi
# Continue to provide a legacy airgap archive set with the default CNI images
cat build/images-core.txt build/images-canal.txt > build/images.txt
070701000000A3000081ED000000000000000000000001653C446F00000504000000000000000000000000000000000000002800000000rke2-1.27.7+rke2r1/scripts/build-upload#!/bin/bash
set -ex

[ -n "$AWS_ACCESS_KEY_ID" ] || {
  echo "AWS_ACCESS_KEY_ID is not set"
  exit 0
}

[ -n "$AWS_SECRET_ACCESS_KEY" ] || {
  echo "AWS_SECRET_ACCESS_KEY is not set"
  exit 0
}

[[ $1 =~ rke2\.(linux|windows)-.+\.tar\.gz ]] || {
  echo "First argument should be a dist bundle tarball" >&2
  exit 1
}

[[ $2 =~ rke2-images\..+\.tar\.zst ]] || {
  echo "Second argument should be a compressed airgap runtime image tarball" >&2
  exit 1
}

[ -n "$3" ] || {
  echo "Third argument should be a commit hash" >&2
  exit 1
}

umask 077

TMPDIR=$(mktemp -d)
cleanup() {
  exit_code=$?
  trap - EXIT INT
  rm -rf ${TMPDIR}
  exit ${exit_code}
}
trap cleanup EXIT INT

BUNDLE_NAME=$(basename $1 .tar.gz)-$3.tar.gz
(cd $(dirname $1) && sha256sum $(basename $1)) >${TMPDIR}/${BUNDLE_NAME}.sha256sum
cp $1 ${TMPDIR}/${BUNDLE_NAME}

TARBALL_NAME=$(basename $2 .tar.zst)-$3.tar.zst
(cd $(dirname $2) && sha256sum $(basename $2)) >${TMPDIR}/${TARBALL_NAME}.sha256sum
cp $2 ${TMPDIR}/${TARBALL_NAME}

for FILE in ${TMPDIR}/${BUNDLE_NAME}*; do
  aws s3 cp ${FILE} s3://rke2-ci-builds || exit 1
done

for FILE in ${TMPDIR}/${TARBALL_NAME}*; do
  aws s3 cp ${FILE} s3://rke2-ci-builds || exit 1
done
echo "Build uploaded" >&2
echo "https://rke2-ci-builds.s3.amazonaws.com/${BUNDLE_NAME}"
070701000000A4000081ED000000000000000000000001653C446F0000063B000000000000000000000000000000000000003000000000rke2-1.27.7+rke2r1/scripts/build-windows-binary#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

if [ "${GOARCH}" == "s390x" ] || [ "${GOARCH}" == "arm64" ]; then
    exit 0
fi

if [ -z "${GODEBUG}" ]; then
    EXTRA_LDFLAGS="${EXTRA_LDFLAGS} -w"
    DEBUG_GO_GCFLAGS=""
    DEBUG_TAGS=""
else
    DEBUG_GO_GCFLAGS='-gcflags=all=-N -l'
fi

REVISION=$(git rev-parse HEAD)$(if ! git diff --no-ext-diff --quiet --exit-code; then echo .dirty; fi)
GOOS=windows
RELEASE=${PROG}.${GOOS}-${GOARCH}

BUILDTAGS="netgo osusergo no_stage static_build sqlite_omit_load_extension no_cri_dockerd"
GO_BUILDTAGS="${GO_BUILDTAGS} ${BUILDTAGS} ${DEBUG_TAGS}"

VERSION_FLAGS="
    -X ${K3S_PKG}/pkg/version.GitCommit=${REVISION}
    -X ${K3S_PKG}/pkg/version.Program=${PROG}
    -X ${K3S_PKG}/pkg/version.Version=${VERSION}
    -X ${RKE2_PKG}/pkg/images.DefaultRegistry=${REGISTRY}
    -X ${RKE2_PKG}/pkg/images.DefaultEtcdImage=rancher/hardened-etcd:${ETCD_VERSION}-build20230802
    -X ${RKE2_PKG}/pkg/images.DefaultKubernetesImage=${REPO}/hardened-kubernetes:${KUBERNETES_IMAGE_TAG}
    -X ${RKE2_PKG}/pkg/images.DefaultPauseImage=rancher/pause:${PAUSE_VERSION}
    -X ${RKE2_PKG}/pkg/images.DefaultRuntimeImage=${REPO}/${PROG}-runtime:${DOCKERIZED_VERSION}-${GOOS}-${GOARCH}
"

GO_LDFLAGS="${STATIC_FLAGS} ${EXTRA_LDFLAGS}"
echo ${DEBUG_GO_GCFLAGS}
GOOS=windows \
    CGO_ENABLED=1 CXX=x86_64-w64-mingw32-g++ CC=x86_64-w64-mingw32-gcc \
    go build \
        -tags "${GO_BUILDTAGS}" \
        ${GO_GCFLAGS} ${GO_BUILD_FLAGS} \
        -o bin/${PROG}.exe \
        -ldflags "${GO_LDFLAGS} ${VERSION_FLAGS}" \
        ${GO_TAGS}
070701000000A5000081ED000000000000000000000001653C446F000001E0000000000000000000000000000000000000003000000000rke2-1.27.7+rke2r1/scripts/build-windows-images#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

if [ "${GOARCH}" == "s390x" ] || [ "${GOARCH}" == "arm64" ]; then
    exit 0
fi

mkdir -p build

WINDOWS_IMAGES=(${REGISTRY}/${REPO}/${PROG}-runtime:${DOCKERIZED_VERSION}-windows-amd64 rancher/mirrored-pause:${PAUSE_VERSION}-windows-1809-amd64 rancher/mirrored-pause:${PAUSE_VERSION}-windows-ltsc2022-amd64)
for IMAGE in "${WINDOWS_IMAGES[@]}"; do
    echo "${IMAGE}" >> build/windows-images.txt
done
070701000000A6000081ED000000000000000000000001653C446F00000040000000000000000000000000000000000000002100000000rke2-1.27.7+rke2r1/scripts/clean#!/usr/bin/env bash

cd $(dirname $0)/..

rm -rf bin dist build
070701000000A7000081ED000000000000000000000001653C446F00000092000000000000000000000000000000000000002700000000rke2-1.27.7+rke2r1/scripts/clean-cache#!/usr/bin/env bash

cd $(dirname $0)/..

source ./scripts/version.sh

docker rm -fv ${PROG}-dev-shell
docker volume rm ${PROG}-cache ${PROG}-pkg
070701000000A8000081ED000000000000000000000001653C446F000001FC000000000000000000000000000000000000002400000000rke2-1.27.7+rke2r1/scripts/dev-peer#!/usr/bin/env bash
set -ex

PEER=${PEER:-1}

cd $(dirname $0)/..

. ./scripts/version.sh

docker run --rm --link \
    ${PROG}-dev-shell:${PROG}-server \
    --name ${PROG}-peer${PEER} \
    --hostname ${PROG}-peer${PEER} \
    -p 127.0.0.1:234${PEER}:2345 \
    -ti -e WORKSPACE=$(pwd) \
    -v ${HOME}:${HOME} \
    -v ${PROG} -w $(pwd) \
    -v ${PWD}/build/images:/var/lib/rancher/rke2/agent/images \
    --privileged -v ${PROG}-pkg:/go/pkg \
    -v ${PROG}-cache:/root/.cache/go-build ${PROG}-dev bash
070701000000A9000081ED000000000000000000000001653C446F00000084000000000000000000000000000000000000002A00000000rke2-1.27.7+rke2r1/scripts/dev-peer-enter#!/usr/bin/env bash
set -ex

PEER=${PEER:-1}

cd $(dirname $0)/..

. ./scripts/version.sh

docker exec -it ${PROG}-peer${PEER} bash
070701000000AA000081ED000000000000000000000001653C446F000000F8000000000000000000000000000000000000002300000000rke2-1.27.7+rke2r1/scripts/dev-rpm#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

if [ "${GOARCH}" != "amd64" ]; then
    exit 0
fi

if [ -z "${SKIP_DEV_RPM}" ] && [ -z "${DRONE_TAG}" ]; then
    scripts/package-dev-rpm
    scripts/publish-dev-rpm
fi
070701000000AB000081ED000000000000000000000001653C446F00000310000000000000000000000000000000000000002D00000000rke2-1.27.7+rke2r1/scripts/dev-runtime-image#!/bin/bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

if [ "${GOARCH}" == "s390x" ] || [ "${GOARCH}" == "arm64" ]; then
    exit 0
fi

docker image save \
    ${REGISTRY}/${REPO}/${PROG}-runtime:${DOCKERIZED_VERSION} | \
    zstd -T0 -16 -f --long=25 --no-progress - -o build/images/${PROG}-images.${PLATFORM}.tar.zst
./scripts/build-upload dist/artifacts/${RELEASE}.tar.gz build/images/${PROG}-images.${PLATFORM}.tar.zst ${COMMIT}

docker image save \
    ${REGISTRY}/${REPO}/${PROG}-runtime:${DOCKERIZED_VERSION}-windows-${ARCH} | \
    zstd -T0 -16 -f --long=25 --no-progress - -o build/images/${PROG}-images.windows-${ARCH}.tar.zst
./scripts/build-upload dist/artifacts/${PROG}.windows-${ARCH}.tar.gz build/images/${PROG}-images.windows-${ARCH}.tar.zst ${COMMIT}
070701000000AC000081ED000000000000000000000001653C446F000002BD000000000000000000000000000000000000002500000000rke2-1.27.7+rke2r1/scripts/dev-shell#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

set -- docker container run \
    --env WORKSPACE=${PWD} \
    --hostname ${PROG}-server \
    --interactive \
    --name ${PROG}-dev-shell \
    --privileged \
    --publish ":2345:2345" \
    --rm \
    --tty \
    --volume "${HOME}:${HOME}:ro" \
    --volume "${PROG}-pkg:/go/pkg" \
    --volume "${PROG}-cache:/root/.cache/go-build" \
    --volume "${PWD}:${PWD}" \
    --volume "/run/k3s" \
    --volume "/var/lib/rancher/rke2" \
    --workdir "${PWD}"

if [ -z "${SKIP_PRELOAD_IMAGE}" ]; then
    set -- "${@}" "--volume" "${PWD}/build/images:/var/lib/rancher/rke2/agent/images"
fi

exec "${@}" "${PROG}-dev" "bash"
070701000000AD000081ED000000000000000000000001653C446F00000100000000000000000000000000000000000000002B00000000rke2-1.27.7+rke2r1/scripts/dev-shell-build#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

if [ ! -d build/images ]; then
  ./scripts/build-images
fi

# build the dev shell image
DOCKER_BUILDKIT=${DOCKER_BUILDKIT:-1} docker image build -t ${PROG}-dev --target shell .
070701000000AE000081ED000000000000000000000001653C446F00000076000000000000000000000000000000000000002B00000000rke2-1.27.7+rke2r1/scripts/dev-shell-enter#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

docker exec -it ${PROG}-dev-shell bash
070701000000AF000081ED000000000000000000000001653C446F0000034B000000000000000000000000000000000000002400000000rke2-1.27.7+rke2r1/scripts/dispatch#!/usr/bin/env bash
set -ex

REPO="https://api.github.com/repos/rancher/rke2-upgrade/dispatches"

# send dispatch event to REPO
curl -XPOST -u "${PAT_USERNAME}:${PAT_TOKEN}" \
        -H "Accept: application/vnd.github.everest-preview+json"  \
        -H "Content-Type: application/json" $REPO \
        --data '{"event_type": "create_tag", "client_payload": {"tag":"'"$DRONE_TAG"'"}}'

SYSTEM_AGENT_INSTALLER_RKE2_REPO="https://api.github.com/repos/rancher/system-agent-installer-rke2/dispatches"

# send dispatch event to SYSTEM_AGENT_INSTALLER_RKE2_REPO
curl -XPOST -u "${PAT_USERNAME}:${PAT_TOKEN}" \
        -H "Accept: application/vnd.github.everest-preview+json"  \
        -H "Content-Type: application/json" $SYSTEM_AGENT_INSTALLER_RKE2_REPO \
        --data '{"event_type": "create_tag", "client_payload": {"tag":"'"$DRONE_TAG"'"}}'
070701000000B0000081ED000000000000000000000001653C446F000002D6000000000000000000000000000000000000002600000000rke2-1.27.7+rke2r1/scripts/log-upload#!/bin/bash

[ -n "$AWS_ACCESS_KEY_ID" ] || {
  echo "AWS_ACCESS_KEY_ID is not set"
  exit 0
}

[ -n "$AWS_SECRET_ACCESS_KEY" ] || {
  echo "AWS_SECRET_ACCESS_KEY is not set"
  exit 0
}

[ -d "$1" ] || {
  echo "First argument should be a directory" >&2
  exit 1
}

umask 077

GO=${GO-go}

TMPDIR=$(mktemp -d)
cleanup() {
  exit_code=$?
  trap - EXIT INT
  rm -rf ${TMPDIR}
  exit ${exit_code}
}
trap cleanup EXIT INT

LOG_TGZ=rke2-log-$(date +%s)-$("${GO}" env GOARCH)-$(git rev-parse --short HEAD)-$(basename $1).tgz

tar -cz -f ${TMPDIR}/${LOG_TGZ} -C $(dirname $1) $(basename $1)
aws s3 cp ${TMPDIR}/${LOG_TGZ} s3://rke2-ci-logs || exit 1
echo "Logs uploaded" >&2
echo "https://rke2-ci-logs.s3.amazonaws.com/${LOG_TGZ}"

070701000000B1000081ED000000000000000000000001653C446F000000E5000000000000000000000000000000000000002300000000rke2-1.27.7+rke2r1/scripts/package#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

mkdir -p dist/{artifacts,bundle}

./scripts/package-binary
./scripts/package-windows-binary
./scripts/package-bundle
./scripts/package-windows-bundle
070701000000B2000081ED000000000000000000000001653C446F00000099000000000000000000000000000000000000002A00000000rke2-1.27.7+rke2r1/scripts/package-binary#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

mkdir -p dist/artifacts

install -s bin/${PROG} dist/artifacts/${RELEASE}
070701000000B3000081ED000000000000000000000001653C446F00000261000000000000000000000000000000000000002A00000000rke2-1.27.7+rke2r1/scripts/package-bundle#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

mkdir -p dist/bundle/share/${PROG}

### bundle underlay
rsync -a bundle/ dist/bundle/

### bin/rke2
install -s bin/${PROG} dist/bundle/bin/

### share/rke2/LICENSE
cp -vf LICENSE dist/bundle/share/${PROG}/LICENSE.txt

### (setup directory)
mkdir -p dist/artifacts

### (make the tarball)
if [ -z "${PACKAGE_SKIP_TARBALL}" ]; then
  tar -czf dist/artifacts/${RELEASE}.tar.gz -C dist/bundle --exclude share/rke2-windows --exclude '*.exe' --exclude '*.ps*' $(find dist/bundle -mindepth 1 -maxdepth 1 -type d -exec basename {} \;)
fi
070701000000B4000081ED000000000000000000000001653C446F000008BD000000000000000000000000000000000000002B00000000rke2-1.27.7+rke2r1/scripts/package-dev-rpm#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

export COMMIT
export DAPPER_SOURCE=${DAPPER_SOURCE:-$(realpath -q .)}
export COMBARCH='x86_64-amd64'

RPM_VERSION="${VERSION}.testing.0"

TMPDIR=$(mktemp -d -t)
SCRIPT_LIST=$(mktemp "${TMPDIR}/XXXXXX")
cleanup() {
    exit_code=$?
    trap - EXIT INT
    rm -rf "${TMPDIR}"
    git tag -d "${RPM_VERSION}" || true
    exit ${exit_code}
}
trap cleanup EXIT INT

curl -L https://github.com/rancher/rke2-packaging/archive/master.tar.gz | tar --strip-components=1 -xzC "${TMPDIR}"

export SRC_PATH="${TMPDIR}/source"
DIST_PATH=$(realpath -mq ./dist/rpms)
USER=$(whoami)

[ -d "${DIST_PATH}" ] || mkdir "${DIST_PATH}"
[ -d "${SRC_PATH}" ] || mkdir "${SRC_PATH}"
cp ./dist/artifacts/* "${SRC_PATH}"

# Mock spectool, not needed for local builds
mkdir "${TMPDIR}/bin"
echo 'exit 0' > "${TMPDIR}/bin/spectool"
chmod +x "${TMPDIR}/bin/spectool"
cp "${TMPDIR}/bin/spectool" "${TMPDIR}/bin/rpmdev-spectool"
export PATH="${TMPDIR}/bin:${PATH}"

# Set rpmmacros that differ in Alpine from RHEL distributions
echo "%_topdir ${HOME}/rpmbuild" > ~/.rpmmacros
echo "%_sharedstatedir /var/lib" >> ~/.rpmmacros
echo "%_localstatedir /var" >> ~/.rpmmacros

# Set rpm version as lightweight tag
git tag "${RPM_VERSION}"

find -L "${TMPDIR}" -name 'build-*' -print >"${SCRIPT_LIST}"
while IFS= read -r script; do
    if [ "${USER}" != 'root' ]; then
        # Use /home/$USER instead of /root when running outside of dapper
        sed -i -e "s%/root%${HOME}%g" "${script}"
    fi

# Modify rpmbuild flags
    #   --nodeps  do not check for build dependencies, systemd-rpm-macros should suffice
    #   -bb       do not build src packages, not needed for commit rpms
    sed -i  -e 's/^rpmbuild/rpmbuild --nodeps/' \
        -e '/^rpmbuild/,/.spec$/{s/-ba/-bb/}' -e '/rpmbuild\/SRPMS\/\*/d' \
        "${script}"

# Replace hardcoded paths and remove inline rpm macros
    sed -i  -e "s%/source%${TMPDIR}%g" -e "s%${TMPDIR}/dist%$DIST_PATH%g" -e '/SRC_PATH=/d' \
        -e '/rpmmacros/d' \
        "${script}"

# Build rpm
    bash "${script}"
done <"${SCRIPT_LIST}"

if [ "${DAPPER_UID:--1}" -ne "-1" ]; then
    chown -R "$DAPPER_UID:$DAPPER_GID" "${DIST_PATH}"
fi
070701000000B5000081ED000000000000000000000001653C446F000004A9000000000000000000000000000000000000002A00000000rke2-1.27.7+rke2r1/scripts/package-images#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

mkdir -p dist/artifacts

# We reorder the tar file so that the metadata files are at the start of the archive, which should make loading
# the runtime image faster. By default `docker image save` puts these at the end of the archive, which means the entire
# tarball needs to be read even if you're just loading a single image.
for FILE in build/images*.txt; do
    BASE=$(basename ${FILE} .txt)
    DEST=build/images/${PROG}-${BASE}.tar
    docker image save --output ${DEST}.tmp $(<${FILE})
    bsdtar -c -f ${DEST} --include=manifest.json --include=repositories @${DEST}.tmp
    bsdtar -r -f ${DEST} --exclude=manifest.json --exclude=repositories @${DEST}.tmp
    rm -f ${DEST}.tmp

BASE=$(basename ${FILE} .txt)
    TARFILE=build/images/${PROG}-${BASE}.tar
    cp -f ${FILE} dist/artifacts/${PROG}-${BASE}.${PLATFORM}.txt
    zstd -T0 -16 -f --long=25 --no-progress ${TARFILE} -o dist/artifacts/${PROG}-${BASE}.${PLATFORM}.tar.zst
    pigz -v -c ${TARFILE} > dist/artifacts/${PROG}-${BASE}.${PLATFORM}.tar.gz
done

cat build/images*.txt | sort -V | uniq > dist/artifacts/${PROG}-images-all.${PLATFORM}.txt
070701000000B6000081ED000000000000000000000001653C446F000000FD000000000000000000000000000000000000003200000000rke2-1.27.7+rke2r1/scripts/package-windows-binary#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

if [ "${GOARCH}" == "s390x" ] || [ "${GOARCH}" == "arm64" ]; then
    exit 0
fi

mkdir -p dist/artifacts

install -s bin/${PROG}.exe dist/artifacts/${PROG}-windows-amd64.exe
070701000000B7000081ED000000000000000000000001653C446F00000290000000000000000000000000000000000000003200000000rke2-1.27.7+rke2r1/scripts/package-windows-bundle#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

if [ "${GOARCH}" == "s390x" ] || [ "${GOARCH}" == "arm64" ]; then
    exit 0
fi

mkdir -p dist/bundle/share/${PROG}-windows

### bundle underlay
rsync -a bundle/ dist/bundle/

### bin/rke2.exe
install -s bin/${PROG}.exe dist/bundle/bin/

### share/rke2/LICENSE
cp -vf LICENSE dist/bundle/share/${PROG}/LICENSE.txt

### (setup directory)
mkdir -p dist/artifacts

### (make the tarball)
if [ -z "${PACKAGE_SKIP_TARBALL}" ]; then
    tar -czf dist/artifacts/${PROG}.windows-${ARCH}.tar.gz -C dist/bundle $(find dist/bundle -mindepth 1 -maxdepth 1 -type d -exec basename {} \;)
fi
070701000000B8000081ED000000000000000000000001653C446F000003A4000000000000000000000000000000000000003200000000rke2-1.27.7+rke2r1/scripts/package-windows-images#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

mkdir -p dist/artifacts

# 1809/LTSC
crane --platform windows/amd64 pull \
  ${REGISTRY}/${REPO}/${PROG}-runtime:${DOCKERIZED_VERSION}-windows-amd64 \
  rancher/pause:${PAUSE_VERSION}-windows-1809-amd64 \
  rke2-windows-1809-amd64-images.tar

# 2022/LTSC
crane --platform windows/amd64 pull \
  ${REGISTRY}/${REPO}/${PROG}-runtime:${DOCKERIZED_VERSION}-windows-amd64 \
  rancher/pause:${PAUSE_VERSION}-windows-ltsc2022-amd64 \
  rke2-windows-ltsc2022-amd64-images.tar

WINDOWS_TARFILES=(rke2-windows-1809-amd64-images.tar rke2-windows-ltsc2022-amd64-images.tar)
for TARFILE in "${WINDOWS_TARFILES[@]}"; do
    zstd -T0 -16 -f --long=25 --no-progress ${TARFILE} -o dist/artifacts/${TARFILE}.zst
    pigz -v -c ${TARFILE} > dist/artifacts/${TARFILE}.gz
done
cat build/windows-images.txt | sort -V | uniq > dist/artifacts/${PROG}-images.windows-amd64.txt

070701000000B9000081ED000000000000000000000001653C446F000003AA000000000000000000000000000000000000002B00000000rke2-1.27.7+rke2r1/scripts/publish-dev-rpm#!/usr/bin/env bash
set -ex

[ -n "$AWS_ACCESS_KEY_ID" ] || {
  echo "AWS_ACCESS_KEY_ID is not set"
  exit 0
}

[ -n "$AWS_SECRET_ACCESS_KEY" ] || {
  echo "AWS_SECRET_ACCESS_KEY is not set"
  exit 0
}

cd $(dirname $0)/..

source ./scripts/version.sh

RPM_LIST=$(mktemp -t)
TMPDIR=$(mktemp -d)
cleanup() {
  exit_code=$?
  trap - EXIT INT
  rm -rf "${TMPDIR}" "${RPM_LIST}"
  exit ${exit_code}
}
trap cleanup EXIT INT

RPM_DIR='./dist/rpms'

find "${RPM_DIR}" -mindepth 2 -type f $ -name '*.rpm' -not -name '*.src.rpm' $ -print >"${RPM_LIST}"
while IFS= read -r FILE; do
  KIND=$(echo "${FILE}" | grep -oE 'rke2-\w+')
  DISTRO=$(basename "${FILE%%x86_64*}")
  cp "${FILE}" "${RPM_DIR}/${KIND}-${COMMIT}.${DISTRO}.rpm"
done <"${RPM_LIST}"

umask 077

aws s3 cp ${RPM_DIR}/ s3://rke2-ci-builds --exclude "*" --include "*.rpm" --recursive || exit 1

echo "Build uploaded" >&2
echo "https://rke2-ci-builds.s3.amazonaws.com/${BUNDLE_NAME}"
070701000000BA000081ED000000000000000000000001653C446F0000009D000000000000000000000000000000000000003400000000rke2-1.27.7+rke2r1/scripts/publish-image-kubernetes#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

docker image push ${REPO}/hardened-kubernetes:${DOCKERIZED_VERSION}-${GOARCH}
070701000000BB000081ED000000000000000000000001653C446F00000138000000000000000000000000000000000000003100000000rke2-1.27.7+rke2r1/scripts/publish-image-runtime#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

docker image push ${REPO}/${PROG}-runtime:${DOCKERIZED_VERSION}-${GOOS}-${GOARCH}
if [ "${GOARCH}" != "s390x" ] && [ "${GOARCH}" != "arm64" ]; then
    docker image push ${REPO}/${PROG}-runtime:${DOCKERIZED_VERSION}-windows-amd64
fi
070701000000BC000081ED000000000000000000000001653C446F00000157000000000000000000000000000000000000003700000000rke2-1.27.7+rke2r1/scripts/publish-manifest-kubernetes#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh
export DOCKER_CLI_EXPERIMENTAL=enabled

docker manifest create \
    --amend ${REPO}/hardened-kubernetes:${DOCKERIZED_VERSION} \
    ${REPO}/hardened-kubernetes:${DOCKERIZED_VERSION}-${GOARCH}

docker manifest push ${REPO}/hardened-kubernetes:${DOCKERIZED_VERSION}
070701000000BD000081ED000000000000000000000001653C446F00000123000000000000000000000000000000000000002800000000rke2-1.27.7+rke2r1/scripts/remote-debug#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

source ./scripts/version.sh

GODEBUG=y ./scripts/build-binary
CATTLE_DEV_MODE=true dlv \
  --listen=:2345 \
  --headless=true \
  --api-version=2 \
  --check-go-version=false \
  --accept-multiclient exec -- ./bin/${PROG} ${COMMAND} ${ARGS}
070701000000BE000081ED000000000000000000000001653C446F00000050000000000000000000000000000000000000002D00000000rke2-1.27.7+rke2r1/scripts/remote-debug-exit#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

dlv connect :2345 <<< '
q
y
'
070701000000BF000081ED000000000000000000000001653C446F00000089000000000000000000000000000000000000001F00000000rke2-1.27.7+rke2r1/scripts/run#!/usr/bin/env bash
set -ex

cd $(dirname $0)/..

. ./scripts/version.sh

COMMAND="server"
GODEBUG="y"

./bin/${PROG} ${COMMAND} ${ARGS}
070701000000C0000081ED000000000000000000000001653C446F0000032E000000000000000000000000000000000000002700000000rke2-1.27.7+rke2r1/scripts/scan-images#!/usr/bin/env bash

cd $(dirname $0)/..

EXITCODE=0
SCAN_OUTPUT="scan.json"

for IMAGE in $(cat build/images*.txt); do
  echo -e "\nScanning ${IMAGE}"
  trivy image \
    --format json \
    --output ${SCAN_OUTPUT} \
    --exit-code 1 \
    --security-checks vuln \
    --severity ${SEVERITIES:-CRITICAL,HIGH} \
    --ignore-unfixed \
    --no-progress \
    --quiet \
    ${IMAGE}
  RC=$?
  if [ ${RC} -gt ${EXITCODE} ]; then
    EXITCODE=${RC}
  fi
  if [ ${RC} -gt 0 ]; then
    echo -e "\nSev\tPackage\tVulnID\tInstalled\tFixed"
    jq -rc 'try .Results[].Vulnerabilities[] | "\(.Severity)\t\(.PkgName)\t\(.VulnerabilityID)\t\(.InstalledVersion)\t\(.FixedVersion)"' ${SCAN_OUTPUT} | sort
  fi
  echo
  rm ${SCAN_OUTPUT}
done

if [ ${EXITCODE} -gt 0 ]; then
  echo "VULNERABILITIES FOUND"
fi

exit ${EXITCODE}
070701000000C1000081ED000000000000000000000001653C446F00000015000000000000000000000000000000000000002B00000000rke2-1.27.7+rke2r1/scripts/semver-parse.sh#!/bin/bash

set -e

070701000000C2000081A4000000000000000000000001653C446F00000049000000000000000000000000000000000000003000000000rke2-1.27.7+rke2r1/scripts/sonobuoy-config.json{
    "Plugins": [
        {
            "name": "e2e"
        }
    ]
}
070701000000C3000081ED000000000000000000000001653C446F00000230000000000000000000000000000000000000002000000000rke2-1.27.7+rke2r1/scripts/test#!/bin/bash

set -e -x
cd $(dirname $0)/..

docker ps

. ./scripts/test-helpers

artifacts=$(pwd)/dist/artifacts
mkdir -p $artifacts

# ---

. ./scripts/test-run-basics
echo "Did test-run-basics $?"

# ---

if [ "$ARCH" != 'amd64' ]; then
    early-exit "Skipping remaining tests, images not available for $ARCH."
fi

E2E_OUTPUT=$artifacts test-run-sonobuoy
echo "Did test-run-sonobuoy $?"
# ---

if [ "$DRONE_BUILD_EVENT" = 'tag' ]; then
    early-exit 'Skipping remaining tests on tag.'
fi
# ---

#test-run-sonobuoy mysql
#test-run-sonobuoy postgres

exit 0
070701000000C4000081A4000000000000000000000001653C446F000007BC000000000000000000000000000000000000003200000000rke2-1.27.7+rke2r1/scripts/test-certs-openssl.cnf# db OpenSSL configuration file.
SAN = "IP:127.0.0.1, IP:172.17.0.1, DNS:host.docker.internal"
dir = .

[ ca ]
default_ca = db_ca

[ db_ca ]
certs            = $dir/certs
certificate      = $dir/certs/ca.crt
crl              = $dir/crl.pem
crl_dir          = $dir/crl
crlnumber        = $dir/crlnumber
database         = $dir/index.txt
email_in_dn      = no
new_certs_dir    = $dir/newcerts
private_key      = $dir/private/ca.key
serial           = $dir/serial
RANDFILE         = $dir/private/.rand
name_opt         = ca_default
cert_opt         = ca_default
default_days     = 3650
default_crl_days = 30
default_md       = sha512
preserve         = no
policy           = policy_db

[ policy_db ]
organizationName = optional
commonName       = supplied

[ req ]
default_bits       = 1024
default_keyfile    = privkey.pem
distinguished_name = req_distinguished_name
attributes         = req_attributes
x509_extensions    = v3_ca
string_mask        = utf8only
req_extensions     = db_client

[ req_distinguished_name ]
countryName                = Country Name (2 letter code)
countryName_default        = US
countryName_min            = 2
countryName_max            = 2
commonName                 = Common Name (FQDN)
0.organizationName         = Organization Name (eg, company)
0.organizationName_default = db-ca

[ req_attributes ]

[ v3_ca ]
basicConstraints       = CA:true
keyUsage               = keyCertSign,cRLSign
subjectKeyIdentifier   = hash

[ db_client ]
basicConstraints       = CA:FALSE
extendedKeyUsage       = clientAuth
keyUsage               = digitalSignature, keyEncipherment

[ db_peer ]
basicConstraints       = CA:FALSE
extendedKeyUsage       = clientAuth, serverAuth
keyUsage               = digitalSignature, keyEncipherment
subjectAltName         = ${ENV::SAN}

[ db_server ]
basicConstraints       = CA:FALSE
extendedKeyUsage       = clientAuth, serverAuth
keyUsage               = digitalSignature, keyEncipherment
subjectAltName         = ${ENV::SAN}
070701000000C5000081ED000000000000000000000001653C446F000041FA000000000000000000000000000000000000002800000000rke2-1.27.7+rke2r1/scripts/test-helpers#!/bin/bash

# ---

port-used() {
    netstat -tuna | grep -q ":$1 "
}
export -f port-used

# ---

get-port() {
    local port=0
    while
        port=$((10000 + RANDOM % 50000))
        port-used $port
    do continue; done
    echo $port
}
export -f get-port

# ---

fetch-kubeconfig() {(
    set -e -o pipefail
    local num=${1:-1}
    local name=$(cat $TEST_DIR/servers/$num/metadata/name)
    local port=$(cat $TEST_DIR/servers/$num/metadata/port)
    docker cp $name:/etc/rancher/rke2/rke2.yaml - 2>/dev/null | tar -xO 2>/dev/null | sed -e "s/:6443/:$port/g" >$TEST_DIR/servers/$num/kubeconfig.yaml
)}
export -f fetch-kubeconfig

# ---

wait-for-kubeconfig() {
    while ! fetch-kubeconfig $1; do
        echo 'Waiting for kubeconfig to become available...' >&2
        sleep 5
    done
}
export -f wait-for-kubeconfig

# ---

count-ready-nodes() {
    kubectl get nodes -o json \
        | jq '.items[].status.conditions[] | select(.type == "Ready" and .status == "True") | .type' \
        | wc -l \
        | tr -d '[:space:]'
}
export -f count-ready-nodes

# ---

wait-for-nodes() {
    while [[ $(count-ready-nodes) -ne $1 ]]; do
        echo 'Waiting for nodes to be ready...' >&2
        sleep 5
    done
}
export -f wait-for-nodes

# ---

pod-ready() {
    kubectl get pods -n kube-system -o json \
        | jq ".items[].status | select(.containerStatuses != null) | .containerStatuses[] | select(.name == \"$1\") | .ready" 2>/dev/null
}
export -f pod-ready

# -- wait-for-services() accepts container names as input and checks if they are ready. It does not check Kubernetes services!
wait-for-services() {
    for service in $@; do
        while [[ "$(pod-ready $service | sort -u)" != 'true' ]]; do
            echo "Waiting for service $service to be ready..." >&2
            sleep 5
        done
        echo "Service $service is ready"
    done
}
export -f wait-for-services

# ---

wait-for-db-connection() {
    if [ -z "$DB_CONNECTION_TEST" ]; then
      echo 'DB_CONNECTION_TEST is not defined' >&2
      return 1
    fi
    while ! $DB_CONNECTION_TEST 2>/dev/null; do
        echo 'Waiting for database to become available...' >&2
        sleep 5
    done
}
export -f wait-for-db-connection

# ---

verify-valid-version() {
    docker exec $@ 2>&1 | tee .version.tmp
    # check for bad strings in the version output, including '.' in the build metadata
    if grep -oiE '.*(head|unknown|fail|refuse|\+[^"]*\.).*' .version.tmp; then
        return 1
    fi
}
export -f verify-valid-version

# ---

verify-valid-versions() {
    verify-valid-version $1 kubectl version
    verify-valid-version $1 ctr version
    verify-valid-version $1 crictl version
}
export -f verify-valid-versions

# ---

dump-logs() {
    local testID=$(basename $TEST_DIR)
    echo "#---------------------------------"
    echo "#- Begin: logs for run ($testID)"
    echo
    local server=$(cat $TEST_DIR/servers/1/metadata/name)
    docker exec $server kubectl get pods -A -o wide >$TEST_DIR/logs/kubectl-get-pods.txt
    docker exec $server kubectl get nodes -o wide >$TEST_DIR/logs/kubectl-get-nodes.txt
    docker exec $server kubectl describe pods -A >$TEST_DIR/logs/kubectl-describe-pods.txt

for node in $TEST_DIR/*/*; do
        [ -d "$node" ] || continue
        local name=$(cat $node/metadata/name 2>/dev/null)
        [ "$name" ] || continue
        mkdir -p $node/logs
        local hostname=$(docker exec $name hostname)
        docker logs $name >$node/logs/system.log 2>&1
        if [[ $name == rke2-* ]]; then
            docker cp $name:/var/lib/rancher/rke2/agent/containerd/containerd.log $node/logs/containerd.log
            docker cp $name:/var/lib/rancher/rke2/agent/logs/kubelet.log $node/logs/kubelet.log
            docker cp $name:/var/log/pods $node/logs/pods
            docker exec $server kubectl describe node/$hostname >$node/logs/kubectl-describe-node.txt
            docker exec $name crictl pods >$node/logs/crictl-pods.txt
            docker exec $name crictl ps -a >$node/logs/crictl-ps.txt
        fi
        for log in $node/logs/*.log; do
            echo
            echo "#- Tail: $log"
            tail -5 $log
            echo "#- Done: $log"
            echo
        done
    done
    for txt in $TEST_DIR/logs/*.txt $TEST_DIR/*/*/logs/*.txt; do
        echo
        echo "#- Cat: $txt"
        cat $txt
        echo "#- Done: $txt"
        echo
    done
    echo
    echo "#- Finish: logs for run ($testID)"
    echo "#---------------------------------"
    echo
    ./scripts/log-upload $TEST_DIR
}
export -f dump-logs

# ---

retrieve-sonobuoy-logs() {
    local status=passed
    local code=0
    local testStatus=$(sonobuoy status 2>&1)
    cat <<< $testStatus

if ! grep -q -E '\s+e2e\s+complete\s+passed\s+' <<< $testStatus; then
        status=failed
        code=1
    fi

mkdir -p $TEST_DIR/sonobuoy
    sonobuoy retrieve $TEST_DIR/sonobuoy 2>/dev/null || true
    local logTarball=$TEST_DIR/sonobuoy/*_sonobuoy_*.tar.gz

if [ -f $logTarball ]; then
        tar -xz -f $logTarball -C $TEST_DIR/sonobuoy
        rm $logTarball
    else
        rm -rf $TEST_DIR/sonobuoy
    fi

local e2eLog=$TEST_DIR/sonobuoy/plugins/e2e/results/global/e2e.log
    if [ ! -s $e2eLog ]; then
        return 1
    fi
    if [ -n "$LOG_OUTPUT" ]; then
        cp $e2eLog $(sed -e "s/-STATUS-/-$status-/g" <<< "$LOG_OUTPUT")
    fi
    tail -11 $e2eLog
    awk '/^Summarizing .* Failures?:$/,0' $e2eLog
    return $code
}
export -f retrieve-sonobuoy-logs

# ---

test-wait() {
    wait $1 || echo "test wait exit code $?"
    local delay=15
    sleep $delay
    while sonobuoy status | grep -q -E ' +e2e +running +'; do
        sleep $delay
    done
    sleep $delay
    if sonobuoy status | grep -q -E ' +e2e +complete +passed +'; then
        return 0
    fi
    return 1
}
export -f test-wait

# ---

sonobuoy-test() {
    if [ "$ARCH" = 'arm' ]; then
        echo "Aborting sonobuoy tests, images not available for $ARCH"
        return 0
    fi
    echo 'Starting sonobuoy tests'

sonobuoy run \
        --config=scripts/sonobuoy-config.json \
        --plugin-env=e2e.E2E_USE_GO_RUNNER=true \
        --kube-conformance-image-version=${KUBERNETES_VERSION} \
        --wait=90 \
        $@ &

local sonobuoyPID=$!
    local code=0
    time timeout --foreground 30m bash -c test-wait $sonobuoyPID || code=$?
    echo "Sonobuoy finished with code $code"
    retrieve-sonobuoy-logs
    return $code
}
export -f sonobuoy-test

# ---

test-cleanup() {
    local code=$?
    set +e -x
    echo 'Cleaning up...'
    trap - EXIT INT TERM
    if [[ $code -ne 0 ]]; then
        dump-logs
    fi
    for name in $TEST_DIR/*/*/metadata/name; do
        [ -f "$name" ] || continue
        local container=$(cat $name)
        echo "Removing container $container"
        docker rm -f -v $container
    done
    if [ "$TEST_CLEANUP" = true ]; then
        echo "Removing test directory $TEST_DIR"
        rm -rf $TEST_DIR
    fi
    [ -f "$PROVISION_LOCK" ] && rm $PROVISION_LOCK
    echo
    echo -n "Test $(basename $TEST_DIR) "
    if [ $code -eq 0 ]; then
        echo "passed."
    else
        echo "failed."
    fi
    echo
    exit $code
}
export -f test-cleanup

# ---

test-setup() {
    export TEST_DIR=$(mktemp -d '/tmp/XXXXXX')
    trap test-cleanup EXIT INT TERM

mkdir -p $TEST_DIR/metadata
    if [ "$LABEL" ]; then
        exec > >(awk "{ printf \"[\033[36m${LABEL}\033[m] %s\n\", \$0; fflush() }") \
            2> >(awk "{ printf \"[\033[35m${LABEL}\033[m] %s\n\", \$0; fflush() }" >&2)
        echo "$LABEL" >$TEST_DIR/metadata/label
    fi

mkdir -p $TEST_DIR/logs
    exec > >(tee -a $TEST_DIR/logs/test.log) \
        2> >(tee -a $TEST_DIR/logs/test.log >&2)

if [ -z "$RKE2_IMAGE" ]; then
        . ./scripts/version.sh
        #TAG=${TAG:-${VERSION_TAG}${SUFFIX}}
        #REPO=${REPO:-rancher}
        #IMAGE_NAME=${IMAGE_NAME:-rke2}
        export RKE2_IMAGE=${REPO}/${PROG}-test:${DOCKERIZED_VERSION}-${GOARCH}
        #export RKE2_IMAGE=${REPO}/${IMAGE_NAME}:${TAG}
    fi

if [ -z "$RKE2_IMAGE" ]; then
        echo 'RKE2_IMAGE environment variable should be defined'
        return 1
    fi

local setupFile=./scripts/test-setup-${TEST_TYPE}
    [ -f $setupFile ] && source $setupFile

echo ${RANDOM}${RANDOM}${RANDOM} >$TEST_DIR/metadata/secret
}
export -f test-setup

# ---

gen-certs() {(
    set -e -x
    #umask 077

local opensslConfig=$(pwd)/scripts/test-certs-openssl.cnf
    local subject="/C=US/ST=AZ/L=Tempe/O=Rancher/OU=DevOps/DC=com/DC=rancher"
    local caDir=$TEST_DIR/db-ca
    [ -d $caDir ] && rm -rf $caDir
    mkdir -p $caDir

cd $caDir
    mkdir -p private certs newcerts crl
    touch index.txt
    echo '01' > serial

openssl req \
        -config $opensslConfig \
        -new -x509 \
        -nodes \
        -subj $subject \
        -extensions v3_ca \
        -keyout private/ca.key \
        -out certs/ca.crt

openssl req \
        -config $opensslConfig \
        -new \
        -nodes \
        -subj $subject"/CN=server" \
        -keyout private/db.key \
        -out db.csr

openssl ca \
        -config $opensslConfig \
        -batch \
        -extensions db_server \
        -keyfile private/ca.key \
        -cert certs/ca.crt \
        -out certs/db.crt \
        -infiles db.csr

openssl req \
        -config $opensslConfig \
        -new \
        -nodes \
        -subj $subject"/CN=client" \
        -keyout private/client.key \
        -out client.csr

openssl ca \
        -config $opensslConfig \
        -batch \
        -extensions db_client \
        -keyfile private/ca.key \
        -cert certs/ca.crt \
        -out certs/client.crt \
        -infiles client.csr
)}
export -f gen-certs

# ---

inc-count() {(
    shopt -s extglob
    local count=$(exec 2>/dev/null; ls -1d "$TEST_DIR/$1/+([0-9])" | xargs -n1 basename | sort -n -r | head -1)
    count=$((count+1))
    mkdir -p "$TEST_DIR/$1/$count/metadata"
    echo $count
)}
export -f inc-count

# ---

run-function() {
    declare -f $1 >/dev/null 2>&1 || return 0
    $@
}
export -f run-function

# ---

provision-server() {
    local count=$(inc-count servers)
    local testID=$(basename $TEST_DIR)
    local name=$(echo "rke2-server-$count-$testID" | tee $TEST_DIR/servers/$count/metadata/name)
    #local args=$(cat $TEST_DIR/args $TEST_DIR/servers/args $TEST_DIR/servers/$count/args 2>/dev/null)
    local port=$(timeout --foreground 5s bash -c get-port | tee $TEST_DIR/servers/$count/metadata/port)
    local SERVER_INSTANCE_ARGS="SERVER_${count}_ARGS"

run-function server-pre-hook $count

docker run \
        -d --name $name \
        --privileged \
        -v $TEST_DIR/db-ca/:/db-ca \
        -p 127.0.0.1:$port:6443 \
        -e RKE2_TOKEN=$(cat $TEST_DIR/metadata/secret) \
        -e RKE2_DEBUG=true \
        ${REGISTRY_CLUSTER_ARGS:-} \
        $RKE2_IMAGE server $ARGS $SERVER_ARGS ${!SERVER_INSTANCE_ARGS}
    docker exec $name mount --make-rshared /var/lib/kubelet

local ip=$(docker inspect --format '{{ .NetworkSettings.IPAddress }}' $name | tee $TEST_DIR/servers/$count/metadata/ip)
    local url=$(echo "https://$ip:9345" | tee $TEST_DIR/servers/$count/metadata/url)

echo "Started $name @ $url"
    run-function server-post-hook $count
}
export -f provision-server

# ---

provision-agent() {
    local RKE2_URL=${RKE2_URL:-"$(cat $TEST_DIR/servers/1/metadata/url)"}
    local count=$(inc-count agents)
    local testID=$(basename $TEST_DIR)
    local name=$(echo "rke2-agent-$count-$testID" | tee $TEST_DIR/agents/$count/metadata/name)
    #local args=$(cat $TEST_DIR/args $TEST_DIR/agents/args $TEST_DIR/agents/$count/args 2>/dev/null)
    local AGENT_INSTANCE_ARGS="AGENT_${count}_ARGS"

run-function agent-pre-hook $count
    docker run \
        -d --name $name \
        --privileged \
        -e RKE2_TOKEN=$(cat $TEST_DIR/metadata/secret) \
        -e RKE2_URL=$RKE2_URL \
        -e RKE2_DEBUG=true \
        ${REGISTRY_CLUSTER_ARGS:-} \
        $RKE2_IMAGE agent $ARGS $AGENT_ARGS ${!AGENT_INSTANCE_ARGS}
    docker exec $name mount --make-rshared /var/lib/kubelet

echo "Started $name"
    run-function agent-post-hook $count
}
export -f provision-agent

# ---

provision-cluster() {
    run-function cluster-pre-hook

if [ "${ENABLE_REGISTRY}" == 'true' ]; then
      provision-registry-proxy
    fi

for i in $(seq 1 $NUM_SERVERS); do
        provision-server
        timeout --foreground 120s bash -c "wait-for-kubeconfig $i"
    done
    export KUBECONFIG=$TEST_DIR/servers/1/kubeconfig.yaml

if [ $NUM_AGENTS -gt 0 ]; then
        for _ in $(seq 1 $NUM_AGENTS); do
            provision-agent
        done
    fi

timeout --foreground 4m bash -c "wait-for-nodes $(( NUM_SERVERS + NUM_AGENTS ))"
    timeout --foreground 8m bash -c "wait-for-services $WAIT_SERVICES"

run-function cluster-post-hook

[ -f "$PROVISION_LOCK" ] && rm $PROVISION_LOCK
}
export -f provision-cluster

# ---

provision-registry-proxy() {
    set -e -o pipefail
    local image="docker.io/library/registry:2.7.1"
    local prefix="docker-registry-"
    local registries="docker.io:registry-1.docker.io k8s.gcr.io gcr.io quay.io ghcr.io"
    local registries_yaml="$TEST_DIR/registries.yaml"

echo "mirrors:" > $registries_yaml

for registry in $registries; do
        IFS=: read registry_name registry_endpoint <<< $registry
        if [ -z "$registry_endpoint" ]; then
            registry_endpoint=$registry_name
        fi

local name="registry_${registry_name//./_}"
        local status=$(docker inspect $name --format '{{ .State.Status }} {{ .Config.Image }} {{ (index .HostConfig.PortBindings "5000/tcp" 0).HostPort }}' 2>/dev/null || true)

read state_status config_image hostport <<< $status
        if [ "$state_status" != "running" ] || [ "$config_image" != "$image" ]; then
            hostport=$(timeout --foreground 5s bash -c get-port)
            docker rm --force $name 2>/dev/null || true
            docker run \
                -d --name $name \
                -p 0.0.0.0:$hostport:5000 \
                -v "registry-cache:/var/lib/registry" \
                -e "REGISTRY_HTTP_SECRET=shared-secret" \
                -e "REGISTRY_PROXY_REMOTEURL=https://$registry_endpoint" \
                -e "REGISTRY_STORAGE_CACHE_BLOBDESCRIPTOR=inmemory" \
                -e "REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY=/var/lib/registry/$registry_name" \
                $image
        fi
        echo -e "  $registry_name:\n    endpoint:\n    - http://172.17.0.1:$hostport" >> $registries_yaml
    done

echo "Using registry mirror with cluster registries.yaml:"
    cat $registries_yaml

export REGISTRY_CLUSTER_ARGS="-v $registries_yaml:/etc/rancher/rke2/registries.yaml"
}
export -f provision-registry-proxy

# ---

early-exit() {
    printf "\033[33m$1\033[m\n"
    exit $2
}
export -f early-exit

# ---

run-test() {
    export PROVISION_LOCK=$(mktemp)
    ./scripts/test-runner $@ &
    pids+=($!)
    (
        set +x
        while [ -f "$PROVISION_LOCK" ]; do
            sleep 1
        done
        sleep 5
    )
}
export -f run-test

# ---

e2e-test() {
    local label=$label
    if [ -n "$LABEL_SUFFIX" ]; then
        label="$label-$LABEL_SUFFIX"
    fi
    local logOutput=
    if [ -n "$E2E_OUTPUT" ]; then
        logOutput=$E2E_OUTPUT/$logName
    fi
    LABEL=$label LOG_OUTPUT=$logOutput run-test $@
}

# ---

run-e2e-tests() {
    label=PARALLEL \
        logName=e2e-STATUS-${ARCH}-parallel.log \
        e2e-test ${sonobuoyParallelArgs[@]}
    echo "Exit code $? for parallel start"

label=SERIAL \
        logName=e2e-STATUS-${ARCH}-serial.log \
        e2e-test ${sonobuoySerialArgs[@]}
    echo "Exit code $? for serial start"
}
export -f run-e2e-tests

# ---

test-run-sonobuoy() {
    local suffix
    if [ "$1" ]; then
        suffix="-$1"
        export LABEL_SUFFIX=$1
    fi

. ./scripts/test-setup-sonobuoy$suffix
    run-e2e-tests
}
export -f test-run-sonobuoy

# ---

pid-cleanup() {
    local code=$?
    local failCount=0
    set +e
    if [ $code -eq 0 ]; then
        for pid in ${pids[@]}; do
            wait $pid || code=$?
        done
    fi
    if [ $code -ne 0 ]; then
        for pid in ${pids[@]}; do
            pkill -P $pid
            wait $pid || failCount=$((failCount+1))
        done
    fi
    trap - EXIT INT TERM
    set +x
    echo
    if [ $failCount -eq 0 ]; then
        printf '\033[32mAll tests passed.\033[m\n'
    else
        printf "\033[31m$failCount tests failed.\033[m\n"
        if [ "$DRONE_BUILD_EVENT" = 'tag' ]; then
            printf "\033[31mIgnoring test failures on tag.\033[m\n"
            code=0
        else
            code=1
        fi
    fi
    echo
    exit $code
}
export -f pid-cleanup

# ---

pids=()
trap pid-cleanup EXIT INT TERM
070701000000C6000081ED000000000000000000000001653C446F000009C9000000000000000000000000000000000000002B00000000rke2-1.27.7+rke2r1/scripts/test-run-basics#!/bin/bash

all_services=(
    calico-node
    coredns
    etcd
    kube-apiserver
    kube-controller-manager
    kube-flannel
    kube-proxy
    kube-scheduler
    metrics-server
    rke2-ingress-nginx-controller
    rke2-snapshot-controller
    rke2-snapshot-validation-webhook
)

export NUM_SERVERS=1
export NUM_AGENTS=1
export WAIT_SERVICES="${all_services[@]}"
export SERVER_ARGS="${SERVER_ARGS} --enable-servicelb"

start-test() {
    #docker exec $(cat $TEST_DIR/servers/1/metadata/name) check-config || true
    use-nodelocal-DNSCache
    use-servicelb
    verify-valid-versions $(cat $TEST_DIR/servers/1/metadata/name)
    verify-airgap-images $(cat $TEST_DIR/{servers,agents}/*/metadata/name)
    verify-snapshot-controller
}
export -f start-test

# -- check for changes to the airgap image list
# -- this currently only checks imags for the default CNI and charts
verify-airgap-images() {
    local expected="$TEST_DIR/logs/images-expected.txt"
    local actual="$TEST_DIR/logs/images-actual.txt"

docker exec $(cat $TEST_DIR/servers/1/metadata/name) cat /images.txt | sort -u >$expected

for name in $@; do
        docker exec $name crictl images -o json \
            | jq -r '.images[].repoTags[0] | select(. != null)'
    done | sort -u >$actual

if ! diff $expected $actual; then
        echo '[ERROR] Failed airgap image check'
        return 1
    fi
    return 0
}
export -f verify-airgap-images

# -- Enable the nodelocal DNSCache so that its images are used
use-nodelocal-DNSCache() {
    local DNS_nodeCache_manifest='scripts/airgap/dnsNodeCache-test.yaml'
    kubectl apply -f $DNS_nodeCache_manifest
    wait-for-services node-cache
}
export -f use-nodelocal-DNSCache

# -- Create a loadbalancer service so that the klipper-lb image is used
use-servicelb() {
    local loadbalancer_manifest='scripts/airgap/loadbalancer-test.yaml'
    kubectl apply -f $loadbalancer_manifest
    wait-for-services lb-tcp-8080
}
export -f use-servicelb

# -- Verify that the snapshot controller and validation webhook work,
#    by installing the host-path CSI driver and waiting for a snapshot to be taken.
verify-snapshot-controller() {
  for MANIFEST in $(cat tests/e2e/resource_files/csi-driver-host-path.txt); do
    kubectl create -f ${MANIFEST}
  done
  kubectl wait volumesnapshot new-snapshot-demo --for=jsonpath='{.status.readyToUse}'=true --timeout=2m
}
export -f verify-snapshot-controller

# --- create a basic cluster and check for valid versions
LABEL=BASICS run-test
070701000000C7000081ED000000000000000000000001653C446F00000092000000000000000000000000000000000000002700000000rke2-1.27.7+rke2r1/scripts/test-runner#!/bin/bash
set -x -e
cd $(dirname $0)/..

# ---

for include in $TEST_INCLUDES; do
  . $include
done

test-setup
provision-cluster
start-test $@
070701000000C8000081ED000000000000000000000001653C446F00000264000000000000000000000000000000000000002F00000000rke2-1.27.7+rke2r1/scripts/test-setup-sonobuoy#!/bin/bash

all_services=(
    calico-node
    coredns
    etcd
    kube-apiserver
    kube-controller-manager
    kube-flannel
    kube-proxy
    kube-scheduler
    metrics-server
)
export SERVER_ARGS='--disable=rke2-ingress-nginx --kube-apiserver-arg=kubelet-preferred-address-types=InternalIP'

export NUM_SERVERS=1
export NUM_AGENTS=1
export WAIT_SERVICES="${all_services[@]}"

export sonobuoyParallelArgs=(--e2e-focus='\[Conformance\]' --e2e-skip='\[Serial\]' --e2e-parallel=y)
export sonobuoySerialArgs=(--e2e-focus='\[Serial\].*\[Conformance\]')

start-test() {
  sonobuoy-test $@
}
export -f start-test
070701000000C9000081ED000000000000000000000001653C446F0000010F000000000000000000000000000000000000002600000000rke2-1.27.7+rke2r1/scripts/unit-tests#!/usr/bin/env bash

set -ex

BUILDTAGS="selinux netgo osusergo no_stage static_build sqlite_omit_load_extension no_embedded_executor no_cri_dockerd"
GO_BUILDTAGS="${GO_BUILDTAGS} ${BUILDTAGS} ${DEBUG_TAGS}"

go test -tags "${GO_BUILDTAGS}" -v -cover ./pkg/... -run Unit
070701000000CA000081ED000000000000000000000001653C446F000008D0000000000000000000000000000000000000002400000000rke2-1.27.7+rke2r1/scripts/validate#!/usr/bin/env bash
set -ex

if [ -n "${SKIP_VALIDATE}" ]; then
    echo "skipping validation. continuing..."
    exit 0
fi

fatal() {
    echo '[ERROR] ' "$@" >&2
    exit 1
}

function check_win_binaries() {
    #  Upstream hasn't released a new version of crictl for 1.26 yet; skip the check entirely until they do.
    #  I'm not honestly even sure that there is any guarantee of a cri-tools release for every Kubernetes minor.
    #if [ -z "${RC}" ]; then
    #    CRICTL_WINDOWS_VERSION=$(grep 'CRICTL_VERSION=' Dockerfile.windows | cut -d '=' -f 2- | grep -oE "v([0-9]+)\.([0-9]+)")
    #    if [ ! "$CRICTL_WINDOWS_VERSION" = "v$VERSION_MAJOR.$VERSION_MINOR" ]; then
    #       fatal "crictl windows binary version [$CRICTL_WINDOWS_VERSION] does not match kubernetes version"
    #    fi
    #fi

CALICO_WINDOWS_VERSION=$(grep 'CALICO_VERSION=' Dockerfile.windows | cut -d '=' -f 2- | grep -oE "v([0-9]+)\.([0-9]+)")
    CALICO_LINUX_VERSION=$(grep "rke2-calico.yaml" Dockerfile | grep 'CHART_VERSION=' | cut -d '=' -f 2- | grep -oE "v([0-9]+)\.([0-9]+)")
    if [ ! "$CALICO_WINDOWS_VERSION" = "$CALICO_LINUX_VERSION" ]; then
        fatal "Calico windows binary version [$CALICO_WINDOWS_VERSION] does not match Calico chart version [$CALICO_LINUX_VERSION]"
    fi

CONTAINERD_WINDOWS_VERSION=$(grep "rancher/hardened-containerd" Dockerfile.windows | grep ':v' | cut -d '=' -f 2- | grep -oE "([0-9]+)\.([0-9]+)\.([0-9]+)")
    CONTAINERD_LINUX_VERSION=$(grep "rancher/hardened-containerd" Dockerfile | grep ':v' | cut -d '=' -f 2- | grep -oE "([0-9]+)\.([0-9]+)\.([0-9]+)")
    if [ "$CONTAINERD_LINUX_VERSION" != "$CONTAINERD_WINDOWS_VERSION" ]; then
        fatal "Containerd windows binary version [$CONTAINERD_WINDOWS_VERSION] does not match Containerd linux version [$CONTAINERD_LINUX_VERSION]"
    fi
}

if ! command -v golangci-lint; then
    echo Skipping validation: no golangci-lint available
    exit
fi

cd $(dirname $0)/..
GO=${GO-go}

echo Running validation

echo Running: golangci-lint
#CGO_ENABLED=0 golangci-lint run -v

echo Running: go mod tidy
go mod tidy

. ./scripts/version.sh

if [ -n "$DIRTY" ]; then
    echo Source dir is dirty
    git status --porcelain --untracked-files=no
    exit 1
fi

check_win_binaries
070701000000CB000081ED000000000000000000000001653C446F0000072B000000000000000000000000000000000000002C00000000rke2-1.27.7+rke2r1/scripts/validate-release#!/usr/bin/env bash
set -e

BUILD_REGEX="build[0-9]+"

info() {
    echo '[INFO] ' "$@"
}

fatal() {
    echo '[ERROR] ' "$@" >&2
    exit 1
}

function parse_tag() {
    if [ -z $1 ]; then
        fatal "tag required as argument"
        exit 1
    fi
    tag=$1
    if [[ "${tag}" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)([-+][a-zA-Z0-9]+)?[-+](rke2r[0-9]+)$ ]]; then
        MAJOR=${BASH_REMATCH[1]}
        MINOR=${BASH_REMATCH[2]}
        PATCH=${BASH_REMATCH[3]}
        RC=${BASH_REMATCH[4]}
        RKE2_PATCH=${BASH_REMATCH[5]}
    fi
}

function get-module-version() {
  go list -m -f '{{if .Replace}}{{.Replace.Version}}{{else}}{{.Version}}{{end}}' $1
}

function check_release_branch() {
    TAG_BRANCH=$(git branch --all -q --contains $GIT_TAG | grep origin | grep -vE 'dependabot|updatecli|origin$|HEAD' | sed -e 's/^[[:space:]]*//')
    if [ "$TAG_BRANCH" == "remotes/origin/master" ]; then
        K8S_VERSION_GO_MOD=$(get-module-version k8s.io/kubernetes | cut -d. -f1-2)
        if [ "v$MAJOR.$MINOR" == "$K8S_VERSION_GO_MOD" ]; then
            info "Tag $GIT_TAG is cut from master"
            return
        fi
    fi
    if [ ! "$TAG_BRANCH" = "remotes/origin/release-$MAJOR.$MINOR" ]; then
        fatal "Tag is cut from the wrong branch $TAG_BRANCH"
    fi
}

function check_kubernetes_version() {
    if [[ ! "$KUBERNETES_IMAGE_TAG" =~ v$MAJOR.$MINOR.$PATCH-$RKE2_PATCH-$BUILD_REGEX ]]; then
        fatal "Kubernetes image tag [$KUBERNETES_IMAGE_TAG] is incorrect for this tag"
    fi

if [[ ! "$KUBERNETES_VERSION" =~ v$MAJOR.$MINOR.$PATCH ]]; then
        fatal "Kubernetes version variable [$KUBERNETES_VERSION] is incorrect, please correct the version to v$MAJOR.$MINOR.$PATCH"
    fi

}

. ./scripts/version.sh

git fetch origin -f --tags
parse_tag $DRONE_TAG
check_release_branch
check_kubernetes_version
070701000000CC000081ED000000000000000000000001653C446F0000082E000000000000000000000000000000000000002600000000rke2-1.27.7+rke2r1/scripts/version.sh#!/bin/bash
set -x

PROG=rke2
REGISTRY=docker.io
REPO=${REPO:-rancher}
K3S_PKG=github.com/k3s-io/k3s
RKE2_PKG=github.com/rancher/rke2
GO=${GO-go}
GOARCH=${GOARCH:-$("${GO}" env GOARCH)}
GOOS=${GOOS:-$("${GO}" env GOOS)}
if [ -z "$GOOS" ]; then
    if [ "${OS}" == "Windows_NT" ]; then
      GOOS="windows"
    else
      UNAME_S=$(shell uname -s)
		  if [ "${UNAME_S}" == "Linux" ]; then
			    GOOS="linux"
		  elif [ "${UNAME_S}" == "Darwin" ]; then
				  GOOS="darwin"
		  elif [ "${UNAME_S}" == "FreeBSD" ]; then
				  GOOS="freebsd"
		  fi
    fi
fi

GIT_TAG=$DRONE_TAG
TREE_STATE=clean
COMMIT=$DRONE_COMMIT
REVISION=$(git rev-parse HEAD)$(if ! git diff --no-ext-diff --quiet --exit-code; then echo .dirty; fi)
PLATFORM=${GOOS}-${GOARCH}
RELEASE=${PROG}.${PLATFORM}
# hardcode versions unless set specifically
KUBERNETES_VERSION=${KUBERNETES_VERSION:-v1.27.7}
KUBERNETES_IMAGE_TAG=${KUBERNETES_IMAGE_TAG:-v1.27.7-rke2r1-build20231018}
ETCD_VERSION=${ETCD_VERSION:-v3.5.9-k3s1}
PAUSE_VERSION=${PAUSE_VERSION:-3.6}
CCM_VERSION=${CCM_VERSION:-v1.28.2-build20231016}

if [ -d .git ]; then
    if [ -z "$GIT_TAG" ]; then
        GIT_TAG=$(git tag -l --contains HEAD | head -n 1)
    fi
    if [ -n "$(git status --porcelain --untracked-files=no)" ]; then
        DIRTY="-dirty"
        TREE_STATE=dirty
    fi

COMMIT=$(git log -n3 --pretty=format:"%H %ae" | grep -v ' drone@localhost$' | cut -f1 -d\  | head -1)
    if [ -z "${COMMIT}" ]; then
        COMMIT=$(git rev-parse HEAD || true)
    fi
fi

if [[ -n "$GIT_TAG" ]]; then
    VERSION=$GIT_TAG
else
    VERSION="${KUBERNETES_VERSION}+dev.${COMMIT:0:8}$DIRTY"
fi

if [[ "${VERSION}" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)([-+][a-zA-Z0-9.]+)?[-+]((rke2r[0-9]+|dev.*))$ ]]; then
    VERSION_MAJOR=${BASH_REMATCH[1]}
    VERSION_MINOR=${BASH_REMATCH[2]}
    PATCH=${BASH_REMATCH[3]}
    RC=${BASH_REMATCH[4]}
    RKE2_PATCH=${BASH_REMATCH[5]}
    echo "VERSION=${VERSION} parsed as MAJOR=${MAJOR} MINOR=${MINOR} PATCH=${PATCH} RC=${RC} RKE2_PATCH=${RKE2_PATCH}"
fi

DOCKERIZED_VERSION="${VERSION/+/-}" # this mimics what kubernetes builds do
070701000000CD000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001900000000rke2-1.27.7+rke2r1/tests070701000000CE000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001D00000000rke2-1.27.7+rke2r1/tests/e2e070701000000CF000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002A00000000rke2-1.27.7+rke2r1/tests/e2e/createreport070701000000D0000081A4000000000000000000000001653C446F000037E7000000000000000000000000000000000000003D00000000rke2-1.27.7+rke2r1/tests/e2e/createreport/generate_report.gopackage main

import (
	"bufio"
	"bytes"
	"encoding/json"
	"fmt"
	"html/template"
	"io/ioutil"
	"log"
	"math"
	"net/http"
	"os"
	"strings"
	"time"

"github.com/aws/aws-sdk-go/aws"
	"github.com/aws/aws-sdk-go/aws/session"
	"github.com/aws/aws-sdk-go/service/s3"
	"github.com/spf13/cobra"
)

// Output to store test results from specReport
type Output struct {
	State string
	Name  string
	Type  string
	Time  float64
}

// GoTestJSONRowData to store logs in JSON format
type GoTestJSONRowData struct {
	Time    time.Time
	Action  string
	Package string
	Test    string
	Output  string
	Elapsed float64
}

// ProcessedTestdata to store formatted data
type ProcessedTestdata struct {
	TotalTestTime    string
	TestDate         string
	FailedTests      int
	PassedTests      int
	SkippedTests     int
	TestSummary      []TestOverview
	TestSuiteSummary map[string]TestSuiteDetails
}

// TestSuiteDetails to store test suite details
type TestSuiteDetails struct {
	TestSuiteName string
	ElapsedTime   float64
	Status        string
	FailedTests   int
	PassedTests   int
	SkippedTests  int
}

// TestDetails to store test case details
type TestDetails struct {
	TestSuiteName string
	TestCaseName  string
	ElapsedTime   float64
	Status        string
}

// TestOverview to store structured test case details per test suite
type TestOverview struct {
	TestSuiteName string
	TestCases     []TestDetails
}

func main() {
	rootCmd := initCommand()
	if err := rootCmd.Execute(); err != nil {
		fmt.Println(err)
		os.Exit(1)
	}
}

var fileName string
var testSuiteName string
var OS string
var htmlReport string
var bucketName string

func initCommand() *cobra.Command {
	var rootCmd = &cobra.Command{
		Use:   "go-test-html-report",
		Short: "go-test-html-report generates a html report of go-test logs",
		RunE: func(cmd *cobra.Command, args []string) (e error) {
			file, _ := cmd.Flags().GetString("file")
			testData := make([]GoTestJSONRowData, 0)
			if file != "" {
				testData = ReadLogsFromFile(file)
			} else {
				log.Println("Log file not passed")
				os.Exit(1)
			}
			OS = strings.Split(strings.Split(file, "_")[1], ".")[0]
			processedTestdata := ProcessTestData(testData)
			GenerateHTMLReport(processedTestdata.TotalTestTime,
				processedTestdata.TestDate,
				processedTestdata.TestSummary,
				processedTestdata.TestSuiteSummary,
			)
			log.Println("Report Generated")
			LaunchHTML()
			// upload test result
			UploadReport(htmlReport)
			// upload result result for all OS
			UploadReport("launchresults.html")
			return nil
		},
	}
	rootCmd.PersistentFlags().StringVarP(
		&fileName,
		"file",
		"f",
		"",
		"set the file of the go test json logs")
	return rootCmd
}

// ReadLogsFromFile the logs generated from the test run script
func ReadLogsFromFile(fileName string) []GoTestJSONRowData {
	file, err := os.Open(fileName)
	if err != nil {
		log.Println("error opening file: ", err)
		os.Exit(1)
	}
	defer func() {
		err := file.Close()
		if err != nil {
			log.Println("error closing file: ", err)
			os.Exit(1)
		}
	}()

scanner := bufio.NewScanner(file)
	rowData := make([]GoTestJSONRowData, 0)

for scanner.Scan() {
		row := GoTestJSONRowData{}

// unmarshall each line to GoTestJSONRowData
		err := json.Unmarshal([]byte(scanner.Text()), &row)
		if err != nil {
			log.Println("error to unmarshall test logs: ", err)
			os.Exit(1)
		}
		rowData = append(rowData, row)
	}

if err := scanner.Err(); err != nil {
		log.Println("error with file scanner: ", err)
		os.Exit(1)
	}
	return rowData
}

// ProcessTestData reads json formatted data and stores into respective structures
func ProcessTestData(rowData []GoTestJSONRowData) ProcessedTestdata {
	testDetails := map[string]TestDetails{}
	testSuiteDetails := map[string]TestSuiteDetails{}
	passedTests := 0
	failedTests := 0
	skippedTests := 0
	// Loop through logs
	for _, r := range rowData {
		if r.Test != "" {
			testSuiteName = r.Test
			var jsonMap Output

// Extract valid data from the logs
			if strings.Contains(r.Output, "k3s test") || strings.Contains(r.Output, "rke2 test") {
				output2 := strings.LastIndex(r.Output, "}")
				output2 = output2 + 1
				json.Unmarshal([]byte(strings.TrimSpace(r.Output[:output2])), &jsonMap)
			}

// Check if there is a valid test case
			if len(jsonMap.Name) > 1 {
				if jsonMap.State == "failed" || jsonMap.State == "passed" || jsonMap.State == "skipped" {
					testDetails[r.Test+jsonMap.Name] = TestDetails{
						TestSuiteName: r.Test,
						TestCaseName:  jsonMap.Name,
						ElapsedTime:   jsonMap.Time / (1000 * 1000 * 1000 * 60),
						Status:        jsonMap.State,
					}
				}

if jsonMap.State == "failed" {
					failedTests = failedTests + 1
				} else if jsonMap.State == "passed" {
					passedTests = passedTests + 1
				} else if jsonMap.State == "skipped" {
					skippedTests = skippedTests + 1
				}
			}
		} else {
			if r.Action == "fail" || r.Action == "pass" || r.Action == "skip" {
				testSuiteDetails[testSuiteName] = TestSuiteDetails{
					TestSuiteName: testSuiteName,
					ElapsedTime:   r.Elapsed / 60,
					Status:        r.Action,
					FailedTests:   failedTests,
					PassedTests:   passedTests,
					SkippedTests:  skippedTests,
				}
				passedTests = 0
				failedTests = 0
				skippedTests = 0

}
		}
	}

testSummary := make([]TestOverview, 0)
	for key := range testSuiteDetails {
		testCases := make([]TestDetails, 0)
		for _, t2 := range testDetails {
			if t2.TestSuiteName == key {
				testCases = append(testCases, t2)
			}
		}
		// testSummary holds testSuiteName and testCases
		testSummary = append(testSummary, TestOverview{
			TestSuiteName: key,
			TestCases:     testCases,
		})
	}
	// determine total test time
	totalTestTime := ""
	if rowData[len(rowData)-1].Time.Sub(rowData[0].Time).Seconds() < 60 {
		totalTestTime = fmt.Sprintf("%f s", rowData[len(rowData)-1].Time.Sub(rowData[0].Time).Seconds())
	} else {
		min := int(math.Trunc(rowData[len(rowData)-1].Time.Sub(rowData[0].Time).Seconds() / 60))
		seconds := int(math.Trunc((rowData[len(rowData)-1].Time.Sub(rowData[0].Time).Minutes() - float64(min)) * 60))
		totalTestTime = fmt.Sprintf("%dm:%ds", min, seconds)
	}

// determine test date
	testDate := rowData[0].Time.Format(time.RFC850)

return ProcessedTestdata{
		TotalTestTime:    totalTestTime,
		TestDate:         testDate,
		FailedTests:      failedTests,
		PassedTests:      passedTests,
		SkippedTests:     skippedTests,
		TestSummary:      testSummary,
		TestSuiteSummary: testSuiteDetails,
	}
}

// GenerateHTMLReport generates report in the form rke2_<OS>_results.html
func GenerateHTMLReport(totalTestTime, testDate string, testSummary []TestOverview, testSuiteDetails map[string]TestSuiteDetails) {
	totalPassedTests := 0
	totalFailedTests := 0
	totalSkippedTests := 0
	templates := make([]template.HTML, 0)
	for _, testSuite := range testSuiteDetails {
		totalPassedTests = totalPassedTests + testSuite.PassedTests
		totalFailedTests = totalFailedTests + testSuite.FailedTests
		totalSkippedTests = totalSkippedTests + testSuite.SkippedTests
		// display testSuiteName
		htmlString := template.HTML("<div type=\"button\" class=\"collapsible\">\n")
		packageInfoTemplateString := template.HTML("")

packageInfoTemplateString = "<div>{{.testsuiteName}}</div>" + "\n" + "<div>Run Time: {{.elapsedTime}}m</div> " + "\n"
		packageInfoTemplate, err := template.New("packageInfoTemplate").Parse(string(packageInfoTemplateString))
		if err != nil {
			log.Println("error parsing package info template", err)
			os.Exit(1)
		}

var processedPackageTemplate bytes.Buffer
		err = packageInfoTemplate.Execute(&processedPackageTemplate, map[string]string{
			"testsuiteName": testSuite.TestSuiteName + "_" + OS,
			"elapsedTime":   fmt.Sprintf("%.2f", testSuite.ElapsedTime),
		})
		if err != nil {
			log.Println("error applying package info template: ", err)
			os.Exit(1)
		}

if testSuite.Status == "pass" {
			packageInfoTemplateString = "<div class=\"collapsibleHeading packageCardLayout successBackgroundColor \">" +
				template.HTML(processedPackageTemplate.Bytes()) + "</div>"
		} else if testSuite.Status == "fail" {
			packageInfoTemplateString = "<div class=\"collapsibleHeading packageCardLayout failBackgroundColor \">" +
				template.HTML(processedPackageTemplate.Bytes()) + "</div>"
		} else {
			packageInfoTemplateString = "<div class=\"collapsibleHeading packageCardLayout skipBackgroundColor \">" +
				template.HTML(processedPackageTemplate.Bytes()) + "</div>"
		}

htmlString = htmlString + "\n" + packageInfoTemplateString
		testInfoTemplateString := template.HTML("")

// display testCases
		for _, pt := range testSummary {
			testHTMLTemplateString := template.HTML("")
			if len(pt.TestCases) == 0 {
				log.Println("Test run failed for ", pt.TestSuiteName, "no testcases were executed")
				continue
			}
			if pt.TestSuiteName == testSuite.TestSuiteName {
				if testSuite.FailedTests == 0 {
					testHTMLTemplateString = "<div type=\"button\" class=\"collapsible \">" +
						"\n" + "<div class=\"collapsibleHeading testCardLayout successBackgroundColor \">" +
						"<div>+ {{.testName}}</div>" + "\n" + "<div>{{.elapsedTime}}</div>" + "\n" +
						"</div>" + "\n" +
						"<div class=\"collapsibleHeadingContent\">"
				} else if testSuite.FailedTests > 0 {
					testHTMLTemplateString = "<div type=\"button\" class=\"collapsible \">" +
						"\n" + "<div class=\"collapsibleHeading testCardLayout failBackgroundColor \">" +
						"<div>+ {{.testName}}</div>" + "\n" + "<div>{{.elapsedTime}}</div>" + "\n" +
						"</div>" + "\n" +
						"<div class=\"collapsibleHeadingContent\">"
				} else if testSuite.SkippedTests > 0 {
					testHTMLTemplateString = "<div type=\"button\" class=\"collapsible \">" +
						"\n" + "<div class=\"collapsibleHeading testCardLayout skipBackgroundColor \">" +
						"<div>+ {{.testName}}</div>" + "\n" + "<div>{{.elapsedTime}}</div>" + "\n" +
						"</div>" + "\n" +
						"<div class=\"collapsibleHeadingContent\">"
				}
				testTemplate, err := template.New("Test").Parse(string(testHTMLTemplateString))
				if err != nil {
					log.Println("error parsing tests template: ", err)
					os.Exit(1)
				}
				var processedTestTemplate bytes.Buffer
				err = testTemplate.Execute(&processedTestTemplate, map[string]string{
					"testName": "TestCases",
				})
				if err != nil {
					log.Println("error applying test template: ", err)
					os.Exit(1)
				}

testHTMLTemplateString = template.HTML(processedTestTemplate.Bytes())
				testCaseHTMLTemplateString := template.HTML("")

for _, tC := range pt.TestCases {
					testCaseHTMLTemplateString = "<div>{{.testName}}</div>" + "\n" + "<div>{{.elapsedTime}}m</div>"
					testCaseTemplate, err := template.New("testCase").Parse(string(testCaseHTMLTemplateString))
					if err != nil {
						log.Println("error parsing test case template: ", err)
						os.Exit(1)
					}

var processedTestCaseTemplate bytes.Buffer
					err = testCaseTemplate.Execute(&processedTestCaseTemplate, map[string]string{
						"testName":    tC.TestCaseName,
						"elapsedTime": fmt.Sprintf("%f", tC.ElapsedTime),
					})
					if err != nil {
						log.Println("error applying test case template: ", err)
						os.Exit(1)
					}

if tC.Status == "passed" {
						testCaseHTMLTemplateString = "<div class=\"testCardLayout successBackgroundColor \">" + template.HTML(processedTestCaseTemplate.Bytes()) + "</div>"

} else if tC.Status == "failed" {
						testCaseHTMLTemplateString = "<div  class=\"testCardLayout failBackgroundColor \">" + template.HTML(processedTestCaseTemplate.Bytes()) + "</div>"

} else {
						testCaseHTMLTemplateString = "<div  class=\"testCardLayout skipBackgroundColor \">" + template.HTML(processedTestCaseTemplate.Bytes()) + "</div>"
					}
					testHTMLTemplateString = testHTMLTemplateString + "\n" + testCaseHTMLTemplateString
				}
				testHTMLTemplateString = testHTMLTemplateString + "\n" + "</div>" + "\n" + "</div>"
				testInfoTemplateString = testInfoTemplateString + "\n" + testHTMLTemplateString
			}
		}
		htmlString = htmlString + "\n" + "<div class=\"collapsibleHeadingContent\">\n" + testInfoTemplateString + "\n" + "</div>"
		htmlString = htmlString + "\n" + "</div>"
		templates = append(templates, htmlString)
	}
	reportTemplate := template.New("report-template.html")
	reportTemplateData, err := Asset("report-template.html")
	if err != nil {
		log.Println("error retrieving report-template.html: ", err)
		os.Exit(1)
	}

report, err := reportTemplate.Parse(string(reportTemplateData))
	if err != nil {
		log.Println("error parsing report-template.html: ", err)
		os.Exit(1)
	}

var processedTemplate bytes.Buffer
	type templateData struct {
		HTMLElements  []template.HTML
		FailedTests   int
		PassedTests   int
		SkippedTests  int
		TotalTestTime string
		TestDate      string
	}

err = report.Execute(&processedTemplate,
		&templateData{
			HTMLElements:  templates,
			FailedTests:   totalFailedTests,
			PassedTests:   totalPassedTests,
			SkippedTests:  totalSkippedTests,
			TotalTestTime: totalTestTime,
			TestDate:      testDate,
		},
	)
	if err != nil {
		log.Println("error applying report-template.html: ", err)
		os.Exit(1)
	}
	htmlReport = strings.Split(fileName, ".")[0] + "_results.html"
	bucketName = strings.Split(htmlReport, "_")[0] + "-results"
	fmt.Println(bucketName)
	err = ioutil.WriteFile(htmlReport, processedTemplate.Bytes(), 0644)
	if err != nil {
		log.Println("error writing report.html file: ", err)
		os.Exit(1)
	}
}

// UploadReport used to upload test result to s3 bucket
func UploadReport(filename string) {
	file, err := os.Open(filename)

if err != nil {
		log.Println("error opening file: ", err)
		os.Exit(1)
	}
	report1 := s3.New(session.New(), &aws.Config{Region: aws.String("us-east-2")})
	params1 := &s3.PutObjectInput{
		Bucket:      aws.String(bucketName),
		Key:         aws.String(filename),
		ContentType: aws.String("text/html"),
		Body:        file,
	}
	_, err = report1.PutObject(params1)
	if err != nil {
		fmt.Println("Upload failed due to: ", err)
		os.Exit(1)
	}

fmt.Println(filename, "is uploaded")

}

// LaunchHTML to reflect the changes dynamically to the matrix
func LaunchHTML() {
	http.Handle("/", http.FileServer(http.Dir("./")))
	http.ListenAndServe(":80", nil)
}
070701000000D1000081A4000000000000000000000001653C446F00000354000000000000000000000000000000000000003D00000000rke2-1.27.7+rke2r1/tests/e2e/createreport/launchresults.html<!DOCTYPE html>
<html>
   <head>
<style>
.center {
  text-align: left;
  color: darkblue;
  font-size: 120%;
  background-color: yellow;
  width: 1850px;
}
</style>
</head>
   <body>
      <h1>
      </h1>
	<p class="center"> Ubuntu 20.04 Test Results </p>
   <iframe src="./rke2_ubuntu2004_results.html"
              height="500px" width="1850px">
      </iframe>
	<p class="center"> Rocky Linux8.7 Test Results </p>
   <iframe src="./rke2_rocky8_results.html"
              height="500px" width="1850px">
      </iframe>
	<p class="center"> Fedora36 Test Results </p>
   <iframe src="rke2_fedora36_results.html"
              height="500px" width="1850px">
      </iframe>
	<p class="center"> openSUSE Leap 15.4 Test Results</p>
   <iframe src="rke2_Leap_results.html"
              height="500px" width="1850px">
      </iframe>
   </body>
</html>
070701000000D2000081A4000000000000000000000001653C446F00002768000000000000000000000000000000000000004500000000rke2-1.27.7+rke2r1/tests/e2e/createreport/report-template-bindata.go// Code generated by go-bindata.
// sources:
// report-template.html
// DO NOT EDIT!

package main

import (
	"bytes"
	"compress/gzip"
	"fmt"
	"io"
	"io/ioutil"
	"os"
	"path/filepath"
	"strings"
	"time"
)

func bindataRead(data []byte, name string) ([]byte, error) {
	gz, err := gzip.NewReader(bytes.NewBuffer(data))
	if err != nil {
		return nil, fmt.Errorf("Read %q: %v", name, err)
	}

var buf bytes.Buffer
	_, err = io.Copy(&buf, gz)
	clErr := gz.Close()

if err != nil {
		return nil, fmt.Errorf("Read %q: %v", name, err)
	}
	if clErr != nil {
		return nil, err
	}

return buf.Bytes(), nil
}

type asset struct {
	bytes []byte
	info  os.FileInfo
}

type bindataFileInfo struct {
	name    string
	size    int64
	mode    os.FileMode
	modTime time.Time
}

func (fi bindataFileInfo) Name() string {
	return fi.name
}
func (fi bindataFileInfo) Size() int64 {
	return fi.size
}
func (fi bindataFileInfo) Mode() os.FileMode {
	return fi.mode
}
func (fi bindataFileInfo) ModTime() time.Time {
	return fi.modTime
}
func (fi bindataFileInfo) IsDir() bool {
	return false
}
func (fi bindataFileInfo) Sys() interface{} {
	return nil
}

var _reportTemplateHtml = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xa4\x57\xdd\x6f\xdb\x36\x10\x7f\x9e\xff\x8a\x9b\xd6\xa1\x0e\x5a\xc9\x1f\xeb\x86\x42\x96\xfc\xd0\xb4\x45\x1f\xba\xb5\x58\xbc\x87\x61\xdd\x03\x2d\x9e\x65\x26\x14\x29\x90\x27\xc7\x5e\xe0\xff\x7d\xa0\x3e\x6c\x59\x56\xd2\xb4\x11\x10\x05\xe4\xdd\xef\x77\x1f\xbc\x3b\xca\xd1\x8f\x6f\x3f\x5d\x2e\xfe\xfe\xfc\x0e\xd6\x94\xc9\xf9\x20\x72\xff\x40\x32\x95\xc6\x1e\x2a\xcf\x6d\x20\xe3\xf3\x01\x00\x40\x94\x21\x31\x48\xd6\xcc\x58\xa4\xd8\xfb\x6b\xf1\xde\x7f\xed\xd5\x22\x12\x24\x71\xbe\x70\xef\x68\x54\x2d\x2a\x81\xa5\x9d\x44\xa0\x5d\x8e\xb1\x47\xb8\xa5\x51\x62\x6d\x0d\x72\x4f\x60\xb4\x26\xb8\x3b\xac\xdd\xb3\x64\xc9\x4d\x6a\x74\xa1\xb8\x9f\x68\xa9\x4d\x08\x3f\x4d\x7f\x99\x8e\x5f\x4d\x66\x27\x6a\xb5\xec\x76\x2d\x08\x8f\x92\xfd\xe0\xc8\x6d\x8b\x24\x41\x6b\xdf\x1c\xf8\x2e\x1d\xe4\xab\xd6\x38\x33\x37\xa9\x41\x54\xfd\xac\x2b\x26\xe4\xf7\x50\x1a\xe4\xf7\xb8\x79\x23\xf2\xef\xf4\x71\xd7\xcf\x98\xb3\xe4\x86\xa5\x78\xc9\x0c\xff\xc8\x76\xba\xe8\x66\x38\x35\x82\xfb\x84\x59\x2e\x19\xa1\xa3\x2c\x32\x65\x43\x98\xac\x0c\xb0\x82\xf4\xf1\x35\x3b\x87\x55\xda\x7e\xca\xf2\x10\x5e\xe7\xdb\x53\x0d\x2e\x6c\x2e\xd9\x2e\x2c\x55\xfb\x7d\x23\xb4\xf4\x24\xc7\x1e\x65\xd1\x3d\xb7\x82\xd3\x3a\x84\xc9\x78\xfc\x73\x27\x8e\x5e\xdf\x97\xda\x70\x34\xbe\x61\x5c\x14\x36\x84\x57\x5d\x79\xc6\x4c\x2a\x94\xbf\xd4\x44\x3a\x0b\xe1\xd7\xae\x3c\x67\x9c\x0b\x95\x76\x90\xed\xd0\x13\x2d\x25\xcb\xad\x58\x4a\xec\xc4\x9d\x14\xc6\xba\x63\xcd\xb5\x50\x84\xe6\xab\xf0\x0f\xc8\x9c\xad\x2e\x4b\x6f\x47\x9c\xf8\x76\x16\xf5\xbd\x49\xaa\xd2\x11\x82\xd2\xaa\x43\xe6\xda\xd8\x67\x52\xa4\x2a\x04\x89\x2b\x3a\x95\xea\x82\xa4\x50\xd8\x07\x5c\x69\x45\xbe\x15\xff\x61\x08\x93\xb3\xf4\x3d\x25\xfd\x0f\x67\x29\x64\x2b\xc2\x6e\x4b\x25\x5a\x11\x2a\x0a\xe1\xf9\x97\xf1\x78\xfa\xe6\x79\x3f\x19\x4b\x48\x6c\xf0\x61\x02\xef\xcb\x74\x3a\x99\x7a\x8f\xf5\xe6\xb2\xc2\x75\xd8\x0e\x07\x34\x86\xc9\xd9\x19\x65\x6c\xeb\xaf\x51\xa4\x6b\x0a\x61\xdc\xc9\xf6\x06\xcd\x4a\xea\xdb\x10\xd6\x82\xf3\xf6\xc8\x2a\x4f\xca\x30\x65\x05\x09\xad\xc2\x16\x09\x8c\x83\xa9\x05\x64\x16\x7d\x5d\xd0\xfd\x5d\x7a\x45\x8c\xec\xa7\x0d\x9a\x8d\xc0\x5b\xb8\x1b\xfc\x00\x0f\x77\x68\xf3\xf7\xe8\x26\x3d\x1d\x59\xd6\x22\x5f\xa0\x25\xdb\x49\x4d\xab\x6a\xb6\xbe\x64\x26\xc5\xde\x7b\xe0\x2b\x13\xfb\x49\xdc\x9d\xd1\x7d\x20\x76\x93\x3b\x7f\xaa\xd7\xbb\x2e\x75\x34\x2a\x2f\xcd\xf9\x20\x1a\x55\x97\x6f\xb4\xd4\x7c\x07\x89\x64\xd6\xc6\x9e\xbb\x30\xdd\xbd\xcc\xc5\x06\x4a\xbd\xd8\x3b\xa4\x77\x25\x71\x3b\x2b\xdf\x3e\x17\x06\x93\xea\xe4\xab\x43\x9a\xd5\x1d\x14\xc2\xe4\xb7\x7c\x3b\x83\xa6\xa0\x26\xe3\xf1\x66\xdd\x5c\xe3\x2d\xd2\xf3\x00\xbc\xb9\x0b\x14\xfe\xc4\x5c\x1b\x8a\x46\x5c\x6c\x1e\x44\xb5\x31\x6f\x19\x61\x08\x77\x77\x81\x5b\xb9\xc5\x7e\xdf\x25\xa8\xc3\x3b\x2b\xbc\xd6\xc7\x42\x94\x37\x66\xea\x61\x40\x3a\x77\x1d\xe1\x35\xe0\x56\x11\x79\xf3\xcf\xe5\x02\x1c\xa1\x2d\x6d\x7f\x3e\x4a\x9d\xf9\xfc\x1b\x88\x5b\x15\xe4\xcd\xdf\x97\x8b\x16\xf1\xfb\xa3\xf4\x5b\x89\xdb\x15\xe4\xcd\xaf\xaa\x55\x8b\xfa\xaa\x25\xbf\x97\xbb\xa7\xd6\xa0\x63\x6f\xbe\xd0\xc4\x64\x49\x0c\x24\xb2\xfa\x30\xdc\x9e\xa3\x5e\x88\x0c\x5b\xec\xad\xa3\xb9\xbb\x33\x4c\xa5\x08\xcf\x84\xe2\xb8\x7d\x09\xcf\x50\x62\xe6\xc6\x57\x18\x43\xf0\x61\xf1\xfb\xc7\x77\xd5\xda\xee\xf7\xb5\x7e\xa3\x71\xd8\x40\xc5\xf7\xfb\x41\xcd\x19\x8d\x5c\x2d\xcf\x07\x91\x4d\x8c\xc8\xa9\x32\x32\x1a\xc1\xb5\x85\x6a\x07\x48\x43\x62\x90\x11\x02\x53\xd0\x1a\x9f\xa5\xe6\x86\x99\x72\x0f\x62\xe0\x3a\x29\x9c\x9d\x20\x45\x6a\x9c\x78\xb3\xbb\x74\x69\xfd\x83\x65\x38\xf4\x5a\x58\xef\xa2\xea\xb1\x95\x36\x30\x94\x48\x20\x20\x86\xf1\x0c\x04\x44\x25\x5d\x20\x51\xa5\xb4\x9e\x81\x78\xf1\xe2\xa2\xd5\xc8\x8d\xb9\xce\xad\x1b\x43\xa1\x38\xae\x84\x42\x7e\x9c\x32\x07\xee\xeb\x8a\xfb\xba\xe6\xfe\x47\xfc\x1b\x24\x6b\x21\xb9\x41\x75\xb0\x73\x7d\x6a\xc7\x3d\x0e\xda\x24\x37\x3e\x47\x0a\xc2\x6c\x78\x7d\x71\x02\x11\x2b\x18\xd6\x90\x20\x69\x02\x0f\x84\x4a\x64\xc1\xd1\x9e\x64\xa0\x76\xdd\xbb\xe8\x9a\xad\x67\xd1\x79\x88\x35\xf1\x99\xf2\xd2\x20\xbb\x39\xd9\xdd\xf7\x0d\xdd\x73\xce\x80\x71\xfe\x6e\x83\x8a\x3e\x0a\x4b\xa8\xd0\x0c\xbd\x44\x8a\xe4\xc6\x7b\x09\xab\x42\x95\xb3\x0a\x86\x5d\xf7\x68\x2d\x6c\x15\x9b\x43\x05\xa4\xd3\x54\xe2\xd0\xab\xee\x65\xef\x34\x1d\xd5\x69\x55\xb7\x6b\x5c\x21\x15\x6e\x9b\xe2\xb8\x12\x4b\x29\x54\x3a\x3b\xcb\x60\x0d\x09\xca\x66\x0a\x32\xb6\xfd\x50\x4e\xc6\xfe\x44\xf5\xaa\x42\x0c\xaa\x90\xf2\x94\x7a\x0f\x28\x6d\xf7\x3b\xef\x61\x92\x5b\xa1\xb8\xbe\x0d\x84\x52\x68\xea\xcd\x17\xe0\xe5\x5b\x6f\x76\x5f\xbe\xeb\xba\x76\xed\xd5\x34\x54\x34\xaa\x7e\xc9\xfd\x1f\x00\x00\xff\xff\x46\x11\x73\x73\xda\x0d\x00\x00")

func reportTemplateHtmlBytes() ([]byte, error) {
	return bindataRead(
		_reportTemplateHtml,
		"report-template.html",
	)
}

func reportTemplateHtml() (*asset, error) {
	bytes, err := reportTemplateHtmlBytes()
	if err != nil {
		return nil, err
	}

info := bindataFileInfo{name: "report-template.html", size: 3546, mode: os.FileMode(420), modTime: time.Unix(1673562223, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

// Asset loads and returns the asset for the given name.
// It returns an error if the asset could not be found or
// could not be loaded.
func Asset(name string) ([]byte, error) {
	cannonicalName := strings.Replace(name, "\\", "/", -1)
	if f, ok := _bindata[cannonicalName]; ok {
		a, err := f()
		if err != nil {
			return nil, fmt.Errorf("Asset %s can't read by error: %v", name, err)
		}
		return a.bytes, nil
	}
	return nil, fmt.Errorf("Asset %s not found", name)
}

// MustAsset is like Asset but panics when Asset would return an error.
// It simplifies safe initialization of global variables.
func MustAsset(name string) []byte {
	a, err := Asset(name)
	if err != nil {
		panic("asset: Asset(" + name + "): " + err.Error())
	}

return a
}

// AssetInfo loads and returns the asset info for the given name.
// It returns an error if the asset could not be found or
// could not be loaded.
func AssetInfo(name string) (os.FileInfo, error) {
	cannonicalName := strings.Replace(name, "\\", "/", -1)
	if f, ok := _bindata[cannonicalName]; ok {
		a, err := f()
		if err != nil {
			return nil, fmt.Errorf("AssetInfo %s can't read by error: %v", name, err)
		}
		return a.info, nil
	}
	return nil, fmt.Errorf("AssetInfo %s not found", name)
}

// AssetNames returns the names of the assets.
func AssetNames() []string {
	names := make([]string, 0, len(_bindata))
	for name := range _bindata {
		names = append(names, name)
	}
	return names
}

// _bindata is a table, holding each asset generator, mapped to its name.
var _bindata = map[string]func() (*asset, error){
	"report-template.html": reportTemplateHtml,
}

// AssetDir returns the file names below a certain
// directory embedded in the file by go-bindata.
// For example if you run go-bindata on data/... and data contains the
// following hierarchy:
//     data/
//       foo.txt
//       img/
//         a.png
//         b.png
// then AssetDir("data") would return []string{"foo.txt", "img"}
// AssetDir("data/img") would return []string{"a.png", "b.png"}
// AssetDir("foo.txt") and AssetDir("notexist") would return an error
// AssetDir("") will return []string{"data"}.
func AssetDir(name string) ([]string, error) {
	node := _bintree
	if len(name) != 0 {
		cannonicalName := strings.Replace(name, "\\", "/", -1)
		pathList := strings.Split(cannonicalName, "/")
		for _, p := range pathList {
			node = node.Children[p]
			if node == nil {
				return nil, fmt.Errorf("Asset %s not found", name)
			}
		}
	}
	if node.Func != nil {
		return nil, fmt.Errorf("Asset %s not found", name)
	}
	rv := make([]string, 0, len(node.Children))
	for childName := range node.Children {
		rv = append(rv, childName)
	}
	return rv, nil
}

type bintree struct {
	Func     func() (*asset, error)
	Children map[string]*bintree
}
var _bintree = &bintree{nil, map[string]*bintree{
	"report-template.html": &bintree{reportTemplateHtml, map[string]*bintree{}},
}}

// RestoreAsset restores an asset under the given directory
func RestoreAsset(dir, name string) error {
	data, err := Asset(name)
	if err != nil {
		return err
	}
	info, err := AssetInfo(name)
	if err != nil {
		return err
	}
	err = os.MkdirAll(_filePath(dir, filepath.Dir(name)), os.FileMode(0755))
	if err != nil {
		return err
	}
	err = ioutil.WriteFile(_filePath(dir, name), data, info.Mode())
	if err != nil {
		return err
	}
	err = os.Chtimes(_filePath(dir, name), info.ModTime(), info.ModTime())
	if err != nil {
		return err
	}
	return nil
}

// RestoreAssets restores an asset under the given directory recursively
func RestoreAssets(dir, name string) error {
	children, err := AssetDir(name)
	// File
	if err != nil {
		return RestoreAsset(dir, name)
	}
	// Dir
	for _, child := range children {
		err = RestoreAssets(dir, filepath.Join(name, child))
		if err != nil {
			return err
		}
	}
	return nil
}

func _filePath(dir, name string) string {
	cannonicalName := strings.Replace(name, "\\", "/", -1)
	return filepath.Join(append([]string{dir}, strings.Split(cannonicalName, "/")...)...)
}

070701000000D3000081A4000000000000000000000001653C446F00000DDA000000000000000000000000000000000000003F00000000rke2-1.27.7+rke2r1/tests/e2e/createreport/report-template.html<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
    <style type="text/css">
        .root {
            background-color: #232041;
            color: white;
        }

.successBackgroundColor {
            background-color: darkgreen;
        }

.failBackgroundColor {
            background-color: darkred;
        }

.skipBackgroundColor {
            background-color: darkgrey;
        }

.packageCardLayout {
            grid-template-columns: 1fr auto auto auto;
            grid-column-gap: 8px;
            display: grid;
        }

.testCardLayout {
            grid-template-columns: 1fr auto auto;
            display: grid;
            width: 100%;
            gap: 8px;
            border-radius: 4px;
            margin-bottom: 5px;
            padding: 4px;
        }

.collapsible {
            cursor: pointer;
        }

.collapsibleHeading {
            color: white;
            padding: 8px;
            width: 100%;
            border: none;
            text-align: left;
            outline: none;
            font-size: 15px;
            border-radius: 4px;
            margin-bottom: 5px;
        }

.collapsibleHeading:after {
            content: '\002B';
        }

.active:after {
            content: "\2212";
        }

.collapsibleHeadingContent {
            padding: 0 18px;
            max-height: 0;
            overflow: hidden;
            transition: max-height 0.2s ease-out;
        }

.testStatsOverview {
	    grid-template-columns: 1fr 1fr 1fr auto;
            display: grid;
        }

.passedTests {
            font-size: x-large;
            color: green;
        }

.failedTests {
            font-size: x-large;
            color: red;
        }
        .skippedTests {
            font-size: x-large;
            color: grey;
        }
    </style>
</head>
<body class="root">
<div style="display: flex; flex-direction: column; margin: 16px; height: 100vh">
    <div style="font-size: x-large">Test Report</div>
    <div style="font-size: large">Test Date: {{.TestDate}}</div>
    <div class="testStatsOverview">
        <p style="margin-top: 0;" class="passedTests">Passed tests: {{.PassedTests}}</p>
        <p style="margin-top: 0;" class="failedTests">Failed tests: {{.FailedTests}}</p>
        <p style="margin-top: 0;" class="skippedTests">Skipped tests: {{.SkippedTests}}</p>
        <p style="font-size: x-large; margin-top: 0;">Total test time: {{.TotalTestTime}}</p>
    </div>
    {{range $index, $element := .HTMLElements}}
    {{$element}}
    {{end}}
</div>
</body>
<script>
    // js script to create an collapsible
    var coll = document.getElementsByClassName("collapsible");
    for (let i = 0; i < coll.length; i++) {
        var collapsibleHeading = undefined

for (let j = 0; j < coll[i].children.length; j++) {
            let element = coll[i].children.item(j)
            if (element.className.includes("collapsibleHeading")) {
                collapsibleHeading = element
                break
            }
        }

collapsibleHeading.addEventListener("click", function () {
            this.classList.toggle("active")
            var content = this.nextElementSibling;
            if (content.style.maxHeight) {
                content.style.maxHeight = null;
            } else {
                content.style.maxHeight = window.innerHeight + "px";
            }
        });
    }
</script>
</html>
070701000000D4000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002700000000rke2-1.27.7+rke2r1/tests/e2e/dualstack070701000000D5000081A4000000000000000000000001653C446F0000120B000000000000000000000000000000000000003300000000rke2-1.27.7+rke2r1/tests/e2e/dualstack/VagrantfileENV['VAGRANT_NO_PARALLEL'] = 'no'
NODE_ROLES = (ENV['E2E_NODE_ROLES'] ||
  ["server-0", "server-1", "server-2", "agent-0" ])
NODE_BOXES = (ENV['E2E_NODE_BOXES'] ||
  ['generic/ubuntu2004', 'generic/ubuntu2004', 'generic/ubuntu2004', 'generic/ubuntu2004'])
GITHUB_BRANCH = (ENV['E2E_GITHUB_BRANCH'] || "master")
RELEASE_VERSION = (ENV['E2E_RELEASE_VERSION'] || "")
NODE_CPUS = (ENV['E2E_NODE_CPUS'] || 2).to_i
NODE_MEMORY = (ENV['E2E_NODE_MEMORY'] || 3072).to_i
CNI = (ENV['E2E_CNI'] || "canal") # canal, cilium and calico supported
NETWORK4_PREFIX = "10.10.10"
NETWORK6_PREFIX = "fd11:decf:c0ff:ee"
install_type = ""

def provision(vm, roles, role_num, node_num)
  vm.box = NODE_BOXES[node_num]
  vm.hostname = "#{roles[0]}-#{role_num}"
  node_ip4 = "#{NETWORK4_PREFIX}.#{100+node_num}"
  node_ip6 = "#{NETWORK6_PREFIX}::#{10+node_num}"
  node_ip6_gw = "#{NETWORK6_PREFIX}::1"
  # Only works with libvirt, which allows IPv4 + IPv6 on a single network/interface
  vm.network "private_network", 
    :ip => node_ip4,
    :netmask => "255.255.255.0",
    :libvirt__dhcp_enabled => false,
    :libvirt__forward_mode => "none",
    :libvirt__guest_ipv6 => "yes",
    :libvirt__ipv6_address => "#{NETWORK6_PREFIX}::1",
    :libvirt__ipv6_prefix => "64"
    
  vagrant_defaults = File.exists?("./vagrantdefaults.rb") ? "./vagrantdefaults.rb" : "../vagrantdefaults.rb"
  load vagrant_defaults
  
  defaultOSConfigure(vm)
  
  scripts_location = Dir.exists?("./scripts") ? "./scripts" : "../scripts" 
  vm.provision "IPv6 Setup", type: "shell", path: scripts_location + "/ipv6.sh", args: [node_ip4, node_ip6, node_ip6_gw, CNI, vm.box]
  
  install_type = getInstallType(vm, RELEASE_VERSION, GITHUB_BRANCH)
  vm.provision "Ping Check", type: "shell", inline: "ping -4 -c 2 rke2.io"
  
  if roles.include?("server") && role_num == 0
    vm.provision :rke2, run: 'once' do |rke2|
      rke2.env = %W[INSTALL_RKE2_TYPE=server #{install_type}]
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
      rke2.config = <<~YAML
        write-kubeconfig-mode: '0644'
        node-external-ip: #{node_ip4},#{node_ip6}
        node-ip: #{node_ip4},#{node_ip6}
        token: vagrant-rke2
        cluster-cidr: 10.42.0.0/16,2001:cafe:42:0::/56
        service-cidr: 10.43.0.0/16,2001:cafe:43:0::/112
        bind-address: #{NETWORK4_PREFIX}.100
        cni: #{CNI}
        kubelet-arg: "--node-ip=0.0.0.0" # Workaround for https://github.com/kubernetes/kubernetes/issues/111695
      YAML
    end
  elsif roles.include?("server") && role_num != 0
    vm.provision :rke2, run: 'once' do |rke2|
      rke2.env = %W[INSTALL_RKE2_TYPE=server #{install_type}]
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
      rke2.config = <<~YAML
        write-kubeconfig-mode: '0644'
        node-external-ip: #{node_ip4},#{node_ip6}
        node-ip: #{node_ip4},#{node_ip6}
        server: https://#{NETWORK4_PREFIX}.100:9345
        token: vagrant-rke2
        cluster-cidr: 10.42.0.0/16,2001:cafe:42:0::/56
        service-cidr: 10.43.0.0/16,2001:cafe:43:0::/112
        cni: #{CNI}
        kubelet-arg: "--node-ip=0.0.0.0" # Workaround for https://github.com/kubernetes/kubernetes/issues/111695
      YAML
    end
  end
  if roles.include?("agent")
    vm.provision :rke2, run: 'once' do |rke2|
      rke2.env = %W[INSTALL_RKE2_TYPE=agent #{install_type}]
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
      rke2.install_path = false
      rke2.config = <<~YAML
        write-kubeconfig-mode: '0644'
        node-external-ip: #{node_ip4},#{node_ip6}
        node-ip: #{node_ip4},#{node_ip6}
        server: https://#{NETWORK4_PREFIX}.100:9345
        token: vagrant-rke2
        cni: #{CNI}
        kubelet-arg: "--node-ip=0.0.0.0" # Workaround for https://github.com/kubernetes/kubernetes/issues/111695
      YAML
    end
  end
end

Vagrant.configure("2") do |config|
  config.vagrant.plugins = ["vagrant-rke2", "vagrant-reload", "vagrant-libvirt"]
  config.vm.provider "libvirt" do |v|
    v.cpus = NODE_CPUS
    v.memory = NODE_MEMORY
  end
  
  if NODE_ROLES.kind_of?(String)
    NODE_ROLES = NODE_ROLES.split(" ", -1)
  end
  if NODE_BOXES.kind_of?(String)
    NODE_BOXES = NODE_BOXES.split(" ", -1)
  end

# Must iterate on the index, vagrant does not understand iterating 
  # over the node roles themselves
  NODE_ROLES.length.times do |i|
    name = NODE_ROLES[i]
    config.vm.define name do |node|
      roles = name.split("-", -1)
      role_num = roles.pop.to_i
      provision(node.vm, roles, role_num, i)
    end
  end
end
070701000000D6000081A4000000000000000000000001653C446F00002298000000000000000000000000000000000000003900000000rke2-1.27.7+rke2r1/tests/e2e/dualstack/dualstack_test.gopackage dualstack

import (
	"flag"
	"fmt"

"os"
	"strings"
	"testing"

. "github.com/onsi/ginkgo/v2"
	. "github.com/onsi/gomega"
	"github.com/rancher/rke2/tests/e2e"
)

// Valid nodeOS: generic/ubuntu2004, opensuse/Leap-15.3.x86_64
var nodeOS = flag.String("nodeOS", "generic/ubuntu2004", "VM operating system")
var serverCount = flag.Int("serverCount", 3, "number of server nodes")
var agentCount = flag.Int("agentCount", 0, "number of agent nodes")
var ci = flag.Bool("ci", false, "running on CI")

// Environment Variables Info:
// E2E_RELEASE_VERSION=v1.23.1+rke2r1 or nil for latest commit from master

type objIP struct {
	name string
	ipv4 string
	ipv6 string
}

func getPodIPs(kubeConfigFile string) ([]objIP, error) {
	cmd := `kubectl get pods -A -o=jsonpath='{range .items[*]}{.metadata.name}{" "}{.status.podIPs[*].ip}{"\n"}{end}' --kubeconfig=` + kubeConfigFile
	return getObjIPs(cmd)
}
func getNodeIPs(kubeConfigFile string) ([]objIP, error) {
	cmd := `kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{" "}{.status.addresses[?(@.type == "ExternalIP")].address}{"\n"}{end}' --kubeconfig=` + kubeConfigFile
	return getObjIPs(cmd)
}

func getObjIPs(cmd string) ([]objIP, error) {
	var objIPs []objIP
	res, err := e2e.RunCommand(cmd)
	if err != nil {
		return nil, err
	}
	objs := strings.Split(res, "\n")
	objs = objs[:len(objs)-1]

for _, obj := range objs {
		fields := strings.Fields(obj)
		if len(fields) > 2 {
			objIPs = append(objIPs, objIP{name: fields[0], ipv4: fields[1], ipv6: fields[2]})
		} else if len(fields) > 1 {
			objIPs = append(objIPs, objIP{name: fields[0], ipv4: fields[1]})
		} else {
			objIPs = append(objIPs, objIP{name: fields[0]})
		}
	}
	return objIPs, nil
}

func Test_E2EDualStack(t *testing.T) {
	flag.Parse()
	RegisterFailHandler(Fail)
	suiteConfig, reporterConfig := GinkgoConfiguration()
	RunSpecs(t, "Validate dualstack Test Suite", suiteConfig, reporterConfig)
}

var (
	kubeConfigFile  string
	serverNodeNames []string
	agentNodeNames  []string
)
var _ = ReportAfterEach(e2e.GenReport)

var _ = Describe("Verify DualStack Configuration", Ordered, func() {

It("Starts up with no issues", func() {
		var err error
		serverNodeNames, agentNodeNames, err = e2e.CreateCluster(*nodeOS, *serverCount, *agentCount)
		Expect(err).NotTo(HaveOccurred(), e2e.GetVagrantLog(err))
		fmt.Println("CLUSTER CONFIG")
		fmt.Println("OS:", *nodeOS)
		fmt.Println("Server Nodes:", serverNodeNames)
		fmt.Println("Agent Nodes:", agentNodeNames)
		kubeConfigFile, err = e2e.GenKubeConfigFile(serverNodeNames[0])
		Expect(err).NotTo(HaveOccurred())
	})

It("Checks Node Status", func() {
		Eventually(func(g Gomega) {
			nodes, err := e2e.ParseNodes(kubeConfigFile, false)
			g.Expect(err).NotTo(HaveOccurred())
			for _, node := range nodes {
				g.Expect(node.Status).Should(Equal("Ready"))
			}
		}, "620s", "5s").Should(Succeed())
		_, err := e2e.ParseNodes(kubeConfigFile, true)
		Expect(err).NotTo(HaveOccurred())
	})

It("Checks Pod Status", func() {
		Eventually(func(g Gomega) {
			pods, err := e2e.ParsePods(kubeConfigFile, false)
			g.Expect(err).NotTo(HaveOccurred())
			for _, pod := range pods {
				if strings.Contains(pod.Name, "helm-install") {
					g.Expect(pod.Status).Should(Equal("Completed"), pod.Name)
				} else {
					g.Expect(pod.Status).Should(Equal("Running"), pod.Name)
				}
			}
		}, "420s", "5s").Should(Succeed())
		_, err := e2e.ParsePods(kubeConfigFile, true)
		Expect(err).NotTo(HaveOccurred())
	})

It("Verifies that each node has IPv4 and IPv6", func() {
		for _, node := range serverNodeNames {
			cmd := fmt.Sprintf("kubectl get node %s -o jsonpath='{.status.addresses}' --kubeconfig=%s | jq '.[] | select(.type == \"ExternalIP\") | .address'",
				node, kubeConfigFile)
			res, err := e2e.RunCommand(cmd)
			Expect(err).NotTo(HaveOccurred(), res)
			Expect(res).Should(ContainSubstring("10.10.10"))
			Expect(res).Should(ContainSubstring("fd11:decf:c0ff"))
		}
	})
	It("Verifies that each pod has IPv4 and IPv6", func() {
		podIPs, err := getPodIPs(kubeConfigFile)
		Expect(err).NotTo(HaveOccurred())
		for _, pod := range podIPs {
			Expect(pod.ipv4).Should(Or(ContainSubstring("10.10.10"), ContainSubstring("10.42."), ContainSubstring("192.168.")), pod.name)
			Expect(pod.ipv6).Should(Or(ContainSubstring("fd11:decf:c0ff"), ContainSubstring("2001:cafe:42")), pod.name)
		}
	})

It("Verifies ClusterIP Service", func() {
		_, err := e2e.DeployWorkload("dualstack_clusterip.yaml", kubeConfigFile)
		Expect(err).NotTo(HaveOccurred())
		Eventually(func() (string, error) {
			cmd := "kubectl get pods -o=name -l k8s-app=nginx-app-clusterip --field-selector=status.phase=Running --kubeconfig=" + kubeConfigFile
			return e2e.RunCommand(cmd)
		}, "120s", "5s").Should(ContainSubstring("ds-clusterip-pod"))

// Checks both IPv4 and IPv6
		clusterips, err := e2e.FetchClusterIP(kubeConfigFile, "ds-clusterip-svc", true)
		Expect(err).NotTo(HaveOccurred())
		for _, ip := range strings.Split(clusterips, ",") {
			if strings.Contains(ip, "::") {
				ip = "[" + ip + "]"
			}
			pods, err := e2e.ParsePods(kubeConfigFile, false)
			Expect(err).NotTo(HaveOccurred())
			for _, pod := range pods {
				if !strings.HasPrefix(pod.Name, "ds-clusterip-pod") {
					continue
				}
				cmd := fmt.Sprintf("curl -L --insecure http://%s", ip)
				Eventually(func() (string, error) {
					return e2e.RunCmdOnNode(cmd, serverNodeNames[0])
				}, "60s", "5s").Should(ContainSubstring("Welcome to nginx!"), "failed cmd: "+cmd)
			}
		}
	})
	It("Verifies Ingress", func() {
		_, err := e2e.DeployWorkload("dualstack_ingress.yaml", kubeConfigFile)
		Expect(err).NotTo(HaveOccurred(), "Ingress manifest not deployed")
		cmd := "kubectl get ingress ds-ingress --kubeconfig=" + kubeConfigFile + " -o jsonpath=\"{.spec.rules[*].host}\""
		hostName, err := e2e.RunCommand(cmd)
		Expect(err).NotTo(HaveOccurred(), "failed cmd: "+cmd)
		nodeIPs, err := getNodeIPs(kubeConfigFile)
		Expect(err).NotTo(HaveOccurred(), "failed cmd: "+cmd)
		for _, node := range nodeIPs {
			cmd := fmt.Sprintf("curl  --header host:%s http://%s/name.html", hostName, node.ipv4)
			Eventually(func() (string, error) {
				return e2e.RunCommand(cmd)
			}, "10s", "2s").Should(ContainSubstring("ds-clusterip-pod"), "failed cmd: "+cmd)
			cmd = fmt.Sprintf("curl  --header host:%s http://[%s]/name.html", hostName, node.ipv6)
			Eventually(func() (string, error) {
				return e2e.RunCommand(cmd)
			}, "5s", "1s").Should(ContainSubstring("ds-clusterip-pod"), "failed cmd: "+cmd)
		}
	})

It("Verifies NodePort Service", func() {
		_, err := e2e.DeployWorkload("dualstack_nodeport.yaml", kubeConfigFile)
		Expect(err).NotTo(HaveOccurred())
		cmd := "kubectl get service ds-nodeport-svc --kubeconfig=" + kubeConfigFile + " --output jsonpath=\"{.spec.ports[0].nodePort}\""
		nodeport, err := e2e.RunCommand(cmd)
		Expect(err).NotTo(HaveOccurred(), "failed cmd: "+cmd)
		nodeIPs, err := getNodeIPs(kubeConfigFile)
		Expect(err).NotTo(HaveOccurred())
		for _, node := range nodeIPs {
			cmd = "curl -L --insecure http://" + node.ipv4 + ":" + nodeport + "/name.html"
			Eventually(func() (string, error) {
				return e2e.RunCommand(cmd)
			}, "10s", "1s").Should(ContainSubstring("ds-nodeport-pod"), "failed cmd: "+cmd)
			cmd = "curl -L --insecure http://[" + node.ipv6 + "]:" + nodeport + "/name.html"
			Eventually(func() (string, error) {
				return e2e.RunCommand(cmd)
			}, "10s", "1s").Should(ContainSubstring("ds-nodeport-pod"), "failed cmd: "+cmd)
		}
	})
	It("Verifies podSelector Network Policy", func() {
		_, err := e2e.DeployWorkload("pod_client.yaml", kubeConfigFile)
		Expect(err).NotTo(HaveOccurred())
		cmd := "kubectl exec svc/client-curl --kubeconfig=" + kubeConfigFile + " -- curl -m7 ds-clusterip-svc/name.html"
		Eventually(func() (string, error) {
			return e2e.RunCommand(cmd)
		}, "20s", "3s").Should(ContainSubstring("ds-clusterip-pod"), "failed cmd: "+cmd)
		_, err = e2e.DeployWorkload("netpol-fail.yaml", kubeConfigFile)
		Expect(err).NotTo(HaveOccurred())
		cmd = "kubectl exec svc/client-curl --kubeconfig=" + kubeConfigFile + " -- curl -m7 ds-clusterip-svc/name.html"
		_, err = e2e.RunCommand(cmd)
		Expect(err).To(HaveOccurred())
		_, err = e2e.DeployWorkload("netpol-work.yaml", kubeConfigFile)
		Expect(err).NotTo(HaveOccurred())
		cmd = "kubectl exec svc/client-curl --kubeconfig=" + kubeConfigFile + " -- curl -m7 ds-clusterip-svc/name.html"
		Eventually(func() (string, error) {
			return e2e.RunCommand(cmd)
		}, "20s", "3s").Should(ContainSubstring("ds-clusterip-pod"), "failed cmd: "+cmd)
	})
})

var failed bool
var _ = AfterEach(func() {
	failed = failed || CurrentSpecReport().Failed()
})

def provision(vm, role, role_num, node_num)
  vm.box = NODE_BOXES[node_num]
  vm.hostname = role
  # An expanded netmask is required to allow VM<-->VM communication, virtualbox defaults to /32
  node_ip = "#{NETWORK_PREFIX}.#{100+node_num}"
  vm.network "private_network", ip: node_ip, netmask: "255.255.255.0"

vagrant_defaults = '../vagrantdefaults.rb'
  load vagrant_defaults if File.exists?(vagrant_defaults)

defaultOSConfigure(vm)

if role.include?("windows")
    vm.provision "shell", path: "../scripts/install-bgp.ps1"
    if !RELEASE_VERSION.empty?
      install_type = "Version=#{RELEASE_VERSION}"
    else 
      vm.provision "shell", path: "../scripts/latest_commit.ps1", args: [GITHUB_BRANCH, "./rke2_commits.txt"]
      install_type = "Commit=(Get-Content -TotalCount 1 ./rke2_commits.txt)"
    end
  else
    if !RELEASE_VERSION.empty?
      install_type = "INSTALL_RKE2_VERSION=#{RELEASE_VERSION}"
    else 
      # Grabs the last 5 commit SHA's from the given branch, then purges any commits that do not have a passing CI build
      vm.provision "shell", path: "../scripts/latest_commit.sh", args: [GITHUB_BRANCH, "/tmp/rke2_commits"]
      install_type = "INSTALL_RKE2_COMMIT=$(head\ -n\ 1\ /tmp/rke2_commits)"
    end
    vm.provision "shell", inline: "ping -c 2 rke2.io"
    vm.provision "Create Calico Manifest", type: "shell", path: "../scripts/calico_manifest.sh", args: [ "#{NETWORK_PREFIX}.1" ]
  end

if role.include?("server") && role_num == 0
    vm.provision :rke2, run: 'once' do |rke2|
      rke2.env = %W[INSTALL_RKE2_TYPE=server #{install_type}]
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
      rke2.config = <<~YAML
        write-kubeconfig-mode: '0644'
        node-external-ip: #{NETWORK_PREFIX}.100
        node-ip: #{NETWORK_PREFIX}.100
        token: vagrant-rke2
        cni: calico
      YAML
    end
    vm.provision "Install sonobuoy", type: "shell", path: "../scripts/install_sonobuoy.sh"
  elsif role.include?("server") && role_num != 0
    vm.provision :rke2, run: 'once' do |rke2|
      rke2.env = %W[INSTALL_RKE2_TYPE=server #{install_type}]
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
      rke2.config = <<~YAML
        write-kubeconfig-mode: '0644'
        node-external-ip: #{node_ip}
        node-ip: #{node_ip}
        server: https://#{NETWORK_PREFIX}.100:9345
        token: vagrant-rke2
        cni: calico
      YAML
    end
  end
  if role.include?("linux-agent")
    vm.provision :rke2, run: 'once' do |rke2|
      rke2.env = %W[INSTALL_RKE2_TYPE=agent #{install_type}]
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
      rke2.install_path = false
      rke2.config = <<~YAML
        write-kubeconfig-mode: '0644'
        node-external-ip: #{node_ip}
        node-ip: #{node_ip}
        server: https://#{NETWORK_PREFIX}.100:9345
        token: vagrant-rke2
      YAML
    end
  end
  if role.include?("windows-agent")
    if !vm.box.match?(/Windows.*2022/) && !vm.box.match?(/Windows.*2019/)
      puts "invalid box: " + vm.box + " found for windows agent"
      abort
    end

# For Windows GUI on virtualbox
    # vm.provider "virtualbox" do |v|
      # v.gui = true
      # v.customize ["modifyvm", :id, "--vram", 128]
      # v.customize ["modifyvm", :id, "--clipboard", "bidirectional"]
      # v.customize ["modifyvm", :id, "--accelerate3d", "on"]
      # v.customize ["modifyvm", :id, "--accelerate2dvideo", "on"]
    # end
    # If using libvirt, use virt-viewer for GUI after bring up the node
    vm.provision :rke2, run: 'once' do |rke2|
      rke2.env = [install_type]
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
      # rke2.skip_start = true
      rke2.config = <<~YAML
        node-external-ip: #{node_ip}
        node-ip: #{node_ip}
        server: https://#{NETWORK_PREFIX}.100:9345
        token: vagrant-rke2
      YAML
    end
  end
end

Vagrant.configure("2") do |config|
  config.vagrant.plugins = ["vagrant-rke2", "vagrant-reload"]
  # For windows, just use the password not the private key
  config.ssh.password    = "vagrant"
  # Default provider is libvirt, virtualbox is only provided as a backup
  config.vm.provider "libvirt" do |v|
    v.cpus = NODE_CPUS
    v.memory = NODE_MEMORY
  end
  config.vm.provider "virtualbox" do |v|
    v.cpus = NODE_CPUS
    v.memory = NODE_MEMORY
    v.linked_clone = false
  end

if NODE_ROLES.kind_of?(String)
    NODE_ROLES = NODE_ROLES.split(" ", -1)
  end
  if NODE_BOXES.kind_of?(String)
    NODE_BOXES = NODE_BOXES.split(" ", -1)
  end

# Must iterate on the index, vagrant does not understand iterating 
  # over the node roles themselves
  NODE_ROLES.length.times do |i|
    name = NODE_ROLES[i]
    config.vm.define name do |node|
      role_num = name.split("-", -1).pop.to_i
      provision(node.vm, name, role_num, i)
    end
  end
end
070701000000D9000081A4000000000000000000000001653C446F00001948000000000000000000000000000000000000003500000000rke2-1.27.7+rke2r1/tests/e2e/mixedos/mixedos_test.gopackage mixedos

import (
	"flag"
	"fmt"
	"os"
	"strconv"
	"strings"
	"testing"

. "github.com/onsi/ginkgo/v2"
	. "github.com/onsi/gomega"
	"github.com/rancher/rke2/tests/e2e"
)

// Valid nodeOS: generic/ubuntu2004, opensuse/Leap-15.3.x86_64
var nodeOS = flag.String("nodeOS", "generic/ubuntu2004", "operating system for linux nodes")
var serverCount = flag.Int("serverCount", 3, "number of server nodes")
var linuxAgentCount = flag.Int("linuxAgentCount", 0, "number of linux agent nodes")
var windowsAgentCount = flag.Int("windowsAgentCount", 1, "number of windows agent nodes")
var ci = flag.Bool("ci", false, "running on CI")

const defaultWindowsOS = "jborean93/WindowsServer2022"

func Test_E2EMixedOSValidation(t *testing.T) {
	flag.Parse()
	RegisterFailHandler(Fail)
	suiteConfig, reporterConfig := GinkgoConfiguration()
	RunSpecs(t, "Validate MixedOS Test Suite", suiteConfig, reporterConfig)
}

func createMixedCluster(nodeOS string, serverCount, linuxAgentCount, windowsAgentCount int) ([]string, []string, []string, error) {
	serverNodeNames := []string{}
	for i := 0; i < serverCount; i++ {
		serverNodeNames = append(serverNodeNames, "server-"+strconv.Itoa(i))
	}
	linuxAgentNames := []string{}
	for i := 0; i < linuxAgentCount; i++ {
		linuxAgentNames = append(linuxAgentNames, "linux-agent-"+strconv.Itoa(i))
	}
	windowsAgentNames := []string{}
	for i := 0; i < linuxAgentCount; i++ {
		windowsAgentNames = append(windowsAgentNames, "linux-agent-"+strconv.Itoa(i))
	}
	nodeRoles := strings.Join(serverNodeNames, " ") + " " + strings.Join(linuxAgentNames, " ") + " " + strings.Join(windowsAgentNames, " ")
	nodeRoles = strings.TrimSpace(nodeRoles)
	nodeBoxes := strings.Repeat(nodeOS+" ", serverCount+linuxAgentCount)
	nodeBoxes += strings.Repeat(defaultWindowsOS+" ", windowsAgentCount)
	nodeBoxes = strings.TrimSpace(nodeBoxes)

var testOptions string
	for _, env := range os.Environ() {
		if strings.HasPrefix(env, "E2E_") {
			testOptions += " " + env
		}
	}

cmd := fmt.Sprintf("NODE_ROLES=\"%s\" NODE_BOXES=\"%s\" %s vagrant up &> vagrant.log", nodeRoles, nodeBoxes, testOptions)
	fmt.Println(cmd)
	if _, err := e2e.RunCommand(cmd); err != nil {
		fmt.Println("Error Creating Cluster", err)
		return nil, nil, nil, err
	}
	return serverNodeNames, linuxAgentNames, windowsAgentNames, nil
}

var (
	kubeConfigFile    string
	serverNodeNames   []string
	linuxAgentNames   []string
	windowsAgentNames []string
)

var _ = ReportAfterEach(e2e.GenReport)
var _ = Describe("Verify Basic Cluster Creation", Ordered, func() {

It("Starts up with no issues", func() {
		var err error
		serverNodeNames, linuxAgentNames, windowsAgentNames, err = createMixedCluster(*nodeOS, *serverCount, *linuxAgentCount, *windowsAgentCount)
		Expect(err).NotTo(HaveOccurred(), e2e.GetVagrantLog(err))
		fmt.Println("CLUSTER CONFIG")
		fmt.Println("OS:", *nodeOS)
		fmt.Println("Server Nodes:", serverNodeNames)
		fmt.Println("Agent Nodes:", linuxAgentNames)
		kubeConfigFile, err = e2e.GenKubeConfigFile(serverNodeNames[0])
		Expect(err).NotTo(HaveOccurred())
	})

It("Checks Node Status", func() {
		Eventually(func(g Gomega) {
			nodes, err := e2e.ParseNodes(kubeConfigFile, false)
			g.Expect(err).NotTo(HaveOccurred())
			for _, node := range nodes {
				g.Expect(node.Status).Should(Equal("Ready"))
			}
		}, "420s", "5s").Should(Succeed())
		_, err := e2e.ParseNodes(kubeConfigFile, true)
		Expect(err).NotTo(HaveOccurred())
	})

_, err = e2e.DeployWorkload("windows_app_deployment.yaml", kubeConfigFile)
		Expect(err).NotTo(HaveOccurred())

// Wait for the pod_client pods to have an IP
		Eventually(func() string {
			ips, _ := e2e.PodIPsUsingLabel(kubeConfigFile, "app=client")
			return ips[0]
		}, "120s", "10s").Should(ContainSubstring("10.42"), "failed getClientIPs")

// Wait for the windows_app_deployment pods to have an IP (We must wait 250s because it takes time)
		Eventually(func() string {
			ips, _ := e2e.PodIPsUsingLabel(kubeConfigFile, "app=windows-app")
			return ips[0]
		}, "620s", "10s").Should(ContainSubstring("10.42"), "failed getClientIPs")

// Test Linux -> Windows communication
		cmd := "kubectl exec svc/client-curl --kubeconfig=" + kubeConfigFile + " -- curl -m7 windows-app-svc:3000"
		Eventually(func() (string, error) {
			return e2e.RunCommand(cmd)
		}, "120s", "3s").Should(ContainSubstring("Welcome to PSTools for K8s Debugging"), "failed cmd: "+cmd)

// Test Windows -> Linux communication
		cmd = "kubectl exec svc/windows-app-svc --kubeconfig=" + kubeConfigFile + " -- curl -m7 client-curl:8080"
		Eventually(func() (string, error) {
			return e2e.RunCommand(cmd)
		}, "20s", "3s").Should(ContainSubstring("Welcome to nginx!"), "failed cmd: "+cmd)
	})
	It("Runs the mixed os sonobuoy plugin", func() {
		cmd := "sonobuoy run --kubeconfig=/etc/rancher/rke2/rke2.yaml --plugin my-sonobuoy-plugins/mixed-workload-e2e/mixed-workload-e2e.yaml --aggregator-node-selector kubernetes.io/os:linux --wait"
		res, err := e2e.RunCmdOnNode(cmd, serverNodeNames[0])
		Expect(err).NotTo(HaveOccurred(), "failed output:"+res)
		cmd = "sonobuoy retrieve --kubeconfig=/etc/rancher/rke2/rke2.yaml"
		testResultTar, err := e2e.RunCmdOnNode(cmd, serverNodeNames[0])
		Expect(err).NotTo(HaveOccurred(), "failed cmd: "+cmd)
		cmd = "sonobuoy results " + testResultTar
		res, err = e2e.RunCmdOnNode(cmd, serverNodeNames[0])
		Expect(err).NotTo(HaveOccurred(), "failed cmd: "+cmd)
		Expect(res).Should(ContainSubstring("Plugin: mixed-workload-e2e\nStatus: passed\n"))
	})

})

var failed bool
var _ = AfterEach(func() {
	failed = failed || CurrentSpecReport().Failed()
})

var _ = AfterSuite(func() {
	if failed && !*ci {
		fmt.Println("FAILED!")
	} else {
		Expect(e2e.DestroyCluster()).To(Succeed())
		Expect(os.Remove(kubeConfigFile)).To(Succeed())
	}
})
070701000000DA000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002C00000000rke2-1.27.7+rke2r1/tests/e2e/resource_files070701000000DB000081A4000000000000000000000001653C446F00000252000000000000000000000000000000000000003B00000000rke2-1.27.7+rke2r1/tests/e2e/resource_files/clusterip.yamlapiVersion: apps/v1
kind: Deployment
metadata:
  name: test-clusterip
spec:
  selector:
    matchLabels:
      k8s-app: nginx-app-clusterip
  replicas: 2
  template:
    metadata:
      labels:
        k8s-app: nginx-app-clusterip
    spec:
      containers:
      - name: nginx
        image: ranchertest/mytestcontainer
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  labels:
    k8s-app: nginx-app-clusterip
  name: nginx-clusterip-svc
  namespace: default 
spec:
  type: ClusterIP
  ports:
    - port: 80
  selector:
    k8s-app: nginx-app-clusterip
070701000000DC000081A4000000000000000000000001653C446F00000509000000000000000000000000000000000000004500000000rke2-1.27.7+rke2r1/tests/e2e/resource_files/csi-driver-host-path.txthttps://github.com/kubernetes-csi/external-provisioner/raw/v3.4.0/deploy/kubernetes/rbac.yaml
https://github.com/kubernetes-csi/external-attacher/raw/v4.2.0/deploy/kubernetes/rbac.yaml
https://github.com/kubernetes-csi/external-snapshotter/raw/v6.2.1/deploy/kubernetes/csi-snapshotter/rbac-csi-snapshotter.yaml
https://github.com/kubernetes-csi/external-resizer/raw/v1.7.0/deploy/kubernetes/rbac.yaml
https://github.com/kubernetes-csi/external-health-monitor/raw/v0.8.0/deploy/kubernetes/external-health-monitor-controller/rbac.yaml
https://github.com/kubernetes-csi/csi-driver-host-path/raw/v1.11.0/deploy/kubernetes-1.24/hostpath/csi-hostpath-driverinfo.yaml
https://github.com/kubernetes-csi/csi-driver-host-path/raw/v1.11.0/deploy/kubernetes-1.24/hostpath/csi-hostpath-plugin.yaml
https://github.com/kubernetes-csi/csi-driver-host-path/raw/v1.11.0/deploy/kubernetes-1.24/hostpath/csi-hostpath-snapshotclass.yaml
https://github.com/kubernetes-csi/csi-driver-host-path/raw/v1.11.0/examples/csi-storageclass.yaml
https://github.com/kubernetes-csi/csi-driver-host-path/raw/v1.11.0/examples/csi-pvc.yaml
https://github.com/kubernetes-csi/csi-driver-host-path/raw/v1.11.0/examples/csi-app.yaml
https://github.com/kubernetes-csi/csi-driver-host-path/raw/v1.11.0/examples/csi-snapshot-v1.yaml
070701000000DD000081A4000000000000000000000001653C446F0000014A000000000000000000000000000000000000003B00000000rke2-1.27.7+rke2r1/tests/e2e/resource_files/daemonset.yamlapiVersion: apps/v1
kind: DaemonSet
metadata:
  name: test-daemonset
spec:
  selector:
    matchLabels:
      k8s-app: test-daemonset
  template:
    metadata:
      labels:
        k8s-app: test-daemonset
    spec:
      containers:
        - name: webserver
          image: nginx
          ports:
          - containerPort: 80
070701000000DE000081A4000000000000000000000001653C446F0000010E000000000000000000000000000000000000003A00000000rke2-1.27.7+rke2r1/tests/e2e/resource_files/dnsutils.yamlapiVersion: v1
kind: Pod
metadata:
  name: dnsutils
  namespace: default
spec:
  containers:
  - name: dnsutils
    image: gcr.io/kubernetes-e2e-test-images/dnsutils:1.3
    command:
      - sleep
      - "3600"
    imagePullPolicy: IfNotPresent
  restartPolicy: Always
070701000000DF000081A4000000000000000000000001653C446F0000029C000000000000000000000000000000000000004500000000rke2-1.27.7+rke2r1/tests/e2e/resource_files/dualstack_clusterip.yamlapiVersion: apps/v1
kind: Deployment
metadata:
  name: ds-clusterip-pod
spec:
  selector:
    matchLabels:
      k8s-app: nginx-app-clusterip
  replicas: 2
  template:
    metadata:
      labels:
        k8s-app: nginx-app-clusterip
    spec:
      containers:
      - name: nginx
        image: ranchertest/mytestcontainer
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  labels:
    k8s-app: nginx-app-clusterip
  name: ds-clusterip-svc
  namespace: default 
spec:
  type: ClusterIP
  ipFamilyPolicy: PreferDualStack
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
  selector:
    k8s-app: nginx-app-clusterip
070701000000E0000081A4000000000000000000000001653C446F00000153000000000000000000000000000000000000004300000000rke2-1.27.7+rke2r1/tests/e2e/resource_files/dualstack_ingress.yamlapiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ds-ingress
spec:
  rules:
  - host: testds.com
    http:
      paths:
      - backend:
          service:
            # Reliant on dualstack_clusterip.yaml
            name: ds-clusterip-svc
            port:
              number: 80
        pathType: ImplementationSpecific070701000000E1000081A4000000000000000000000001653C446F00000292000000000000000000000000000000000000004400000000rke2-1.27.7+rke2r1/tests/e2e/resource_files/dualstack_nodeport.yamlapiVersion: apps/v1
kind: Deployment
metadata:
  name: ds-nodeport-pod
spec:
  selector:
    matchLabels:
      k8s-app: nginx-app-nodeport
  replicas: 2
  template:
    metadata:
      labels:
        k8s-app: nginx-app-nodeport
    spec:
      containers:
      - name: nginx
        image: ranchertest/mytestcontainer
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  labels:
    k8s-app: nginx-app-nodeport
  name: ds-nodeport-svc
  namespace: default
spec:
  type: NodePort
  ipFamilyPolicy: PreferDualStack
  ports:
    - port: 80
      nodePort: 30096
      name: http
  selector:
    k8s-app: nginx-app-nodeport
070701000000E2000081A4000000000000000000000001653C446F00000395000000000000000000000000000000000000003900000000rke2-1.27.7+rke2r1/tests/e2e/resource_files/ingress.yamlapiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test-ingress
spec:
  rules:
  - host: foo1.bar.com
    http:
      paths:
      - backend:
          service:
            name: nginx-ingress-svc
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
---
apiVersion: v1
kind: Service
metadata:
 name: nginx-ingress-svc
 labels:
   k8s-app: nginx-app-ingress
spec:
 ports:
 - port: 80
   targetPort: 80
   protocol: TCP
   name: http
 selector:
   k8s-app: nginx-app-ingress
---
apiVersion: v1
kind: ReplicationController
metadata:
 name: test-ingress
spec:
 replicas: 2
 selector:
   k8s-app: nginx-app-ingress
 template:
   metadata:
     labels:
       k8s-app: nginx-app-ingress
   spec:
     terminationGracePeriodSeconds: 60
     containers:
     - name: testcontainer
       image: ranchertest/mytestcontainer
       ports:
       - containerPort: 80
070701000000E3000081A4000000000000000000000001653C446F0000029A000000000000000000000000000000000000003E00000000rke2-1.27.7+rke2r1/tests/e2e/resource_files/loadbalancer.yaml---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-loadbalancer
spec:
  selector:
    matchLabels:
      k8s-app: nginx-app-loadbalancer
  replicas: 2
  template:
    metadata:
      labels:
        k8s-app: nginx-app-loadbalancer
    spec:
      containers:
      - name: nginx
        image: ranchertest/mytestcontainer
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
 name: nginx-loadbalancer-svc
 labels:
   k8s-app: nginx-app-loadbalancer
spec:
 type: LoadBalancer
 externalIPs:
 - 10.10.10.100
 ports:
 - port: 81
   targetPort: 80
   protocol: TCP
   name: http
 selector:
   k8s-app: nginx-app-loadbalancer
070701000000E4000081A4000000000000000000000001653C446F00000365000000000000000000000000000000000000004800000000rke2-1.27.7+rke2r1/tests/e2e/resource_files/local-path-provisioner.yaml---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: local-pv-volume
  labels:
    type: local
spec:
  storageClassName: manual
  capacity:
    storage: 500Mi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: "/data"
  claimRef:
    namespace: default
    name: local-path-pvc
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: local-path-pvc
  namespace: default
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: ""
  resources:
    requests:
      storage: 500Mi
---
apiVersion: v1
kind: Pod
metadata:
  name: volume-test
  namespace: default
spec:
  containers:
  - name: volume-test
    image: nginx:stable-alpine
    imagePullPolicy: IfNotPresent
    volumeMounts:
    - name: volv
      mountPath: /data
    ports:
    - containerPort: 80
  volumes:
  - name: volv
    persistentVolumeClaim:
      claimName: local-path-pvc
070701000000E5000081A4000000000000000000000001653C446F00000157000000000000000000000000000000000000003D00000000rke2-1.27.7+rke2r1/tests/e2e/resource_files/netpol-fail.yamlapiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      k8s-app: nginx-app-clusterip
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: whatever
    ports:
    - protocol: TCP
      port: 80
070701000000E6000081A4000000000000000000000001653C446F00000155000000000000000000000000000000000000003D00000000rke2-1.27.7+rke2r1/tests/e2e/resource_files/netpol-work.yamlapiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      k8s-app: nginx-app-clusterip
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: client
    ports:
    - protocol: TCP
      port: 80
070701000000E7000081A4000000000000000000000001653C446F00000271000000000000000000000000000000000000003A00000000rke2-1.27.7+rke2r1/tests/e2e/resource_files/nodeport.yamlapiVersion: apps/v1
kind: Deployment
metadata:
  name: test-nodeport
spec:
  selector:
    matchLabels:
      k8s-app: nginx-app-nodeport
  replicas: 2
  template:
    metadata:
      labels:
        k8s-app: nginx-app-nodeport
    spec:
      containers:
      - name: nginx
        image: ranchertest/mytestcontainer
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  labels:
    k8s-app: nginx-app-nodeport
  name: nginx-nodeport-svc
  namespace: default
spec:
  type: NodePort
  ports:
    - port: 80
      nodePort: 30096
      name: http
  selector:
    k8s-app: nginx-app-nodeport
070701000000E8000081A4000000000000000000000001653C446F0000047D000000000000000000000000000000000000003C00000000rke2-1.27.7+rke2r1/tests/e2e/resource_files/pod_client.yamlapiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: client
  name: client-deployment
spec:
  replicas: 2
  selector:
    matchLabels:
      app: client
  template:
    metadata:
      labels:
        app: client
    spec:
      containers:
      - image: ranchertest/mytestcontainer
        imagePullPolicy: Always
        name: client-curl
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - client
            topologyKey: kubernetes.io/hostname
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: kubernetes.io/os
                operator: In
                values:
                - linux
---
apiVersion: v1
kind: Service
metadata:
  name: client-curl
  labels:
    app: client
    service: client-curl
spec:
  type: ClusterIP
  selector:
    app: client
  ports:
  - port: 8080
    protocol: TCP
    targetPort: 80
070701000000E9000081A4000000000000000000000001653C446F00000374000000000000000000000000000000000000004800000000rke2-1.27.7+rke2r1/tests/e2e/resource_files/windows_app_deployment.yamlapiVersion: apps/v1
kind: Deployment
metadata:
  name: windows-app-deployment
spec:
  selector:
    matchLabels:
      app: windows-app
  replicas: 2
  template:
    metadata:
      labels:
        app: windows-app
    spec:
      containers:
        - name: windows-app
          image: mbuilsuse/pstools:v0.2.0
          ports:
            - containerPort: 3000
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: kubernetes.io/os
                operator: In
                values:
                - windows
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: windows-app-svc
  name: windows-app-svc
  namespace: default
spec:
  type: NodePort
  ports:
    - port: 3000
      nodePort: 30096
      name: http
  selector:
    app: windows-app
070701000000EA000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002500000000rke2-1.27.7+rke2r1/tests/e2e/scripts070701000000EB000081A4000000000000000000000001653C446F00000230000000000000000000000000000000000000003800000000rke2-1.27.7+rke2r1/tests/e2e/scripts/calico_manifest.sh#!/bin/bash
ip4_addr=$1

# Override default calico and specify the interface for windows-agent
# by default, the windows-agent use a different interface name than the linux-agent
mkdir -p /var/lib/rancher/rke2/server/manifests

echo "Creating calico chart"
echo "apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: rke2-calico
  namespace: kube-system
spec:
  valuesContent: |-
    installation:
      calicoNetwork:
        nodeAddressAutodetectionV4:
          canReach: $ip4_addr" >> /var/lib/rancher/rke2/server/manifests/e2e-calico.yaml
070701000000EC000081A4000000000000000000000001653C446F00000127000000000000000000000000000000000000003500000000rke2-1.27.7+rke2r1/tests/e2e/scripts/install-bgp.ps1echo "Installing RemoteAccess, RSAT-RemoteAccess-PowerShell and Routing packages"
Install-WindowsFeature RemoteAccess
Install-WindowsFeature RSAT-RemoteAccess-PowerShell
Install-WindowsFeature Routing
echo "Installing remoteAccess vpntype: routingOnly"
Install-RemoteAccess -VpnType RoutingOnly
070701000000ED000081A4000000000000000000000001653C446F0000011D000000000000000000000000000000000000003900000000rke2-1.27.7+rke2r1/tests/e2e/scripts/install_sonobuoy.sh#!/bin/bash
git clone https://github.com/phillipsj/my-sonobuoy-plugins.git
wget -q https://github.com/vmware-tanzu/sonobuoy/releases/download/v0.56.0/sonobuoy_0.56.0_linux_amd64.tar.gz
tar -xvf sonobuoy_0.56.0_linux_amd64.tar.gz
chmod +x sonobuoy && mv sonobuoy /usr/local/bin/sonobuoy070701000000EE000081A4000000000000000000000001653C446F000007EC000000000000000000000000000000000000002D00000000rke2-1.27.7+rke2r1/tests/e2e/scripts/ipv6.sh#!/bin/bash
ip4_addr=$1
ip6_addr=$2
ip6_addr_gw=$3
cni=$4
os=$5

sysctl -w net.ipv6.conf.all.disable_ipv6=0
sysctl -w net.ipv6.conf.eth1.accept_dad=0

if [ -z "${os##*ubuntu*}" ]; then
  netplan set ethernets.eth1.accept-ra=false
  netplan set ethernets.eth1.addresses=["$ip4_addr"/24,"$ip6_addr"/64]
  netplan set ethernets.eth1.gateway6="$ip6_addr_gw"
  netplan apply
elif [ -z "${os##*alpine*}" ]; then
  iplink set eth1 down
  iplink set eth1 up
  ip -6 addr add "$ip6_addr"/64 dev eth1
  ip -6 r add default via "$ip6_addr_gw"
else
  ip -6 addr add "$ip6_addr"/64 dev eth1
  ip -6 r add default via "$ip6_addr_gw"
fi
ip addr show dev eth1
ip -6 r

echo "net.ipv6.conf.all.disable_ipv6=0
net.ipv6.conf.eth1.accept_dad=0" > /etc/sysctl.conf

# Override default CNI and specify the interface since we don't have a default IPv6 route
mkdir -p /var/lib/rancher/rke2/server/manifests

case "$cni" in
  "canal")
    echo "Creating canal chart"
    echo "apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: rke2-canal
  namespace: kube-system
spec:
  valuesContent: |-
    flannel:
      iface: \"eth1\"
    calico:
      ipAutoDetectionMethod: \"interface=eth1.*\"
      ip6AutoDetectionMethod: \"interface=eth1.*\"" >> /var/lib/rancher/rke2/server/manifests/e2e-canal.yaml
  ;;
  
  "cilium")
    echo "Creating cilium chart"
    echo "apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: rke2-cilium
  namespace: kube-system
spec:
  valuesContent: |-
    devices: eth1
    ipv6:
      enabled: true">> /var/lib/rancher/rke2/server/manifests/e2e-cilium.yaml
  ;;
  
  "calico")
    echo "Creating calico chart"
    echo "apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: rke2-calico
  namespace: kube-system
spec:
  valuesContent: |-
    installation:
      calicoNetwork:
        nodeAddressAutodetectionV4:
          interface: eth1.* 
        nodeAddressAutodetectionV6:
          interface: eth1.* " >> /var/lib/rancher/rke2/server/manifests/e2e-calico.yaml
  ;;
esac
070701000000EF000081A4000000000000000000000001653C446F000003F9000000000000000000000000000000000000003700000000rke2-1.27.7+rke2r1/tests/e2e/scripts/latest_commit.ps1# Grabs the last 5 commit SHA's from the given branch, then purges any commits that do not have a passing CI build
param ($Branch, $CommitFile)
(Invoke-RestMethod "https://api.github.com/repos/rancher/rke2/commits?per_page=5&sha=$Branch").sha | `
Out-File -FilePath $CommitFile

$StorageUrl = "https://rke2-ci-builds.s3.amazonaws.com/rke2-images.windows-amd64-"
$TopCommit = (Get-Content -TotalCount 1 $CommitFile)
$StatusCode = Invoke-WebRequest $StorageUrl$TopCommit".tar.zst.sha256sum" -DisableKeepAlive -UseBasicParsing -Method head | % {$_.StatusCode}
$Iterations = 0
while (($StatusCode -ne 200) -AND ($Iterations -lt 6)) {
    $Iterations++
    (Get-Content $CommitFile | Select-Object -Skip 1) | Set-Content $CommitFile
    $TopCommit = (Get-Content -TotalCount 1 $CommitFile)
    $StatusCode = Invoke-WebRequest $StorageUrl$TopCommit".tar.zst.sha256sum" -DisableKeepAlive -UseBasicParsing -Method head | % {$_.StatusCode}
}

if ($Iterations -ge 6){
    Write-Host echo "No valid commits found" 
    Exit 1
}
070701000000F0000081ED000000000000000000000001653C446F000002BB000000000000000000000000000000000000003600000000rke2-1.27.7+rke2r1/tests/e2e/scripts/latest_commit.sh#!/bin/bash
# Grabs the last 5 commit SHA's from the given branch, then purges any commits that do not have a passing CI build
iterations=0
curl -s -H 'Accept: application/vnd.github.v3+json' "https://api.github.com/repos/rancher/rke2/commits?per_page=5&sha=$1" | jq -r '.[] | .sha'  &> "$2"
curl -s --fail https://rke2-ci-builds.s3.amazonaws.com/rke2-images.linux-amd64-$(head -n 1 $2).tar.zst.sha256sum
while [ $? -ne 0 ]; do
    ((iterations++))
    if [ "$iterations" -ge 6 ]; then
        echo "No valid commits found"
        exit 1
    fi
    sed -i 1d "$2"
    sleep 1
    curl -s --fail https://rke2-ci-builds.s3.amazonaws.com/rke2-images.linux-amd64-$(head -n 1 $2).tar.zst.sha256sum
done
070701000000F1000081A4000000000000000000000001653C446F0000012F000000000000000000000000000000000000003100000000rke2-1.27.7+rke2r1/tests/e2e/scripts/registry.sh#!/bin/bash

# Script to to point rke2 to the docker registry running on the host
# This is used to avoid hitting dockerhub rate limits on E2E runners
ip_addr=$1

mkdir -p /etc/rancher/rke2/
echo "mirrors:
  docker.io:
    endpoint:
      - \"http://$ip_addr:5000\"" >> /etc/rancher/rke2/registries.yaml070701000000F2000081ED000000000000000000000001653C446F000009D4000000000000000000000000000000000000003200000000rke2-1.27.7+rke2r1/tests/e2e/scripts/run_tests.sh#!/bin/bash
nodeOS=${1:-"generic/ubuntu2004"}
servercount=${2:-3}
agentcount=${3:-1}
db=${4:-"etcd"}
hardened=${5:-""}
rke2_version=${rke2_version}
rke2_channel=${rke2_channel:-"commit"}

E2E_EXTERNAL_DB=$db && export E2E_EXTERNAL_DB
E2E_REGISTRY=true && export E2E_REGISTRY

cd
cd rke2 && git pull --rebase origin master
/usr/local/go/bin/go mod tidy

cd tests/e2e
OS=$(echo "$nodeOS"|cut -d'/' -f2)
echo "$OS"

# create directory to store reports if it does not exists
if [ ! -d createreport ]
then
	mkdir createreport
fi

count=0
run_tests(){
	count=$(( count + 1 ))
	vagrant global-status | awk '/running/'|cut -c1-7| xargs -r -d '\n' -n 1 -- vagrant destroy -f

E2E_RELEASE_VERSION=$rke2_version && export E2E_RELEASE_VERSION
	E2E_RELEASE_CHANNEL=$rke2_channel && export E2E_RELEASE_CHANNEL

echo 'RUNNING CLUSTER UPGRADE TEST'
	E2E_REGISTRY=true /usr/local/go/bin/go test -v ./upgradecluster/upgradecluster_test.go -nodeOS="$nodeOS" -serverCount=$((servercount)) -agentCount=$((agentcount)) -timeout=1h -json -ci |tee createreport/rke2_"$OS".log

echo 'RUNNING DUALSTACK VALIDATION TEST'
	E2E_HARDENED="$hardened" /usr/local/go/bin/go test -v dualstack/dualstack_test.go -nodeOS="$nodeOS" -serverCount=1 -agentCount=1  -timeout=30m -json -ci |tee -a createreport/rke2_"$OS".log

echo 'RUNNING CLUSTER VALIDATION TEST'
	E2E_REGISTRY=true E2E_HARDENED="$hardened" /usr/local/go/bin/go test -v validatecluster/validatecluster_test.go -nodeOS="$nodeOS" -serverCount=$((servercount)) -agentCount=$((agentcount))  -timeout=30m -json -ci |tee -a createreport/rke2_"$OS".log

echo 'RUNNING MIXEDOS TEST'
	/usr/local/go/bin/go test -v mixedos/mixedos_test.go -nodeOS="$nodeOS" -serverCount=$((servercount)) -timeout=1h -json -ci |tee -a  createreport/rke2_"$OS".log

echo 'RUNNING SPLIT SERVER VALIDATION TEST'
	E2E_HARDENED="$hardened" /usr/local/go/bin/go test -v splitserver/splitserver_test.go -nodeOS="$nodeOS" -timeout=30m -json -ci |tee -a createreport/rke2_"$OS".log
}

ls createreport/rke2_"$OS".log 2>/dev/null && rm createreport/rke2_"$OS".log
run_tests

# re-run test if first run fails and keep record of repeatedly failed test to debug
while [ -f createreport/rke2_"$OS".log ] && grep -w ":fail" createreport/rke2_"$OS".log && [ $count -le 2 ]
do
        cp createreport/rke2_"$OS".log createreport/rke2_"$OS"_"$count".log
        run_tests
done

# Generate report and upload to s3 bucket
cd createreport && /usr/local/go/bin/go run -v report-template-bindata.go generate_report.go -f rke2_"OS".log
070701000000F3000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002900000000rke2-1.27.7+rke2r1/tests/e2e/splitserver070701000000F4000081A4000000000000000000000001653C446F0000126C000000000000000000000000000000000000003500000000rke2-1.27.7+rke2r1/tests/e2e/splitserver/VagrantfileENV['VAGRANT_NO_PARALLEL'] = 'no'
NODE_ROLES = (ENV['E2E_NODE_ROLES'] ||
  ["server-etcd-0", "server-cp-0", "server-cp-1", "agent-0"])
NODE_BOXES = (ENV['E2E_NODE_BOXES'] ||
  ['generic/ubuntu2004', 'generic/ubuntu2004', 'generic/ubuntu2004', 'generic/ubuntu2004', 'generic/ubuntu2004'])
GITHUB_BRANCH = (ENV['E2E_GITHUB_BRANCH'] || "master")
RELEASE_VERSION = (ENV['E2E_RELEASE_VERSION'] || "")
NODE_CPUS = (ENV['E2E_NODE_CPUS'] || 2).to_i
NODE_MEMORY = (ENV['E2E_NODE_MEMORY'] || 3072).to_i
# Virtualbox >= 6.1.28 require `/etc/vbox/network.conf` for expanded private networks 
NETWORK_PREFIX = "10.10.10"
install_type = ""

defaultOSConfigure(vm)
  install_type = getInstallType(vm, RELEASE_VERSION, GITHUB_BRANCH)

vm.provision "ping rke2.io", type: "shell", inline: "ping -c 2 rke2.io"
  
  if node_num == 0 && !role.include?("server") && !role.include?("etcd")
    puts "first node must be a etcd server"
    abort
  elsif role.include?("server") && role.include?("etcd") && role_num == 0
    vm.provision 'rke2-install', type: 'rke2', run: 'once' do |rke2|
      rke2.env = %W[INSTALL_RKE2_TYPE=server #{install_type}]
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
      rke2.config = <<~YAML
        write-kubeconfig-mode: '0644'
        node-external-ip: #{NETWORK_PREFIX}.100
        node-ip: #{NETWORK_PREFIX}.100
        token: vagrant-rke2
        disable-apiserver: true
        disable-controller-manager: true
        disable-scheduler: true
        node-taint:
        - node-role.kubernetes.io/etcd:NoExecute
      YAML
    end
  elsif role.include?("server") && role.include?("etcd") && role_num != 0
    vm.provision 'rke2-install', type: 'rke2', run: 'once' do |rke2|
      rke2.env = %W[INSTALL_RKE2_TYPE=server #{install_type}]
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
      rke2.config = <<~YAML
        write-kubeconfig-mode: '0644'
        node-external-ip: #{node_ip}
        node-ip: #{node_ip}
        server: https://#{NETWORK_PREFIX}.100:9345
        token: vagrant-rke2
        disable-apiserver: true
        disable-controller-manager: true
        disable-scheduler: true
        node-taint:
        - node-role.kubernetes.io/etcd:NoExecute
      YAML
    end
  elsif role.include?("server") && role.include?("cp")
    vm.provision 'rke2-install', type: 'rke2', run: 'once' do |rke2|
      rke2.env = %W[INSTALL_RKE2_TYPE=server #{install_type}]
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
      rke2.config = <<~YAML
        write-kubeconfig-mode: '0644'
        node-ip: #{node_ip}
        node-external-ip: #{node_ip}
        server: https://#{NETWORK_PREFIX}.100:9345
        token: vagrant-rke2
        disable-etcd: true
        node-taint:
        - node-role.kubernetes.io/control-plane:NoSchedule
      YAML
    end
  end
  if role.include?("agent")
    vm.provision 'rke2-install', type: 'rke2', run: 'once' do |rke2|
      rke2.env = %W[INSTALL_RKE2_TYPE=agent #{install_type}]
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
      rke2.install_path = false
      rke2.config = <<~YAML
        write-kubeconfig-mode: '0644'
        node-ip: #{node_ip}
        server: https://#{NETWORK_PREFIX}.100:9345
        token: vagrant-rke2
      YAML
    end
  end
end

Vagrant.configure("2") do |config|
  config.vagrant.plugins = ["vagrant-rke2"]
  # Default provider is libvirt, virtualbox is only provided as a backup
  config.vm.provider "libvirt" do |v|
    v.cpus = NODE_CPUS
    v.memory = NODE_MEMORY
  end
  config.vm.provider "virtualbox" do |v|
    v.cpus = NODE_CPUS
    v.memory = NODE_MEMORY
  end
  
  if NODE_ROLES.kind_of?(String)
    NODE_ROLES = NODE_ROLES.split(" ", -1)
  end
  if NODE_BOXES.kind_of?(String)
    NODE_BOXES = NODE_BOXES.split(" ", -1)
  end

# Must iterate on the index, vagrant does not understand iterating 
  # over the node roles themselves
  NODE_ROLES.length.times do |i|
    name = NODE_ROLES[i]
    role_num = name.split("-", -1).pop.to_i
    config.vm.define name do |node|
      provision(node.vm, name, role_num, i)
    end
  end
end
070701000000F5000081A4000000000000000000000001653C446F00002079000000000000000000000000000000000000003D00000000rke2-1.27.7+rke2r1/tests/e2e/splitserver/splitserver_test.gopackage splitserver

import (
	"flag"
	"fmt"
	"os"
	"strconv"
	"strings"
	"testing"

. "github.com/onsi/ginkgo/v2"
	. "github.com/onsi/gomega"
	"github.com/rancher/rke2/tests/e2e"
)

// Valid nodeOS: generic/ubuntu2004, opensuse/Leap-15.3.x86_64
var nodeOS = flag.String("nodeOS", "generic/ubuntu2004", "VM operating system")
var etcdCount = flag.Int("etcdCount", 1, "number of server nodes only deploying etcd")
var controlPlaneCount = flag.Int("controlPlaneCount", 1, "number of server nodes acting as control plane")
var agentCount = flag.Int("agentCount", 1, "number of agent nodes")
var ci = flag.Bool("ci", false, "running on CI")

// Environment Variables Info:
// E2E_RELEASE_VERSION=v1.23.1+rke2r1 or nil for latest commit from master

func createSplitCluster(nodeOS string, etcdCount, controlPlaneCount, agentCount int) ([]string, []string, []string, error) {
	etcdNodeNames := make([]string, etcdCount)
	for i := 0; i < etcdCount; i++ {
		etcdNodeNames[i] = "server-etcd-" + strconv.Itoa(i)
	}
	cpNodeNames := make([]string, controlPlaneCount)
	for i := 0; i < controlPlaneCount; i++ {
		cpNodeNames[i] = "server-cp-" + strconv.Itoa(i)
	}
	agentNodeNames := make([]string, agentCount)
	for i := 0; i < agentCount; i++ {
		agentNodeNames[i] = "agent-" + strconv.Itoa(i)
	}
	nodeRoles := strings.Join(etcdNodeNames, " ") + " " + strings.Join(cpNodeNames, " ") + " " + strings.Join(agentNodeNames, " ")

nodeRoles = strings.TrimSpace(nodeRoles)
	nodeBoxes := strings.Repeat(nodeOS+" ", etcdCount+controlPlaneCount+agentCount)
	nodeBoxes = strings.TrimSpace(nodeBoxes)

var testOptions string
	for _, env := range os.Environ() {
		if strings.HasPrefix(env, "E2E_") {
			testOptions += " " + env
		}
	}

cmd := fmt.Sprintf(`E2E_NODE_ROLES="%s" E2E_NODE_BOXES="%s" %s vagrant up &> vagrant.log`, nodeRoles, nodeBoxes, testOptions)
	fmt.Println(cmd)
	if _, err := e2e.RunCommand(cmd); err != nil {
		fmt.Println("Error Creating Cluster", err)
		return nil, nil, nil, err
	}
	return etcdNodeNames, cpNodeNames, agentNodeNames, nil
}
func Test_E2ESplitServer(t *testing.T) {
	RegisterFailHandler(Fail)
	flag.Parse()
	suiteConfig, reporterConfig := GinkgoConfiguration()
	RunSpecs(t, "Split Server Test Suite", suiteConfig, reporterConfig)
}

var (
	kubeConfigFile string
	etcdNodeNames  []string
	cpNodeNames    []string
	agentNodeNames []string
)
var _ = ReportAfterEach(e2e.GenReport)
var _ = Describe("Verify Create", Ordered, func() {
	Context("Cluster :", func() {
		It("Starts up with no issues", func() {
			var err error
			etcdNodeNames, cpNodeNames, agentNodeNames, err = createSplitCluster(*nodeOS, *etcdCount, *controlPlaneCount, *agentCount)
			Expect(err).NotTo(HaveOccurred(), e2e.GetVagrantLog(err))
			fmt.Println("CLUSTER CONFIG")
			fmt.Println("OS:", *nodeOS)
			fmt.Println("Etcd Server Nodes:", etcdNodeNames)
			fmt.Println("Control Plane Server Nodes:", cpNodeNames)
			fmt.Println("Agent Nodes:", agentNodeNames)
			kubeConfigFile, err = e2e.GenKubeConfigFile(cpNodeNames[0])
			Expect(err).NotTo(HaveOccurred())
		})

It("Checks Node and Pod Status", func() {
			fmt.Printf("\nFetching node status\n")
			Eventually(func(g Gomega) {
				nodes, err := e2e.ParseNodes(kubeConfigFile, false)
				g.Expect(err).NotTo(HaveOccurred())
				for _, node := range nodes {
					g.Expect(node.Status).Should(Equal("Ready"))
				}
			}, "420s", "5s").Should(Succeed())
			_, _ = e2e.ParseNodes(kubeConfigFile, true)

fmt.Printf("\nFetching Pods status\n")
			Eventually(func(g Gomega) {
				pods, err := e2e.ParsePods(kubeConfigFile, false)
				g.Expect(err).NotTo(HaveOccurred())
				for _, pod := range pods {
					if strings.Contains(pod.Name, "helm-install") {
						g.Expect(pod.Status).Should(Equal("Completed"), pod.Name)
					} else {
						g.Expect(pod.Status).Should(Equal("Running"), pod.Name)
					}
				}
			}, "420s", "5s").Should(Succeed())
			_, _ = e2e.ParsePods(kubeConfigFile, true)
		})

It("Verifies ClusterIP Service", func() {
			_, err := e2e.DeployWorkload("clusterip.yaml", kubeConfigFile)
			Expect(err).NotTo(HaveOccurred(), "Cluster IP manifest not deployed")

cmd := "kubectl get pods -o=name -l k8s-app=nginx-app-clusterip --field-selector=status.phase=Running --kubeconfig=" + kubeConfigFile
			Eventually(func() (string, error) {
				return e2e.RunCommand(cmd)
			}, "240s", "5s").Should(ContainSubstring("test-clusterip"), "failed cmd: "+cmd)

clusterip, _ := e2e.FetchClusterIP(kubeConfigFile, "nginx-clusterip-svc", false)
			cmd = "curl -L --insecure http://" + clusterip + "/name.html"
			for _, nodeName := range cpNodeNames {
				Eventually(func() (string, error) {
					return e2e.RunCmdOnNode(cmd, nodeName)
				}, "120s", "10s").Should(ContainSubstring("test-clusterip"), "failed cmd: "+cmd)
			}
		})

It("Verifies NodePort Service", func() {
			_, err := e2e.DeployWorkload("nodeport.yaml", kubeConfigFile)
			Expect(err).NotTo(HaveOccurred(), "NodePort manifest not deployed")

for _, nodeName := range cpNodeNames {
				nodeExternalIP, _ := e2e.FetchNodeExternalIP(nodeName)
				cmd := "kubectl get service nginx-nodeport-svc --kubeconfig=" + kubeConfigFile + " --output jsonpath=\"{.spec.ports[0].nodePort}\""
				nodeport, err := e2e.RunCommand(cmd)
				Expect(err).NotTo(HaveOccurred())

cmd = "kubectl get pods -o=name -l k8s-app=nginx-app-nodeport --field-selector=status.phase=Running --kubeconfig=" + kubeConfigFile
				Eventually(func() (string, error) {
					return e2e.RunCommand(cmd)
				}, "240s", "5s").Should(ContainSubstring("test-nodeport"), "nodeport pod was not created")

cmd = "curl -L --insecure http://" + nodeExternalIP + ":" + nodeport + "/name.html"
				Eventually(func() (string, error) {
					return e2e.RunCommand(cmd)
				}, "240s", "5s").Should(ContainSubstring("test-nodeport"), "failed cmd: "+cmd)
			}
		})

It("Verifies LoadBalancer Service", func() {
			_, err := e2e.DeployWorkload("loadbalancer.yaml", kubeConfigFile)
			Expect(err).NotTo(HaveOccurred(), "Loadbalancer manifest not deployed")

cmd := "kubectl get service nginx-loadbalancer-svc --kubeconfig=" + kubeConfigFile + " --output jsonpath=\"{.spec.externalIPs[0]}:{.spec.ports[0].port}\""
			ipPort, err := e2e.RunCommand(cmd)
			Expect(err).NotTo(HaveOccurred())

cmd = "kubectl get pods -o=name -l k8s-app=nginx-app-loadbalancer --field-selector=status.phase=Running --kubeconfig=" + kubeConfigFile
			Eventually(func() (string, error) {
				return e2e.RunCommand(cmd)
			}, "240s", "5s").Should(ContainSubstring("test-loadbalancer"))

cmd = "curl -L --insecure http://" + ipPort + "/name.html"
			Eventually(func() (string, error) {
				return e2e.RunCommand(cmd)
			}, "240s", "5s").Should(ContainSubstring("test-loadbalancer"), "failed cmd: "+cmd)
		})

It("Verifies Daemonset", func() {
			_, err := e2e.DeployWorkload("daemonset.yaml", kubeConfigFile)
			Expect(err).NotTo(HaveOccurred(), "Daemonset manifest not deployed")

Eventually(func(g Gomega) {
				pods, _ := e2e.ParsePods(kubeConfigFile, false)
				count := e2e.CountOfStringInSlice("test-daemonset", pods)
				fmt.Println("POD COUNT")
				fmt.Println(count)
				fmt.Println("CP COUNT")
				fmt.Println(len(cpNodeNames))
				g.Expect(len(cpNodeNames)).Should((Equal(count)), "Daemonset pod count does not match cp node count")
			}, "240s", "10s").Should(Succeed())
		})

It("Verifies dns access", func() {
			_, err := e2e.DeployWorkload("dnsutils.yaml", kubeConfigFile)
			Expect(err).NotTo(HaveOccurred(), "dnsutils manifest not deployed")

cmd := "kubectl get pods dnsutils --kubeconfig=" + kubeConfigFile
			Eventually(func() (string, error) {
				return e2e.RunCommand(cmd)
			}, "420s", "2s").Should(ContainSubstring("dnsutils"), "failed cmd: "+cmd)

cmd = "kubectl --kubeconfig=" + kubeConfigFile + " exec -i -t dnsutils -- nslookup kubernetes.default"
			Eventually(func() (string, error) {
				return e2e.RunCommand(cmd)
			}, "420s", "2s").Should(ContainSubstring("kubernetes.default.svc.cluster.local"), "failed cmd: "+cmd)
		})
	})
})

var failed = false
var _ = AfterEach(func() {
	failed = failed || CurrentSpecReport().Failed()
})

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"os"
	"os/exec"
	"path/filepath"
	"strconv"
	"strings"
	"time"

"github.com/onsi/ginkgo/v2"
	"golang.org/x/sync/errgroup"
)

type Node struct {
	Name       string
	Status     string
	Roles      string
	InternalIP string
	ExternalIP string
}

type Pod struct {
	NameSpace string
	Name      string
	Ready     string
	Status    string
	Restarts  string
	NodeIP    string
	Node      string
}

type NodeError struct {
	Node string
	Cmd  string
	Err  error
}

func (ne *NodeError) Error() string {
	return fmt.Sprintf("failed creating cluster: %s: %v", ne.Cmd, ne.Err)
}

func (ne *NodeError) Unwrap() error {
	return ne.Err
}

func newNodeError(cmd, node string, err error) *NodeError {
	return &NodeError{
		Cmd:  cmd,
		Node: node,
		Err:  err,
	}
}

func CountOfStringInSlice(str string, pods []Pod) int {
	count := 0
	for _, pod := range pods {
		if strings.Contains(pod.Name, str) {
			count++
		}
	}
	return count
}

// genNodeEnvs generates the node and testing environment variables for vagrant up
func genNodeEnvs(nodeOS string, serverCount, agentCount int) ([]string, []string, string) {
	serverNodeNames := make([]string, serverCount)
	for i := 0; i < serverCount; i++ {
		serverNodeNames[i] = "server-" + strconv.Itoa(i)
	}
	agentNodeNames := make([]string, agentCount)
	for i := 0; i < agentCount; i++ {
		agentNodeNames[i] = "agent-" + strconv.Itoa(i)
	}

nodeRoles := strings.Join(serverNodeNames, " ") + " " + strings.Join(agentNodeNames, " ")
	nodeRoles = strings.TrimSpace(nodeRoles)

nodeBoxes := strings.Repeat(nodeOS+" ", serverCount+agentCount)
	nodeBoxes = strings.TrimSpace(nodeBoxes)

nodeEnvs := fmt.Sprintf(`E2E_NODE_ROLES="%s" E2E_NODE_BOXES="%s"`, nodeRoles, nodeBoxes)

return serverNodeNames, agentNodeNames, nodeEnvs
}

func CreateCluster(nodeOS string, serverCount int, agentCount int) ([]string, []string, error) {

serverNodeNames, agentNodeNames, nodeEnvs := genNodeEnvs(nodeOS, serverCount, agentCount)

var testOptions string
	for _, env := range os.Environ() {
		if strings.HasPrefix(env, "E2E_") {
			testOptions += " " + env
		}
	}

// Bring up the first server node
	cmd := fmt.Sprintf(`%s %s vagrant up %s &> vagrant.log`, nodeEnvs, testOptions, serverNodeNames[0])

fmt.Println(cmd)
	if _, err := RunCommand(cmd); err != nil {
		return nil, nil, newNodeError(cmd, serverNodeNames[0], err)
	}

// Bring up the rest of the nodes in parallel
	errg, _ := errgroup.WithContext(context.Background())
	for _, node := range append(serverNodeNames[1:], agentNodeNames...) {
		cmd := fmt.Sprintf(`%s %s vagrant up %s &>> vagrant.log`, nodeEnvs, testOptions, node)
		errg.Go(func() error {
			if _, err := RunCommand(cmd); err != nil {
				return newNodeError(cmd, node, err)
			}
			return nil
		})
		// We must wait a bit between provisioning nodes to avoid too many learners attempting to join the cluster
		time.Sleep(40 * time.Second)
	}
	if err := errg.Wait(); err != nil {
		return nil, nil, err
	}

return serverNodeNames, agentNodeNames, nil
}

func DeployWorkload(workload string, kubeconfig string) (string, error) {
	resourceDir := "../resource_files"
	files, err := os.ReadDir(resourceDir)
	if err != nil {
		fmt.Println("Unable to read resource manifest file for ", workload)
	}
	fmt.Println("\nDeploying", workload)
	for _, f := range files {
		filename := filepath.Join(resourceDir, f.Name())
		if strings.TrimSpace(f.Name()) == workload {
			cmd := "kubectl apply -f " + filename + " --kubeconfig=" + kubeconfig
			return RunCommand(cmd)
		}
	}
	return "", nil
}

// RestartCluster restarts the rke2 service on each server-agent given
func RestartCluster(nodeNames []string) error {
	for _, nodeName := range nodeNames {
		const cmd = "sudo systemctl restart rke2-*"
		if _, err := RunCmdOnNode(cmd, nodeName); err != nil {
			return err
		}
	}
	return nil
}

func DestroyCluster() error {
	if _, err := RunCommand("vagrant destroy -f"); err != nil {
		return err
	}
	return os.Remove("vagrant.log")
}

func FetchClusterIP(kubeconfig string, servicename string, dualStack bool) (string, error) {
	if dualStack {
		cmd := "kubectl get svc " + servicename + " -o jsonpath='{.spec.clusterIPs}' --kubeconfig=" + kubeconfig
		res, err := RunCommand(cmd)
		if err != nil {
			return res, err
		}
		res = strings.ReplaceAll(res, "\"", "")
		return strings.Trim(res, "[]"), nil
	}
	cmd := "kubectl get svc " + servicename + " -o jsonpath='{.spec.clusterIP}' --kubeconfig=" + kubeconfig
	return RunCommand(cmd)
}

func FetchIngressIP(kubeconfig string) ([]string, error) {
	cmd := "kubectl get ing  ingress  -o jsonpath='{.status.loadBalancer.ingress[*].ip}' --kubeconfig=" + kubeconfig
	res, err := RunCommand(cmd)
	if err != nil {
		return nil, err
	}
	ingressIP := strings.Trim(res, " ")
	ingressIPs := strings.Split(ingressIP, " ")
	return ingressIPs, nil
}

func FetchNodeExternalIP(nodename string) (string, error) {
	cmd := "vagrant ssh " + nodename + " -c  \"ip -f inet addr show eth1| awk '/inet / {print $2}'|cut -d/ -f1\""
	ipaddr, err := RunCommand(cmd)
	if err != nil {
		return "", err
	}
	ips := strings.Trim(ipaddr, "")
	ip := strings.Split(ips, "inet")
	nodeip := strings.TrimSpace(ip[1])
	return nodeip, nil
}

// GenReport returns the relevant lines from test results in json format
func GenReport(specReport ginkgo.SpecReport) {
	state := struct {
		State string        `json:"state"`
		Name  string        `json:"name"`
		Type  string        `json:"type"`
		Time  time.Duration `json:"time"`
	}{
		State: specReport.State.String(),
		Name:  specReport.LeafNodeText,
		Type:  "rke2 test",
		Time:  specReport.RunTime,
	}
	status, _ := json.Marshal(state)
	fmt.Printf("%s", status)
}

// GetVagrantLog returns the logs of on vagrant commands that initialize the nodes and provision RKE2 on each node.
// It also attempts to fetch the systemctl logs of RKE2 on nodes where the rke2.service failed.
func GetVagrantLog(cErr error) string {
	var nodeErr *NodeError
	nodeJournal := ""
	if errors.As(cErr, &nodeErr) {
		nodeJournal, _ = RunCommand("vagrant ssh " + nodeErr.Node + " -c \"sudo journalctl -u rke2* --no-pager\"")
		nodeJournal = "\nNode Journal Logs:\n" + nodeJournal
	}

log, err := os.Open("vagrant.log")
	if err != nil {
		return err.Error()
	}
	bytes, err := io.ReadAll(log)
	if err != nil {
		return err.Error()
	}
	return string(bytes) + nodeJournal
}

func GenKubeConfigFile(serverName string) (string, error) {
	cmd := fmt.Sprintf("vagrant ssh %s -c \"sudo cat /etc/rancher/rke2/rke2.yaml\"", serverName)
	kubeConfig, err := RunCommand(cmd)
	if err != nil {
		return "", err
	}
	nodeIP, err := FetchNodeExternalIP(serverName)
	if err != nil {
		return "", err
	}
	kubeConfig = strings.Replace(kubeConfig, "127.0.0.1", nodeIP, 1)
	kubeConfigFile := fmt.Sprintf("kubeconfig-%s", serverName)
	if err := os.WriteFile(kubeConfigFile, []byte(kubeConfig), 0644); err != nil {
		return "", err
	}
	return kubeConfigFile, nil
}

func ParseNodes(kubeConfig string, print bool) ([]Node, error) {
	nodes := make([]Node, 0, 10)
	nodeList := ""

cmd := "kubectl get nodes --no-headers -o wide -A --kubeconfig=" + kubeConfig
	res, err := RunCommand(cmd)

if err != nil {
		return nil, fmt.Errorf("failed cmd: %s, %w", cmd, err)
	}
	nodeList = strings.TrimSpace(res)
	split := strings.Split(nodeList, "\n")
	for _, rec := range split {
		if strings.TrimSpace(rec) != "" {
			fields := strings.Fields(rec)
			node := Node{
				Name:       fields[0],
				Status:     fields[1],
				Roles:      fields[2],
				InternalIP: fields[5],
				ExternalIP: fields[6],
			}
			nodes = append(nodes, node)
		}
	}
	if print {
		fmt.Println(nodeList)
	}
	return nodes, nil
}

func ParsePods(kubeconfig string, print bool) ([]Pod, error) {
	pods := make([]Pod, 0, 10)
	podList := ""

cmd := "kubectl get pods -o wide --no-headers -A --kubeconfig=" + kubeconfig
	res, _ := RunCommand(cmd)
	res = strings.TrimSpace(res)
	podList = res

split := strings.Split(res, "\n")
	for _, rec := range split {
		fields := strings.Fields(string(rec))
		pod := Pod{
			NameSpace: fields[0],
			Name:      fields[1],
			Ready:     fields[2],
			Status:    fields[3],
			Restarts:  fields[4],
			NodeIP:    fields[6],
			Node:      fields[7],
		}
		pods = append(pods, pod)
	}
	if print {
		fmt.Println(podList)
	}
	return pods, nil
}

// RunCmdOnNode executes a command from within the given node
func RunCmdOnNode(cmd string, nodename string) (string, error) {
	communicator := "ssh"
	runcmd := "vagrant " + communicator + " -c \"" + cmd + "\" " + nodename
	return RunCommand(runcmd)
}

// RunCommand execute a command on the host
func RunCommand(cmd string) (string, error) {
	c := exec.Command("bash", "-c", cmd)
	out, err := c.CombinedOutput()
	return string(out), err
}

// StartCluster starts the rke2 service on each node given
func StartCluster(nodeNames []string) error {
	for _, nodeName := range nodeNames {
		cmd := "sudo systemctl start rke2"
		if strings.Contains(nodeName, "server") {
			cmd += "-server"
		}
		if strings.Contains(nodeName, "agent") {
			cmd += "-agent"
		}
		if _, err := RunCmdOnNode(cmd, nodeName); err != nil {
			return err
		}
	}
	return nil
}

// StopCluster starts the rke2 service on each node given
func StopCluster(nodeNames []string) error {
	for _, nodeName := range nodeNames {
		cmd := "sudo systemctl stop rke2*"
		if _, err := RunCmdOnNode(cmd, nodeName); err != nil {
			return err
		}
	}
	return nil
}

func UpgradeCluster(serverNodenames []string, agentNodenames []string) error {
	for _, nodeName := range serverNodenames {
		cmd := "E2E_RELEASE_CHANNEL=commit vagrant provision " + nodeName
		fmt.Println(cmd)
		if out, err := RunCommand(cmd); err != nil {
			fmt.Println("Error Upgrading Cluster", out)
			return err
		}
	}
	for _, nodeName := range agentNodenames {
		cmd := "E2E_RELEASE_CHANNEL=commit vagrant provision " + nodeName
		if _, err := RunCommand(cmd); err != nil {
			fmt.Println("Error Upgrading Cluster", err)
			return err
		}
	}
	return nil
}

// PodIPsUsingLabel returns the IPs of the pods with a label (only single-stack supported)
func PodIPsUsingLabel(kubeConfigFile string, label string) ([]string, error) {
	cmd := `kubectl get pods -l ` + label + ` -o=jsonpath='{range .items[*]}{.status.podIPs[*].ip}{" "}{end}' --kubeconfig=` + kubeConfigFile
	res, err := RunCommand(cmd)
	if err != nil {
		return nil, err
	}

return strings.Split(res, " "), nil
}
070701000000F7000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002C00000000rke2-1.27.7+rke2r1/tests/e2e/upgradecluster070701000000F8000081A4000000000000000000000001653C446F0000106B000000000000000000000000000000000000003800000000rke2-1.27.7+rke2r1/tests/e2e/upgradecluster/VagrantfileENV['VAGRANT_NO_PARALLEL'] = 'no'
NODE_ROLES = (ENV['E2E_NODE_ROLES'] ||
  ["server-0", "server-1", "server-2", "agent-0"])
NODE_BOXES = (ENV['E2E_NODE_BOXES'] ||
  ['generic/ubuntu2004', 'generic/ubuntu2004', 'generic/ubuntu2004', 'generic/ubuntu2004'])
RELEASE_CHANNEL = (ENV['E2E_RELEASE_CHANNEL'] || "latest")
RELEASE_VERSION = (ENV['E2E_RELEASE_VERSION'] || "")
NODE_CPUS = (ENV['E2E_NODE_CPUS'] || 2).to_i
NODE_MEMORY = (ENV['E2E_NODE_MEMORY'] || 3072).to_i
REGISTRY = (ENV['E2E_REGISTRY'] || "")
# Virtualbox >= 6.1.28 require `/etc/vbox/network.conf` for expanded private networks 
NETWORK_PREFIX = "10.10.10"
install_type = ""

def provision(vm, roles, role_num, node_num)
  vm.box = NODE_BOXES[node_num]
  vm.hostname = "#{roles[0]}-#{role_num}"
  # An expanded netmask is required to allow VM<-->VM communication, virtualbox defaults to /32
  node_ip = "#{NETWORK_PREFIX}.#{100+node_num}"
  vm.network "private_network", ip: node_ip, netmask: "255.255.255.0"

scripts_location = Dir.exists?("./scripts/") ? "./scripts/" : "../scripts/"
  vagrant_defaults = '../vagrantdefaults.rb'
  load vagrant_defaults if File.exists?(vagrant_defaults)
  
  defaultOSConfigure(vm)
  
  if !RELEASE_VERSION.empty?
    install_type = "INSTALL_RKE2_VERSION=#{RELEASE_VERSION}"
  elsif RELEASE_CHANNEL == "commit"
    vm.provision "shell", path: scripts_location + "latest_commit.sh", args: ["master", "/tmp/rke2_commits"]
    install_type = "INSTALL_RKE2_COMMIT=$(head\ -n\ 1\ /tmp/rke2_commits)"
  else
    vm.provision "latest version", type: "shell",
      inline: "curl -w '%{url_effective}' -L -s -S https://update.rke2.io/v1-release/channels/#{RELEASE_CHANNEL} -o /dev/null | sed -e 's|.*/||'  &> /tmp/rke2_version"
    install_type = "INSTALL_RKE2_VERSION=$(cat\ /tmp/rke2_version)"
  end

if !REGISTRY.empty?
    vm.provision "Set private registry", type: "shell", path: scripts_location + "/registry.sh", args: [ "#{NETWORK_PREFIX}.1" ]
  end
  
  vm.provision "shell", inline: "ping -c 2 rke2.io"

if roles.include?("server") && role_num == 0
    vm.provision :rke2, run: 'once' do |rke2|
      rke2.env = %W[INSTALL_RKE2_TYPE=server #{install_type}]
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
      rke2.config = <<~YAML
        write-kubeconfig-mode: '0644'
        node-external-ip: #{NETWORK_PREFIX}.100
        token: vagrant-rke2
      YAML
    end
  elsif roles.include?("server") && role_num != 0
    vm.provision :rke2, run: 'once' do |rke2|
      rke2.env = %W[INSTALL_RKE2_TYPE=server #{install_type}]
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
      rke2.config = <<~YAML
        write-kubeconfig-mode: '0644'
        node-external-ip: #{node_ip}
        server: https://#{NETWORK_PREFIX}.100:9345
        token: vagrant-rke2
      YAML
    end
  end
  if roles.include?("agent")
    vm.provision :rke2, run: 'once' do |rke2|
      rke2.env = %W[INSTALL_RKE2_TYPE=agent #{install_type}]
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
      rke2.install_path = false
      rke2.config = <<~YAML
        write-kubeconfig-mode: '0644'
        node-external-ip: #{node_ip}
        server: https://#{NETWORK_PREFIX}.100:9345
        token: vagrant-rke2
      YAML
    end
  end
end

Vagrant.configure("2") do |config|
  config.vagrant.plugins = ["vagrant-rke2", "vagrant-reload", "vagrant-libvirt"]
  # Default provider is libvirt, virtualbox is only provided as a backup
  config.vm.provider "libvirt" do |v|
    v.cpus = NODE_CPUS
    v.memory = NODE_MEMORY
  end
  config.vm.provider "virtualbox" do |v|
    v.cpus = NODE_CPUS
    v.memory = NODE_MEMORY
  end
  
  if NODE_ROLES.kind_of?(String)
    NODE_ROLES = NODE_ROLES.split(" ", -1)
  end
  if NODE_BOXES.kind_of?(String)
    NODE_BOXES = NODE_BOXES.split(" ", -1)
  end

# Must iterate on the index, vagrant does not understand iterating 
  # over the node roles themselves
  NODE_ROLES.length.times do |i|
    name = NODE_ROLES[i]
    config.vm.define name do |node|
      roles = name.split("-", -1)
      role_num = roles.pop.to_i
      provision(node.vm, roles, role_num, i)
    end
  end
end
070701000000F9000081A4000000000000000000000001653C446F000036FD000000000000000000000000000000000000004300000000rke2-1.27.7+rke2r1/tests/e2e/upgradecluster/upgradecluster_test.gopackage upgradecluster

import (
	"flag"
	"fmt"
	"os"
	"strings"
	"testing"

. "github.com/onsi/ginkgo/v2"
	. "github.com/onsi/gomega"
	"github.com/rancher/rke2/tests/e2e"
)

// Valid nodeOS: generic/ubuntu2004, opensuse/Leap-15.3.x86_64
var nodeOS = flag.String("nodeOS", "generic/ubuntu2004", "VM operating system")
var serverCount = flag.Int("serverCount", 3, "number of server nodes")
var agentCount = flag.Int("agentCount", 1, "number of agent nodes")
var ci = flag.Bool("ci", false, "running on CI")

// Environment Variables Info:
// E2E_RELEASE_VERSION=v1.23.3+rke2r1
// OR
// E2E_RELEASE_CHANNEL=(commit|latest|stable), commit pulls latest commit from master

func Test_E2EUpgradeValidation(t *testing.T) {
	RegisterFailHandler(Fail)
	flag.Parse()
	suiteConfig, reporterConfig := GinkgoConfiguration()
	RunSpecs(t, "Upgrade Cluster Test Suite", suiteConfig, reporterConfig)
}

var (
	kubeConfigFile  string
	serverNodeNames []string
	agentNodeNames  []string
)

var _ = ReportAfterEach(e2e.GenReport)

var _ = Describe("Verify Upgrade", Ordered, func() {
	Context("Cluster :", func() {
		It("Starts up with no issues", func() {
			var err error
			serverNodeNames, agentNodeNames, err = e2e.CreateCluster(*nodeOS, *serverCount, *agentCount)
			Expect(err).NotTo(HaveOccurred(), e2e.GetVagrantLog(err))
			fmt.Println("CLUSTER CONFIG")
			fmt.Println("OS:", *nodeOS)
			fmt.Println("Server Nodes:", serverNodeNames)
			fmt.Println("Agent Nodes:", agentNodeNames)
			kubeConfigFile, err = e2e.GenKubeConfigFile(serverNodeNames[0])
			Expect(err).NotTo(HaveOccurred())
		})

It("Verifies ClusterIP Service", func() {
			_, err := e2e.DeployWorkload("clusterip.yaml", kubeConfigFile)

Expect(err).NotTo(HaveOccurred(), "Cluster IP manifest not deployed")

clusterip, _ := e2e.FetchClusterIP(kubeConfigFile, "nginx-clusterip-svc", false)
			cmd = "curl -L --insecure http://" + clusterip + "/name.html"
			for _, nodeName := range serverNodeNames {
				Eventually(func() (string, error) {
					return e2e.RunCmdOnNode(cmd, nodeName)
				}, "120s", "10s").Should(ContainSubstring("test-clusterip"), "failed cmd: "+cmd)
			}
		})

It("Verifies NodePort Service", func() {
			_, err := e2e.DeployWorkload("nodeport.yaml", kubeConfigFile)
			Expect(err).NotTo(HaveOccurred(), "NodePort manifest not deployed")

for _, nodeName := range serverNodeNames {
				nodeExternalIP, _ := e2e.FetchNodeExternalIP(nodeName)
				cmd := "kubectl get service nginx-nodeport-svc --kubeconfig=" + kubeConfigFile + " --output jsonpath=\"{.spec.ports[0].nodePort}\""
				nodeport, err := e2e.RunCommand(cmd)
				Expect(err).NotTo(HaveOccurred(), "failed cmd: "+cmd)

cmd = "curl -L --insecure http://" + nodeExternalIP + ":" + nodeport + "/name.html"
				fmt.Println(cmd)
				Eventually(func() (string, error) {
					return e2e.RunCommand(cmd)
				}, "240s", "5s").Should(ContainSubstring("test-nodeport"), "failed cmd: "+cmd)
			}
		})

It("Verifies LoadBalancer Service", func() {
			_, err := e2e.DeployWorkload("loadbalancer.yaml", kubeConfigFile)
			Expect(err).NotTo(HaveOccurred())
			ip, err := e2e.FetchNodeExternalIP(serverNodeNames[0])
			Expect(err).NotTo(HaveOccurred(), "Loadbalancer manifest not deployed")
			cmd := "kubectl get service nginx-loadbalancer-svc --kubeconfig=" + kubeConfigFile + " --output jsonpath=\"{.spec.ports[0].port}\""
			port, err := e2e.RunCommand(cmd)
			Expect(err).NotTo(HaveOccurred())

cmd = "curl -L --insecure http://" + ip + ":" + port + "/name.html"
			Eventually(func() (string, error) {
				return e2e.RunCommand(cmd)
			}, "240s", "5s").Should(ContainSubstring("test-loadbalancer"), "failed cmd: "+cmd)
		})

It("Verifies Ingress", func() {
			_, err := e2e.DeployWorkload("ingress.yaml", kubeConfigFile)
			Expect(err).NotTo(HaveOccurred(), "Ingress manifest not deployed")

for _, nodeName := range serverNodeNames {
				ip, _ := e2e.FetchNodeExternalIP(nodeName)
				cmd := "curl  --header host:foo1.bar.com" + " http://" + ip + "/name.html"
				Eventually(func() (string, error) {
					return e2e.RunCommand(cmd)
				}, "240s", "5s").Should(ContainSubstring("test-ingress"), "failed cmd: "+cmd)
			}
		})

It("Verifies Daemonset", func() {
			_, err := e2e.DeployWorkload("daemonset.yaml", kubeConfigFile)
			Expect(err).NotTo(HaveOccurred(), "Daemonset manifest not deployed")

nodes, _ := e2e.ParseNodes(kubeConfigFile, false) //nodes :=
			pods, _ := e2e.ParsePods(kubeConfigFile, false)

It("Verifies dns access", func() {
			_, err := e2e.DeployWorkload("dnsutils.yaml", kubeConfigFile)
			Expect(err).NotTo(HaveOccurred(), "dnsutils manifest not deployed")

Eventually(func() (string, error) {
				cmd := "kubectl get pods dnsutils --kubeconfig=" + kubeConfigFile
				return e2e.RunCommand(cmd)
			}, "420s", "2s").Should(ContainSubstring("dnsutils"))

cmd := "kubectl --kubeconfig=" + kubeConfigFile + " exec -i -t dnsutils -- nslookup kubernetes.default"
			Eventually(func() (string, error) {
				return e2e.RunCommand(cmd)
			}, "420s", "2s").Should(ContainSubstring("kubernetes.default.svc.cluster.local"))
		})

It("Verifies Local Path Provisioner storage ", func() {
			_, err := e2e.DeployWorkload("local-path-provisioner.yaml", kubeConfigFile)
			Expect(err).NotTo(HaveOccurred(), "local-path-provisioner manifest not deployed")
			Eventually(func(g Gomega) {
				cmd := "kubectl get pvc local-path-pvc --kubeconfig=" + kubeConfigFile
				res, err := e2e.RunCommand(cmd)
				g.Expect(err).NotTo(HaveOccurred())
				fmt.Println(res)
				g.Expect(res).Should(ContainSubstring("local-path-pvc"))
				g.Expect(res).Should(ContainSubstring("Bound"))
			}, "240s", "2s").Should(Succeed())

Eventually(func(g Gomega) {
				cmd := "kubectl get pod volume-test --kubeconfig=" + kubeConfigFile
				res, err := e2e.RunCommand(cmd)
				g.Expect(err).NotTo(HaveOccurred())
				fmt.Println(res)

g.Expect(res).Should(ContainSubstring("volume-test"))
				g.Expect(res).Should(ContainSubstring("Running"))
			}, "420s", "2s").Should(Succeed())

cmd := "kubectl --kubeconfig=" + kubeConfigFile + " exec volume-test -- sh -c 'echo local-path-test > /data/test'"
			_, err = e2e.RunCommand(cmd)
			Expect(err).NotTo(HaveOccurred())
			fmt.Println("Data stored in pvc: local-path-test")

})

It("Upgrades with no issues", func() {
			var err error
			err = e2e.UpgradeCluster(serverNodeNames, agentNodeNames)
			fmt.Println(err)
			Expect(err).NotTo(HaveOccurred())
			fmt.Println("CLUSTER UPGRADED")
			kubeConfigFile, err = e2e.GenKubeConfigFile(serverNodeNames[0])
			Expect(err).NotTo(HaveOccurred())
		})

It("After upgrade Checks Node and Pod Status", func() {
			fmt.Printf("\nFetching node status\n")
			Eventually(func(g Gomega) {
				nodes, err := e2e.ParseNodes(kubeConfigFile, false)
				g.Expect(err).NotTo(HaveOccurred())
				for _, node := range nodes {
					g.Expect(node.Status).Should(Equal("Ready"))
				}
			}, "420s", "5s").Should(Succeed())
			e2e.ParseNodes(kubeConfigFile, true)

fmt.Printf("\nFetching Pods status\n")
			Eventually(func(g Gomega) {
				pods, err := e2e.ParsePods(kubeConfigFile, false)
				g.Expect(err).NotTo(HaveOccurred())
				for _, pod := range pods {
					if strings.Contains(pod.Name, "helm-install") {
						g.Expect(pod.Status).Should(Equal("Completed"))
					} else {
						g.Expect(pod.Status).Should(Equal("Running"))
					}
				}
			}, "420s", "5s").Should(Succeed())
			e2e.ParsePods(kubeConfigFile, true)
		})

It("After upgrade verifies ClusterIP Service", func() {
			Eventually(func() (string, error) {
				cmd := "kubectl get pods -o=name -l k8s-app=nginx-app-clusterip --field-selector=status.phase=Running --kubeconfig=" + kubeConfigFile
				return e2e.RunCommand(cmd)
			}, "420s", "5s").Should(ContainSubstring("test-clusterip"))

clusterip, _ := e2e.FetchClusterIP(kubeConfigFile, "nginx-clusterip-svc", false)
			cmd := "curl -L --insecure http://" + clusterip + "/name.html"
			fmt.Println(cmd)
			for _, nodeName := range serverNodeNames {
				Eventually(func() (string, error) {
					return e2e.RunCmdOnNode(cmd, nodeName)
				}, "120s", "10s").Should(ContainSubstring("test-clusterip"), "failed cmd: "+cmd)
			}
		})

It("After upgrade verifies NodePort Service", func() {

Eventually(func() (string, error) {
					cmd := "kubectl get pods -o=name -l k8s-app=nginx-app-nodeport --field-selector=status.phase=Running --kubeconfig=" + kubeConfigFile
					return e2e.RunCommand(cmd)
				}, "240s", "5s").Should(ContainSubstring("test-nodeport"), "nodeport pod was not created")

It("After upgrade verifies LoadBalancer Service", func() {
			ip, err := e2e.FetchNodeExternalIP(serverNodeNames[0])
			Expect(err).NotTo(HaveOccurred())
			cmd := "kubectl get service nginx-loadbalancer-svc --kubeconfig=" + kubeConfigFile + " --output jsonpath=\"{.spec.ports[0].port}\""
			port, err := e2e.RunCommand(cmd)
			Expect(err).NotTo(HaveOccurred())
			cmd = "curl -L --insecure http://" + ip + ":" + port + "/name.html"
			Eventually(func() (string, error) {
				return e2e.RunCommand(cmd)
			}, "240s", "5s").Should(ContainSubstring("test-loadbalancer"), "failed cmd: "+cmd)

Eventually(func() (string, error) {
				cmd := "kubectl get pods -o=name -l k8s-app=nginx-app-loadbalancer --field-selector=status.phase=Running --kubeconfig=" + kubeConfigFile
				return e2e.RunCommand(cmd)
			}, "240s", "5s").Should(ContainSubstring("test-loadbalancer"))
		})

It("After upgrade verifies Ingress", func() {
			for _, nodeName := range serverNodeNames {
				ip, _ := e2e.FetchNodeExternalIP(nodeName)
				cmd := "curl  --header host:foo1.bar.com" + " http://" + ip + "/name.html"
				fmt.Println(cmd)

Eventually(func() (string, error) {
					return e2e.RunCommand(cmd)
				}, "420s", "5s").Should(ContainSubstring("test-ingress"))
			}
		})

It("After upgrade verifies Daemonset", func() {
			nodes, _ := e2e.ParseNodes(kubeConfigFile, false)
			pods, _ := e2e.ParsePods(kubeConfigFile, false)

Eventually(func(g Gomega) {
				count := e2e.CountOfStringInSlice("test-daemonset", pods)
				fmt.Println("POD COUNT")
				fmt.Println(count)
				fmt.Println("NODE COUNT")
				fmt.Println(len(nodes))
				g.Expect(len(nodes)).Should(Equal(count), "Daemonset pod count does not match node count")
			}, "420s", "1s").Should(Succeed())
		})
		It("After upgrade verifies dns access", func() {
			Eventually(func() (string, error) {
				cmd := "kubectl --kubeconfig=" + kubeConfigFile + " exec -i -t dnsutils -- nslookup kubernetes.default"
				return e2e.RunCommand(cmd)
			}, "180s", "2s").Should((ContainSubstring("kubernetes.default.svc.cluster.local")))
		})

It("After upgrade verify Local Path Provisioner storage ", func() {
			cmd := "kubectl exec volume-test cat /data/test --kubeconfig=" + kubeConfigFile
			Eventually(func() (string, error) {
				return e2e.RunCommand(cmd)
			}, "180s", "2s").Should(ContainSubstring("local-path-test"), "failed cmd: "+cmd)

cmd = "kubectl delete pod volume-test --kubeconfig=" + kubeConfigFile
			res, err := e2e.RunCommand(cmd)
			Expect(err).NotTo(HaveOccurred())
			fmt.Println(res)
		})
	})
})

var failed = false
var _ = AfterEach(func() {
	failed = failed || CurrentSpecReport().Failed()
})

def getInstallType(vm, version, branch)
  if version == "skip"
    return "INSTALL_RKE2_ARTIFACT_PATH=/tmp" 
  elsif !version.empty?
    return "INSTALL_RKE2_VERSION=#{version}"
  end
  # Grabs the last 5 commit SHA's from the given branch, then purges any commits that do not have a passing CI build
  scripts_location = Dir.exists?("./scripts") ? "./scripts" : "../scripts" 
  vm.provision "shell", path:  scripts_location + "/latest_commit.sh", args: [branch, "/tmp/rke2_commits"]
  return "INSTALL_RKE2_COMMIT=$(head\ -n\ 1\ /tmp/rke2_commits)"
end

def cisPrep(vm)
  vm.provision "shell", inline: "useradd -r -c 'etcd user' -s /sbin/nologin -M etcd -U"
  vm.provision "shell", inline: "printf 'vm.panic_on_oom=0\nvm.overcommit_memory=1\nkernel.panic=10\nkernel.panic_on_oops=1' > /etc/sysctl.d/60-rke2-cis.conf; systemctl restart systemd-sysctl"
end070701000000FB000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002D00000000rke2-1.27.7+rke2r1/tests/e2e/validatecluster070701000000FC000081A4000000000000000000000001653C446F00000F50000000000000000000000000000000000000003900000000rke2-1.27.7+rke2r1/tests/e2e/validatecluster/VagrantfileENV['VAGRANT_NO_PARALLEL'] = 'no'
NODE_ROLES = (ENV['E2E_NODE_ROLES'] ||
  ["server-0", "server-1", "server-2", "agent-0" ])
NODE_BOXES = (ENV['E2E_NODE_BOXES'] ||
  ['generic/ubuntu2004', 'generic/ubuntu2004', 'generic/ubuntu2004', 'generic/ubuntu2004'])
GITHUB_BRANCH = (ENV['E2E_GITHUB_BRANCH'] || "master")
RELEASE_VERSION = (ENV['E2E_RELEASE_VERSION'] || "")
NODE_CPUS = (ENV['E2E_NODE_CPUS'] || 2).to_i
NODE_MEMORY = (ENV['E2E_NODE_MEMORY'] || 3072).to_i
CNI = (ENV['E2E_CNI'] || "canal") # canal, cilium and calico supported
REGISTRY = (ENV['E2E_REGISTRY'] || "")
# Virtualbox >= 6.1.28 require `/etc/vbox/network.conf` for expanded private networks,
# see https://www.virtualbox.org/manual/ch06.html#network_hostonly
NETWORK_PREFIX = "10.10.10"

scripts_location = Dir.exists?("./scripts") ? "./scripts" : "../scripts" 
  vagrant_defaults = File.exists?("./vagrantdefaults.rb") ? "./vagrantdefaults.rb" : "../vagrantdefaults.rb"
  load vagrant_defaults
  
  defaultOSConfigure(vm)
  install_type = getInstallType(vm, RELEASE_VERSION, GITHUB_BRANCH)
  
  vm.provision "shell", inline: "ping -c 2 rke2.io"
  
  if !REGISTRY.empty?
    vm.provision "Set private registry", type: "shell", path: scripts_location + "/registry.sh", args: [ "#{NETWORK_PREFIX}.1" ]
  end

if roles.include?("server") && role_num == 0
    vm.provision :rke2, run: 'once' do |rke2|
      rke2.env = %W[INSTALL_RKE2_TYPE=server #{install_type}]
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
      rke2.config = <<~YAML
        write-kubeconfig-mode: '0644'
        node-external-ip: #{NETWORK_PREFIX}.100
        node-ip: #{NETWORK_PREFIX}.100
        token: vagrant-rke2
        cni: #{CNI}
      YAML
    end
  elsif roles.include?("server") && role_num != 0
    vm.provision :rke2, run: 'once' do |rke2|
      rke2.env = %W[INSTALL_RKE2_TYPE=server #{install_type}]
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
      rke2.config = <<~YAML
        write-kubeconfig-mode: '0644'
        node-external-ip: #{node_ip}
        node-ip: #{node_ip}
        server: https://#{NETWORK_PREFIX}.100:9345
        token: vagrant-rke2
        cni: #{CNI}
      YAML
    end
  end
  if roles.include?("agent")
    vm.provision :rke2, run: 'once' do |rke2|
      rke2.env = %W[INSTALL_RKE2_TYPE=agent #{install_type}]
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
      rke2.install_path = false
      rke2.config = <<~YAML
        write-kubeconfig-mode: '0644'
        node-external-ip: #{node_ip}
        node-ip: #{node_ip}
        server: https://#{NETWORK_PREFIX}.100:9345
        token: vagrant-rke2
      YAML
    end
  end
end

Vagrant.configure("2") do |config|
  config.vagrant.plugins = ["vagrant-rke2", "vagrant-reload"]
  # Default provider is libvirt, virtualbox is only provided as a backup
  config.vm.provider "libvirt" do |v|
    v.cpus = NODE_CPUS
    v.memory = NODE_MEMORY
  end
  config.vm.provider "virtualbox" do |v|
    v.cpus = NODE_CPUS
    v.memory = NODE_MEMORY
  end
  
  if NODE_ROLES.kind_of?(String)
    NODE_ROLES = NODE_ROLES.split(" ", -1)
  end
  if NODE_BOXES.kind_of?(String)
    NODE_BOXES = NODE_BOXES.split(" ", -1)
  end

# Must iterate on the index, vagrant does not understand iterating 
  # over the node roles themselves
  NODE_ROLES.length.times do |i|
    name = NODE_ROLES[i]
    config.vm.define name do |node|
      roles = name.split("-", -1)
      role_num = roles.pop.to_i
      provision(node.vm, roles, role_num, i)
    end
  end
end
070701000000FD000081A4000000000000000000000001653C446F00003050000000000000000000000000000000000000004500000000rke2-1.27.7+rke2r1/tests/e2e/validatecluster/validatecluster_test.gopackage validatecluster

import (
	"flag"
	"fmt"
	"os"
	"regexp"
	"strings"
	"testing"

. "github.com/onsi/ginkgo/v2"
	. "github.com/onsi/gomega"
	"github.com/rancher/rke2/tests/e2e"
)

// Valid nodeOS: generic/ubuntu2004, opensuse/Leap-15.3.x86_64
var nodeOS = flag.String("nodeOS", "generic/ubuntu2004", "VM operating system")
var serverCount = flag.Int("serverCount", 3, "number of server nodes")
var agentCount = flag.Int("agentCount", 1, "number of agent nodes")
var ci = flag.Bool("ci", false, "running on CI")

// Environment Variables Info:
// E2E_CNI=(canal|cilium|calico)
// E2E_RELEASE_VERSION=v1.23.1+rke2r1 or nil for latest commit from master

func Test_E2EClusterValidation(t *testing.T) {
	flag.Parse()
	RegisterFailHandler(Fail)
	suiteConfig, reporterConfig := GinkgoConfiguration()
	RunSpecs(t, "Validate Cluster Test Suite", suiteConfig, reporterConfig)
}

var (
	kubeConfigFile  string
	serverNodeNames []string
	agentNodeNames  []string
)
var _ = ReportAfterEach(e2e.GenReport)

var _ = Describe("Verify Basic Cluster Creation", Ordered, func() {

It("Checks Node Status", func() {
		Eventually(func(g Gomega) {
			nodes, err := e2e.ParseNodes(kubeConfigFile, false)
			g.Expect(err).NotTo(HaveOccurred())
			for _, node := range nodes {
				g.Expect(node.Status).Should(Equal("Ready"))
			}
		}, "420s", "5s").Should(Succeed())
		_, err := e2e.ParseNodes(kubeConfigFile, true)
		Expect(err).NotTo(HaveOccurred())
	})

It("Verifies ClusterIP Service", func() {
		_, err := e2e.DeployWorkload("clusterip.yaml", kubeConfigFile)
		Expect(err).NotTo(HaveOccurred())
		Eventually(func() (string, error) {
			cmd := "kubectl get pods -o=name -l k8s-app=nginx-app-clusterip --field-selector=status.phase=Running --kubeconfig=" + kubeConfigFile
			return e2e.RunCommand(cmd)
		}, "240s", "5s").Should(ContainSubstring("test-clusterip"))

clusterip, _ := e2e.FetchClusterIP(kubeConfigFile, "nginx-clusterip-svc", false)
		cmd := "curl -L --insecure http://" + clusterip + "/name.html"
		for _, nodeName := range serverNodeNames {
			Expect(e2e.RunCmdOnNode(cmd, nodeName)).Should(ContainSubstring("test-clusterip"), "failed cmd: "+cmd)
		}
	})

It("Verifies NodePort Service", func() {
		_, err := e2e.DeployWorkload("nodeport.yaml", kubeConfigFile)
		Expect(err).NotTo(HaveOccurred())
		for _, nodeName := range serverNodeNames {
			nodeExternalIP, err := e2e.FetchNodeExternalIP(nodeName)
			Expect(err).NotTo(HaveOccurred())
			cmd := "kubectl get service nginx-nodeport-svc --kubeconfig=" + kubeConfigFile + " --output jsonpath=\"{.spec.ports[0].nodePort}\""
			nodeport, err := e2e.RunCommand(cmd)
			Expect(err).NotTo(HaveOccurred(), "failed cmd: "+cmd)
			cmd = "curl -L --insecure http://" + nodeExternalIP + ":" + nodeport + "/name.html"
			Eventually(func() (string, error) {
				return e2e.RunCommand(cmd)
			}, "5s", "1s").Should(ContainSubstring("test-nodeport"), "failed cmd: "+cmd)
			cmd = "kubectl get pods -o=name -l k8s-app=nginx-app-nodeport --field-selector=status.phase=Running --kubeconfig=" + kubeConfigFile
			Eventually(func() (string, error) {
				return e2e.RunCommand(cmd)
			}, "120s", "5s").Should(ContainSubstring("test-nodeport"), "failed cmd: "+cmd)
		}
	})

It("Verifies LoadBalancer Service", func() {
		_, err := e2e.DeployWorkload("loadbalancer.yaml", kubeConfigFile)
		Expect(err).NotTo(HaveOccurred())
		ip, err := e2e.FetchNodeExternalIP(serverNodeNames[0])
		Expect(err).NotTo(HaveOccurred(), "Loadbalancer manifest not deployed")
		cmd := "kubectl get service nginx-loadbalancer-svc --kubeconfig=" + kubeConfigFile + " --output jsonpath=\"{.spec.ports[0].port}\""
		port, err := e2e.RunCommand(cmd)
		Expect(err).NotTo(HaveOccurred())

cmd = "kubectl get pods -o=name -l k8s-app=nginx-app-loadbalancer --field-selector=status.phase=Running --kubeconfig=" + kubeConfigFile
		Eventually(func() (string, error) {
			return e2e.RunCommand(cmd)
		}, "240s", "5s").Should(ContainSubstring("test-loadbalancer"))

cmd = "curl -L --insecure http://" + ip + ":" + port + "/name.html"
		Eventually(func() (string, error) {
			return e2e.RunCommand(cmd)
		}, "240s", "5s").Should(ContainSubstring("test-loadbalancer"), "failed cmd: "+cmd)
	})

It("Verifies Ingress", func() {
		_, err := e2e.DeployWorkload("ingress.yaml", kubeConfigFile)
		Expect(err).NotTo(HaveOccurred())
		for _, nodeName := range serverNodeNames {
			ip, _ := e2e.FetchNodeExternalIP(nodeName)
			cmd := "curl  --header host:foo1.bar.com" + " http://" + ip + "/name.html"
			Eventually(func() (string, error) {
				return e2e.RunCommand(cmd)
			}, "240s", "5s").Should(ContainSubstring("test-ingress"))
		}
	})

It("Verifies Daemonset", func() {
		_, err := e2e.DeployWorkload("daemonset.yaml", kubeConfigFile)
		Expect(err).NotTo(HaveOccurred())
		nodes, err := e2e.ParseNodes(kubeConfigFile, false)
		Expect(err).NotTo(HaveOccurred())

Eventually(func(g Gomega) {
			pods, err := e2e.ParsePods(kubeConfigFile, false)
			g.Expect(err).NotTo(HaveOccurred())
			count := e2e.CountOfStringInSlice("test-daemonset", pods)
			g.Expect(len(nodes)).Should((Equal(count)), "Daemonset pod count does not match node count")
		}, "240s", "10s").Should(Succeed())
	})

It("Verifies dns access", func() {
		_, err := e2e.DeployWorkload("dnsutils.yaml", kubeConfigFile)
		Expect(err).NotTo(HaveOccurred())
		cmd := "kubectl --kubeconfig=" + kubeConfigFile + " exec -i -t dnsutils -- nslookup kubernetes.default"
		Eventually(func() (string, error) {
			return e2e.RunCommand(cmd)
		}, "120s", "2s").Should(ContainSubstring("kubernetes.default.svc.cluster.local"))
	})

It("Verify Local Path Provisioner storage ", func() {
		_, err := e2e.DeployWorkload("local-path-provisioner.yaml", kubeConfigFile)
		Expect(err).NotTo(HaveOccurred())

Eventually(func() (string, error) {
			cmd := "kubectl get pvc local-path-pvc --kubeconfig=" + kubeConfigFile
			return e2e.RunCommand(cmd)
		}, "120s", "2s").Should(MatchRegexp(`local-path-pvc.+Bound`))

Eventually(func() (string, error) {
			cmd := "kubectl get pod volume-test --kubeconfig=" + kubeConfigFile
			return e2e.RunCommand(cmd)
		}, "420s", "2s").Should(MatchRegexp(`volume-test.+Running`))

cmd := "kubectl --kubeconfig=" + kubeConfigFile + " exec volume-test -- sh -c 'echo local-path-test > /data/test'"
		_, err = e2e.RunCommand(cmd)
		Expect(err).NotTo(HaveOccurred())

cmd = "kubectl delete pod volume-test --kubeconfig=" + kubeConfigFile
		_, err = e2e.RunCommand(cmd)
		Expect(err).NotTo(HaveOccurred())

_, err = e2e.DeployWorkload("local-path-provisioner.yaml", kubeConfigFile)
		Expect(err).NotTo(HaveOccurred())

Eventually(func() (string, error) {
			cmd = "kubectl exec volume-test cat /data/test --kubeconfig=" + kubeConfigFile
			return e2e.RunCommand(cmd)
		}, "180s", "2s").Should(ContainSubstring("local-path-test"))
	})

Context("Validate restart", func() {
		It("Restarts normally", func() {
			errRestart := e2e.RestartCluster(append(serverNodeNames, agentNodeNames...))
			Expect(errRestart).NotTo(HaveOccurred(), "Restart Nodes not happened correctly")

Eventually(func(g Gomega) {
				nodes, err := e2e.ParseNodes(kubeConfigFile, false)
				g.Expect(err).NotTo(HaveOccurred())
				for _, node := range nodes {
					g.Expect(node.Status).Should(Equal("Ready"))
				}
				pods, _ := e2e.ParsePods(kubeConfigFile, false)
				count := e2e.CountOfStringInSlice("test-daemonset", pods)
				g.Expect(len(nodes)).Should((Equal(count)), "Daemonset pod count does not match node count")
				podsRunningAr := 0
				for _, pod := range pods {
					if strings.Contains(pod.Name, "test-daemonset") && pod.Status == "Running" && pod.Ready == "1/1" {
						podsRunningAr++
					}
				}
				g.Expect(len(nodes)).Should((Equal(podsRunningAr)), "Daemonset pods are not running after the restart")
			}, "1120s", "5s").Should(Succeed())
		})
	})

Context("Validate Certificate Rotation", func() {
		It("Stops rke2 and rotates certificates", func() {
			errStop := e2e.StopCluster(serverNodeNames)
			Expect(errStop).NotTo(HaveOccurred(), "Cluster could not be stopped successfully")

for _, nodeName := range serverNodeNames {
				cmd := "sudo rke2 certificate rotate"
				if _, err := e2e.RunCmdOnNode(cmd, nodeName); err != nil {
					Expect(err).NotTo(HaveOccurred(), "Certificate could not be rotated successfully")
				}
			}
		})

It("Start normally", func() {
			// Since we stopped all the server, we have to start 2 at once to get it back up
			// If we only start one at a time, the first will hang waiting for the second to be up
			_, err := e2e.RunCmdOnNode("sudo systemctl --no-block start rke2-server", serverNodeNames[0])
			Expect(err).NotTo(HaveOccurred())
			err = e2e.StartCluster(serverNodeNames[1:])
			Expect(err).NotTo(HaveOccurred(), "Cluster could not be started successfully")

Eventually(func(g Gomega) {
				pods, err := e2e.ParsePods(kubeConfigFile, false)
				g.Expect(err).NotTo(HaveOccurred())
				for _, pod := range pods {
					if strings.Contains(pod.Name, "helm-install") {
						g.Expect(pod.Status).Should(Equal("Completed"), pod.Name)
					} else {
						g.Expect(pod.Status).Should(Equal("Running"), pod.Name)
					}
				}
			}, "1120s", "5s").Should(Succeed())
		})

It("Validates certificates", func() {
			const grepCert = "sudo ls -lt /var/lib/rancher/rke2/server/ | grep tls"
			var expectResult = []string{"client-ca.crt",
				"client-ca.key",
				"client-ca.nochain.crt",
				"client-supervisor.crt",
				"client-supervisor.key",
				"dynamic-cert.json", "peer-ca.crt",
				"peer-ca.key", "server-ca.crt",
				"server-ca.key", "request-header-ca.crt",
				"request-header-ca.key", "server-ca.crt",
				"server-ca.key", "server-ca.nochain.crt",
				"service.current.key", "service.key",
				"",
			}

var finalResult string
			var finalErr error
			for _, nodeName := range serverNodeNames {
				grCert, errGrep := e2e.RunCmdOnNode(grepCert, nodeName)
				Expect(errGrep).NotTo(HaveOccurred(), "Certificate could not be created successfully")
				re := regexp.MustCompile("tls-[0-9]+")
				tls := re.FindAllString(grCert, -1)[0]
				final := fmt.Sprintf("sudo diff -sr /var/lib/rancher/rke2/server/tls/ /var/lib/rancher/rke2/server/%s/"+
					"| grep -i identical | cut -f4 -d ' ' | xargs basename -a \n", tls)
				finalResult, finalErr = e2e.RunCmdOnNode(final, nodeName)
				Expect(finalErr).NotTo(HaveOccurred(), "Final Certification does not created successfully")
			}
			errRestartAgent := e2e.RestartCluster(agentNodeNames)
			Expect(errRestartAgent).NotTo(HaveOccurred(), "Agent could not be restart successfully")

finalCert := strings.Replace(finalResult, "\n", ",", -1)
			finalCertArray := strings.Split(finalCert, ",")
			Expect((finalCertArray)).Should((Equal(expectResult)), "Final certification does not match the expected results")

})

})
var failed bool
var _ = AfterEach(func() {
	failed = failed || CurrentSpecReport().Failed()
})

import (
	"regexp"
	"strings"
	"testing"
	"time"

. "github.com/onsi/ginkgo/v2"
	. "github.com/onsi/gomega"
	"github.com/rancher/rke2/tests/util"
)

var serverArgs = []string{"server"}

var _ = Describe("etcd snapshots", func() {
	BeforeEach(func() {
		if !util.ServerArgsPresent(serverArgs) {
			Skip("Test needs rke2 server with: " + strings.Join(serverArgs, " "))
		}
	})
	When("a new etcd is created", func() {
		It("starts up with no problems", func() {
			Eventually(util.Rke2Ready(), "90s", "1s").Should(BeTrue())
		})
		It("saves an etcd snapshot", func() {
			Expect(util.Rke2Cmd("etcd-snapshot", "save")).
				To(ContainSubstring("Saving current etcd snapshot set to rke2-etcd-snapshots"))
		})
		It("list snapshots", func() {
			Expect(util.Rke2Cmd("etcd-snapshot", "ls")).
				To(MatchRegexp(`:///var/lib/rancher/rke2/server/db/snapshots/on-demand`))
		})
		It("deletes a snapshot", func() {
			lsResult, err := util.Rke2Cmd("etcd-snapshot", "ls")
			Expect(err).ToNot(HaveOccurred())
			reg, err := regexp.Compile(`on-demand[^\s]+`)
			Expect(err).ToNot(HaveOccurred())
			snapshotName := reg.FindString(lsResult)
			Expect(util.Rke2Cmd("etcd-snapshot", "delete", snapshotName)).
				To(ContainSubstring("Removing the given locally stored etcd snapshot"))
		})
	})
	When("saving a custom name", func() {
		It("saves an etcd snapshot with a custom name", func() {
			Expect(util.Rke2Cmd("etcd-snapshot", "save", "--name", "ALIVEBEEF")).
				To(ContainSubstring("Saving etcd snapshot to /var/lib/rancher/rke2/server/db/snapshots/ALIVEBEEF"))
		})
		It("deletes that snapshot", func() {
			lsResult, err := util.Rke2Cmd("etcd-snapshot", "ls")
			Expect(err).ToNot(HaveOccurred())
			reg, err := regexp.Compile(`ALIVEBEEF[^\s]+`)
			Expect(err).ToNot(HaveOccurred())
			snapshotName := reg.FindString(lsResult)
			Expect(util.Rke2Cmd("etcd-snapshot", "delete", snapshotName)).
				To(ContainSubstring("Removing the given locally stored etcd snapshot"))
		})
	})
	When("using etcd snapshot prune", func() {
		It("saves 3 different snapshots", func() {
			Expect(util.Rke2Cmd("etcd-snapshot", "save", "--name", "PRUNE_TEST")).
				To(ContainSubstring("Saving current etcd snapshot set to rke2-etcd-snapshots"))
			time.Sleep(1 * time.Second)
			Expect(util.Rke2Cmd("etcd-snapshot", "save", "--name", "PRUNE_TEST")).
				To(ContainSubstring("Saving current etcd snapshot set to rke2-etcd-snapshots"))
			time.Sleep(1 * time.Second)
			Expect(util.Rke2Cmd("etcd-snapshot", "save", "--name", "PRUNE_TEST")).
				To(ContainSubstring("Saving current etcd snapshot set to rke2-etcd-snapshots"))
			time.Sleep(1 * time.Second)
		})
		It("lists all 3 snapshots", func() {
			lsResult, err := util.Rke2Cmd("etcd-snapshot", "ls")
			Expect(err).ToNot(HaveOccurred())
			reg, err := regexp.Compile(`:///var/lib/rancher/rke2/server/db/snapshots/PRUNE_TEST`)
			Expect(err).ToNot(HaveOccurred())
			sepLines := reg.FindAllString(lsResult, -1)
			Expect(sepLines).To(HaveLen(3))
		})
		It("prunes snapshots down to 2", func() {
			Expect(util.Rke2Cmd("etcd-snapshot", "prune", "--snapshot-retention", "2", "--name", "PRUNE_TEST")).
				To(BeEmpty())
			lsResult, err := util.Rke2Cmd("etcd-snapshot", "ls")
			Expect(err).ToNot(HaveOccurred())
			reg, err := regexp.Compile(`:///var/lib/rancher/rke2/server/db/snapshots/PRUNE_TEST`)
			Expect(err).ToNot(HaveOccurred())
			sepLines := reg.FindAllString(lsResult, -1)
			Expect(sepLines).To(HaveLen(2))
		})
		It("cleans up remaining snapshots", func() {
			lsResult, err := util.Rke2Cmd("etcd-snapshot", "ls")
			Expect(err).ToNot(HaveOccurred())
			reg, err := regexp.Compile(`PRUNE_TEST[^\s]+`)
			Expect(err).ToNot(HaveOccurred())
			for _, snapshotName := range reg.FindAllString(lsResult, -1) {
				Expect(util.Rke2Cmd("etcd-snapshot", "delete", snapshotName)).
					To(ContainSubstring("Removing the given locally stored etcd snapshot"))
			}
		})
	})
})

func Test_IntegrationEtcd(t *testing.T) {
	RegisterFailHandler(Fail)
	RunSpecs(t, "Etcd Suite")
}
070701000000FF000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002100000000rke2-1.27.7+rke2r1/tests/install07070100000100000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002A00000000rke2-1.27.7+rke2r1/tests/install/centos-707070100000101000081A4000000000000000000000001653C446F000002C7000000000000000000000000000000000000003400000000rke2-1.27.7+rke2r1/tests/install/centos-7/README.mdRKE2 Install on CentOS 8
---

Asserting correctness of the RKE2 installer script using [CentOS 7](https://docs.centos.org/en-US/centos/install-guide/)
as a stand-in for [RHEL 7](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/).

### Testing With Vagrant

The [Vagrant box](https://app.vagrantup.com/dweomer/boxes/centos-7.9-amd64) used for this test supports these providers:
- `libvirt`
- `virtualbox` (the default for most installations, including `macos-12` github actions runners)
- `vmware_desktop`

To spin up a VM to test a locally modified `install.sh`:
```shell
vagrant up
```

See also:
- [developer-docs/testing.md](../../../developer-docs/testing.md#environment-variables)
07070100000102000081A4000000000000000000000001653C446F00001702000000000000000000000000000000000000003600000000rke2-1.27.7+rke2r1/tests/install/centos-7/Vagrantfile# -*- mode: ruby -*-
# vi: set ft=ruby :

ENV['TEST_INSTALL_SH'] ||= '../../../install.sh'

Vagrant.configure("2") do |config|
  config.vm.box = "dweomer/centos-7.9-amd64"
  config.vm.boot_timeout = ENV['TEST_VM_BOOT_TIMEOUT'] || 600 # seconds
  config.vm.synced_folder '.', '/vagrant', type: 'rsync', disabled: false
  %w[libvirt virtualbox vmware_desktop].each do |p|
    config.vm.provider p do |v, o|
      v.cpus = ENV['TEST_VM_CPUS'] || 2
      v.memory = ENV['TEST_VM_MEMORY'] || 3072
    end
  end

external_env = ""
  ENV.select{|k,v| k.start_with?('RKE2_') || k.start_with?('INSTALL_RKE2_')}.each {|key,value| external_env << "#{key.to_s}=#{value.to_s}"}

config.vm.define "install-centos-7", primary: true do |test|
    test.vm.hostname = 'smoke'
    test.vm.provision 'rke2-upload-installer', type: 'file', run: 'always', source: ENV['TEST_INSTALL_SH'], destination: 'install.sh'
    test.vm.provision"rke2-install", type: 'rke2', run: "once" do |rke2|
      rke2.installer_url = 'file:///home/vagrant/install.sh'
      rke2.env = %W[ #{external_env} INSTALL_RKE2_TYPE=server]
      rke2.config = <<~YAML
        token: 'vagrant'
      YAML
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
    end
    test.vm.provision "rke2-wait-for-node", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        echo 'Waiting for node (and static pods) to be ready ...'
        time {
            timeout 500 bash -c 'while ! (kubectl wait --for condition=ready node/$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 300 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/etcd-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 300 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-apiserver-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 300 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-scheduler-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 300 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-proxy-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 300 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-controller-manager-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 300 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/cloud-controller-manager-$(hostname) 2>/dev/null); do sleep 5; done'
        }
        kubectl get node,all -A -o wide
      SHELL
    end
    test.vm.provision "rke2-wait-for-canal", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        time {
            timeout 500 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s daemonset/rke2-canal 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-wait-for-coredns", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        time {
            timeout 500 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/rke2-coredns-rke2-coredns 2>/dev/null); do sleep 5; done'
            timeout 500 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/rke2-coredns-rke2-coredns-autoscaler 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-wait-for-ingress-nginx", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        time {
            timeout 500 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s daemonset/rke2-ingress-nginx-controller 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-wait-for-metrics-server", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        time {
            timeout 500 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/rke2-metrics-server 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-status", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eux -o pipefail
        kubectl get node,all -A -o wide
      SHELL
    end
    test.vm.provision "rke2-procps", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eux -o pipefail
        ps auxZ | grep -E 'etcd|kube|rke2|container|spc_t|unconfined_t' | grep -v grep
      SHELL
    end
  end

config.vm.provision "install-packages", type: "shell", run: "once" do |sh|
    sh.upload_path = "/tmp/vagrant-install-packages"
    sh.env = {
        'INSTALL_PACKAGES': ENV['INSTALL_PACKAGES'],
    }
    sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eux -o pipefail
        yum -y install \
            curl \
            iptables \
            less \
            lsof \
            nc \
            socat \
            ${INSTALL_PACKAGES}
    SHELL
  end

config.vm.provision "selinux-status", type: "shell", run: "once", inline: "sestatus -v"
  config.vm.provision "rke2-profile-env", type: "shell", run: "once" do |sh|
    sh.inline = <<~SHELL
        #!/usr/bin/env bash
        cat <<-EOF > /etc/profile.d/rke2.sh
export KUBECONFIG=/etc/rancher/rke2/rke2.yaml PATH=/usr/local/bin:$PATH:/var/lib/rancher/rke2/bin
EOF
    SHELL
  end

end
07070100000103000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002F00000000rke2-1.27.7+rke2r1/tests/install/opensuse-leap07070100000104000081A4000000000000000000000001653C446F00001780000000000000000000000000000000000000003B00000000rke2-1.27.7+rke2r1/tests/install/opensuse-leap/Vagrantfile# -*- mode: ruby -*-
# vi: set ft=ruby :

ENV['TEST_INSTALL_SH'] ||= '../../../install.sh'

Vagrant.configure("2") do |config|
  config.vm.box = 'opensuse/Leap-15.4.x86_64'
  config.vm.boot_timeout = ENV['TEST_VM_BOOT_TIMEOUT'] || 600 # seconds
  config.vm.synced_folder '.', '/vagrant', type: 'rsync', disabled: false
  %w[libvirt virtualbox vmware_desktop].each do |p|
    config.vm.provider p do |v, o|
      v.cpus = ENV['TEST_VM_CPUS'] || 2
      v.memory = ENV['TEST_VM_MEMORY'] || 3072
    end
  end

external_env = ""
  ENV.select{|k,v| k.start_with?('RKE2_') || k.start_with?('INSTALL_RKE2_')}.each {|key,value| external_env << "#{key.to_s}=#{value.to_s}"}

config.vm.define "install-leap-15.4", primary: true do |test|
    test.vm.hostname = 'smoke'
    test.vm.provision 'rke2-upload-installer', type: 'file', run: 'always', source: ENV['TEST_INSTALL_SH'], destination: 'install.sh'
    test.vm.provision"rke2-install", type: 'rke2', run: "once" do |rke2|
      rke2.installer_url = 'file:///home/vagrant/install.sh'
      rke2.env = %W[ #{external_env} INSTALL_RKE2_TYPE=server]
      rke2.config = <<~YAML
        token: 'vagrant'
      YAML
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
    end
    test.vm.provision "rke2-wait-for-node", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        echo 'Waiting for node (and static pods) to be ready ...'
        time {
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready node/$(hostnamectl --static) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/etcd-$(hostnamectl --static) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-apiserver-$(hostnamectl --static) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-scheduler-$(hostnamectl --static) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-proxy-$(hostnamectl --static) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-controller-manager-$(hostnamectl --static) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/cloud-controller-manager-$(hostnamectl --static) 2>/dev/null); do sleep 5; done'
        }
        kubectl get node,all -A -o wide
      SHELL
    end
    test.vm.provision "rke2-wait-for-canal", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        time {
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s daemonset/rke2-canal 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-wait-for-coredns", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        time {
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/rke2-coredns-rke2-coredns 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/rke2-coredns-rke2-coredns-autoscaler 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-wait-for-ingress-nginx", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        time {
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s daemonset/rke2-ingress-nginx-controller 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-wait-for-metrics-server", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        time {
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/rke2-metrics-server 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-status", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eux -o pipefail
        kubectl get node,all -A -o wide
      SHELL
    end
    test.vm.provision "rke2-procps", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eux -o pipefail
        ps auxZ | grep -E 'etcd|kube|rke2|container|spc_t|unconfined_t' | grep -v grep
      SHELL
    end
  end

config.vm.provision "install-packages", type: "shell", run: "once" do |sh|
    sh.upload_path = "/tmp/vagrant-install-packages"
    sh.env = {
        'INSTALL_PACKAGES': ENV['INSTALL_PACKAGES'],
    }
    sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eux -o pipefail
        zypper install -y \
            curl \
            iptables \
            less \
            lsof \
            socat \
            restorecond \
            policycoreutils
            ${INSTALL_PACKAGES}
    SHELL
  end

end
07070100000105000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000003200000000rke2-1.27.7+rke2r1/tests/install/opensuse-microos07070100000106000081A4000000000000000000000001653C446F00000596000000000000000000000000000000000000003C00000000rke2-1.27.7+rke2r1/tests/install/opensuse-microos/README.mdRKE2 Install on MicroOS
---

Asserting correctness of the RKE2 installer script using [openSUSE MicroOS](https://microos.opensuse.org/)
as a stand-in for [SUSE Linux Enterprise Micro](https://www.suse.com/products/micro/).

### Testing With Vagrant

The [Vagrant box](https://app.vagrantup.com/dweomer/boxes/microos.amd64) used for this test supports these providers:
- `libvirt`
- `virtualbox` (the default for most installations, including `macos-12` github actions runners)
- `vmware_desktop`

To spin up a VM to test a locally modified `install.sh`:
```shell
# make sure the vagrant-reload plugin is installed, one-time only
vagrant plugin install vagrant-reload
```
```shell
vagrant up
```

See also:
- [developer-docs/testing.md](../../../developer-docs/testing.md#environment-variables)

### Vagrant Reload Plugin

The MicroOS guest leverages [transactional updates](https://documentation.suse.com/sles/15-SP1/html/SLES-all/cha-transactional-updates.html)
for most persistent mutations of the installation (typically involving the `/usr` partition) which requires a reboot to
take effect. The `vagrant-reload` provisioner plugin is used for this because the implementation of the [`reboot` option](https://www.vagrantup.com/docs/provisioning/shell#reboot)
of the built-in [Vagrant Shell Provisioner](https://www.vagrantup.com/docs/provisioning/shell) is unreliable
(especially if used more than once per provisioning run).
07070100000107000081A4000000000000000000000001653C446F000018E3000000000000000000000000000000000000003E00000000rke2-1.27.7+rke2r1/tests/install/opensuse-microos/Vagrantfile# -*- mode: ruby -*-
# vi: set ft=ruby :

ENV['TEST_INSTALL_SH'] ||= '../../../install.sh'

Vagrant.configure("2") do |config|
  config.vagrant.plugins = {
    'vagrant-reload' => {},
  }
  config.vm.box = "dweomer/microos.amd64"
  config.vm.boot_timeout = ENV['TEST_VM_BOOT_TIMEOUT'] || 600 # seconds
  config.vm.synced_folder '.', '/vagrant', type: 'rsync', disabled: false
  %w[libvirt virtualbox vmware_desktop].each do |p|
    config.vm.provider p do |v, o|
      v.cpus = ENV['TEST_VM_CPUS'] || 2
      v.memory = ENV['TEST_VM_MEMORY'] || 3072
    end
  end

external_env = ""
  ENV.select{|k,v| k.start_with?('RKE2_') || k.start_with?('INSTALL_RKE2_')}.each {|key,value| external_env << "#{key.to_s}=#{value.to_s}"}

config.vm.define "install-microos", primary: true do |test|
    test.vm.hostname = 'smoke'
    test.vm.provision 'rke2-upload-installer', type: 'file', run: 'always', source: ENV['TEST_INSTALL_SH'], destination: 'install.sh'
    test.vm.provision"rke2-install", type: 'rke2', run: "once" do |rke2|
      rke2.installer_url = 'file:///home/vagrant/install.sh'
      rke2.env = %W[ #{external_env} INSTALL_RKE2_TYPE=server]
      rke2.config = <<~YAML
        token: 'vagrant'
      YAML
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
    end
    test.vm.provision "rke2-wait-for-node", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        source /etc/profile.d/rke2.sh
        set -eu -o pipefail
        echo 'Waiting for node (and static pods) to be ready ...'
        time {
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready node/$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/etcd-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-apiserver-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-scheduler-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-proxy-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-controller-manager-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/cloud-controller-manager-$(hostname) 2>/dev/null); do sleep 5; done'
        }
        kubectl get node,all -A -o wide
      SHELL
    end
    test.vm.provision "rke2-wait-for-canal", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        source /etc/profile.d/rke2.sh
        set -eu -o pipefail
        time {
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s daemonset/rke2-canal 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-wait-for-coredns", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        source /etc/profile.d/rke2.sh
        set -eu -o pipefail
        time {
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/rke2-coredns-rke2-coredns 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/rke2-coredns-rke2-coredns-autoscaler 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-wait-for-ingress-nginx", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        source /etc/profile.d/rke2.sh
        set -eu -o pipefail
        time {
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s daemonset/rke2-ingress-nginx-controller 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-wait-for-metrics-server", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        source /etc/profile.d/rke2.sh
        set -eu -o pipefail
        time {
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/rke2-metrics-server 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-status", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        source /etc/profile.d/rke2.sh
        set -eux -o pipefail
        kubectl get node,all -A -o wide
      SHELL
    end
    test.vm.provision "rke2-procps", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        source /etc/profile.d/rke2.sh
        set -eux -o pipefail
        ps auxZ | grep -E 'etcd|kube|rke2|container|spc_t|unconfined_t' | grep -v grep
      SHELL
    end
  end

config.vm.provision "install-packages", type: "shell", run: "once" do |sh|
    sh.upload_path = "/tmp/vagrant-install-packages"
    sh.env = {
        'INSTALL_PACKAGES': ENV['INSTALL_PACKAGES'],
    }
    sh.inline = <<~SHELL
        #!/usr/bin/env bash
        source /etc/profile.d/rke2.sh
        set -eux -o pipefail
        transactional-update --no-selfupdate -d pkg install -y --allow-unsigned-rpm \
            curl \
            iptables \
            less \
            lsof \
            socat \
            ${INSTALL_PACKAGES}
    SHELL
  end
  config.vm.provision "install-packages-reload", type: "reload", run: "once"
  config.vm.provision "selinux-status", type: "shell", run: "once", inline: "sestatus -v"
  config.vm.provision "rke2-profile-env", type: "shell", run: "once" do |sh|
    sh.inline = <<~SHELL
        #!/usr/bin/env bash
        cat <<-EOF > /etc/profile.d/rke2.sh
export KUBECONFIG=/etc/rancher/rke2/rke2.yaml PATH=/usr/local/bin:$PATH:/var/lib/rancher/rke2/bin
EOF
    SHELL
  end

end
07070100000108000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002900000000rke2-1.27.7+rke2r1/tests/install/rocky-807070100000109000081A4000000000000000000000001653C446F000002C1000000000000000000000000000000000000003300000000rke2-1.27.7+rke2r1/tests/install/rocky-8/README.mdRKE2 Install on CentOS 8
---

Asserting correctness of the RKE2 installer script using [Rocky Linux](https://wiki.rockylinux.org/)
as a stand-in for [RHEL 8](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8).

### Testing With Vagrant

The [Vagrant box](https://app.vagrantup.com/generic/boxes/rocky8) used for this test supports these providers:
- `libvirt`
- `virtualbox` (the default for most installations, including `macos-12` github actions runners)
- `vmware_desktop`
- `hyperv`
- `parallels`

To spin up a VM to test a locally modified `install.sh`:
```shell
vagrant up
```

See also:
- [developer-docs/testing.md](../../../developer-docs/testing.md#environment-variables)
0707010000010A000081A4000000000000000000000001653C446F00001753000000000000000000000000000000000000003500000000rke2-1.27.7+rke2r1/tests/install/rocky-8/Vagrantfile# -*- mode: ruby -*-
# vi: set ft=ruby :

ENV['TEST_INSTALL_SH'] ||= '../../../install.sh'

Vagrant.configure("2") do |config|
  config.vm.box = "generic/rocky8"
  config.vm.boot_timeout = ENV['TEST_VM_BOOT_TIMEOUT'] || 600 # seconds
  config.vm.synced_folder '.', '/vagrant', type: 'rsync', disabled: false
  %w[libvirt virtualbox vmware_desktop].each do |p|
    config.vm.provider p do |v, o|
      v.cpus = ENV['TEST_VM_CPUS'] || 2
      v.memory = ENV['TEST_VM_MEMORY'] || 3072
    end
  end

external_env = ""
  ENV.select{|k,v| k.start_with?('RKE2_') || k.start_with?('INSTALL_RKE2_')}.each {|key,value| external_env << "#{key.to_s}=#{value.to_s}"}

config.vm.define "install-rocky-8", primary: true do |test|
    test.vm.hostname = 'smoke'
    test.vm.provision "disable-firewall", type: "shell", inline: "systemctl stop firewalld"
    test.vm.provision 'rke2-upload-installer', type: 'file', run: 'always', source: ENV['TEST_INSTALL_SH'], destination: 'install.sh'
    test.vm.provision"rke2-install", type: 'rke2', run: "once" do |rke2|
      rke2.installer_url = 'file:///home/vagrant/install.sh'
      rke2.env = %W[ #{external_env} INSTALL_RKE2_TYPE=server]
      rke2.config = <<~YAML
        token: 'vagrant'
      YAML
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
    end
    test.vm.provision "rke2-wait-for-node", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        echo 'Waiting for node (and static pods) to be ready ...'
        time {
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready node/$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/etcd-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-apiserver-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-scheduler-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-proxy-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-controller-manager-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/cloud-controller-manager-$(hostname) 2>/dev/null); do sleep 5; done'
        }
        kubectl get node,all -A -o wide
      SHELL
    end
    test.vm.provision "rke2-wait-for-canal", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        time {
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s daemonset/rke2-canal 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-wait-for-coredns", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        time {
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/rke2-coredns-rke2-coredns 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/rke2-coredns-rke2-coredns-autoscaler 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-wait-for-ingress-nginx", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        time {
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s daemonset/rke2-ingress-nginx-controller 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-wait-for-metrics-server", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        time {
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/rke2-metrics-server 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-status", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eux -o pipefail
        kubectl get node,all -A -o wide
      SHELL
    end
    test.vm.provision "rke2-procps", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eux -o pipefail
        ps auxZ | grep -E 'etcd|kube|rke2|container|spc_t|unconfined_t' | grep -v grep
      SHELL
    end
  end

config.vm.provision "install-packages", type: "shell", run: "once" do |sh|
    sh.upload_path = "/tmp/vagrant-install-packages"
    sh.env = {
        'INSTALL_PACKAGES': ENV['INSTALL_PACKAGES'],
    }
    sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eux -o pipefail
        dnf -y install \
            curl \
            iptables \
            less \
            lsof \
            nc \
            socat \
            ${INSTALL_PACKAGES}
    SHELL
  end

end
0707010000010B000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002E00000000rke2-1.27.7+rke2r1/tests/install/ubuntu-focal0707010000010C000081A4000000000000000000000001653C446F0000026E000000000000000000000000000000000000003800000000rke2-1.27.7+rke2r1/tests/install/ubuntu-focal/README.mdRKE2 Install on Ubuntu Focal Fossa
---

Asserting correctness of the RKE2 installer script on [Ubuntu 20.04](https://releases.ubuntu.com/20.04/).

### Testing With Vagrant

The [Vagrant box](https://app.vagrantup.com/generic/boxes/ubuntu2004) used for this test supports these providers:
- `hyperv`
- `libvirt`
- `parallels`
- `virtualbox` (the default for most installations, including `macos-12` github actions runners)
- `vmware_desktop`

To spin up a VM to test a locally modified `install.sh`:
```shell
vagrant up
```

See also:
- [developer-docs/testing.md](../../../developer-docs/testing.md#environment-variables)
0707010000010D000081A4000000000000000000000001653C446F000016BE000000000000000000000000000000000000003A00000000rke2-1.27.7+rke2r1/tests/install/ubuntu-focal/Vagrantfile# -*- mode: ruby -*-
# vi: set ft=ruby :

ENV['TEST_INSTALL_SH'] ||= '../../../install.sh'

Vagrant.configure("2") do |config|
  config.vm.box = "generic/ubuntu2004"
  config.vm.boot_timeout = ENV['TEST_VM_BOOT_TIMEOUT'] || 600 # seconds
  config.vm.synced_folder '.', '/vagrant', type: 'rsync', disabled: false
  %w[libvirt virtualbox vmware_desktop].each do |p|
    config.vm.provider p do |v, o|
      v.cpus = ENV['TEST_VM_CPUS'] || 2
      v.memory = ENV['TEST_VM_MEMORY'] || 3072
    end
  end

external_env = ""
  ENV.select{|k,v| k.start_with?('RKE2_') || k.start_with?('INSTALL_RKE2_')}.each {|key,value| external_env << "#{key.to_s}=#{value.to_s}"}

config.vm.define "install-ubuntu-focal", primary: true do |test|
    test.vm.hostname = 'smoke'
    test.vm.provision 'rke2-upload-installer', type: 'file', run: 'always', source: ENV['TEST_INSTALL_SH'], destination: 'install.sh'
    test.vm.provision"rke2-install", type: 'rke2', run: "once" do |rke2|
      rke2.installer_url = 'file:///home/vagrant/install.sh'
      rke2.env = %W[ #{external_env} INSTALL_RKE2_TYPE=server]
      rke2.config = <<~YAML
        token: 'vagrant'
      YAML
      rke2.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
    end
    test.vm.provision "rke2-wait-for-node", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        echo 'Waiting for node (and static pods) to be ready ...'
        time {
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready node/$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/etcd-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-apiserver-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-scheduler-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-proxy-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-controller-manager-$(hostname) 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/cloud-controller-manager-$(hostname) 2>/dev/null); do sleep 5; done'
        }
        kubectl get node,all -A -o wide
      SHELL
    end
    test.vm.provision "rke2-wait-for-canal", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        time {
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s daemonset/rke2-canal 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-wait-for-coredns", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        time {
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/rke2-coredns-rke2-coredns 2>/dev/null); do sleep 5; done'
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/rke2-coredns-rke2-coredns-autoscaler 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-wait-for-ingress-nginx", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        time {
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s daemonset/rke2-ingress-nginx-controller 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-wait-for-metrics-server", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eu -o pipefail
        time {
            timeout 240 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/rke2-metrics-server 2>/dev/null); do sleep 5; done'
        }
      SHELL
    end
    test.vm.provision "rke2-status", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eux -o pipefail
        kubectl get node,all -A -o wide
      SHELL
    end
    test.vm.provision "rke2-procps", type: "shell", run: ENV['CI'] == 'true' ? 'never' : 'once' do |sh|
      sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eux -o pipefail
        ps auxZ | grep -E 'etcd|kube|rke2|container|confined' | grep -v grep
      SHELL
    end
  end

config.vm.provision "install-packages", type: "shell", run: "once" do |sh|
    sh.upload_path = "/tmp/vagrant-install-packages"
    sh.env = {
        'INSTALL_PACKAGES': ENV['INSTALL_PACKAGES'],
    }
    sh.inline = <<~SHELL
        #!/usr/bin/env bash
        set -eux -o pipefail
        apt-get -y update
        apt-get -y install \
            curl \
            iptables \
            less \
            lsof \
            netcat \
            socat \
            ${INSTALL_PACKAGES}
    SHELL
  end

config.vm.provision "rke2-profile-env", type: "shell", run: "once" do |sh|
    sh.inline = <<~SHELL
        #!/usr/bin/env bash
        cat <<-EOF > /etc/profile.d/rke2.sh
export KUBECONFIG=/etc/rancher/rke2/rke2.yaml PATH=/usr/local/bin:$PATH:/var/lib/rancher/rke2/bin
EOF
    SHELL
  end

end
0707010000010E000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002E00000000rke2-1.27.7+rke2r1/tests/install/windows-20190707010000010F000081A4000000000000000000000001653C446F00000299000000000000000000000000000000000000003800000000rke2-1.27.7+rke2r1/tests/install/windows-2019/README.mdRKE2 Install on Windows Server 2019
---

Asserting correctness of the RKE2 installer script on [Windows Server 2019](https://docs.microsoft.com/en-us/windows-server/get-started/whats-new-in-windows-server-2019).

### Testing With Vagrant

The [Vagrant box](https://app.vagrantup.com/jborean93/boxes/WindowsServer2019) used for this test supports these providers:
- `hyperv`
- `libvirt`
- `virtualbox` (the default for most installations, including `macos-12` github actions runners)

To spin up a VM to test a locally modified `install.ps1`:
```shell
vagrant up
```

See also:
- [developer-docs/testing.md](../../../developer-docs/testing.md#environment-variables)
07070100000110000081A4000000000000000000000001653C446F000006BB000000000000000000000000000000000000003A00000000rke2-1.27.7+rke2r1/tests/install/windows-2019/Vagrantfile# -*- mode: ruby -*-
# vi: set ft=ruby :

ENV['TEST_INSTALL_PS1'] ||= '../../../install.ps1'

Vagrant.configure("2") do |config|
  config.vagrant.plugins = ["vagrant-reload"]
  config.vm.box = "gusztavvargadr/windows-server-2019-standard"
  config.vm.boot_timeout = ENV['TEST_VM_BOOT_TIMEOUT'] || 600 # seconds
  config.vm.synced_folder '.', '/vagrant', disabled: true
  %w[libvirt virtualbox hyperv].each do |p|
    config.vm.provider p do |v, o|
      v.cpus = ENV['TEST_VM_CPUS'] || 2
      v.memory = ENV['TEST_VM_MEMORY'] || 3072
    end
  end

config.vm.define "install-windows-2019", primary: true do |test|
    test.vm.hostname = 'smoke'
    test.vm.provision :shell, privileged: true, run: "once", inline: "Install-WindowsFeature -Name Containers"
    test.vm.provision :reload
    test.vm.provision 'rke2-upload-installer', type: 'file', run: 'always', source: ENV['TEST_INSTALL_PS1'], destination: 'install.ps1'
    test.vm.provision "rke2-install", type: "shell",  privileged: true, run: "once" do |sh|
      sh.env = ENV.select{|k,v| k.start_with?('RKE2_') || k.start_with?('INSTALL_RKE2_')}.merge({
        :INSTALL_RKE2_TYPE => 'AGENT'
      })
      sh.inline = <<~SHELL
        Write-Host "Installing RKE2 as an agent..."
        Push-Location C:\\Users\\vagrant\\Documents
        ./install.ps1

Write-Host "Adding RKE2 Windows Service..."
        $env:PATH+=";C:\\usr\\local\\bin;C:\\var\\lib\\rancher\\rke2\\bin"
        Push-Location c:\\usr\\local\\bin
        rke2.exe agent service --add
        Pop-Location
        Start-Sleep -s 5

if(Get-Service rke2 -ErrorAction Ignore) {
            exit 0
        }
        else {
            exit 1
        }
      SHELL
    end
  end
end
07070100000111000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002E00000000rke2-1.27.7+rke2r1/tests/install/windows-202207070100000112000081A4000000000000000000000001653C446F00000299000000000000000000000000000000000000003800000000rke2-1.27.7+rke2r1/tests/install/windows-2022/README.mdRKE2 Install on Windows Server 2019
---

Asserting correctness of the RKE2 installer script on [Windows Server 2022](https://docs.microsoft.com/en-us/windows-server/get-started/whats-new-in-windows-server-2022).

### Testing With Vagrant

The [Vagrant box](https://app.vagrantup.com/jborean93/boxes/WindowsServer2022) used for this test supports these providers:
- `hyperv`
- `libvirt`
- `virtualbox` (the default for most installations, including `macos-12` github actions runners)

To spin up a VM to test a locally modified `install.ps1`:
```shell
vagrant up
```

See also:
- [developer-docs/testing.md](../../../developer-docs/testing.md#environment-variables)
07070100000113000081A4000000000000000000000001653C446F000006AB000000000000000000000000000000000000003A00000000rke2-1.27.7+rke2r1/tests/install/windows-2022/Vagrantfile# -*- mode: ruby -*-
# vi: set ft=ruby :

ENV['TEST_INSTALL_PS1'] ||= '../../../install.ps1'

Vagrant.configure("2") do |config|
  config.vagrant.plugins = ["vagrant-reload"]
  config.vm.box = "jborean93/WindowsServer2022"
  config.vm.boot_timeout = ENV['TEST_VM_BOOT_TIMEOUT'] || 900 # seconds
  config.vm.synced_folder '.', '/vagrant', disabled: true
  %w[libvirt virtualbox hyperv].each do |p|
    config.vm.provider p do |v, o|
      v.cpus = ENV['TEST_VM_CPUS'] || 2
      v.memory = ENV['TEST_VM_MEMORY'] || 3072
    end
  end

config.vm.define "install-windows-2022", primary: true do |test|
    test.vm.hostname = 'smoke'
    test.vm.provision :shell, privileged: true, run: "once", inline: "Install-WindowsFeature -Name Containers"
    test.vm.provision :reload
    test.vm.provision 'rke2-upload-installer', type: 'file', run: 'always', source: ENV['TEST_INSTALL_PS1'], destination: 'install.ps1'
    test.vm.provision "rke2-install", type: "shell",  privileged: true, run: "once" do |sh|
      sh.env = ENV.select{|k,v| k.start_with?('RKE2_') || k.start_with?('INSTALL_RKE2_')}.merge({
        :INSTALL_RKE2_TYPE => 'AGENT'
      })
      sh.inline = <<~SHELL
        Write-Host "Installing RKE2 as an agent..."
        Push-Location C:\\Users\\vagrant\\Documents
        ./install.ps1

if(Get-Service rke2 -ErrorAction Ignore) {
            exit 0
        }
        else {
            exit 1
        }
      SHELL
    end
  end
end
07070100000114000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001E00000000rke2-1.27.7+rke2r1/tests/util07070100000115000081A4000000000000000000000001653C446F0000095A000000000000000000000000000000000000002500000000rke2-1.27.7+rke2r1/tests/util/cmd.gopackage util

import (
	"encoding/json"
	"os"
	"os/exec"
	"regexp"
	"strings"

"github.com/sirupsen/logrus"
)

func findRke2Executable() string {
	rke2Bin := "bin/rke2"
	for {
		_, err := os.Stat(rke2Bin)
		if err != nil {
			rke2Bin = "../" + rke2Bin
			continue
		}
		break
	}
	return rke2Bin
}

// Rke2Cmd launches the provided Rke2 command via exec. Command blocks until finished.
// Kubectl commands can also be passed.
// Command output from both Stderr and Stdout is provided via string.
// cmdEx1, err := Rke2Cmd("etcd-snapshot", "ls")
// cmdEx2, err := Rke2Cmd("kubectl", "get", "pods", "-A")
func Rke2Cmd(cmdName string, cmdArgs ...string) (string, error) {
	if cmdName == "kubectl" {
		byteOut, err := exec.Command(cmdName, cmdArgs...).CombinedOutput()
		return string(byteOut), err
	}
	rke2Bin := findRke2Executable()
	rke2Cmd := append([]string{cmdName}, cmdArgs...)
	byteOut, err := exec.Command(rke2Bin, rke2Cmd...).CombinedOutput()
	return string(byteOut), err
}

func Rke2Ready() bool {
	podsToCheck := []string{
		"etcd-rke2-server",
		"kube-apiserver-rke2-server",
		"kube-proxy-rke2-server",
		"kube-scheduler-rke2-server",
		"rke2-coredns-rke2-coredns",
	}
	pods, err := Rke2Cmd("kubectl", "get", "pods", "-A")
	if err != nil {
		return false
	}
	for _, pod := range podsToCheck {
		reg := pod + ".+Running"
		match, err := regexp.MatchString(reg, pods)
		if !match || err != nil {
			logrus.Error(err)
			return false
		}
	}
	return true
}

func contains(source []string, target string) bool {
	for _, s := range source {
		if s == target {
			return true
		}
	}
	return false
}

// ServerArgsPresent checks if the given arguments are found in the running k3s server
func ServerArgsPresent(neededArgs []string) bool {
	currentArgs, err := Rke2ServerArgs()
	if err != nil {
		logrus.Error(err)
		return false
	}
	for _, arg := range neededArgs {
		if !contains(currentArgs, arg) {
			return false
		}
	}
	return true
}

// Rke2ServerArgs returns the list of arguments that the rke2 server launched with
func Rke2ServerArgs() ([]string, error) {
	results, err := Rke2Cmd("kubectl", "get", "nodes", "-o", `jsonpath='{.items[0].metadata.annotations.rke2\.io/node-args}'`)
	if err != nil {
		return nil, err
	}
	res := strings.ReplaceAll(results, "'", "")
	var args []string
	if err := json.Unmarshal([]byte(res), &args); err != nil {
		return nil, err
	}
	return args, nil
}
07070100000116000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001D00000000rke2-1.27.7+rke2r1/updatecli07070100000117000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000002900000000rke2-1.27.7+rke2r1/updatecli/updatecli.d07070100000118000081A4000000000000000000000001653C446F00000A48000000000000000000000000000000000000003700000000rke2-1.27.7+rke2r1/updatecli/updatecli.d/updatecli.yml# This small test makes sure that updatecli is working properly on a repo.
# To test this:
#   have "UPDATECLI_GITHUB_ACTOR" env set to your github username
#   have "UPDATECLI_GITHUB_TOKEN" env set to your github token
#   have the latest version of updatecli installed
#   'updatecli diff -v updatecli/values.yaml -c updatecli/updatecli.d/updatecli.yml'
# In the future, more useful files should be added to this directory.
---
name: "Introduce updatecli to repo and validate basic functionality"
# Make sure we can pull in github repos from multiple orgs
scms:
  rke2:
    kind: "github"
    spec:
      user: "{{ .github.user }}"
      email: "{{ .github.email }}"
      username: "{{ requiredEnv .github.username }}"
      token: '{{ requiredEnv .github.token }}'
      owner: rancher
      repository: rke2
      branch: master
  go:
    kind: "github"
    spec:
      user: "{{ .github.user }}"
      email: "{{ .github.email }}"
      username: "{{ requiredEnv .github.username }}"
      token: '{{ requiredEnv .github.token }}'
      owner: golang
      repository: go
      branch: master

sources:
  # validate gittag parsing external public repos
  goTag:
    name: "Get Go 1.20.2 tag"
    kind: "gittag"
    scmid: "go"
    spec:
      versionfilter:
        kind: "regex"
        pattern: '^go1\.20\.2$'

# Validate read access to local repo
## continue to targets if the go version in the validate file doesn't match the goTag source
conditions:
  testVersionShouldMatchGoTag:
    name:
    kind: yaml
    sourceid: goTag
    spec:
      file: "updatecli/validate.yml"
      key: version
    failwhen: true #if set to true, continue to targets when condition is true rather than false

# Validate the ability to generate branches, commits, what the commits look like, and what branches look like
## allow validation of workflow to delete unused branch after merge
## generate a commit on a branch named updatecli_<256 sha of change>
## the commit message will be automatically generated by updatecli based on the change
targets:
  updateValidateFile:
    name: "Update the version in the validate file"
    kind: "yaml"
    scmid: "rke2"
    sourceid: goTag
    spec:
      file: "updatecli/validate.yml"
      key: version

# Validate generating a pull request
actions:
  # create a pull request which is not allowed to automerge
  # the title matches the commit message
  github:
    kind: "github/pullrequest"
    scmid: "rke2"
    spec:
      automerge: false
      draft: false
      mergemethod: squash
      parent: false # this would allow for making a PR to an upstream fork, if we ran updatecli from a fork
07070100000119000081A4000000000000000000000001653C446F00000012000000000000000000000000000000000000002A00000000rke2-1.27.7+rke2r1/updatecli/validate.ymlversion: go1.20.2
0707010000011A000081A4000000000000000000000001653C446F000000AE000000000000000000000000000000000000002900000000rke2-1.27.7+rke2r1/updatecli/values.yamlgithub:
  user: "github-actions[bot]"
  email: "41898282+github-actions[bot]@users.noreply.github.com"
  username: "UPDATECLI_GITHUB_ACTOR"
  token: "UPDATECLI_GITHUB_TOKEN"
0707010000011B000041ED000000000000000000000002653C446F00000000000000000000000000000000000000000000001B00000000rke2-1.27.7+rke2r1/windows0707010000011C000081A4000000000000000000000001653C446F00005175000000000000000000000000000000000000002C00000000rke2-1.27.7+rke2r1/windows/rke2-install.ps1#Requires -RunAsAdministrator
<#
.SYNOPSIS 
    Installs Rancher RKE2 to create Windows Worker Nodes.
.DESCRIPTION 
    Run the script to install all Rancher RKE2 related needs. (kubernetes, containerd, network)
.NOTES
    Environment variables:
      System Agent Variables
      - CATTLE_AGENT_LOGLEVEL (default: debug)
      - CATTLE_AGENT_CONFIG_DIR (default: C:/etc/rancher/agent)
      - CATTLE_AGENT_VAR_DIR (default: C:/var/lib/rancher/agent)
      - CATTLE_AGENT_BIN_PREFIX (default: C:/usr/local)

Rancher 2.6+ Variables
      - CATTLE_SERVER
      - CATTLE_TOKEN
      - CATTLE_CA_CHECKSUM
      - CATTLE_ROLE_CONTROLPLANE=false
      - CATTLE_ROLE_ETCD=false
      - CATTLE_ROLE_WORKER=false
      - CATTLE_LABELS
      - CATTLE_TAINTS

Advanced Environment Variables
      - CATTLE_AGENT_BINARY_URL (default: latest GitHub release)
      - CATTLE_PRESERVE_WORKDIR (default: false)
      - CATTLE_REMOTE_ENABLED (default: true)
      - CATTLE_ID (default: autogenerate)
      - CATTLE_AGENT_BINARY_LOCAL (default: false)
      - CATTLE_AGENT_BINARY_LOCAL_LOCATION (default: )
.EXAMPLE 
    
#>
#Make sure this params matches the CmdletBinding below
param (
    [Parameter()]
    [String]
    $Address,
    [Parameter()]
    [String]
    $CaChecksum,
    [Parameter()]
    [String]
    $InternalAddress,
    [Parameter()]
    [String]
    $Label,
    [Parameter()]
    [String]
    $NodeName,
    [Parameter()]
    [String]
    $Server,
    [Parameter()]
    [String]
    $Taint,
    [Parameter()]
    [String]
    $Token,
    [Parameter()]
    [Switch]
    $Worker
)
function Rke2-Installer {
    [CmdletBinding()]
    param (
        [Parameter()]
        [String]
        $Address,
        [Parameter()]
        [String]
        $CaChecksum,
        [Parameter()]
        [String]
        $InternalAddress,
        [Parameter()]
        [String]
        $Label,
        [Parameter()]
        [String]
        $NodeName,
        [Parameter()]
        [String]
        $Server,
        [Parameter()]
        [String]
        $Taint,
        [Parameter()]
        [String]
        $Token,
        [Parameter()]
        [Switch]
        $Worker
    )
    Set-StrictMode -Version Latest
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls -bor [Net.SecurityProtocolType]::Tls11 -bor [Net.SecurityProtocolType]::Tls12 -bor [Net.SecurityProtocolType]::Tls13

function Write-LogInfo {
        Write-Host -NoNewline -ForegroundColor Blue "INFO: "
        Write-Host -ForegroundColor Gray ("{0,-44}" -f ($args -join " "))
    }
    function Write-LogWarn {
        Write-Host -NoNewline -ForegroundColor DarkYellow "WARN: "
        Write-Host -ForegroundColor Gray ("{0,-44}" -f ($args -join " "))
    }
    function Write-LogError {
        Write-Host -NoNewline -ForegroundColor DarkRed "ERROR: "
        Write-Host -ForegroundColor Gray ("{0,-44}" -f ($args -join " "))
    }
    function Write-LogFatal {
        Write-Host -NoNewline -ForegroundColor DarkRed "FATAL: "
        Write-Host -ForegroundColor Gray ("{0,-44}" -f ($args -join " "))
        exit 255
    }

function Get-Args {
        if ($Address) {
            $env:CATTLE_ADDRESS = $Address
        }

if ($CaChecksum) {
            $env:CATTLE_CA_CHECKSUM = $CaChecksum
        }

if ($InternalAddress) {
            $env:CATTLE_INTERNAL_ADDRESS = $InternalAddress
        }

if ($Label) {
            if ($env:CATTLE_LABELS) {
                $env:CATTLE_LABELS += ",$Label"
            }
            else {
                $env:CATTLE_LABELS = $Label
            }
        }

if ($NodeName) {
            $env:CATTLE_NODE_NAME = $NodeName
        }

if ($Server) {
            $env:CATTLE_SERVER = $Server
        }

if ($Taint) {
            if ($env:CATTLE_TAINTS) {
                $env:CATTLE_TAINTS += ",$Taint"
            }
            else {
                $env:CATTLE_TAINTS = $Taint
            }
        }

if ($Token) {
            $env:CATTLE_TOKEN = $Token
        }

if ($Worker) {
            $env:CATTLE_ROLE_WORKER = "true"
        }
    }

function Set-Path {
        $env:PATH += ";C:\var\lib\rancher\rke2\bin;C:\usr\local\bin"
        $environment = [System.Environment]::GetEnvironmentVariable("Path", "Machine")
        $environment = $environment.Insert($environment.Length, ";C:\var\lib\rancher\rke2\bin;C:\usr\local\bin")
        [System.Environment]::SetEnvironmentVariable("Path", $environment, "Machine")
    }

function Set-Environment {
        if (-Not $env:CATTLE_ROLE_CONTROLPLANE) {
            $env:CATTLE_ROLE_CONTROLPLANE = "false"
        }

if (-Not $env:CATTLE_ROLE_ETCD) {
            $env:CATTLE_ROLE_ETCD = "false"
        }

if (-Not $env:CATTLE_ROLE_WORKER) {
            $env:CATTLE_ROLE_WORKER = "false"
        }

if (-Not $env:CATTLE_REMOTE_ENABLED) {
            $env:CATTLE_REMOTE_ENABLED = "true"
        }
        else {
            #$env:CATTLE_REMOTE_ENABLED = "$(echo "${CATTLE_REMOTE_ENABLED}" | tr '[:upper:]' '[:lower:]')"
        }

if (-Not $env:CATTLE_PRESERVE_WORKDIR) {
            $env:CATTLE_PRESERVE_WORKDIR = "false"
        }
        else {
            #$env:CATTLE_PRESERVE_WORKDIR = "$(echo "${CATTLE_PRESERVE_WORKDIR}" | tr '[:upper:]' '[:lower:]')"
        }

if (-Not $env:CATTLE_AGENT_LOGLEVEL) {
            $env:CATTLE_AGENT_LOGLEVEL = "debug"
        }
        else {
            #$env:CATTLE_AGENT_LOGLEVEL = "$(echo "${CATTLE_AGENT_LOGLEVEL}" | tr '[:upper:]' '[:lower:]')"
        }

if ($env:CATTLE_AGENT_BINARY_LOCAL -eq "true") {
            if (-Not $env:CATTLE_AGENT_BINARY_LOCAL_LOCATION) {
                Write-LogFatal "No local binary location was specified"
            }
        }
        else {
            if (-Not $env:CATTLE_AGENT_BINARY_URL) {
                $env:CATTLE_AGENT_BINARY_URL = "https://raw.githubusercontent.com/rancher/rke2/master/install.ps1"
            }
        }

if ($env:CATTLE_REMOTE_ENABLED -eq "true") {
            if (-Not $env:CATTLE_TOKEN) {
                Write-LogInfo "Environment variable CATTLE_TOKEN was not set. Will not retrieve a remote connection configuration from Rancher2"
            }
            else {
                if (-Not $env:CATTLE_SERVER) {
                    Write-LogFatal "Environment variable CATTLE_SERVER was not set"
                }
            }
        }

if (-Not $env:CATTLE_AGENT_CONFIG_DIR) {
            $env:CATTLE_AGENT_CONFIG_DIR = "C:/etc/rancher/agent"
            [System.Environment]::SetEnvironmentVariable('CATTLE_AGENT_CONFIG_DIR', "C:/etc/rancher/agent", 'Machine')
            Write-LogInfo "Using default agent configuration directory $( $env:CATTLE_AGENT_CONFIG_DIR )"
        }

if (-Not (Test-Path $env:CATTLE_AGENT_CONFIG_DIR)) {
            New-Item -Path $env:CATTLE_AGENT_CONFIG_DIR -ItemType Directory -Force
        }

if (-Not $env:CATTLE_AGENT_VAR_DIR) {
            $env:CATTLE_AGENT_VAR_DIR = "C:/var/lib/rancher/agent"
            [System.Environment]::SetEnvironmentVariable('CATTLE_AGENT_VAR_DIR', "C:/var/lib/rancher/agent", 'Machine')
            Write-LogInfo "Using default agent var directory $( $env:CATTLE_AGENT_VAR_DIR )"
        }

if (-Not (Test-Path $env:CATTLE_AGENT_VAR_DIR)) {
            New-Item -Path $env:CATTLE_AGENT_VAR_DIR -ItemType Directory -Force
        }

if (-Not $env:CATTLE_AGENT_BIN_PREFIX) {
            $env:CATTLE_AGENT_BIN_PREFIX = "C:/usr/local"
            [System.Environment]::SetEnvironmentVariable('CATTLE_AGENT_BIN_PREFIX', "C:/usr/local", 'Machine')
            Write-LogInfo "Using default agent bin prefix $( $env:CATTLE_AGENT_BIN_PREFIX )"
        }

if (-Not (Test-Path $env:CATTLE_AGENT_BIN_PREFIX)) {
            New-Item -Path "$($env:CATTLE_AGENT_BIN_PREFIX)/bin" -ItemType Directory -Force
        }
        
        $env:CATTLE_ADDRESS = Get-Address -Value $env:CATTLE_ADDRESS
        $env:CATTLE_INTERNAL_ADDRESS = Get-Address -Value $env:CATTLE_INTERNAL_ADDRESS
    }

function Test-Architecture() {
        if ($env:PROCESSOR_ARCHITECTURE -ne "AMD64") {
            Write-LogFatal "Unsupported architecture $( $env:PROCESSOR_ARCHITECTURE )"
        }
    }

function Invoke-Rke2AgentDownload() {
        $localLocation = "$($env:CATTLE_AGENT_BIN_PREFIX)/bin"
        if ($env:CATTLE_AGENT_BINARY_LOCAL) {
            Write-LogInfo "Using local RKE2 installer from $($env:CATTLE_AGENT_BINARY_LOCAL_LOCATION)"
            Copy-Item -Path $env:CATTLE_AGENT_BINARY_LOCAL -Destination "$($localLocation)/install.ps1"
        }
        else {
            Write-LogInfo "Downloading RKE2 installer from $($env:CATTLE_AGENT_BINARY_URL)"
            curl.exe -sfL $env:CATTLE_AGENT_BINARY_URL -o "$($localLocation)/install.ps1"
        }
    }

function Test-CaCheckSum() {
        $caCertsPath = "cacerts"
        $env:RANCHER_CERT = "$env:TEMP/ranchercert"
        if (-Not $env:CATTLE_CA_CHECKSUM) {
            return
        }

curl.exe --insecure -sfL $env:CATTLE_SERVER/$caCertsPath -o $env:RANCHER_CERT
        if (-Not(Test-Path -Path $env:RANCHER_CERT)) {
            Write-Error "The environment variable CATTLE_CA_CHECKSUM is set but there is no CA certificate configured at $( $env:CATTLE_SERVER )/$( $caCertsPath )) "
            exit 1
        }
        #Test-Certificate -Cert $cert
        if ($LASTEXITCODE -ne 0) {
            Write-Error "Value from $( $env:CATTLE_SERVER )/$( $caCertsPath ) does not look like an x509 certificate, exited with $( $LASTEXITCODE ) "
            Write-Error "Retrieved cacerts:"
            Get-Content $env:RANCHER_CERT
            exit 1
        }
        else {
            Write-LogInfo "Value from $( $env:CATTLE_SERVER )/$( $caCertsPath ) is an x509 certificate"
        }
        $env:CATTLE_SERVER_CHECKSUM = (Get-FileHash -Path $env:RANCHER_CERT -Algorithm SHA256).Hash.ToLower()
        if ($env:CATTLE_SERVER_CHECKSUM -ne $env:CATTLE_CA_CHECKSUM) {
            Remove-Item -Path $env:RANCHER_CERT -Force
            Write-LogError "Configured cacerts checksum $( $env:CATTLE_SERVER_CHECKSUM ) does not match given --ca-checksum $( $env:CATTLE_CA_CHECKSUM ) "
            Write-LogError "Please check if the correct certificate is configured at $( $env:CATTLE_SERVER )/$( $caCertsPath ) ."
            exit 1
        }
    }
    function Get-Rke2Config() {
        $retries = 0
        $path = "C:\etc\rancher\rke2"
        $file = "config.yaml"
        if (-Not(Test-Path $path)) {
            New-Item -Path $path -ItemType Directory
        }
        $configFile = Join-Path -Path $path -ChildPath $file
        if (-Not(Test-Path $configFile)) {
            $Uri = "$($env:CATTLE_SERVER)/v3/connect/config-yaml"
            Write-LogInfo "Pulling RKE2 config.yaml from $Uri"
            try {
                if (-Not $env:CATTLE_CA_CHECKSUM) {
                    do {
                        # $ErrorActionPreference = "SilentlyContinue"
                        curl.exe -sfL $Uri -o $configFile -H "Authorization: Bearer $($env:CATTLE_TOKEN)" -H "X-Cattle-Id: $($env:CATTLE_ID)" -H "X-Cattle-Role-Worker: $($env:CATTLE_ROLE_WORKER)" -H "X-Cattle-Labels: $($env:CATTLE_LABELS)" -H "X-Cattle-Taints: $($env:CATTLE_TAINTS)" -H "X-Cattle-Address: $($env:CATTLE_ADDRESS)" -H "X-Cattle-Internal-Address: $($env:CATTLE_INTERNAL_ADDRESS)" -H "Content-Type: application/json"
                        $retries++
                        if (-Not(Test-Path $configFile)) {
                            Start-Sleep -Seconds 12
                        }
                    } 
                    while ((-Not(Test-Path $configFile) -and $retries -lt 6 -and $LASTEXITCODE -ne 0))
                }
                else {
                    do {
                        # $ErrorActionPreference = "SilentlyContinue"
                        curl.exe --insecure --cacert $env:RANCHER_CERT -sfL $Uri -o $configFile -H "Authorization: Bearer $($env:CATTLE_TOKEN)" -H "X-Cattle-Id: $($env:CATTLE_ID)" -H "X-Cattle-Role-Worker: $($env:CATTLE_ROLE_WORKER)" -H "X-Cattle-Labels: $($env:CATTLE_LABELS)" -H "X-Cattle-Taints: $($env:CATTLE_TAINTS)" -H "X-Cattle-Address: $($env:CATTLE_ADDRESS)" -H "X-Cattle-Internal-Address: $($env:CATTLE_INTERNAL_ADDRESS)" -H "Content-Type: application/json"
                        $retries++
                        if (-Not(Test-Path $configFile)) {
                            Start-Sleep -Seconds 12
                        }        
                    } 
                    while ((-Not(Test-Path $configFile) -and $retries -lt 6 -and $LASTEXITCODE -ne 0))
                } 
                trap {
                    if ($retries -lt 6) {
                        Write-LogInfo "retry number: $retries"
                        continue
                    }
                    if ($retries -ge 6) {
                        throw [System.Net.WebException]::new()
                    }
                    elseif (-Not(Test-Path $configFile)) {
                        throw [System.IO.FileNotFoundException]
                    }
                    else {
                        throw [Microsoft.PowerShell.Commands.WriteErrorException]::new()                    
                    }
                }
            }
            catch [System.IO.FileNotFoundException] {
                Write-Error -Message "RKE2 config file wasn't found after $retries retries. Max Retries Exceeded." -Exception ([System.Net.WebException]::new()) -ErrorAction Stop -ForegroundColor Red
                exit 1
            }
            catch [System.Net.WebException] {
                Write-Error -Message "RKE2 config file $configFile was not available from $Uri" -Exception ([System.IO.FileNotFoundException]) -ErrorAction Stop  -ForegroundColor Red
                exit 1
            }
            catch [Microsoft.PowerShell.Commands.WriteErrorException] {
                Write-LogFatal "An unexpected error occurred while running the RKE2 Windows Agent Rancher installation script: `r`n$($_)"
            }

if ((Test-Path $configFile)) {
                Write-LogInfo "RKE2 config.yaml pulled successfully"
            }
        }
    }

function Get-Rke2Info() {
        $Uri = "$($env:CATTLE_SERVER)/v3/connect/cluster-info"
        $path = "C:/etc/rancher/rke2"
        $file = "info.json"
        if (-Not(Test-Path $path)) {
            New-Item -Path $path -ItemType Directory
        }

$infoFile = Join-Path -Path $path -ChildPath $file
        if (-Not $env:CATTLE_CA_CHECKSUM) {
            curl.exe -sfL $Uri -o $infoFile -H "Authorization: Bearer $($env:CATTLE_TOKEN)" -H "X-Cattle-Id: $($env:CATTLE_ID)" -H "X-Cattle-Field: kubernetesversion" -H "Content-Type: application/json"
        }
        else {
            curl.exe --insecure --cacert $env:RANCHER_CERT -sfL $Uri -o $infoFile -H "Authorization: Bearer $($env:CATTLE_TOKEN)" -H "X-Cattle-Id: $($env:CATTLE_ID)" -H "X-Cattle-Field: kubernetesversion" -H "Content-Type: application/json"
        }
        Write-LogInfo "$(Get-Content $infoFile)"
        $clusterInfo = Get-Content $infoFile | ConvertFrom-Json
        if ([bool]($clusterInfo.PSobject.Properties.name -match "kubernetesversion")) {
            $env:CATTLE_RKE2_VERSION = $clusterInfo.kubernetesversion
        }
        Remove-Item -Path $infoFile -Force
    }

function New-CattleId() {
        if (-Not $env:CATTLE_ID) {
            Write-LogInfo "Generating Cattle ID"

if (Test-Path -Path "$($env:CATTLE_AGENT_CONFIG_DIR)/cattle-id") {
                $env:CATTLE_ID = Get-Content -Path "$($env:CATTLE_AGENT_CONFIG_DIR)/cattle-id"
                Write-LogInfo "Cattle ID was already detected as $($env:CATTLE_ID). Not generating a new one."
                return
            }
            $stream = [IO.MemoryStream]::new([Text.Encoding]::UTF8.GetBytes($env:COMPUTERNAME))
            $env:CATTLE_ID = (Get-FileHash -InputStream $stream -Algorithm SHA256).Hash.ToLower().Substring(0, 62)
            Set-Content -Path "$($env:CATTLE_AGENT_CONFIG_DIR)/cattle-id" -Value $env:CATTLE_ID
            return
        }
        Write-LogInfo "Not generating Cattle ID"
    }

function Get-Address() {
        [CmdletBinding()]
        param (
            [Parameter()]
            [String]
            $Value
        )
        if (!$Value) {
            # If nothing is given, return empty (it will be automatically determined later if empty)
            return ""
        }
        # If given address is a network interface on the system, retrieve configured IP on that interface (only the first configured IP is taken)
        elseif (Get-NetAdapter -Name $Value -ErrorAction SilentlyContinue) {
            return $(Get-NetIpConfiguration | Where-Object { $null -ne $_.IPv4DefaultGateway -and $_.NetAdapter.Status -ne "Disconnected" }).IPv4Address.IPAddress
        }
        # Loop through cloud provider options to get IP from metadata, if not found return given value
        else {
            switch ($Value) {
                awslocal { return curl.exe --connect-timeout 60 --max-time 60 -s http://169.254.169.254/latest/meta-data/local-ipv4 }
                awspublic { return curl.exe --connect-timeout 60 --max-time 60 -s http://169.254.169.254/latest/meta-data/public-ipv4 }
                doprivate { return curl.exe --connect-timeout 60 --max-time 60 -s http://169.254.169.254/metadata/v1/interfaces/private/0/ipv4/address }
                dopublic { return curl.exe --connect-timeout 60 --max-time 60 -s http://169.254.169.254/metadata/v1/interfaces/public/0/ipv4/address }
                azprivate { return curl.exe --connect-timeout 60 --max-time 60 -s -H Metadata:true "http://169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/privateIpAddress?api-version=2017-08-01&format=text" }
                azpublic { return curl.exe --connect-timeout 60 --max-time 60 -s -H Metadata:true "http://169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/publicIpAddress?api-version=2017-08-01&format=text" }
                gceinternal { return curl.exe --connect-timeout 60 --max-time 60 -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip }
                gceexternal { return curl.exe --connect-timeout 60 --max-time 60 -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip }
                packetlocal { return curl.exe --connect-timeout 60 --max-time 60 -s https://metadata.packet.net/2009-04-04/meta-data/local-ipv4 }
                packetpublic { return curl.exe --connect-timeout 60 --max-time 60 -s https://metadata.packet.net/2009-04-04/meta-data/public-ipv4 }
                ipify { return curl.exe --connect-timeout 60 --max-time 60 -s https://api.ipify.org }
                Default {
                    return $Value
                }
            }          
        }
    }

function Invoke-RancherInstall() {
        $rke2ServiceName = "rke2"
        Test-Architecture
        Get-Args
        Set-Environment
        Set-Path
        Test-CaCheckSum

if ((Get-Service -Name $rke2ServiceName -ErrorAction SilentlyContinue)) {
            Stop-Service -Name $rke2ServiceName
            while ((Get-Service $rke2ServiceName).Status -ne 'Stopped') {
                Start-Sleep -s 5
            }
        }

Invoke-Rke2AgentDownload
        New-CattleId
        Get-Rke2Config
        Get-Rke2Info

if ($env:CATTLE_RKE2_VERSION) {
            Invoke-Expression -Command "$($env:CATTLE_AGENT_BIN_PREFIX)/bin/install.ps1 -Version $($env:CATTLE_RKE2_VERSION)"
        }
        else {
            Invoke-Expression -Command "$($env:CATTLE_AGENT_BIN_PREFIX)/bin/install.ps1"
        }

Write-LogInfo "Checking if RKE2 agent service exists"
        if ((Get-Service -Name $rke2ServiceName -ErrorAction SilentlyContinue)) {
            Write-LogInfo "RKE2 agent service found, stopping now"
            Stop-Service -Name $rke2ServiceName
            while ((Get-Service $rke2ServiceName).Status -ne 'Stopped') {
                Write-LogInfo "Waiting for RKE2 agent service to stop"
                Start-Sleep -s 5
            }
        }
        else {
            # Create Windows Service
            Write-LogInfo "RKE2 agent service not found, enabling agent service"
            Push-Location "$($env:CATTLE_AGENT_BIN_PREFIX)/bin"
            rke2.exe agent service --add
            Pop-Location
            Start-Sleep -s 5
        }

Write-LogInfo "Starting the RKE2 agent service"
        Start-Service -Name $rke2ServiceName
    }

Invoke-RancherInstall
}0707010000011D000081A4000000000000000000000001653C446F00000F3C000000000000000000000000000000000000002F00000000rke2-1.27.7+rke2r1/windows/rke2-quickstart.ps1<#
.SYNOPSIS
  A quickstart script to Setup and Install standalone RKE2 in Windows to be used as Worker Nodes.
  This script enables features, sets up environment variables and adds default configuration that are needed to install RKE2 in Windows and join a cluster.`
.DESCRIPTION
  Run the script to setup and install all RKE2 related needs and to join a cluster.
.Parameter ServerIP
    Server IP of Primary server where RKE2 is already installed and the worker will join.`
.Parameter Token
    Token of Primary server.`
.Parameter Mode
    Installation Mode of RKE2
    Can be either INSTALL_RKE2_VERSION or INSTALL_RKE2_COMMIT`
.Parameter Version
    Version of RKE2 or Commit of RKE2 to download from cloud storage.
    If Commit Mode set, this forces Method=tar in install script.
    * (for developer & QA use only)`

.EXAMPLE
  Usage:
    Invoke-WebRequest ((New-Object System.Net.WebClient).DownloadString('https://github.com/rancher/rke2/blob/master/windows/rke2-quickstart.ps1'))
    ./rke2-quickstart.ps1 $ServerIP <server-IP> $Token <server-token> $Mode <install-mode> $Version <rke2-version>
#>

[CmdletBinding()]
param (
    [Parameter(Mandatory=$true)]
    [String]
    $ServerIP,
    [Parameter(Mandatory=$true)]
    [String]
    $Version,
    [Parameter(Mandatory=$true)]
    [String]
    $Token,
    [Parameter(Mandatory=$false)]
    [String]
    $Mode
)

function Write-InfoLog() {
    Write-Output "[INFO] $($args -join " ")"
}

function Write-WarnLog() {
    Write-Output "[WARN] $($args -join " ")"
}

function Write-DebugLog() {
    Write-Output "[DEBUG] $($args -join " ")"
}

# Set the version or commit based of cli
function Set-Version() {
    if ($PSBoundParameters.ContainsKey("Mode")) {
        if (($Mode -like "*VERSION") -or ($Mode -like "*COMMIT")) {
            $modeArr = $Mode.Split("_")
            $mode = (Get-Culture).TextInfo.ToTitleCase($modeArr[2].ToLower())
            $version = "$($mode) $($Version)"
        } else {
            Write-InfoLog "Unsupported Install Mode: $($Mode)"
        }
    } else {
        if ($Version -match "rke2r") {
            $version = "Version $($Version)"
        } else {
            $version = "Commit $($Version)"
        }
    }
    
    return $version
}

function Enable-Features() {
    Enable-WindowsOptionalFeature -Online -FeatureName Containers -All
}

function Setup-Config(){
    Write-InfoLog "Creating rke2 directory..."
    New-Item -Type Directory c:/etc/rancher/rke2 -Force
    Write-InfoLog "Fetch public IP..."
    $publicIP = (Invoke-WebRequest -uri "https://api.ipify.org/").Content.Trim()
    Write-InfoLog "Setting up rke2 config.yaml file..."
    Set-Content -Path c:/etc/rancher/rke2/config.yaml -Value "server: https://$($ServerIP):9345`ntoken: $Token`nnode-external-ip: $publicIP`n"
    Get-Content -Path c:/etc/rancher/rke2/config.yaml
}

function Setup-EnvironmentVariables(){
    Write-InfoLog "Setting up environment vars..."
    [System.Environment]::SetEnvironmentVariable(
        "Path",[System.Environment]::GetEnvironmentVariable(
            "Path", [System.EnvironmentVariableTarget]::Machine) + ";c:\var\lib\rancher\rke2\bin;c:\usr\local\bin",
    [System.EnvironmentVariableTarget]::Machine)
}

function Install-rke2(){
    Write-InfoLog "Downloading install script..."
    Invoke-WebRequest -Uri https://raw.githubusercontent.com/rancher/rke2/master/install.ps1 -Outfile C:\Users\Administrator\install.ps1
    $version = Set-Version
    Write-InfoLog "Installing rke2 with $version..."
    Invoke-Expression -Command "C:\Users\Administrator\install.ps1 -$version"
}

function Start-rke2(){
    Write-InfoLog "Adding rke2-agent service..."
    Invoke-Expression -Command "C:\usr\local\bin\rke2.exe agent service --add"
    Write-InfoLog "Starting rke2-agent service..."
    Start-Service rke2
}

Enable-Features
Setup-Config
Setup-EnvironmentVariables
Install-rke2
Start-rke2
07070100000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000B00000000TRAILER!!!1960 blocks

Places

File rke2-1.27.7+rke2r1.obscpio of Package rke2-1.27 (Revision 1c0369e63dbe8c671b873f4c0f52017f)

Places