apiVersion: v1
kind: Namespace
metadata:
  name: plevion-local
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.13.0
  name: ingressclassparameterses.configuration.konghq.com
spec:
  group: configuration.konghq.com
  names:
    kind: IngressClassParameters
    listKind: IngressClassParametersList
    plural: ingressclassparameterses
    singular: ingressclassparameters
  scope: Namespaced
  versions:
  - name: v1alpha1
    schema:
      openAPIV3Schema:
        description: IngressClassParameters is the Schema for the IngressClassParameters
          API.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: Spec is the IngressClassParameters specification.
            properties:
              enableLegacyRegexDetection:
                default: false
                description: EnableLegacyRegexDetection automatically detects if ImplementationSpecific
                  Ingress paths are regular expression paths using the legacy 2.x
                  heuristic. The controller adds the "~" prefix to those paths if
                  the Kong version is 3.0 or higher.
                type: boolean
              serviceUpstream:
                default: false
                description: Offload load-balancing to kube-proxy or sidecar.
                type: boolean
            type: object
        type: object
    served: true
    storage: true
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.13.0
  name: kongclusterplugins.configuration.konghq.com
spec:
  group: configuration.konghq.com
  names:
    categories:
    - kong-ingress-controller
    kind: KongClusterPlugin
    listKind: KongClusterPluginList
    plural: kongclusterplugins
    shortNames:
    - kcp
    singular: kongclusterplugin
  scope: Cluster
  versions:
  - additionalPrinterColumns:
    - description: Name of the plugin
      jsonPath: .plugin
      name: Plugin-Type
      type: string
    - description: Age
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    - description: Indicates if the plugin is disabled
      jsonPath: .disabled
      name: Disabled
      priority: 1
      type: boolean
    - description: Configuration of the plugin
      jsonPath: .config
      name: Config
      priority: 1
      type: string
    - jsonPath: .status.conditions[?(@.type=="Programmed")].status
      name: Programmed
      type: string
    name: v1
    schema:
      openAPIV3Schema:
        description: KongClusterPlugin is the Schema for the kongclusterplugins API.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          config:
            description: Config contains the plugin configuration. It's a list of
              keys and values required to configure the plugin. Please read the documentation
              of the plugin being configured to set values in here. For any plugin
              in Kong, anything that goes in the `config` JSON key in the Admin API
              request, goes into this property. Only one of `config` or `configFrom`
              may be used in a KongClusterPlugin, not both at once.
            type: object
            x-kubernetes-preserve-unknown-fields: true
          configFrom:
            description: ConfigFrom references a secret containing the plugin configuration.
              This should be used when the plugin configuration contains sensitive
              information, such as AWS credentials in the Lambda plugin or the client
              secret in the OIDC plugin. Only one of `config` or `configFrom` may
              be used in a KongClusterPlugin, not both at once.
            properties:
              secretKeyRef:
                description: Specifies a name, a namespace, and a key of a secret
                  to refer to.
                properties:
                  key:
                    description: The key containing the value.
                    type: string
                  name:
                    description: The secret containing the key.
                    type: string
                  namespace:
                    description: The namespace containing the secret.
                    type: string
                required:
                - key
                - name
                - namespace
                type: object
            type: object
          consumerRef:
            description: ConsumerRef is a reference to a particular consumer.
            type: string
          disabled:
            description: Disabled set if the plugin is disabled or not.
            type: boolean
          instance_name:
            description: InstanceName is an optional custom name to identify an instance
              of the plugin. This is useful when running the same plugin in multiple
              contexts, for example, on multiple services.
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          ordering:
            description: 'Ordering overrides the normal plugin execution order. It''s
              only available on Kong Enterprise. `<phase>` is a request processing
              phase (for example, `access` or `body_filter`) and `<plugin>` is the
              name of the plugin that will run before or after the KongPlugin. For
              example, a KongPlugin with `plugin: rate-limiting` and `before.access:
              ["key-auth"]` will create a rate limiting plugin that limits requests
              _before_ they are authenticated.'
            properties:
              after:
                additionalProperties:
                  items:
                    type: string
                  type: array
                description: PluginOrderingPhase indicates which plugins in a phase
                  should affect the target plugin's order
                type: object
              before:
                additionalProperties:
                  items:
                    type: string
                  type: array
                description: PluginOrderingPhase indicates which plugins in a phase
                  should affect the target plugin's order
                type: object
            type: object
          plugin:
            description: PluginName is the name of the plugin to which to apply the
              config.
            type: string
          protocols:
            description: Protocols configures plugin to run on requests received on
              specific protocols.
            items:
              description: KongProtocol is a valid Kong protocol. This alias is necessary
                to deal with https://github.com/kubernetes-sigs/controller-tools/issues/342
              enum:
              - http
              - https
              - grpc
              - grpcs
              - tcp
              - tls
              - udp
              type: string
            type: array
          run_on:
            description: RunOn configures the plugin to run on the first or the second
              or both nodes in case of a service mesh deployment.
            enum:
            - first
            - second
            - all
            type: string
          status:
            description: Status represents the current status of the KongClusterPlugin
              resource.
            properties:
              conditions:
                default:
                - lastTransitionTime: "1970-01-01T00:00:00Z"
                  message: Waiting for controller
                  reason: Pending
                  status: Unknown
                  type: Programmed
                description: "Conditions describe the current conditions of the KongClusterPluginStatus.
                  \n Known condition types are: \n * \"Programmed\""
                items:
                  description: "Condition contains details for one aspect of the current
                    state of this API Resource. --- This struct is intended for direct
                    use as an array at the field path .status.conditions.  For example,
                    \n type FooStatus struct{ // Represents the observations of a
                    foo's current state. // Known .status.conditions.type are: \"Available\",
                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
                  properties:
                    lastTransitionTime:
                      description: lastTransitionTime is the last time the condition
                        transitioned from one status to another. This should be when
                        the underlying condition changed.  If that is not known, then
                        using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: message is a human readable message indicating
                        details about the transition. This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: observedGeneration represents the .metadata.generation
                        that the condition was set based upon. For instance, if .metadata.generation
                        is currently 12, but the .status.conditions[x].observedGeneration
                        is 9, the condition is out of date with respect to the current
                        state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: reason contains a programmatic identifier indicating
                        the reason for the condition's last transition. Producers
                        of specific condition types may define expected values and
                        meanings for this field, and whether the values are considered
                        a guaranteed API. The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                        --- Many .condition.type values are consistent across resources
                        like Available, but because arbitrary conditions can be useful
                        (see .node.status.conditions), the ability to deconflict is
                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                maxItems: 8
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
            type: object
        required:
        - plugin
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.13.0
  name: kongconsumergroups.configuration.konghq.com
spec:
  group: configuration.konghq.com
  names:
    categories:
    - kong-ingress-controller
    kind: KongConsumerGroup
    listKind: KongConsumerGroupList
    plural: kongconsumergroups
    shortNames:
    - kcg
    singular: kongconsumergroup
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Age
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    - jsonPath: .status.conditions[?(@.type=="Programmed")].status
      name: Programmed
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: KongConsumerGroup is the Schema for the kongconsumergroups API.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          status:
            description: Status represents the current status of the KongConsumer
              resource.
            properties:
              conditions:
                default:
                - lastTransitionTime: "1970-01-01T00:00:00Z"
                  message: Waiting for controller
                  reason: Pending
                  status: Unknown
                  type: Programmed
                description: "Conditions describe the current conditions of the KongConsumerGroup.
                  \n Known condition types are: \n * \"Programmed\""
                items:
                  description: "Condition contains details for one aspect of the current
                    state of this API Resource. --- This struct is intended for direct
                    use as an array at the field path .status.conditions.  For example,
                    \n type FooStatus struct{ // Represents the observations of a
                    foo's current state. // Known .status.conditions.type are: \"Available\",
                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
                  properties:
                    lastTransitionTime:
                      description: lastTransitionTime is the last time the condition
                        transitioned from one status to another. This should be when
                        the underlying condition changed.  If that is not known, then
                        using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: message is a human readable message indicating
                        details about the transition. This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: observedGeneration represents the .metadata.generation
                        that the condition was set based upon. For instance, if .metadata.generation
                        is currently 12, but the .status.conditions[x].observedGeneration
                        is 9, the condition is out of date with respect to the current
                        state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: reason contains a programmatic identifier indicating
                        the reason for the condition's last transition. Producers
                        of specific condition types may define expected values and
                        meanings for this field, and whether the values are considered
                        a guaranteed API. The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                        --- Many .condition.type values are consistent across resources
                        like Available, but because arbitrary conditions can be useful
                        (see .node.status.conditions), the ability to deconflict is
                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                maxItems: 8
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.13.0
  name: kongconsumers.configuration.konghq.com
spec:
  group: configuration.konghq.com
  names:
    categories:
    - kong-ingress-controller
    kind: KongConsumer
    listKind: KongConsumerList
    plural: kongconsumers
    shortNames:
    - kc
    singular: kongconsumer
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Username of a Kong Consumer
      jsonPath: .username
      name: Username
      type: string
    - description: Age
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    - jsonPath: .status.conditions[?(@.type=="Programmed")].status
      name: Programmed
      type: string
    name: v1
    schema:
      openAPIV3Schema:
        description: KongConsumer is the Schema for the kongconsumers API.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          consumerGroups:
            description: ConsumerGroups are references to consumer groups (that consumer
              wants to be part of) provisioned in Kong.
            items:
              type: string
            type: array
          credentials:
            description: Credentials are references to secrets containing a credential
              to be provisioned in Kong.
            items:
              type: string
            type: array
          custom_id:
            description: CustomID is a Kong cluster-unique existing ID for the consumer
              - useful for mapping Kong with users in your existing database.
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          status:
            description: Status represents the current status of the KongConsumer
              resource.
            properties:
              conditions:
                default:
                - lastTransitionTime: "1970-01-01T00:00:00Z"
                  message: Waiting for controller
                  reason: Pending
                  status: Unknown
                  type: Programmed
                description: "Conditions describe the current conditions of the KongConsumer.
                  \n Known condition types are: \n * \"Programmed\""
                items:
                  description: "Condition contains details for one aspect of the current
                    state of this API Resource. --- This struct is intended for direct
                    use as an array at the field path .status.conditions.  For example,
                    \n type FooStatus struct{ // Represents the observations of a
                    foo's current state. // Known .status.conditions.type are: \"Available\",
                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
                  properties:
                    lastTransitionTime:
                      description: lastTransitionTime is the last time the condition
                        transitioned from one status to another. This should be when
                        the underlying condition changed.  If that is not known, then
                        using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: message is a human readable message indicating
                        details about the transition. This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: observedGeneration represents the .metadata.generation
                        that the condition was set based upon. For instance, if .metadata.generation
                        is currently 12, but the .status.conditions[x].observedGeneration
                        is 9, the condition is out of date with respect to the current
                        state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: reason contains a programmatic identifier indicating
                        the reason for the condition's last transition. Producers
                        of specific condition types may define expected values and
                        meanings for this field, and whether the values are considered
                        a guaranteed API. The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                        --- Many .condition.type values are consistent across resources
                        like Available, but because arbitrary conditions can be useful
                        (see .node.status.conditions), the ability to deconflict is
                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                maxItems: 8
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
            type: object
          username:
            description: Username is a Kong cluster-unique username of the consumer.
            type: string
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.13.0
  name: kongingresses.configuration.konghq.com
spec:
  group: configuration.konghq.com
  names:
    categories:
    - kong-ingress-controller
    kind: KongIngress
    listKind: KongIngressList
    plural: kongingresses
    shortNames:
    - ki
    singular: kongingress
  scope: Namespaced
  versions:
  - name: v1
    schema:
      openAPIV3Schema:
        description: KongIngress is the Schema for the kongingresses API.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          proxy:
            description: Proxy defines additional connection options for the routes
              to be configured in the Kong Gateway, e.g. `connection_timeout`, `retries`,
              etc.
            properties:
              connect_timeout:
                description: "The timeout in milliseconds for\testablishing a connection
                  to the upstream server. Deprecated: use Service's \"konghq.com/connect-timeout\"
                  annotation instead."
                minimum: 0
                type: integer
              path:
                description: '(optional) The path to be used in requests to the upstream
                  server. Deprecated: use Service''s "konghq.com/path" annotation
                  instead.'
                pattern: ^/.*$
                type: string
              protocol:
                description: 'The protocol used to communicate with the upstream.
                  Deprecated: use Service''s "konghq.com/protocol" annotation instead.'
                enum:
                - http
                - https
                - grpc
                - grpcs
                - tcp
                - tls
                - udp
                type: string
              read_timeout:
                description: 'The timeout in milliseconds between two successive read
                  operations for transmitting a request to the upstream server. Deprecated:
                  use Service''s "konghq.com/read-timeout" annotation instead.'
                minimum: 0
                type: integer
              retries:
                description: 'The number of retries to execute upon failure to proxy.
                  Deprecated: use Service''s "konghq.com/retries" annotation instead.'
                minimum: 0
                type: integer
              write_timeout:
                description: 'The timeout in milliseconds between two successive write
                  operations for transmitting a request to the upstream server. Deprecated:
                  use Service''s "konghq.com/write-timeout" annotation instead.'
                minimum: 0
                type: integer
            type: object
          route:
            description: Route define rules to match client requests. Each Route is
              associated with a Service, and a Service may have multiple Routes associated
              to it.
            properties:
              headers:
                additionalProperties:
                  items:
                    type: string
                  type: array
                description: 'Headers contains one or more lists of values indexed
                  by header name that will cause this Route to match if present in
                  the request. The Host header cannot be used with this attribute.
                  Deprecated: use Ingress'' "konghq.com/headers" annotation instead.'
                type: object
              https_redirect_status_code:
                description: 'HTTPSRedirectStatusCode is the status code Kong responds
                  with when all properties of a Route match except the protocol. Deprecated:
                  use Ingress'' "ingress.kubernetes.io/force-ssl-redirect" or "konghq.com/https-redirect-status-code"
                  annotations instead.'
                type: integer
              methods:
                description: 'Methods is a list of HTTP methods that match this Route.
                  Deprecated: use Ingress'' "konghq.com/methods" annotation instead.'
                items:
                  type: string
                type: array
              path_handling:
                description: 'PathHandling controls how the Service path, Route path
                  and requested path are combined when sending a request to the upstream.
                  Deprecated: use Ingress'' "konghq.com/path-handling" annotation
                  instead.'
                enum:
                - v0
                - v1
                type: string
              preserve_host:
                description: 'PreserveHost sets When matching a Route via one of the
                  hosts domain names, use the request Host header in the upstream
                  request headers. If set to false, the upstream Host header will
                  be that of the Service’s host. Deprecated: use Ingress'' "konghq.com/preserve-host"
                  annotation instead.'
                type: boolean
              protocols:
                description: 'Protocols is an array of the protocols this Route should
                  allow. Deprecated: use Ingress'' "konghq.com/protocols" annotation
                  instead.'
                items:
                  description: KongProtocol is a valid Kong protocol. This alias is
                    necessary to deal with https://github.com/kubernetes-sigs/controller-tools/issues/342
                  enum:
                  - http
                  - https
                  - grpc
                  - grpcs
                  - tcp
                  - tls
                  - udp
                  type: string
                type: array
              regex_priority:
                description: 'RegexPriority is a number used to choose which route
                  resolves a given request when several routes match it using regexes
                  simultaneously. Deprecated: use Ingress'' "konghq.com/regex-priority"
                  annotation instead.'
                type: integer
              request_buffering:
                description: 'RequestBuffering sets whether to enable request body
                  buffering or not. Deprecated: use Ingress'' "konghq.com/request-buffering"
                  annotation instead.'
                type: boolean
              response_buffering:
                description: 'ResponseBuffering sets whether to enable response body
                  buffering or not. Deprecated: use Ingress'' "konghq.com/response-buffering"
                  annotation instead.'
                type: boolean
              snis:
                description: 'SNIs is a list of SNIs that match this Route when using
                  stream routing. Deprecated: use Ingress'' "konghq.com/snis" annotation
                  instead.'
                items:
                  type: string
                type: array
              strip_path:
                description: 'StripPath sets When matching a Route via one of the
                  paths strip the matching prefix from the upstream request URL. Deprecated:
                  use Ingress'' "konghq.com/strip-path" annotation instead.'
                type: boolean
            type: object
          upstream:
            description: Upstream represents a virtual hostname and can be used to
              loadbalance incoming requests over multiple targets (e.g. Kubernetes
              `Services` can be a target, OR `Endpoints` can be targets).
            properties:
              algorithm:
                description: 'Algorithm is the load balancing algorithm to use. Accepted
                  values are: "round-robin", "consistent-hashing", "least-connections",
                  "latency".'
                enum:
                - round-robin
                - consistent-hashing
                - least-connections
                - latency
                type: string
              hash_fallback:
                description: 'HashFallback defines What to use as hashing input if
                  the primary hash_on does not return a hash. Accepted values are:
                  "none", "consumer", "ip", "header", "cookie".'
                type: string
              hash_fallback_header:
                description: HashFallbackHeader is the header name to take the value
                  from as hash input. Only required when "hash_fallback" is set to
                  "header".
                type: string
              hash_fallback_query_arg:
                description: HashFallbackQueryArg is the "hash_fallback" version of
                  HashOnQueryArg.
                type: string
              hash_fallback_uri_capture:
                description: HashFallbackURICapture is the "hash_fallback" version
                  of HashOnURICapture.
                type: string
              hash_on:
                description: 'HashOn defines what to use as hashing input. Accepted
                  values are: "none", "consumer", "ip", "header", "cookie", "path",
                  "query_arg", "uri_capture".'
                type: string
              hash_on_cookie:
                description: The cookie name to take the value from as hash input.
                  Only required when "hash_on" or "hash_fallback" is set to "cookie".
                type: string
              hash_on_cookie_path:
                description: The cookie path to set in the response headers. Only
                  required when "hash_on" or "hash_fallback" is set to "cookie".
                type: string
              hash_on_header:
                description: HashOnHeader defines the header name to take the value
                  from as hash input. Only required when "hash_on" is set to "header".
                type: string
              hash_on_query_arg:
                description: HashOnQueryArg is the query string parameter whose value
                  is the hash input when "hash_on" is set to "query_arg".
                type: string
              hash_on_uri_capture:
                description: HashOnURICapture is the name of the capture group whose
                  value is the hash input when "hash_on" is set to "uri_capture".
                type: string
              healthchecks:
                description: Healthchecks defines the health check configurations
                  in Kong.
                properties:
                  active:
                    description: ActiveHealthcheck configures active health check
                      probing.
                    properties:
                      concurrency:
                        minimum: 1
                        type: integer
                      headers:
                        additionalProperties:
                          items:
                            type: string
                          type: array
                        type: object
                      healthy:
                        description: Healthy configures thresholds and HTTP status
                          codes to mark targets healthy for an upstream.
                        properties:
                          http_statuses:
                            items:
                              type: integer
                            type: array
                          interval:
                            minimum: 0
                            type: integer
                          successes:
                            minimum: 0
                            type: integer
                        type: object
                      http_path:
                        pattern: ^/.*$
                        type: string
                      https_sni:
                        type: string
                      https_verify_certificate:
                        type: boolean
                      timeout:
                        minimum: 0
                        type: integer
                      type:
                        type: string
                      unhealthy:
                        description: Unhealthy configures thresholds and HTTP status
                          codes to mark targets unhealthy.
                        properties:
                          http_failures:
                            minimum: 0
                            type: integer
                          http_statuses:
                            items:
                              type: integer
                            type: array
                          interval:
                            minimum: 0
                            type: integer
                          tcp_failures:
                            minimum: 0
                            type: integer
                          timeouts:
                            minimum: 0
                            type: integer
                        type: object
                    type: object
                  passive:
                    description: PassiveHealthcheck configures passive checks around
                      passive health checks.
                    properties:
                      healthy:
                        description: Healthy configures thresholds and HTTP status
                          codes to mark targets healthy for an upstream.
                        properties:
                          http_statuses:
                            items:
                              type: integer
                            type: array
                          interval:
                            minimum: 0
                            type: integer
                          successes:
                            minimum: 0
                            type: integer
                        type: object
                      type:
                        type: string
                      unhealthy:
                        description: Unhealthy configures thresholds and HTTP status
                          codes to mark targets unhealthy.
                        properties:
                          http_failures:
                            minimum: 0
                            type: integer
                          http_statuses:
                            items:
                              type: integer
                            type: array
                          interval:
                            minimum: 0
                            type: integer
                          tcp_failures:
                            minimum: 0
                            type: integer
                          timeouts:
                            minimum: 0
                            type: integer
                        type: object
                    type: object
                  threshold:
                    type: number
                type: object
              host_header:
                description: HostHeader is The hostname to be used as Host header
                  when proxying requests through Kong.
                type: string
              slots:
                description: Slots is the number of slots in the load balancer algorithm.
                minimum: 10
                type: integer
            type: object
        type: object
        x-kubernetes-validations:
        - message: '''proxy'' field is no longer supported, use Service''s annotations
            instead'
          rule: '!has(self.proxy)'
        - message: '''route'' field is no longer supported, use Ingress'' annotations
            instead'
          rule: '!has(self.route)'
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.13.0
  name: kongplugins.configuration.konghq.com
spec:
  group: configuration.konghq.com
  names:
    categories:
    - kong-ingress-controller
    kind: KongPlugin
    listKind: KongPluginList
    plural: kongplugins
    shortNames:
    - kp
    singular: kongplugin
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Name of the plugin
      jsonPath: .plugin
      name: Plugin-Type
      type: string
    - description: Age
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    - description: Indicates if the plugin is disabled
      jsonPath: .disabled
      name: Disabled
      priority: 1
      type: boolean
    - description: Configuration of the plugin
      jsonPath: .config
      name: Config
      priority: 1
      type: string
    - jsonPath: .status.conditions[?(@.type=="Programmed")].status
      name: Programmed
      type: string
    name: v1
    schema:
      openAPIV3Schema:
        description: KongPlugin is the Schema for the kongplugins API.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          config:
            description: Config contains the plugin configuration. It's a list of
              keys and values required to configure the plugin. Please read the documentation
              of the plugin being configured to set values in here. For any plugin
              in Kong, anything that goes in the `config` JSON key in the Admin API
              request, goes into this property. Only one of `config` or `configFrom`
              may be used in a KongPlugin, not both at once.
            type: object
            x-kubernetes-preserve-unknown-fields: true
          configFrom:
            description: ConfigFrom references a secret containing the plugin configuration.
              This should be used when the plugin configuration contains sensitive
              information, such as AWS credentials in the Lambda plugin or the client
              secret in the OIDC plugin. Only one of `config` or `configFrom` may
              be used in a KongPlugin, not both at once.
            properties:
              secretKeyRef:
                description: Specifies a name and a key of a secret to refer to. The
                  namespace is implicitly set to the one of referring object.
                properties:
                  key:
                    description: The key containing the value.
                    type: string
                  name:
                    description: The secret containing the key.
                    type: string
                required:
                - key
                - name
                type: object
            type: object
          consumerRef:
            description: ConsumerRef is a reference to a particular consumer.
            type: string
          disabled:
            description: Disabled set if the plugin is disabled or not.
            type: boolean
          instance_name:
            description: InstanceName is an optional custom name to identify an instance
              of the plugin. This is useful when running the same plugin in multiple
              contexts, for example, on multiple services.
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          ordering:
            description: 'Ordering overrides the normal plugin execution order. It''s
              only available on Kong Enterprise. `<phase>` is a request processing
              phase (for example, `access` or `body_filter`) and `<plugin>` is the
              name of the plugin that will run before or after the KongPlugin. For
              example, a KongPlugin with `plugin: rate-limiting` and `before.access:
              ["key-auth"]` will create a rate limiting plugin that limits requests
              _before_ they are authenticated.'
            properties:
              after:
                additionalProperties:
                  items:
                    type: string
                  type: array
                description: PluginOrderingPhase indicates which plugins in a phase
                  should affect the target plugin's order
                type: object
              before:
                additionalProperties:
                  items:
                    type: string
                  type: array
                description: PluginOrderingPhase indicates which plugins in a phase
                  should affect the target plugin's order
                type: object
            type: object
          plugin:
            description: PluginName is the name of the plugin to which to apply the
              config.
            type: string
          protocols:
            description: Protocols configures plugin to run on requests received on
              specific protocols.
            items:
              description: KongProtocol is a valid Kong protocol. This alias is necessary
                to deal with https://github.com/kubernetes-sigs/controller-tools/issues/342
              enum:
              - http
              - https
              - grpc
              - grpcs
              - tcp
              - tls
              - udp
              type: string
            type: array
          run_on:
            description: RunOn configures the plugin to run on the first or the second
              or both nodes in case of a service mesh deployment.
            enum:
            - first
            - second
            - all
            type: string
          status:
            description: Status represents the current status of the KongPlugin resource.
            properties:
              conditions:
                default:
                - lastTransitionTime: "1970-01-01T00:00:00Z"
                  message: Waiting for controller
                  reason: Pending
                  status: Unknown
                  type: Programmed
                description: "Conditions describe the current conditions of the KongPluginStatus.
                  \n Known condition types are: \n * \"Programmed\""
                items:
                  description: "Condition contains details for one aspect of the current
                    state of this API Resource. --- This struct is intended for direct
                    use as an array at the field path .status.conditions.  For example,
                    \n type FooStatus struct{ // Represents the observations of a
                    foo's current state. // Known .status.conditions.type are: \"Available\",
                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
                  properties:
                    lastTransitionTime:
                      description: lastTransitionTime is the last time the condition
                        transitioned from one status to another. This should be when
                        the underlying condition changed.  If that is not known, then
                        using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: message is a human readable message indicating
                        details about the transition. This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: observedGeneration represents the .metadata.generation
                        that the condition was set based upon. For instance, if .metadata.generation
                        is currently 12, but the .status.conditions[x].observedGeneration
                        is 9, the condition is out of date with respect to the current
                        state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: reason contains a programmatic identifier indicating
                        the reason for the condition's last transition. Producers
                        of specific condition types may define expected values and
                        meanings for this field, and whether the values are considered
                        a guaranteed API. The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                        --- Many .condition.type values are consistent across resources
                        like Available, but because arbitrary conditions can be useful
                        (see .node.status.conditions), the ability to deconflict is
                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                maxItems: 8
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
            type: object
        required:
        - plugin
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.13.0
  labels:
    gateway.networking.k8s.io/policy: direct
  name: kongupstreampolicies.configuration.konghq.com
spec:
  group: configuration.konghq.com
  names:
    categories:
    - kong-ingress-controller
    kind: KongUpstreamPolicy
    listKind: KongUpstreamPolicyList
    plural: kongupstreampolicies
    shortNames:
    - kup
    singular: kongupstreampolicy
  scope: Namespaced
  versions:
  - name: v1beta1
    schema:
      openAPIV3Schema:
        description: "KongUpstreamPolicy allows configuring algorithm that should
          be used for load balancing traffic between Kong Upstream's Targets. It also
          allows configuring health checks for Kong Upstream's Targets. \n Its configuration
          is similar to Kong Upstream object (https://docs.konghq.com/gateway/latest/admin-api/#upstream-object),
          and it is applied to Kong Upstream objects created by the controller. \n
          It can be attached to Services. To attach it to a Service, it has to be
          annotated with `konghq.com/upstream-policy: <name>`, where `<name>` is the
          name of the KongUpstreamPolicy object in the same namespace as the Service.
          \n When attached to a Service, it will affect all Kong Upstreams created
          for the Service. \n When attached to a Service used in a Gateway API *Route
          rule with multiple BackendRefs, all of its Services MUST be configured with
          the same KongUpstreamPolicy. Otherwise, the controller will *ignore* the
          KongUpstreamPolicy. \n Note: KongUpstreamPolicy doesn't implement Gateway
          API's GEP-713 strictly. In particular, it doesn't use the TargetRef for
          attaching to Services and Gateway API *Routes - annotations are used instead.
          This is to allow reusing the same KongUpstreamPolicy for multiple Services
          and Gateway API *Routes."
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: Spec contains the configuration of the Kong upstream.
            properties:
              algorithm:
                description: 'Algorithm is the load balancing algorithm to use. Accepted
                  values are: "round-robin", "consistent-hashing", "least-connections",
                  "latency".'
                enum:
                - round-robin
                - consistent-hashing
                - least-connections
                - latency
                type: string
              hashOn:
                description: HashOn defines how to calculate hash for consistent-hashing
                  load balancing algorithm. Algorithm must be set to "consistent-hashing"
                  for this field to have effect.
                properties:
                  cookie:
                    description: Cookie is the name of the cookie to use as hash input.
                    type: string
                  cookiePath:
                    description: CookiePath is cookie path to set in the response
                      headers.
                    type: string
                  header:
                    description: Header is the name of the header to use as hash input.
                    type: string
                  input:
                    description: Input allows using one of the predefined inputs (ip,
                      consumer, path). For other parametrized inputs, use one of the
                      fields below.
                    enum:
                    - ip
                    - consumer
                    - path
                    type: string
                  queryArg:
                    description: QueryArg is the name of the query argument to use
                      as hash input.
                    type: string
                  uriCapture:
                    description: URICapture is the name of the URI capture group to
                      use as hash input.
                    type: string
                type: object
              hashOnFallback:
                description: HashOnFallback defines how to calculate hash for consistent-hashing
                  load balancing algorithm if the primary hash function fails. Algorithm
                  must be set to "consistent-hashing" for this field to have effect.
                properties:
                  cookie:
                    description: Cookie is the name of the cookie to use as hash input.
                    type: string
                  cookiePath:
                    description: CookiePath is cookie path to set in the response
                      headers.
                    type: string
                  header:
                    description: Header is the name of the header to use as hash input.
                    type: string
                  input:
                    description: Input allows using one of the predefined inputs (ip,
                      consumer, path). For other parametrized inputs, use one of the
                      fields below.
                    enum:
                    - ip
                    - consumer
                    - path
                    type: string
                  queryArg:
                    description: QueryArg is the name of the query argument to use
                      as hash input.
                    type: string
                  uriCapture:
                    description: URICapture is the name of the URI capture group to
                      use as hash input.
                    type: string
                type: object
              healthchecks:
                description: Healthchecks defines the health check configurations
                  in Kong.
                properties:
                  active:
                    description: Active configures active health check probing.
                    properties:
                      concurrency:
                        description: Concurrency is the number of targets to check
                          concurrently.
                        minimum: 1
                        type: integer
                      headers:
                        additionalProperties:
                          items:
                            type: string
                          type: array
                        description: Headers is a list of HTTP headers to add to the
                          probe request.
                        type: object
                      healthy:
                        description: Healthy configures thresholds and HTTP status
                          codes to mark targets healthy for an upstream.
                        properties:
                          httpStatuses:
                            description: HTTPStatuses is a list of HTTP status codes
                              that Kong considers a success.
                            items:
                              description: HTTPStatus is an HTTP status code.
                              maximum: 599
                              minimum: 100
                              type: integer
                            type: array
                          interval:
                            description: Interval is the interval between active health
                              checks for an upstream in seconds when in a healthy
                              state.
                            minimum: 0
                            type: integer
                          successes:
                            description: Successes is the number of successes to consider
                              a target healthy.
                            minimum: 0
                            type: integer
                        type: object
                      httpPath:
                        description: HTTPPath is the path to use in GET HTTP request
                          to run as a probe.
                        pattern: ^/.*$
                        type: string
                      httpsSni:
                        description: HTTPSSNI is the SNI to use in GET HTTPS request
                          to run as a probe.
                        type: string
                      httpsVerifyCertificate:
                        description: HTTPSVerifyCertificate is a boolean value that
                          indicates if the certificate should be verified.
                        type: boolean
                      timeout:
                        description: Timeout is the probe timeout in seconds.
                        minimum: 0
                        type: integer
                      type:
                        description: Type determines whether to perform active health
                          checks using HTTP or HTTPS, or just attempt a TCP connection.
                          Accepted values are "http", "https", "tcp", "grpc", "grpcs".
                        enum:
                        - http
                        - https
                        - tcp
                        - grpc
                        - grpcs
                        type: string
                      unhealthy:
                        description: Unhealthy configures thresholds and HTTP status
                          codes to mark targets unhealthy for an upstream.
                        properties:
                          httpFailures:
                            description: HTTPFailures is the number of failures to
                              consider a target unhealthy.
                            minimum: 0
                            type: integer
                          httpStatuses:
                            description: HTTPStatuses is a list of HTTP status codes
                              that Kong considers a failure.
                            items:
                              description: HTTPStatus is an HTTP status code.
                              maximum: 599
                              minimum: 100
                              type: integer
                            type: array
                          interval:
                            description: Interval is the interval between active health
                              checks for an upstream in seconds when in an unhealthy
                              state.
                            minimum: 0
                            type: integer
                          tcpFailures:
                            description: TCPFailures is the number of TCP failures
                              in a row to consider a target unhealthy.
                            minimum: 0
                            type: integer
                          timeouts:
                            description: Timeouts is the number of timeouts in a row
                              to consider a target unhealthy.
                            minimum: 0
                            type: integer
                        type: object
                    type: object
                  passive:
                    description: Passive configures passive health check probing.
                    properties:
                      healthy:
                        description: Healthy configures thresholds and HTTP status
                          codes to mark targets healthy for an upstream.
                        properties:
                          httpStatuses:
                            description: HTTPStatuses is a list of HTTP status codes
                              that Kong considers a success.
                            items:
                              description: HTTPStatus is an HTTP status code.
                              maximum: 599
                              minimum: 100
                              type: integer
                            type: array
                          interval:
                            description: Interval is the interval between active health
                              checks for an upstream in seconds when in a healthy
                              state.
                            minimum: 0
                            type: integer
                          successes:
                            description: Successes is the number of successes to consider
                              a target healthy.
                            minimum: 0
                            type: integer
                        type: object
                      type:
                        description: Type determines whether to perform passive health
                          checks interpreting HTTP/HTTPS statuses, or just check for
                          TCP connection success. Accepted values are "http", "https",
                          "tcp", "grpc", "grpcs".
                        enum:
                        - http
                        - https
                        - tcp
                        - grpc
                        - grpcs
                        type: string
                      unhealthy:
                        description: Unhealthy configures thresholds and HTTP status
                          codes to mark targets unhealthy.
                        properties:
                          httpFailures:
                            description: HTTPFailures is the number of failures to
                              consider a target unhealthy.
                            minimum: 0
                            type: integer
                          httpStatuses:
                            description: HTTPStatuses is a list of HTTP status codes
                              that Kong considers a failure.
                            items:
                              description: HTTPStatus is an HTTP status code.
                              maximum: 599
                              minimum: 100
                              type: integer
                            type: array
                          interval:
                            description: Interval is the interval between active health
                              checks for an upstream in seconds when in an unhealthy
                              state.
                            minimum: 0
                            type: integer
                          tcpFailures:
                            description: TCPFailures is the number of TCP failures
                              in a row to consider a target unhealthy.
                            minimum: 0
                            type: integer
                          timeouts:
                            description: Timeouts is the number of timeouts in a row
                              to consider a target unhealthy.
                            minimum: 0
                            type: integer
                        type: object
                    type: object
                  threshold:
                    description: Threshold is the minimum percentage of the upstream’s
                      targets’ weight that must be available for the whole upstream
                      to be considered healthy.
                    type: integer
                type: object
              slots:
                description: Slots is the number of slots in the load balancer algorithm.
                  If not set, the default value in Kong for the algorithm is used.
                maximum: 65536
                minimum: 10
                type: integer
            type: object
        type: object
        x-kubernetes-validations:
        - message: Only one of spec.hashOn.(input|cookie|header|uriCapture|queryArg)
            can be set.
          rule: 'has(self.spec.hashOn) ? [has(self.spec.hashOn.input), has(self.spec.hashOn.cookie),
            has(self.spec.hashOn.header), has(self.spec.hashOn.uriCapture), has(self.spec.hashOn.queryArg)].filter(fieldSet,
            fieldSet == true).size() <= 1 : true'
        - message: When spec.hashOn.cookie is set, spec.hashOn.cookiePath is required.
          rule: 'has(self.spec.hashOn) && has(self.spec.hashOn.cookie) ? has(self.spec.hashOn.cookiePath)
            : true'
        - message: When spec.hashOn.cookiePath is set, spec.hashOn.cookie is required.
          rule: 'has(self.spec.hashOn) && has(self.spec.hashOn.cookiePath) ? has(self.spec.hashOn.cookie)
            : true'
        - message: spec.algorithm must be set to "consistent-hashing" when spec.hashOn
            is set.
          rule: 'has(self.spec.hashOn) ? has(self.spec.algorithm) && self.spec.algorithm
            == "consistent-hashing" : true'
        - message: Only one of spec.hashOnFallback.(input|header|uriCapture|queryArg)
            can be set.
          rule: 'has(self.spec.hashOnFallback) ? [has(self.spec.hashOnFallback.input),
            has(self.spec.hashOnFallback.header), has(self.spec.hashOnFallback.uriCapture),
            has(self.spec.hashOnFallback.queryArg)].filter(fieldSet, fieldSet == true).size()
            <= 1 : true'
        - message: spec.algorithm must be set to "consistent-hashing" when spec.hashOnFallback
            is set.
          rule: 'has(self.spec.hashOnFallback) ? has(self.spec.algorithm) && self.spec.algorithm
            == "consistent-hashing" : true'
        - message: spec.hashOnFallback.cookie must not be set.
          rule: 'has(self.spec.hashOnFallback) ? !has(self.spec.hashOnFallback.cookie)
            : true'
        - message: spec.hashOnFallback.cookiePath must not be set.
          rule: 'has(self.spec.hashOnFallback) ? !has(self.spec.hashOnFallback.cookiePath)
            : true'
        - message: spec.healthchecks.passive.healthy.interval must not be set.
          rule: 'has(self.spec.healthchecks) && has(self.spec.healthchecks.passive)
            && has(self.spec.healthchecks.passive.healthy) ? !has(self.spec.healthchecks.passive.healthy.interval)
            : true'
        - message: spec.healthchecks.passive.unhealthy.interval must not be set.
          rule: 'has(self.spec.healthchecks) && has(self.spec.healthchecks.passive)
            && has(self.spec.healthchecks.passive.unhealthy) ? !has(self.spec.healthchecks.passive.unhealthy.interval)
            : true'
        - message: spec.hashOnFallback must not be set when spec.hashOn.cookie is
            set.
          rule: 'has(self.spec.hashOn) && has(self.spec.hashOn.cookie) ? !has(self.spec.hashOnFallback)
            : true'
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.13.0
  name: tcpingresses.configuration.konghq.com
spec:
  group: configuration.konghq.com
  names:
    categories:
    - kong-ingress-controller
    kind: TCPIngress
    listKind: TCPIngressList
    plural: tcpingresses
    singular: tcpingress
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Address of the load balancer
      jsonPath: .status.loadBalancer.ingress[*].ip
      name: Address
      type: string
    - description: Age
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: TCPIngress is the Schema for the tcpingresses API.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: Spec is the TCPIngress specification.
            properties:
              rules:
                description: A list of rules used to configure the Ingress.
                items:
                  description: IngressRule represents a rule to apply against incoming
                    requests. Matching is performed based on an (optional) SNI and
                    port.
                  properties:
                    backend:
                      description: Backend defines the referenced service endpoint
                        to which the traffic will be forwarded to.
                      properties:
                        serviceName:
                          description: Specifies the name of the referenced service.
                          minLength: 1
                          type: string
                        servicePort:
                          description: Specifies the port of the referenced service.
                          format: int32
                          maximum: 65535
                          minimum: 1
                          type: integer
                      required:
                      - serviceName
                      - servicePort
                      type: object
                    host:
                      description: Host is the fully qualified domain name of a network
                        host, as defined by RFC 3986. If a Host is not specified,
                        then port-based TCP routing is performed. Kong doesn't care
                        about the content of the TCP stream in this case. If a Host
                        is specified, the protocol must be TLS over TCP. A plain-text
                        TCP request cannot be routed based on Host. It can only be
                        routed based on Port.
                      type: string
                    port:
                      description: Port is the port on which to accept TCP or TLS
                        over TCP sessions and route. It is a required field. If a
                        Host is not specified, the requested are routed based only
                        on Port.
                      format: int32
                      maximum: 65535
                      minimum: 1
                      type: integer
                  required:
                  - backend
                  - port
                  type: object
                type: array
              tls:
                description: TLS configuration. This is similar to the `tls` section
                  in the Ingress resource in networking.v1beta1 group. The mapping
                  of SNIs to TLS cert-key pair defined here will be used for HTTP
                  Ingress rules as well. Once can define the mapping in this resource
                  or the original Ingress resource, both have the same effect.
                items:
                  description: IngressTLS describes the transport layer security.
                  properties:
                    hosts:
                      description: Hosts are a list of hosts included in the TLS certificate.
                        The values in this list must match the name/s used in the
                        tlsSecret. Defaults to the wildcard host setting for the loadbalancer
                        controller fulfilling this Ingress, if left unspecified.
                      items:
                        type: string
                      type: array
                    secretName:
                      description: SecretName is the name of the secret used to terminate
                        SSL traffic.
                      type: string
                  type: object
                type: array
            type: object
          status:
            description: TCPIngressStatus defines the observed state of TCPIngress.
            properties:
              loadBalancer:
                description: LoadBalancer contains the current status of the load-balancer.
                properties:
                  ingress:
                    description: Ingress is a list containing ingress points for the
                      load-balancer. Traffic intended for the service should be sent
                      to these ingress points.
                    items:
                      description: 'LoadBalancerIngress represents the status of a
                        load-balancer ingress point: traffic intended for the service
                        should be sent to an ingress point.'
                      properties:
                        hostname:
                          description: Hostname is set for load-balancer ingress points
                            that are DNS based (typically AWS load-balancers)
                          type: string
                        ip:
                          description: IP is set for load-balancer ingress points
                            that are IP based (typically GCE or OpenStack load-balancers)
                          type: string
                        ports:
                          description: Ports is a list of records of service ports
                            If used, every port defined in the service should have
                            an entry in it
                          items:
                            properties:
                              error:
                                description: 'Error is to record the problem with
                                  the service port The format of the error shall comply
                                  with the following rules: - built-in error values
                                  shall be specified in this file and those shall
                                  use CamelCase names - cloud provider specific error
                                  values must have names that comply with the format
                                  foo.example.com/CamelCase. --- The regex it matches
                                  is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
                                maxLength: 316
                                pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                                type: string
                              port:
                                description: Port is the port number of the service
                                  port of which status is recorded here
                                format: int32
                                type: integer
                              protocol:
                                default: TCP
                                description: 'Protocol is the protocol of the service
                                  port of which status is recorded here The supported
                                  values are: "TCP", "UDP", "SCTP"'
                                type: string
                            required:
                            - port
                            - protocol
                            type: object
                          type: array
                          x-kubernetes-list-type: atomic
                      type: object
                    type: array
                type: object
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.13.0
  name: udpingresses.configuration.konghq.com
spec:
  group: configuration.konghq.com
  names:
    categories:
    - kong-ingress-controller
    kind: UDPIngress
    listKind: UDPIngressList
    plural: udpingresses
    singular: udpingress
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Address of the load balancer
      jsonPath: .status.loadBalancer.ingress[*].ip
      name: Address
      type: string
    - description: Age
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: UDPIngress is the Schema for the udpingresses API.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: Spec is the UDPIngress specification.
            properties:
              rules:
                description: A list of rules used to configure the Ingress.
                items:
                  description: UDPIngressRule represents a rule to apply against incoming
                    requests wherein no Host matching is available for request routing,
                    only the port is used to match requests.
                  properties:
                    backend:
                      description: Backend defines the Kubernetes service which accepts
                        traffic from the listening Port defined above.
                      properties:
                        serviceName:
                          description: Specifies the name of the referenced service.
                          minLength: 1
                          type: string
                        servicePort:
                          description: Specifies the port of the referenced service.
                          format: int32
                          maximum: 65535
                          minimum: 1
                          type: integer
                      required:
                      - serviceName
                      - servicePort
                      type: object
                    port:
                      description: Port indicates the port for the Kong proxy to accept
                        incoming traffic on, which will then be routed to the service
                        Backend.
                      format: int32
                      maximum: 65535
                      minimum: 1
                      type: integer
                  required:
                  - backend
                  - port
                  type: object
                type: array
            type: object
          status:
            description: UDPIngressStatus defines the observed state of UDPIngress.
            properties:
              loadBalancer:
                description: LoadBalancer contains the current status of the load-balancer.
                properties:
                  ingress:
                    description: Ingress is a list containing ingress points for the
                      load-balancer. Traffic intended for the service should be sent
                      to these ingress points.
                    items:
                      description: 'LoadBalancerIngress represents the status of a
                        load-balancer ingress point: traffic intended for the service
                        should be sent to an ingress point.'
                      properties:
                        hostname:
                          description: Hostname is set for load-balancer ingress points
                            that are DNS based (typically AWS load-balancers)
                          type: string
                        ip:
                          description: IP is set for load-balancer ingress points
                            that are IP based (typically GCE or OpenStack load-balancers)
                          type: string
                        ports:
                          description: Ports is a list of records of service ports
                            If used, every port defined in the service should have
                            an entry in it
                          items:
                            properties:
                              error:
                                description: 'Error is to record the problem with
                                  the service port The format of the error shall comply
                                  with the following rules: - built-in error values
                                  shall be specified in this file and those shall
                                  use CamelCase names - cloud provider specific error
                                  values must have names that comply with the format
                                  foo.example.com/CamelCase. --- The regex it matches
                                  is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
                                maxLength: 316
                                pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                                type: string
                              port:
                                description: Port is the port number of the service
                                  port of which status is recorded here
                                format: int32
                                type: integer
                              protocol:
                                default: TCP
                                description: 'Protocol is the protocol of the service
                                  port of which status is recorded here The supported
                                  values are: "TCP", "UDP", "SCTP"'
                                type: string
                            required:
                            - port
                            - protocol
                            type: object
                          type: array
                          x-kubernetes-list-type: atomic
                      type: object
                    type: array
                type: object
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: edge-controller
  name: edge-controller-sa-local
  namespace: plevion-local
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong
  namespace: plevion-local
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: orchestrator
  name: orchestrator-worker-sa-local
  namespace: plevion-local
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app: edge-controller
  name: edge-controller-stream-manager-local
  namespace: plevion-local
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - create
  - delete
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong
  namespace: plevion-local
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  - pods
  - secrets
  - namespaces
  verbs:
  - get
- apiGroups:
  - ""
  resourceNames:
  - kong-ingress-controller-leader-kong-kong
  resources:
  - configmaps
  verbs:
  - get
  - update
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - create
- apiGroups:
  - ""
  - coordination.k8s.io
  resources:
  - configmaps
  - leases
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app: orchestrator
  name: orchestrator-worker-role-local
  namespace: plevion-local
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
  - get
  - update
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong
rules:
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongupstreampolicies
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongupstreampolicies/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongconsumergroups
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongconsumergroups/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - services/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - configuration.konghq.com
  resources:
  - ingressclassparameterses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongconsumers
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongconsumers/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongingresses/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongplugins
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongplugins/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - configuration.konghq.com
  resources:
  - tcpingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - tcpingresses/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - configuration.konghq.com
  resources:
  - udpingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - udpingresses/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - extensions
  resources:
  - ingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - extensions
  resources:
  - ingresses/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongclusterplugins
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongclusterplugins/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - list
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - ingressclasses
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: edge-controller
  name: edge-controller-stream-manager-local
  namespace: plevion-local
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: edge-controller-stream-manager-local
subjects:
- kind: ServiceAccount
  name: edge-controller-sa-local
  namespace: plevion-local
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong
  namespace: plevion-local
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kong-kong
subjects:
- kind: ServiceAccount
  name: kong-kong
  namespace: plevion-local
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: orchestrator
  name: orchestrator-worker-rolebinding-local
  namespace: plevion-local
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: orchestrator-worker-role-local
subjects:
- kind: ServiceAccount
  name: orchestrator-worker-sa-local
  namespace: plevion-local
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kong-kong
subjects:
- kind: ServiceAccount
  name: kong-kong
  namespace: plevion-local
---
apiVersion: v1
data:
  authmtx.yml: |
    server:
      port: 8080
      read_timeout: 5s
      write_timeout: 10s

    upstream:
      base_url: "http://api.local.plevion.com"
      auth_path: "/public/v1/sink/"
      timeout: 5s

    logging:
      level: "debug"
kind: ConfigMap
metadata:
  labels:
    app: mediamtx
  name: authmtx-config-local-dm99t88c4b
  namespace: plevion-local
---
apiVersion: v1
data:
  mediamtx.yml: |
    api: yes
    apiAddress: :9997

    authMethod: http
    authHTTPAddress: http://localhost:8080/auth

    webrtcIPsFromInterfaces: yes
    webrtcLocalUDPAddress: :8189
    webrtcAdditionalHosts:
      - "192.168.0.240"

    pathDefaults:
      # $MTX_PATH -> live/{installation_id}/{stream_id}
      # $MTX_QUERY -> URL-escaped publisher query string (MediaMTX calls url.QueryEscape
      #   on the raw query, so "jwt=eyJ..." becomes "jwt%3DeyJ..."). Pass it as a named
      #   param so authmtx can decode it correctly.
      # MediaMTX exec()s the command directly (no shell); use absolute path.
      runOnReady: >-
        /usr/bin/wget --post-data="" -q -O /dev/null
        "http://localhost:8080/notify/ready?path=$MTX_PATH&query=$MTX_QUERY&source_type=$MTX_SOURCE_TYPE"
      runOnNotReady: >-
        /usr/bin/wget --post-data="" -q -O /dev/null
        "http://localhost:8080/notify/stop?path=$MTX_PATH"

    paths:
      all_others:

    srt: yes
    srtAddress: :8890

    hls: yes
    hlsVariant: lowLatency
    # 100ms, not the 1s default -- a maintainer-cited "most important parameter"
    # for LL-HLS latency; MediaMTX's own docs discourage hlsPartDuration below
    # 200ms (Apple's own guidance: sub-200ms parts destabilize hls.js playback),
    # so segment duration is the remaining lever.
    hlsSegmentDuration: 100ms
    hlsPartDuration: 200ms

    readTimeout: 3600s
    writeTimeout: 3600s
    writeQueueSize: 1024
kind: ConfigMap
metadata:
  labels:
    app: mediamtx
  name: mediamtx-config-local-gk79kkc942
  namespace: plevion-local
---
apiVersion: v1
data:
  init.sql: |
    CREATE DATABASE orchestrator;
    CREATE DATABASE auth;
    CREATE DATABASE sink;
kind: ConfigMap
metadata:
  labels:
    app: postgres
  name: postgres-init-scripts-local
  namespace: plevion-local
---
apiVersion: v1
data:
  rabbitmq.conf: |
    # Force memory limit to 400Mi to prevent OOMKills in Kubernetes
    vm_memory_high_watermark.absolute = 400Mi
    # Load definitions (policies, queues, exchanges) from JSON file
    management.load_definitions = /etc/rabbitmq/definitions.json
kind: ConfigMap
metadata:
  labels:
    app: rabbitmq
  name: rabbitmq-config-local
  namespace: plevion-local
---
apiVersion: v1
data:
  definitions.json: |
    {
      "users": [
        {
          "name": "user",
          "password_hash": "fJxFDyRRW+jITJP7Fy0o9pFfUutRuwr+sX6kV93O38y23GbO",
          "hashing_algorithm": "rabbit_password_hashing_sha256",
          "tags": "administrator"
        }
      ],
      "vhosts": [
        {
          "name": "/"
        }
      ],
      "permissions": [
        {
          "user": "user",
          "vhost": "/",
          "configure": ".*",
          "write": ".*",
          "read": ".*"
        }
      ],
      "policies": [
        {
          "name": "celery_ev_limit",
          "pattern": "^celeryev\\.",
          "definition": {
            "max-length": 10000
          },
          "apply-to": "queues",
          "vhost": "/"
        }
      ]
    }
kind: ConfigMap
metadata:
  labels:
    app: rabbitmq
  name: rabbitmq-definitions-local-t4gcbb6kdb
  namespace: plevion-local
---
apiVersion: v1
data:
  BACKEND_URL: aHR0cDovL2tvbmcta29uZy1wcm94eS9wdWJsaWMvdjE=
  COMPANY_ID: N2YyYzBkYjMtYjE2ZS00NTlkLTljY2ItNDZiOTM5ZmExNWU2
  OTEL_SERVICE_NAME: cGxldmlvbi1hZG1pbg==
  SERVICE_TOKEN: MTBjYzBhNzA0MDhhMzAxMjZlZjcwMDg5NTdkMjg3YTE5MmU4ODYyZA==
  TAILSCALE_AUTH_KEY: |
    dHNrZXktYXV0aC1rMlI3Q3ZmY3c3MTFDTlRSTC1GUWNGNFJySFhiMmRScXk3Y1h0SmIyMz
    JhZDJjNExnbQ==
kind: Secret
metadata:
  name: admin-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  CSRF_TRUSTED_ORIGINS: aHR0cHM6Ly9hdXRoLmxvY2FsLnBsZXZpb24uY29t
  DB_HOST: cG9zdGdyZXMtbG9jYWw=
  DB_NAME: YXV0aA==
  DB_PASSWORD: cGFzc3dvcmQ=
  DB_PORT: NTQzMg==
  DB_USER: cG9zdGdyZXM=
  DJANGO_SETTINGS_MODULE: c2V0dGluZ3MuZG9ja2Vy
  LOGIN_URL: L2F1dGgvYWRtaW4vbG9naW4v
  ORCHESTRATOR_SERVICE_TOKEN: OTU2NTY0NzRmNTNkN2EzMDc0ZmMzNDA2YzY4M2U0MGJjNDMzNzE1ZQ==
  OTEL_PYTHON_INSTRUMENTATION_REDIS_CAPTURE_ARGS: dHJ1ZQ==
  OTEL_PYTHON_LOG_CORRELATION: dHJ1ZQ==
  OTEL_SDK_DISABLED: dHJ1ZQ==
  OTEL_SERVICE_NAME: YXV0aA==
  PYTHONPATH: L2FwcC9zcmM=
  PYTHONWARNINGS: |
    aWdub3JlOnBrZ19yZXNvdXJjZXMgaXMgZGVwcmVjYXRlZCBhcyBhbiBBUEk6VXNlcldhcm
    5pbmc=
  RABBITMQ_DEFAULT_PASS: MXEydzNl
  RABBITMQ_DEFAULT_USER: dXNlcg==
  RABBITMQ_HOST: cmFiYml0bXEtbG9jYWw=
  RABBITMQ_PORT: NTY3Mg==
  REDIS_HOST: cmVkaXMtbG9jYWw=
  REDIS_PASSWORD: MXEydzNl
  REDIS_PORT: NjM3OQ==
  SERVICE_TOKEN: YjUwOTA2YzM4NGQzOWIyNTVlYjUzYzVmYTgyMjJiZmRlMmRiNTU4ZQ==
  SWAGGER_UI_URL: L2F1dGgvc2NoZW1hL3N3YWdnZXItdWkv
  TAILSCALE_AUTH_KEY: |
    dHNrZXktYXV0aC1rZ2tKQURLcFF5MTFDTlRSTC1Bc0dVcjZaNnRhQ3ViNFp6blRISmJDRD
    FERHdQUVlmWEQ=
  UI_ADMIN_SERVICE_TOKEN: MTBjYzBhNzA0MDhhMzAxMjZlZjcwMDg5NTdkMjg3YTE5MmU4ODYyZA==
kind: Secret
metadata:
  name: auth-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  DB_HOST: cG9zdGdyZXMtbG9jYWw=
  DB_NAME: ZWRnZV9jb250cm9sbGVy
  DB_PASSWORD: cGFzc3dvcmQ=
  DB_PORT: NTQzMg==
  DB_USER: cG9zdGdyZXM=
  DJANGO_SETTINGS_MODULE: c2V0dGluZ3Muazhz
  PYTHONPATH: L2FwcC9zcmM=
  RABBITMQ_DEFAULT_PASS: MXEydzNl
  RABBITMQ_DEFAULT_USER: dXNlcg==
  RABBITMQ_HOST: cmFiYml0bXEtbG9jYWw=
  RABBITMQ_PORT: NTY3Mg==
  REDIS_HOST: cmVkaXMtbG9jYWw=
  REDIS_PASSWORD: MXEydzNl
  REDIS_PORT: NjM3OQ==
  SECRET_KEY: ZGphbmdvLWluc2VjdXJlLWVkZ2UtY29udHJvbGxlci1sb2NhbC1jaGFuZ2UtbWU=
  STREAM_RECORDING_HOST_PATH: |
    L2hvbWUvanBhdWwvRXNjcml0b3Jpby9wbGV2aW9uL2VkZ2UtY29udHJvbGxlci9zcmMvYX
    Bwcy9zdHJlYW1zL3ZpZGVvX2V4YW1wbGVz
kind: Secret
metadata:
  name: edge-controller-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  .dockerconfigjson: |
    ewogICAgImF1dGhzIjogewogICAgICAgICJnaGNyLmlvIjogewogICAgICAgICAgICAidX
    Nlcm5hbWUiOiAiam9uYXRyaW9zIiwKICAgICAgICAgICAgInBhc3N3b3JkIjogImdocF9u
    THZsQWF3aHdCMmR2bUM0YzBzWkxKV290Nk40dTMwc1lXbG0iLAogICAgICAgICAgICAiYX
    V0aCI6ICJhbTl1WVhSeWFXOXpPbWRvY0Y5dVRIWnNRV0YzYUhkQ01tUjJiVU0wWXpCeldr
    eEtWMjkwTms0MGRUTXdjMWxYYkcwPSIKICAgICAgICB9CiAgICB9Cn0K
kind: Secret
metadata:
  name: ghcr-registry-secret
  namespace: plevion-local
type: kubernetes.io/dockerconfigjson
---
apiVersion: v1
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKRENDQWd5Z0F3SUJBZ0lSQUp1N01oaTR1MzlSLzhiR0dtN3BvbE13RFFZSktvWklodmNOQVFFTEJRQXcKSERFYU1CZ0dBMVVFQXhNUmEyOXVaeTFoWkcxcGMzTnBiMjR0WTJFd0hoY05Nall3T0RBeE1EZ3pOakl4V2hjTgpNell3TnpJNU1EZ3pOakl4V2pBY01Sb3dHQVlEVlFRREV4RnJiMjVuTFdGa2JXbHpjMmx2YmkxallUQ0NBU0l3CkRRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFMeTRMSWFyeGtFd2o1Zk5tWDFpN2d3QTErM1AKZExGcS83QzY2RUgwUXNWc3NvSEsraVlCSlJVbUpicXFTY1dIT2g1QUxFTy9yMi8xT2o1M3FNVlh0aXdlNFcwVgpDTGc1a1I1WFVpaEY4ckV1U1R6SVNkaWw1bW00akRvQ1ZQZWJ0YStEN2lrMDVkbWdGM2FtZ1pOTXBkcE5hVDFjCkdLRDlCNXBIMWI5VGE5b1hwdUNMazZzV2J3TG1jS2VlT1NUbjcxK0JFL2prNnp2QVRaTWFDaTIzcGZ6RDkvbjYKcG1UVzJ0TDBXY0JwWDJhMy9kZGdCaWE3RXoycVBLR3Y4TU45QmpaL1Y0cXo2N0VGMzRNSWExcXZzL0VMQVZncAp2QmxNVEpnY1hkYWNIZFUxY0hPd0RXWDZ6Sm9IWDU3eDhveCswRG1HcVQ0UEdyMXZ3VGQ5dGd2V3d3RUNBd0VBCkFhTmhNRjh3RGdZRFZSMFBBUUgvQkFRREFnS2tNQjBHQTFVZEpRUVdNQlFHQ0NzR0FRVUZCd01CQmdnckJnRUYKQlFjREFqQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCVEw1cTJTVXFzanhOMU9SZnZFMXhKNApYUnR1blRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQWV5UkJhNFRXMmovT0swTjVPcEprU1k0SnpxdlR3dm1HCmladUtGdnNPSFV0TzhQQThzQ0QxUjFyWjI5bjlBeUladEVPckQvcFF6Zi9IWld2UjU3Y1dtbkNFek1jUVFFTXAKWjVBbzBDa3R0NUswbmdwUTZsSEtWYWJNNEhIM2RFWnQwV0dlQXhYUmU2NjhNcElHczFudkd5c2tnNXJXd1pKLwpKS2J6dllKMmU1dTRidC9kMGU5Z2tnc2NzSWd2emxhQUlub3cwckdHZ3hicXhTSWthVGdxYWJBNjVnQko5VDR3CktIdFkweW93QzN4MjhFc0ZSdDhjQjVreXFtVVN5a25ra0FMcFQ1Ym92YWxzR0wraVJIYlRmRHAyNDZEY2xFU2cKQmNPZFhNeFcwN1kvcWg2anBNbHJob1AyZnVCTElkdDl6WGhkN2NsK1FtdlcxQTdJWHdiNjJRPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBdkxnc2hxdkdRVENQbDgyWmZXTHVEQURYN2M5MHNXci9zTHJvUWZSQ3hXeXlnY3I2CkpnRWxGU1lsdXFwSnhZYzZIa0FzUTcrdmIvVTZQbmVveFZlMkxCN2hiUlVJdURtUkhsZFNLRVh5c1M1SlBNaEoKMktYbWFiaU1PZ0pVOTV1MXI0UHVLVFRsMmFBWGRxYUJrMHlsMmsxcFBWd1lvUDBIbWtmVnYxTnIyaGVtNEl1VApxeFp2QXVad3A1NDVKT2Z2WDRFVCtPVHJPOEJOa3hvS0xiZWwvTVAzK2ZxbVpOYmEwdlJad0dsZlpyZjkxMkFHCkpyc1RQYW84b2Evd3czMEdObjlYaXJQcnNRWGZnd2hyV3ErejhRc0JXQ204R1V4TW1CeGQxcHdkMVRWd2M3QU4KWmZyTW1nZGZudkh5akg3UU9ZYXBQZzhhdlcvQk4zMjJDOWJEQVFJREFRQUJBb0lCQUE0UG51bXQxTWk0cUlwRAovR0syUTB4THA4c0ZRUW1URWxnRnBSWjg3NWlzSDZUQ0RkOVZDSUZKNVZmQ0pscjhWMTAzcE5TcmJKUG43cDRHCjVtRkZ4c0lFendFRXB6Q3F3V0JFVzArNjNubExISlBWeklMQzRhY1E1QW5TY0tnK1JzdzhCVHUyd0VWMXd5bkoKQURDTWJuTVVmM25kNmN2Yzduc1ZUUnpEUjI3cFlVYkNpV2RDOFRTd3lxbnFtdzF5VHY2ZVYwSVBpc0t2b0QwYgpNVHNQVWpwRXYxdjJjNnZJY3NQcW12b2F4OHgxZGpldXpmU0lROHo1WVFWYkZiQjZBMGhzS0VaWlh0L1dvcEF3CmdPalhaTHcrUmRIRmMwUG5iaHRMaEVHRDQxc3VXSVUwWHRCaTVCOW8zSkFXSVgrS0pYYzNaZFM0eHVmTzdPaG4KZi9YZlhaRUNnWUVBeE9LTy80T1VLQ25BMDJJYUJHaUw3YnVCOGhDeUtVOEFMOFdiZ2g3U29UUVBSdHdYWVF4RQpCMzNtRXY2R0dJT1hLNDdva3JMdENWdGIyOUwzQlZWSlVibHNRZkpUMEdUMENabWZ5cXBqeWxrWi9ORExJdk82CmxiQWpoeTJNVkZCSVFNR1V1MjZGd09tVDJ4dTdOMFRoUmhGZzMwYVNQbFQrc3ZhaDVDT3BRdVVDZ1lFQTlXSDUKYkxBQ2w5Qi9KQVlRM21MWkV0Y2x4d2ZGQ2FINE40N3RMOCtJdTROTFIvYThJSlVleHJzUEVZSElWYWkyQzRhSgo3SmZQZlRYZGMzdy8zU1FXQzBqVm1vWGpLWEVBL0V3ZjlYOUMrRDFZK2dxRzl3WkpVQUc3dTRCc1lTK3lPTW9FCjRXdElqNkc0V3Y1R2lLY2FhNFZEeGtwbElaU2xjZVkrYW1XZU1lMENnWUFMT3NqaE5nWUxUR1pkS0NsSHV4YlEKRm5QUTlMYlV1RmJRWXJyOTd2Z2dqYkdaWHhCT1RyN0tscG02MTUyYVpGY0krdnUwOGxPbXh2azBUcEljVWNMKwowRTZtYkVYdml2S0lZYVRGa0haa29qUmpRUjEwL3VYVGg5cGU2WEFwbHZLb0R1S0cxa1QydmR2YkVYZmFMU21VCkw0V1E5cHQ4eHFoSVdOemZBRkcxS1FLQmdFNE1MSlpxWVZqQ1F6NUZBNmFJVUQwUzIzd3p0M001NWtaZG1vbUQKZkIwUVJLaU9EUVpjQjk3ejduWUdEcDlZT3hidFl2OHl4aGN3UTlDUXE0dCtCOWp0QUt2V2ZBdFpXeFBrYnFIYQpLWVhsbFdCcWFzVTFaYW9oOHdGUGRxbHV6MFFLMVlTUmFCSHZRVUVIOFkxVGdTN0R3MnZWaTljamZYLzkyTXBrCnFlMTlBb0dBV3JqeW9GRWtYVmZQeXZCSVN6S2xJVEZYeUNmUW9NYzM3WnVmbjFlYXBVSGFyRE05cHUwa3M2ZnAKaEl4QkVpQ2thUTRCalZLaG90KzlCTTgwUFV2L2JPdTFReTV5V2tlckZZdmpYbytScmlodnYyVzl6Y3I0Yk9nVwpMcW9aT014d2VHckhuclNnR2o0T3hVOU1RUFRBM2lPcmwzVUNBQnVaWHh4eVBRYmFiMms9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
kind: Secret
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong-validation-webhook-ca-keypair
  namespace: plevion-local
type: kubernetes.io/tls
---
apiVersion: v1
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURhekNDQWxPZ0F3SUJBZ0lSQU56ajUzbG84NXJNYm5TRUVJbGhvTmd3RFFZSktvWklodmNOQVFFTEJRQXcKSERFYU1CZ0dBMVVFQXhNUmEyOXVaeTFoWkcxcGMzTnBiMjR0WTJFd0hoY05Nall3T0RBeE1EZ3pOakl4V2hjTgpNell3TnpJNU1EZ3pOakl4V2pBd01TNHdMQVlEVlFRREV5VnJiMjVuTFd0dmJtY3RkbUZzYVdSaGRHbHZiaTEzClpXSm9iMjlyTG10dmJtY3VjM1pqTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUEKekN3dUYxYXM2ajE2Q1BrOWRLMlNDOGNVOVFJbC8yanlFR2V3c1VOTnhvb3lETmxXS0UwWkFZV2NQcktubitOYwpqMG80TWVkNnNtYTFzMC9JcDd1WFJ1djkvbEpFanN3TVBGQkYzV3A1OFpUYUcxenU3YjlRSVRmMVc0VUREYkFVCmErdGNWNlh6WjBVNkF2Smk2YkFlWHFCOUxaSTdFd3A4NWxRQ1pKeG1MaHJTSDdTTDdCMXFhRG9iZkk5blN2V1kKeEVZWEd1eTJTUmg3aTFSRTFRVmNRU1MwNmJORDlYY1RxRFJtQnFYWEYzcTh3ZU1VbGVLY0cxQnEwWWl6d2VVOQpTRmdiNU1pdnczSE5GNVpkT1VyWHFwRDdGbnhMcnBzcDIwcUVlQUw4M1M1N1F0Y2MyVmxEdEp4UHJ1dGdIOXgrCjZKNmkyT3ZldDFKZjFmOXRwVzRXdlFJREFRQUJvNEdUTUlHUU1BNEdBMVVkRHdFQi93UUVBd0lGb0RBZEJnTlYKSFNVRUZqQVVCZ2dyQmdFRkJRY0RBUVlJS3dZQkJRVUhBd0l3REFZRFZSMFRBUUgvQkFJd0FEQWZCZ05WSFNNRQpHREFXZ0JUTDVxMlNVcXNqeE4xT1JmdkUxeEo0WFJ0dW5UQXdCZ05WSFJFRUtUQW5naVZyYjI1bkxXdHZibWN0CmRtRnNhV1JoZEdsdmJpMTNaV0pvYjI5ckxtdHZibWN1YzNaak1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQi8KZXROUkVhTjdFN3pZUFljNlN3NUlqYzVMclFwc1owUWJIbnBTMjRIdEFDRE8zSEJEanA3a1RPWXpmVXk3SXovZwp1UGg2dWpWTlFHN3IxWVFsaWlpSFNrbnZ4MENkb0tGaVdvTVJGMmFZU2YxUUoyV0JXOHVTdHdrM0hTVjAwcjBDCkN4aENzWEpPdzdwaldjbkFFM0RLdW9rM3J5bDhLa25ZYlJnL1NDMVI3ZlhyOHN0L29HU2Y3SEU1cmZIQVBXbnoKMnpGVGZTT2JWNkVxQTY5OHR6dmdZNmFDSzhMVmxPUXNoTCtEdEt5MFJBWlBQeUxveElxL2tNelZvVVNEVzhQTApUSFZWbm1OWDcyVEIxNmdWdWZ6Q0tqOGVCeUh5VzZzMjIvVXRCSlAyU2NqemtJRnkvV2pCUHBWc2pGMGt1aDdmCm1EazlFSEZTUGF0M3VycjFQRmNpCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBekN3dUYxYXM2ajE2Q1BrOWRLMlNDOGNVOVFJbC8yanlFR2V3c1VOTnhvb3lETmxXCktFMFpBWVdjUHJLbm4rTmNqMG80TWVkNnNtYTFzMC9JcDd1WFJ1djkvbEpFanN3TVBGQkYzV3A1OFpUYUcxenUKN2I5UUlUZjFXNFVERGJBVWErdGNWNlh6WjBVNkF2Smk2YkFlWHFCOUxaSTdFd3A4NWxRQ1pKeG1MaHJTSDdTTAo3QjFxYURvYmZJOW5TdldZeEVZWEd1eTJTUmg3aTFSRTFRVmNRU1MwNmJORDlYY1RxRFJtQnFYWEYzcTh3ZU1VCmxlS2NHMUJxMFlpendlVTlTRmdiNU1pdnczSE5GNVpkT1VyWHFwRDdGbnhMcnBzcDIwcUVlQUw4M1M1N1F0Y2MKMlZsRHRKeFBydXRnSDl4KzZKNmkyT3ZldDFKZjFmOXRwVzRXdlFJREFRQUJBb0lCQUJxOC9uR1lBWi9RMnBaLwptRE53NGx0MTFhSWJNZXdNOWx2U1RkVitiRVVWVVdZQUN4bk90RTVRRFJ6amtMTGp0NlRHOTRKY1A0NmdNaWpWCmMxVzVhaCtqbXVrZmVsTCtiZXZJSjNONUZPeUtXSXMvZnhyV1Njd2xPVUNrWHJpcTEreDZMNUd3UTFGc1EzaWgKL1o5L3JRL1V2THFuRitMRkppNCtla0hBS2JHSHlDVHQxWWpmRkFqRGRpOFRBYUw4dEtEek1mZm1XMnRla2xrNApBNzk0STh1ZFhOa0RMTmtISUNjeEc0WmVBUjVWdS9GZlFJb0NaY2VROUsyU3YvdktidUU3Z0Jpb2dZM0hYOU4zClR3S3hZNWVLTkpXcFJxS0xFTVE1VXJWei9sSURRZndwNXNvUElXOXFLeFlWNUxxMU1pV0h6bldDa29ka1RXUXEKdzFZYUt4RUNnWUVBenFjVUhJTit0Vmp3dUx0RFY1bElldHFtUmtRUEZ6bWx6aytXa1V0OGZ6SmtINmhuTnBpNwpyTkRVMUpZcy9pWU1QZFJaK3lSNXFLQTRUNXNIcVpobDBVKzc4UjBodXIwUEtFZTF1UU9NSllGYmM4Ry9rbGI3ClZ4bTcyaFVCSkZpN2I2ZTNoa2laRWdHb2FLVXhrbEdvWnBQNC9tN3IxSXQxQjkvNlBPOTV1OWNDZ1lFQS9PMTkKNFl3eUpkQUhDbmdxQ1dRRDA3dFdVQ3ViSldSV1k0R0J2UzFQcUFMOFRjd0RzZGhneFMrMGI1eFZKalRMN1dWagpCYTN1bGJsVkVRa3U2R2FyN0tNbkZZbTJVbXFlTmhaQnI2VFBrZUUySHhqOG9DeFg4SVo1NWN6TGFFUWlSYm92CjdOUHgxNStZdHZMSi9HWG9vQzczWHJ6RlRGUjNDQmEwNk1mWWo0c0NnWUVBbjNmRkNEL2NybnFrd0JrWjNXWlcKelI4ZlFvZlFrVjZWK1gvbk05WHBpNHBLUXpmRDloaWtjclp3Rm1DUTljcE1sZ1hoTGZFMnhJNW5CZDhmYVp0RgpydUQxcWhtTjVybHdFZWhNYmlvem90bVF4ZUlVUUF4SlJpeUFqc2k0cWVDak80VlVGUmErc0d1QkZzZXJXanNUClZaMElmdWIvcTNPMmFzNUhIM0M1SXQ4Q2dZQmI3Y1h2RUpHNWhKN0tnMXBrQjJJTXR1NXNQUzBxcmdsb0tVNEsKZ0VtUGUyWlFzSEkzVmJuMmNaeFhaSzdlTUJwZXNwY0hIV3kySnFKd2lySHQ3a05Xd3dZVm9mUU9pSW53aHE1aApOTG5zLzdvNEcxRFd0c2RQdU5EZFlVNGRHNGFKYVY2NTZWN2hURFNwYWgxWUM0STlsbFI2cm9uWGNHdkRHTjJ3CkxkTGNlUUtCZ0dnWXRTL3pCSDA1Q1VmQ3ZYZFoyTWt4MmpjM2wrQndYdnR6ZUo0VnZKMG43bGR1cnREUnZPUGMKK05hNVVXdWl5bVRHNVcvTnRMbGNWNkdjZnJJdmVQTVpYNUtyU1QyNWlUQi9nUkFydU9OZWx6a2Vud2lZVVBvbQpSL2VONTBXaU5oZXp3VkdxbDhVcUdZeWdGdWpQK085cnI5VjVhbm9uR091Wm4yKzc2bmsyCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
kind: Secret
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong-validation-webhook-keypair
  namespace: plevion-local
type: kubernetes.io/tls
---
apiVersion: v1
data: {}
kind: Secret
metadata:
  name: kong-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  BACKEND_URL: aHR0cDovL2tvbmcta29uZy1wcm94eS9wdWJsaWMvdjE=
  COMPANY_ID: N2YyYzBkYjMtYjE2ZS00NTlkLTljY2ItNDZiOTM5ZmExNWU2
  OTEL_SERVICE_NAME: cGxldmlvbi1sYW5kaW5n
  SERVICE_TOKEN: MTBjYzBhNzA0MDhhMzAxMjZlZjcwMDg5NTdkMjg3YTE5MmU4ODYyZA==
kind: Secret
metadata:
  name: landing-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  MINIO_DEFAULT_BUCKETS: cGxldmlvbg==
  MINIO_ROOT_PASSWORD: cGxldmlvbjEyMw==
  MINIO_ROOT_USER: cGxldmlvbg==
kind: Secret
metadata:
  name: minio-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  API_HOST: aHR0cDovL2FwaS5sb2NhbC5wbGV2aW9uLmNvbQ==
  CELERY_WORKER_HEARTBEAT_INTERVAL: MTA=
  CSRF_TRUSTED_ORIGINS: aHR0cHM6Ly9vcmNoZXN0cmF0b3IubG9jYWwucGxldmlvbi5jb20=
  DB_HOST: cG9zdGdyZXMtbG9jYWw=
  DB_NAME: b3JjaGVzdHJhdG9y
  DB_PASSWORD: cGFzc3dvcmQ=
  DB_PORT: NTQzMg==
  DB_USER: cG9zdGdyZXM=
  DJANGO_SETTINGS_MODULE: c2V0dGluZ3MuZG9ja2Vy
  LOGIN_URL: L29yY2hlc3RyYXRvci9hZG1pbi9sb2dpbi8=
  MEDIA_MTX_RTSP_URL: cnRzcDovL21lZGlhbXR4LWxvY2FsLnBsZXZpb24tbG9jYWw6ODU1NC8=
  MEDIA_MTX_SRT_URL: c3J0Oi8vbWVkaWFtdHgtbG9jYWwucGxldmlvbi1sb2NhbDo4ODkw
  MEDIA_MTX_URL: aHR0cDovL21lZGlhbXR4LWxvY2FsLnBsZXZpb24tbG9jYWw6ODg4OQ==
  OTEL_PYTHON_INSTRUMENTATION_REDIS_CAPTURE_ARGS: dHJ1ZQ==
  OTEL_PYTHON_LOG_CORRELATION: dHJ1ZQ==
  OTEL_SDK_DISABLED: dHJ1ZQ==
  OTEL_SERVICE_NAME: b3JjaGVzdHJhdG9y
  PYTHONPATH: L2FwcC9zcmM=
  RABBITMQ_DEFAULT_PASS: MXEydzNl
  RABBITMQ_DEFAULT_USER: dXNlcg==
  RABBITMQ_HOST: cmFiYml0bXEtbG9jYWw=
  RABBITMQ_PORT: NTY3Mg==
  REDIS_HOST: cmVkaXMtbG9jYWw=
  REDIS_PASSWORD: MXEydzNl
  REDIS_PORT: NjM3OQ==
  SERVICE_TOKEN: OTU2NTY0NzRmNTNkN2EzMDc0ZmMzNDA2YzY4M2U0MGJjNDMzNzE1ZQ==
  SWAGGER_UI_URL: L29yY2hlc3RyYXRvci9zY2hlbWEvc3dhZ2dlci11aS8=
  TAILSCALE_AUTH_KEY: |
    dHNrZXktYXV0aC1rdFg1ekVQc2c1MTFDTlRSTC1iRGNlTFJRajR6TFpDVTNYblE2cXlMOW
    ZSMXBvOWVZYw==
kind: Secret
metadata:
  name: orchestrator-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  POSTGRES_DB: cGxldmlvbg==
  POSTGRES_PASSWORD: cGFzc3dvcmQ=
  POSTGRES_USER: cG9zdGdyZXM=
kind: Secret
metadata:
  name: postgres-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  RABBITMQ_DEFAULT_PASS: MXEydzNl
  RABBITMQ_DEFAULT_USER: dXNlcg==
kind: Secret
metadata:
  name: rabbitmq-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  REDIS_PASSWORD: MXEydzNl
kind: Secret
metadata:
  name: redis-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  API_HOST: aHR0cDovL2FwaS5sb2NhbC5wbGV2aW9uLmNvbQ==
  AUTH_JWT_KEY: |
    ZGphbmdvLWluc2VjdXJlLSU4Jil2YSpnMHRAYyFycjV1XjMpemlsa2pvc3F2biZzbzZ6LT
    krI2ZwMiRAa21pcGgl
  AUTH_ROOT_ACCOUNT_ID: MTZiZGZjZTctMDU0Ny00ZWE4LWI0MzEtMmVmYjg5MmJiYmQ1
  AUTH_ROOT_USER_ID: YzQ5MjM5YzItYWNlYS00ZmM0LTgxN2UtYzU2MmY2N2U3NDdj
  AUTH_ROOT_USER_USERNAME: cm9vdEBwbGV2aW9uLmNvbQ==
  DB_HOST: cG9zdGdyZXMtbG9jYWw=
  DB_NAME: c2luaw==
  DB_PASSWORD: cGFzc3dvcmQ=
  DB_PORT: NTQzMg==
  DB_USER: cG9zdGdyZXM=
  DJANGO_SETTINGS_MODULE: c2V0dGluZ3MucHJvZHVjdGlvbg==
  MEDIAMTX_HLS_URL: aHR0cDovL21lZGlhbXR4LWxvY2FsLnBsZXZpb24tbG9jYWw6ODg4OA==
  MEDIAMTX_RTSP_URL: cnRzcDovL21lZGlhbXR4LWxvY2FsLnBsZXZpb24tbG9jYWw6ODU1NA==
  OTEL_PYTHON_LOG_CORRELATION: dHJ1ZQ==
  OTEL_SDK_DISABLED: dHJ1ZQ==
  OTEL_SERVICE_NAME: c2luaw==
  RABBITMQ_DEFAULT_PASS: MXEydzNl
  RABBITMQ_DEFAULT_USER: dXNlcg==
  RABBITMQ_HOST: cmFiYml0bXEtbG9jYWw=
  RABBITMQ_PORT: NTY3Mg==
  REDIS_HOST: cmVkaXMtbG9jYWw=
  REDIS_PASSWORD: MXEydzNl
  REDIS_PORT: NjM3OQ==
  SECRET_KEY: ZGphbmdvLWluc2VjdXJlLWNoYW5nZS1tZS1pbi1wcm9kdWN0aW9u
  SERVICE_TOKEN: YTNmOGMyZTFiMGQ3NDU5NmFmMTJlM2M3MDkxZDg1YmY0ZTYyMDk3OA==
  STORAGE_BUCKET: cGxldmlvbg==
  STORAGE_ENDPOINT: aHR0cDovL21pbmlvLWxvY2FsLnBsZXZpb24tbG9jYWw6OTAwMA==
  STORAGE_KEY: cGxldmlvbg==
  STORAGE_PUBLIC_BASE_URL: aHR0cDovL2FwaS5sb2NhbC5wbGV2aW9uLmNvbS9wbGV2aW9u
  STORAGE_SECRET: cGxldmlvbjEyMw==
kind: Secret
metadata:
  name: sink-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: auth
  name: auth-events-gateway-local
  namespace: plevion-local
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 8080
  selector:
    component: events-gateway
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: auth
  name: auth-local
  namespace: plevion-local
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 8080
  selector:
    app: auth
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong-admin
  namespace: plevion-local
spec:
  ports:
  - name: kong-admin
    port: 8001
    protocol: TCP
    targetPort: 8001
  - name: kong-admin-tls
    port: 8444
    protocol: TCP
    targetPort: 8444
  publishNotReadyAddresses: true
  selector:
    app.kubernetes.io/component: app
    app.kubernetes.io/instance: kong
    app.kubernetes.io/name: kong
  type: NodePort
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong-manager
  namespace: plevion-local
spec:
  ports:
  - name: kong-manager
    port: 8002
    protocol: TCP
    targetPort: 8002
  - name: kong-manager-tls
    port: 8445
    protocol: TCP
    targetPort: 8445
  selector:
    app.kubernetes.io/component: app
    app.kubernetes.io/instance: kong
    app.kubernetes.io/name: kong
  type: NodePort
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    enable-metrics: "true"
    helm.sh/chart: kong-2.36.0
  name: kong-kong-proxy
  namespace: plevion-local
spec:
  ports:
  - name: stream-udp
    port: 8189
    protocol: UDP
    targetPort: 8189
  - name: proxy
    port: 80
    protocol: TCP
    targetPort: 8000
  - name: proxy-ssl
    port: 443
    protocol: TCP
    targetPort: 8443
  selector:
    app.kubernetes.io/component: app
    app.kubernetes.io/instance: kong
    app.kubernetes.io/name: kong
  type: LoadBalancer
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong-validation-webhook
  namespace: plevion-local
spec:
  ports:
  - name: webhook
    port: 443
    protocol: TCP
    targetPort: webhook
  selector:
    app.kubernetes.io/component: app
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: mediamtx
  name: mediamtx-local
  namespace: plevion-local
spec:
  ports:
  - name: rtsp
    nodePort: 30554
    port: 8554
    protocol: TCP
    targetPort: 8554
  - name: http-api
    nodePort: 30888
    port: 8888
    protocol: TCP
    targetPort: 8888
  - name: webrtc
    nodePort: 30889
    port: 8889
    protocol: TCP
    targetPort: 8889
  - name: srt
    nodePort: 30890
    port: 8890
    protocol: UDP
    targetPort: 8890
  - name: udp-stream
    nodePort: 30189
    port: 8189
    protocol: UDP
    targetPort: 8189
  selector:
    app: mediamtx
  type: NodePort
---
apiVersion: v1
kind: Service
metadata:
  name: minio-local
  namespace: plevion-local
spec:
  ports:
  - name: api
    port: 9000
    targetPort: 9000
  - name: console
    port: 9001
    targetPort: 9001
  selector:
    app: minio
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: orchestrator
  name: orchestrator-local
  namespace: plevion-local
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 8080
  selector:
    app: orchestrator
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: postgres
  name: postgres-local
  namespace: plevion-local
spec:
  ports:
  - port: 5432
  selector:
    app: postgres
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    tailscale.com/expose: "true"
    tailscale.com/hostname: rabbitmq
    tailscale.com/tags: tag:k8s-services
  labels:
    app: rabbitmq
  name: rabbitmq-local
  namespace: plevion-local
spec:
  ports:
  - name: amqp
    port: 5672
    targetPort: 5672
  - name: management
    port: 15672
    targetPort: 15672
  selector:
    app: rabbitmq
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    tailscale.com/expose: "true"
    tailscale.com/hostname: redis
    tailscale.com/tags: tag:k8s-services
  labels:
    app: redis
  name: redis-local
  namespace: plevion-local
spec:
  ports:
  - port: 6379
    targetPort: 6379
  selector:
    app: redis
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: sink
  name: sink-broadcast-gateway-local
  namespace: plevion-local
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 8080
  selector:
    component: broadcast-gateway
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: sink
  name: sink-local
  namespace: plevion-local
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 8080
  selector:
    app: sink
  type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: auth
    component: events-gateway
  name: auth-events-gateway-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      component: events-gateway
  template:
    metadata:
      labels:
        component: events-gateway
    spec:
      containers:
      - args:
        - --timeout
        - "120"
        - --threads
        - "2"
        - --workers
        - "3"
        - --bind
        - 0.0.0.0:8080
        - --access-logfile
        - '-'
        - --limit-request-field_size
        - "16384"
        - --worker-class
        - uvicorn.workers.UvicornWorker
        - settings.asgi
        command:
        - opentelemetry-instrument
        - gunicorn
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        envFrom:
        - secretRef:
            name: auth-secrets
        image: ghcr.io/plevion-dev/auth
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            path: /_healthz/
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 30
        name: auth-events-gateway
        ports:
        - containerPort: 8080
          name: http
        resources:
          limits:
            memory: 512Mi
          requests:
            cpu: 100m
            memory: 128Mi
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: auth-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $REDIS_HOST 6379; do echo "Waiting for Redis..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: auth-secrets
        image: busybox:1.36
        name: wait-for-redis
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: auth-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: auth
  name: auth-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: auth
  template:
    metadata:
      labels:
        app: auth
    spec:
      containers:
      - args:
        - --reload
        - --timeout
        - "120"
        - --threads
        - "2"
        - --workers
        - "3"
        - --bind
        - 0.0.0.0:8080
        - --access-logfile
        - '-'
        - --limit-request-field_size
        - "16384"
        - settings.wsgi
        command:
        - opentelemetry-instrument
        - gunicorn
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        envFrom:
        - secretRef:
            name: auth-secrets
        image: ghcr.io/plevion-dev/auth
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
            path: /_healthz/
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 30
        name: auth
        ports:
        - containerPort: 8080
          name: http
        resources:
          limits:
            memory: 512Mi
          requests:
            cpu: 100m
            memory: 128Mi
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - args:
        - |
          python src/manage.py migrate && \
          python src/manage.py fixturing
        command:
        - /bin/sh
        - -c
        envFrom:
        - secretRef:
            name: auth-secrets
        image: ghcr.io/plevion-dev/auth:latest
        imagePullPolicy: IfNotPresent
        name: run-migrations
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: auth-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $REDIS_HOST 6379; do echo "Waiting for Redis..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: auth-secrets
        image: busybox:1.36
        name: wait-for-redis
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: auth-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: edge-controller
  name: edge-controller-worker-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: edge-controller-worker
  template:
    metadata:
      labels:
        app: edge-controller-worker
        component: worker
    spec:
      containers:
      - args:
        - -A
        - settings
        - worker
        - -l
        - info
        - -E
        - -I
        - apps.common.worker.heartbeat
        - --hostname
        - $(CONTROLLER_ID)@%h
        - --concurrency
        - "1"
        command:
        - celery
        env:
        - name: CONTROLLER_ID
          value: b7289a9f-bd55-4e0f-87f2-3168b59f576c
        - name: CONTAINER_BACKEND
          value: kubernetes
        - name: K8S_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: K8S_IMAGE_PULL_SECRET
          value: ghcr-registry-secret
        - name: STREAM_AUTH_URL
          value: http://api.local.plevion.com/public/v1/orchestrator/controllers/{0}/auth/
        - name: STREAM_CONTAINER_IMAGE
          value: ghcr.io/plevion-dev/edge-controller:latest
        - name: STREAM_DEVICE_MOUNT
          value: /dev/video0:/dev/video0,/dev/snd:/dev/snd
        - name: STREAM_DEVICE_INDEX
          value: "0"
        - name: XDG_RUNTIME_DIR
          value: /run/user/1000
        - name: PULSE_SERVER
          value: unix:/run/user/1000/pulse/native
        envFrom:
        - secretRef:
            name: edge-controller-secrets
        image: ghcr.io/plevion-dev/edge-controller
        imagePullPolicy: Always
        livenessProbe:
          exec:
            command:
            - sh
            - -c
            - if [ $(($(date +%s) - $(stat -c %Y /tmp/worker_heartbeat))) -lt 60 ];
              then exit 0; else exit 1; fi
          failureThreshold: 3
          initialDelaySeconds: 30
          periodSeconds: 60
        name: worker
        resources:
          limits:
            cpu: "1"
            memory: 512Mi
          requests:
            cpu: 200m
            memory: 256Mi
        workingDir: /app/src
      hostAliases:
      - hostnames:
        - api.local.plevion.com
        ip: 10.152.183.32
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: edge-controller-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: edge-controller-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
      serviceAccountName: edge-controller-sa-local
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: app
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: app
      app.kubernetes.io/instance: kong
      app.kubernetes.io/name: kong
  template:
    metadata:
      annotations:
        kuma.io/gateway: enabled
        kuma.io/service-account-token-volume: kong-kong-token
        traffic.sidecar.istio.io/includeInboundPorts: ""
      labels:
        app: kong-kong
        app.kubernetes.io/component: app
        app.kubernetes.io/instance: kong
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: kong
        app.kubernetes.io/version: "3.5"
        helm.sh/chart: kong-2.36.0
        version: "3.5"
    spec:
      automountServiceAccountToken: false
      containers:
      - env:
        - name: KONG_ADMIN_ACCESS_LOG
          value: /dev/stdout
        - name: KONG_ADMIN_ERROR_LOG
          value: /dev/stderr
        - name: KONG_ADMIN_GUI_ACCESS_LOG
          value: /dev/stdout
        - name: KONG_ADMIN_GUI_ERROR_LOG
          value: /dev/stderr
        - name: KONG_ADMIN_LISTEN
          value: 0.0.0.0:8001, [::]:8001, 0.0.0.0:8444 http2 ssl, [::]:8444 http2
            ssl
        - name: KONG_CLUSTER_LISTEN
          value: "off"
        - name: KONG_DATABASE
          value: "off"
        - name: KONG_KIC
          value: "on"
        - name: KONG_LUA_PACKAGE_PATH
          value: /opt/?.lua;/opt/?/init.lua;;
        - name: KONG_NGINX_WORKER_PROCESSES
          value: "2"
        - name: KONG_PORTAL_API_ACCESS_LOG
          value: /dev/stdout
        - name: KONG_PORTAL_API_ERROR_LOG
          value: /dev/stderr
        - name: KONG_PORT_MAPS
          value: 80:8000, 443:8443
        - name: KONG_PREFIX
          value: /kong_prefix/
        - name: KONG_PROXY_ACCESS_LOG
          value: /dev/stdout
        - name: KONG_PROXY_ERROR_LOG
          value: /dev/stderr
        - name: KONG_PROXY_LISTEN
          value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2
            ssl
        - name: KONG_PROXY_STREAM_ACCESS_LOG
          value: /dev/stdout basic
        - name: KONG_PROXY_STREAM_ERROR_LOG
          value: /dev/stderr
        - name: KONG_ROUTER_FLAVOR
          value: traditional
        - name: KONG_STATUS_ACCESS_LOG
          value: "off"
        - name: KONG_STATUS_ERROR_LOG
          value: /dev/stderr
        - name: KONG_STATUS_LISTEN
          value: 0.0.0.0:8100, [::]:8100
        - name: KONG_STREAM_LISTEN
          value: "off"
        - name: KONG_NGINX_DAEMON
          value: "off"
        envFrom:
        - secretRef:
            name: kong-secrets
        image: ghcr.io/plevion-dev/kong:v0.0.5-bf83871
        imagePullPolicy: IfNotPresent
        lifecycle:
          preStop:
            exec:
              command:
              - kong
              - quit
              - --wait=15
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /status
            port: status
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        name: proxy
        ports:
        - containerPort: 8001
          name: admin
          protocol: TCP
        - containerPort: 8444
          name: admin-tls
          protocol: TCP
        - containerPort: 8000
          name: proxy
          protocol: TCP
        - containerPort: 8443
          name: proxy-tls
          protocol: TCP
        - containerPort: 8100
          name: status
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /status/ready
            port: status
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        resources:
          limits:
            cpu: 2000m
            memory: 2Gi
          requests:
            cpu: 500m
            memory: 512Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumeMounts:
        - mountPath: /kong_prefix/
          name: kong-kong-prefix-dir
        - mountPath: /tmp
          name: kong-kong-tmp
      - env:
        - name: CONTROLLER_KONG_ADMIN_SVC
          value: plevion-local/kong-kong-admin
        - name: CONTROLLER_PUBLISH_SERVICE
          value: plevion-local/kong-kong-proxy
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: CONTROLLER_ADMISSION_WEBHOOK_LISTEN
          value: 0.0.0.0:8080
        - name: CONTROLLER_ELECTION_ID
          value: kong-ingress-controller-leader-kong
        - name: CONTROLLER_INGRESS_CLASS
          value: kong
        - name: CONTROLLER_KONG_ADMIN_TLS_SKIP_VERIFY
          value: "true"
        - name: CONTROLLER_KONG_ADMIN_URL
          value: https://localhost:8444
        image: kong/kubernetes-ingress-controller:3.0
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 18
          httpGet:
            path: /readyz
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        name: ingress-controller
        ports:
        - containerPort: 8080
          name: webhook
          protocol: TCP
        - containerPort: 10255
          name: cmetrics
          protocol: TCP
        - containerPort: 10254
          name: status
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /readyz
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumeMounts:
        - mountPath: /admission-webhook
          name: webhook-cert
          readOnly: true
        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
          name: kong-kong-token
          readOnly: true
      hostNetwork: false
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - rm
        - -vrf
        - $KONG_PREFIX/pids
        env:
        - name: KONG_ADMIN_ACCESS_LOG
          value: /dev/stdout
        - name: KONG_ADMIN_ERROR_LOG
          value: /dev/stderr
        - name: KONG_ADMIN_GUI_ACCESS_LOG
          value: /dev/stdout
        - name: KONG_ADMIN_GUI_ERROR_LOG
          value: /dev/stderr
        - name: KONG_ADMIN_LISTEN
          value: 0.0.0.0:8001, [::]:8001, 0.0.0.0:8444 http2 ssl, [::]:8444 http2
            ssl
        - name: KONG_CLUSTER_LISTEN
          value: "off"
        - name: KONG_DATABASE
          value: "off"
        - name: KONG_KIC
          value: "on"
        - name: KONG_LUA_PACKAGE_PATH
          value: /opt/?.lua;/opt/?/init.lua;;
        - name: KONG_NGINX_WORKER_PROCESSES
          value: "2"
        - name: KONG_PORTAL_API_ACCESS_LOG
          value: /dev/stdout
        - name: KONG_PORTAL_API_ERROR_LOG
          value: /dev/stderr
        - name: KONG_PORT_MAPS
          value: 80:8000, 443:8443
        - name: KONG_PREFIX
          value: /kong_prefix/
        - name: KONG_PROXY_ACCESS_LOG
          value: /dev/stdout
        - name: KONG_PROXY_ERROR_LOG
          value: /dev/stderr
        - name: KONG_PROXY_LISTEN
          value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2
            ssl
        - name: KONG_PROXY_STREAM_ACCESS_LOG
          value: /dev/stdout basic
        - name: KONG_PROXY_STREAM_ERROR_LOG
          value: /dev/stderr
        - name: KONG_ROUTER_FLAVOR
          value: traditional
        - name: KONG_STATUS_ACCESS_LOG
          value: "off"
        - name: KONG_STATUS_ERROR_LOG
          value: /dev/stderr
        - name: KONG_STATUS_LISTEN
          value: 0.0.0.0:8100, [::]:8100
        - name: KONG_STREAM_LISTEN
          value: "off"
        image: ghcr.io/plevion-dev/kong:v0.0.5-bf83871
        imagePullPolicy: IfNotPresent
        name: clear-stale-pid
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumeMounts:
        - mountPath: /kong_prefix/
          name: kong-kong-prefix-dir
        - mountPath: /tmp
          name: kong-kong-tmp
      securityContext: {}
      serviceAccountName: kong-kong
      terminationGracePeriodSeconds: 30
      volumes:
      - emptyDir:
          sizeLimit: 256Mi
        name: kong-kong-prefix-dir
      - emptyDir:
          sizeLimit: 1Gi
        name: kong-kong-tmp
      - name: kong-kong-token
        projected:
          sources:
          - serviceAccountToken:
              expirationSeconds: 3607
              path: token
          - configMap:
              items:
              - key: ca.crt
                path: ca.crt
              name: kube-root-ca.crt
          - downwardAPI:
              items:
              - fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
                path: namespace
      - name: webhook-cert
        secret:
          secretName: kong-kong-validation-webhook-keypair
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: mediamtx
  name: mediamtx-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mediamtx
  template:
    metadata:
      labels:
        app: mediamtx
    spec:
      containers:
      - image: ghcr.io/plevion-dev/authmtx
        imagePullPolicy: Always
        name: authmtx
        ports:
        - containerPort: 8080
          name: authmtx-http
        volumeMounts:
        - mountPath: /authmtx.yml
          name: authmtx-config
          subPath: authmtx.yml
      - image: ghcr.io/plevion-dev/mediamtx
        imagePullPolicy: Always
        name: mediamtx
        ports:
        - containerPort: 8554
        - containerPort: 1935
        - containerPort: 8888
        - containerPort: 8889
        - containerPort: 8189
          protocol: UDP
        volumeMounts:
        - mountPath: /mediamtx.yml
          name: config
          subPath: mediamtx.yml
      imagePullSecrets:
      - name: ghcr-registry-secret
      volumes:
      - configMap:
          name: mediamtx-config-local-gk79kkc942
        name: config
      - configMap:
          name: authmtx-config-local-dm99t88c4b
        name: authmtx-config
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: minio-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: minio
  template:
    metadata:
      labels:
        app: minio
    spec:
      containers:
      - args:
        - server
        - /data
        - --console-address
        - :9001
        envFrom:
        - secretRef:
            name: minio-secrets
        image: minio/minio:RELEASE.2025-04-22T22-12-26Z
        livenessProbe:
          httpGet:
            path: /minio/health/live
            port: 9000
          initialDelaySeconds: 10
          periodSeconds: 30
        name: minio
        ports:
        - containerPort: 9000
          name: api
        - containerPort: 9001
          name: console
        volumeMounts:
        - mountPath: /data
          name: data
      volumes:
      - emptyDir: {}
        name: data
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: orchestrator
  name: orchestrator-cqrs-worker-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: orchestrator-cqrs-worker
  template:
    metadata:
      labels:
        app: orchestrator-cqrs-worker
        component: cqrs-worker
    spec:
      containers:
      - args:
        - python
        - manage.py
        - cqrs_consume
        command:
        - opentelemetry-instrument
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        - name: OTEL_SERVICE_NAME
          value: orchestrator-cqrs-worker
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: ghcr.io/plevion-dev/orchestrator
        imagePullPolicy: IfNotPresent
        name: cqrs-worker
        resources:
          limits:
            cpu: 500m
            memory: 512Mi
        workingDir: /app/src
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: orchestrator
  name: orchestrator-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: orchestrator
  template:
    metadata:
      labels:
        app: orchestrator
    spec:
      containers:
      - args:
        - --reload
        - --timeout
        - "120"
        - --threads
        - "2"
        - --workers
        - "3"
        - --bind
        - 0.0.0.0:8080
        - --access-logfile
        - '-'
        - --limit-request-field_size
        - "16384"
        - settings.wsgi
        command:
        - opentelemetry-instrument
        - gunicorn
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        - name: MEDIA_MTX_RTSP_URL
          value: rtsp://mediamtx-local.plevion-local:8554/
        - name: MEDIA_MTX_SRT_URL
          value: srt://mediamtx-local.plevion-local:8890
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: ghcr.io/plevion-dev/orchestrator
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
            path: /_healthz/
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 30
        name: orchestrator
        ports:
        - containerPort: 8080
          name: http
        resources:
          limits:
            cpu: 500m
            memory: 512Mi
          requests:
            cpu: 100m
            memory: 128Mi
      hostAliases:
      - hostnames:
        - api.local.plevion.com
        ip: 10.152.183.32
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - args:
        - |
          python src/manage.py migrate && \
          python src/manage.py fixturing
        command:
        - /bin/sh
        - -c
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: ghcr.io/plevion-dev/orchestrator:latest
        imagePullPolicy: IfNotPresent
        name: run-migrations
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $REDIS_HOST 6379; do echo "Waiting for Redis..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-redis
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: orchestrator
  name: orchestrator-monitor-controllers-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: orchestrator-monitor-controllers
  template:
    metadata:
      labels:
        app: orchestrator-monitor-controllers
        component: monitor
    spec:
      containers:
      - args:
        - python
        - manage.py
        - monitor_controllers
        command:
        - opentelemetry-instrument
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        - name: OTEL_SERVICE_NAME
          value: orchestrator-monitor-controllers
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: ghcr.io/plevion-dev/orchestrator
        imagePullPolicy: Always
        name: monitor
        resources:
          limits:
            cpu: 500m
            memory: 512Mi
        workingDir: /app/src
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $REDIS_HOST 6379; do echo "Waiting for Redis..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-redis
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: orchestrator
  name: orchestrator-worker-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: orchestrator-worker
  template:
    metadata:
      labels:
        app: orchestrator-worker
        component: worker
    spec:
      containers:
      - args:
        - -A
        - settings
        - worker
        - -E
        - -l
        - info
        - -I
        - apps.common.worker.heartbeat
        - --hostname
        - orchestrator-worker@%h
        command:
        - opentelemetry-instrument
        - celery
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        - name: OTEL_SERVICE_NAME
          value: orchestrator-worker
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: ghcr.io/plevion-dev/orchestrator
        imagePullPolicy: Always
        livenessProbe:
          exec:
            command:
            - /bin/sh
            - -c
            - if [ $(($(date +%s) - $(stat -c %Y /tmp/worker_heartbeat))) -lt 60 ];
              then exit 0; else exit 1; fi
          initialDelaySeconds: 30
          periodSeconds: 60
          timeoutSeconds: 5
        name: worker
        resources:
          limits:
            cpu: 1000m
            memory: 2Gi
          requests:
            cpu: 250m
            memory: 512Mi
        volumeMounts:
        - mountPath: /var/lib/tailscale
          name: tailscale-state
        workingDir: /app/src
      - env:
        - name: TS_AUTHKEY
          valueFrom:
            secretKeyRef:
              key: TAILSCALE_AUTH_KEY
              name: orchestrator-secrets
        - name: TS_HOSTNAME
          value: orchestrator-worker
        - name: TS_USERSPACE
          value: "false"
        - name: TS_STATE_DIR
          value: /var/lib/tailscale
        - name: TS_ACCEPT_DNS
          value: "true"
        image: tailscale/tailscale:latest
        imagePullPolicy: Always
        name: tailscaled
        securityContext:
          capabilities:
            add:
            - NET_ADMIN
        volumeMounts:
        - mountPath: /var/lib/tailscale
          name: tailscale-state
      dnsConfig:
        nameservers:
        - 100.100.100.100
        - 8.8.8.8
        searches:
        - default.svc.cluster.local
        - svc.cluster.local
        - cluster.local
      hostAliases:
      - hostnames:
        - api.local.plevion.com
        ip: 10.152.183.32
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $REDIS_HOST 6379; do echo "Waiting for Redis..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-redis
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
      serviceAccountName: orchestrator-worker-sa-local
      volumes:
      - emptyDir: {}
        name: tailscale-state
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: postgres
  name: postgres-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
      - envFrom:
        - secretRef:
            name: postgres-secrets
        image: postgres:15
        livenessProbe:
          exec:
            command:
            - pg_isready
            - -U
            - postgres
          initialDelaySeconds: 10
          periodSeconds: 30
        name: postgres
        ports:
        - containerPort: 5432
        volumeMounts:
        - mountPath: /docker-entrypoint-initdb.d
          name: init-scripts
      volumes:
      - configMap:
          name: postgres-init-scripts-local
        name: init-scripts
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: rabbitmq
  name: rabbitmq-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: rabbitmq
  template:
    metadata:
      labels:
        app: rabbitmq
    spec:
      containers:
      - envFrom:
        - secretRef:
            name: rabbitmq-secrets
        image: rabbitmq:3-management
        livenessProbe:
          exec:
            command:
            - rabbitmq-diagnostics
            - ping
          initialDelaySeconds: 30
          periodSeconds: 30
          timeoutSeconds: 10
        name: rabbitmq
        ports:
        - containerPort: 5672
        - containerPort: 15672
        resources:
          limits:
            cpu: 500m
            memory: 512Mi
          requests:
            cpu: 100m
            memory: 256Mi
        volumeMounts:
        - mountPath: /etc/rabbitmq/rabbitmq.conf
          name: config-volume
          subPath: rabbitmq.conf
        - mountPath: /etc/rabbitmq/definitions.json
          name: definitions-volume
          subPath: definitions.json
      volumes:
      - configMap:
          name: rabbitmq-config-local
        name: config-volume
      - configMap:
          name: rabbitmq-definitions-local-t4gcbb6kdb
        name: definitions-volume
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: redis
  name: redis-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: redis
  template:
    metadata:
      labels:
        app: redis
    spec:
      containers:
      - args:
        - --requirepass
        - $(REDIS_PASSWORD)
        envFrom:
        - secretRef:
            name: redis-secrets
        image: redis:latest
        livenessProbe:
          exec:
            command:
            - redis-cli
            - ping
          initialDelaySeconds: 10
          periodSeconds: 30
        name: redis
        ports:
        - containerPort: 6379
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: sink
    component: broadcast-gateway
  name: sink-broadcast-gateway-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      component: broadcast-gateway
  template:
    metadata:
      labels:
        component: broadcast-gateway
    spec:
      containers:
      - args:
        - --timeout
        - "120"
        - --workers
        - "2"
        - --worker-class
        - uvicorn.workers.UvicornWorker
        - --bind
        - 0.0.0.0:8080
        - --access-logfile
        - '-'
        - --error-logfile
        - '-'
        - --limit-request-field_size
        - "16384"
        - --pythonpath
        - /app/src
        - settings.asgi
        command:
        - gunicorn
        envFrom:
        - secretRef:
            name: sink-secrets
        image: ghcr.io/plevion-dev/sink
        imagePullPolicy: Always
        name: sink-broadcast-gateway
        ports:
        - containerPort: 8080
        workingDir: /app/src
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $REDIS_HOST 6379; do echo "Waiting for Redis..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-redis
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: sink
  name: sink-capturer-worker-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      component: sink-capturer-worker
  template:
    metadata:
      labels:
        component: sink-capturer-worker
    spec:
      containers:
      - args:
        - -A
        - settings
        - worker
        - -E
        - -l
        - info
        - --hostname
        - sink-capturer-worker@%h
        - -Q
        - capturer
        - -I
        - apps.common.worker.heartbeat
        - --pool=threads
        - --concurrency=16
        command:
        - opentelemetry-instrument
        - celery
        env:
        - name: MY_POD_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        - name: OTEL_SERVICE_NAME
          value: sink-capturer-worker
        envFrom:
        - secretRef:
            name: sink-secrets
        image: ghcr.io/plevion-dev/sink-capturer
        imagePullPolicy: Always
        livenessProbe:
          exec:
            command:
            - /bin/sh
            - -c
            - if [ $(($(date +%s) - $(stat -c %Y /tmp/worker_heartbeat))) -lt 60 ];
              then exit 0; else exit 1; fi
          initialDelaySeconds: 30
          periodSeconds: 60
          timeoutSeconds: 5
        name: sink-capturer-worker
        resources:
          limits:
            cpu: "4"
            memory: 4Gi
          requests:
            cpu: 500m
            memory: 2Gi
        workingDir: /app/src
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $REDIS_HOST 6379; do echo "Waiting for Redis..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-redis
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: sink
  name: sink-cqrs-worker-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sink-cqrs-worker
  template:
    metadata:
      labels:
        app: sink-cqrs-worker
        component: cqrs-worker
    spec:
      containers:
      - command:
        - uv
        - run
        - python
        - manage.py
        - cqrs_consume
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        - name: OTEL_SERVICE_NAME
          value: sink-cqrs-worker
        envFrom:
        - secretRef:
            name: sink-secrets
        image: ghcr.io/plevion-dev/sink
        imagePullPolicy: Always
        name: cqrs-worker
        workingDir: /app/src
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: sink
  name: sink-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sink
  template:
    metadata:
      labels:
        app: sink
    spec:
      containers:
      - args:
        - --timeout
        - "120"
        - --workers
        - "4"
        - --bind
        - 0.0.0.0:8080
        - --access-logfile
        - '-'
        - --error-logfile
        - '-'
        - --limit-request-field_size
        - "16384"
        - --pythonpath
        - /app/src
        - settings.wsgi
        command:
        - opentelemetry-instrument
        - gunicorn
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        - name: OTEL_SERVICE_NAME
          value: sink
        envFrom:
        - secretRef:
            name: sink-secrets
        image: ghcr.io/plevion-dev/sink
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
            path: /_healthz/
            port: 8080
          initialDelaySeconds: 20
          periodSeconds: 30
        name: sink
        ports:
        - containerPort: 8080
        workingDir: /app/src
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - args:
        - |
          uv run python src/manage.py migrate && \
          uv run python src/manage.py fixturing
        command:
        - /bin/sh
        - -c
        envFrom:
        - secretRef:
            name: sink-secrets
        image: ghcr.io/plevion-dev/sink:latest
        imagePullPolicy: IfNotPresent
        name: run-migrations
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $REDIS_HOST 6379; do echo "Waiting for Redis..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-redis
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
      - command:
        - uv
        - run
        - python
        - manage.py
        - migrate
        envFrom:
        - secretRef:
            name: sink-secrets
        image: ghcr.io/plevion-dev/sink
        imagePullPolicy: IfNotPresent
        name: migrate
        workingDir: /app/src
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: sink
    component: worker
  name: sink-worker-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      component: sink-worker
  template:
    metadata:
      labels:
        component: sink-worker
    spec:
      containers:
      - args:
        - -A
        - settings
        - worker
        - -E
        - -l
        - info
        - --hostname
        - sink-worker@%h
        - -I
        - apps.common.worker.heartbeat
        - --concurrency=4
        command:
        - opentelemetry-instrument
        - celery
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        - name: OTEL_SERVICE_NAME
          value: sink-worker
        envFrom:
        - secretRef:
            name: sink-secrets
        image: ghcr.io/plevion-dev/sink
        imagePullPolicy: Always
        livenessProbe:
          exec:
            command:
            - /bin/sh
            - -c
            - if [ $(($(date +%s) - $(stat -c %Y /tmp/worker_heartbeat))) -lt 60 ];
              then exit 0; else exit 1; fi
          initialDelaySeconds: 30
          periodSeconds: 60
          timeoutSeconds: 5
        name: sink-worker
        resources:
          limits:
            cpu: "6"
            memory: 6Gi
          requests:
            cpu: 500m
            memory: 1Gi
        workingDir: /app/src
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $REDIS_HOST 6379; do echo "Waiting for Redis..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-redis
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
---
apiVersion: batch/v1
kind: CronJob
metadata:
  labels:
    app: orchestrator
  name: orchestrator-check-components-updates-local
  namespace: plevion-local
spec:
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - args:
            - manage.py
            - check_components_updates
            command:
            - python
            envFrom:
            - secretRef:
                name: orchestrator-secrets
            image: ghcr.io/plevion-dev/orchestrator
            imagePullPolicy: IfNotPresent
            name: check-components-updates
            resources:
              limits:
                cpu: 100m
                memory: 128Mi
            workingDir: /app/src
          imagePullSecrets:
          - name: ghcr-registry-secret
          restartPolicy: OnFailure
  schedule: 0 0,12 * * *
---
apiVersion: batch/v1
kind: CronJob
metadata:
  labels:
    app: orchestrator
  name: orchestrator-reap-connections-local
  namespace: plevion-local
spec:
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - args:
            - manage.py
            - reap_connections
            command:
            - python
            envFrom:
            - secretRef:
                name: orchestrator-secrets
            image: ghcr.io/plevion-dev/orchestrator
            imagePullPolicy: Always
            name: reaper
            resources:
              limits:
                cpu: 100m
                memory: 128Mi
            workingDir: /app/src
          imagePullSecrets:
          - name: ghcr-registry-secret
          restartPolicy: OnFailure
  schedule: '* * * * *'
---
apiVersion: configuration.konghq.com/v1
config:
  auth_url: http://auth-local.plevion-local/public/v1/auth/authentication/check/
kind: KongClusterPlugin
metadata:
  annotations:
    kubernetes.io/ingress.class: kong
  name: auth-config
  namespace: plevion-local
plugin: plevion-auth
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    konghq.com/plugins: auth-config
    konghq.com/protocols: http,https
    konghq.com/strip-path: "false"
  labels:
    app: auth
  name: auth-gateway-events-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - host: api.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: auth-events-gateway-local
            port:
              number: 80
        path: /public/v1/auth/events/authentication/
        pathType: Exact
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: selfsigned-ca-issuer
    konghq.com/protocols: https
    konghq.com/strip-path: "false"
  labels:
    app: auth
  name: auth-ingress-admin-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - host: auth.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: auth-local
            port:
              number: 80
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - auth.local.plevion.com
    secretName: auth-admin-tls
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: selfsigned-ca-issuer
    konghq.com/plugins: auth-config
    konghq.com/protocols: http,https
    konghq.com/strip-path: "false"
  labels:
    app: auth
  name: auth-ingress-api-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - host: api.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: auth-local
            port:
              number: 80
        path: /public/v1/auth
        pathType: Prefix
  - host: auth.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: auth-local
            port:
              number: 80
        path: /public/v1/auth
        pathType: Prefix
  tls:
  - hosts:
    - api.local.plevion.com
    - auth.local.plevion.com
    secretName: auth-api-tls
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    konghq.com/strip-path: "false"
  labels:
    app: auth
  name: auth-ingress-authorizer-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - http:
      paths:
      - backend:
          service:
            name: auth-local
            port:
              number: 80
        path: /public/v1/auth/authentication/check/
        pathType: Exact
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    konghq.com/strip-path: "false"
  labels:
    app: auth
  name: auth-ingress-static-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - http:
      paths:
      - backend:
          service:
            name: auth-local
            port:
              number: 80
        path: /static
        pathType: Prefix
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    konghq.com/preserve-host: "true"
    konghq.com/strip-path: "false"
  name: minio-public-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - host: api.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: minio-local
            port:
              number: 9000
        path: /plevion/
        pathType: Prefix
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: selfsigned-ca-issuer
    konghq.com/protocols: https
    konghq.com/strip-path: "false"
  labels:
    app: orchestrator
  name: orchestrator-ingress-admin-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - host: orchestrator.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: orchestrator-local
            port:
              number: 80
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - orchestrator.local.plevion.com
    secretName: orchestrator-admin-tls
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: selfsigned-ca-issuer
    konghq.com/plugins: auth-config
    konghq.com/protocols: http,https
    konghq.com/strip-path: "false"
  labels:
    app: orchestrator
  name: orchestrator-ingress-api-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - host: api.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: orchestrator-local
            port:
              number: 80
        path: /public/v1/orchestrator
        pathType: Prefix
  - host: orchestrator.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: orchestrator-local
            port:
              number: 80
        path: /public/v1/orchestrator
        pathType: Prefix
  tls:
  - hosts:
    - api.local.plevion.com
    - orchestrator.local.plevion.com
    secretName: orchestrator-api-tls
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    konghq.com/strip-path: "false"
  labels:
    app: orchestrator
  name: orchestrator-ingress-static-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - http:
      paths:
      - backend:
          service:
            name: orchestrator-local
            port:
              number: 80
        path: /static
        pathType: Prefix
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    konghq.com/plugins: auth-config
    konghq.com/protocols: http,https
    konghq.com/regex-priority: "100"
    konghq.com/strip-path: "false"
  labels:
    app: sink
  name: sink-gateway-broadcast-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - host: api.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: sink-broadcast-gateway-local
            port:
              number: 80
        path: /public/v1/sink/events/compositions/
        pathType: ImplementationSpecific
      - backend:
          service:
            name: sink-broadcast-gateway-local
            port:
              number: 80
        path: /public/v1/sink/events/
        pathType: ImplementationSpecific
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: selfsigned-ca-issuer
    konghq.com/plugins: auth-config
    konghq.com/protocols: http,https
    konghq.com/strip-path: "false"
  labels:
    app: sink
  name: sink-ingress-api-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - host: api.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: sink-local
            port:
              number: 80
        path: /public/v1/sink/
        pathType: Prefix
  tls:
  - hosts:
    - api.local.plevion.com
    secretName: sink-api-tls
---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong
spec:
  controller: ingress-controllers.konghq.com/kong
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong-validations
  namespace: kong
webhooks:
- admissionReviewVersions:
  - v1beta1
  clientConfig:
    caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKRENDQWd5Z0F3SUJBZ0lSQUp1N01oaTR1MzlSLzhiR0dtN3BvbE13RFFZSktvWklodmNOQVFFTEJRQXcKSERFYU1CZ0dBMVVFQXhNUmEyOXVaeTFoWkcxcGMzTnBiMjR0WTJFd0hoY05Nall3T0RBeE1EZ3pOakl4V2hjTgpNell3TnpJNU1EZ3pOakl4V2pBY01Sb3dHQVlEVlFRREV4RnJiMjVuTFdGa2JXbHpjMmx2YmkxallUQ0NBU0l3CkRRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFMeTRMSWFyeGtFd2o1Zk5tWDFpN2d3QTErM1AKZExGcS83QzY2RUgwUXNWc3NvSEsraVlCSlJVbUpicXFTY1dIT2g1QUxFTy9yMi8xT2o1M3FNVlh0aXdlNFcwVgpDTGc1a1I1WFVpaEY4ckV1U1R6SVNkaWw1bW00akRvQ1ZQZWJ0YStEN2lrMDVkbWdGM2FtZ1pOTXBkcE5hVDFjCkdLRDlCNXBIMWI5VGE5b1hwdUNMazZzV2J3TG1jS2VlT1NUbjcxK0JFL2prNnp2QVRaTWFDaTIzcGZ6RDkvbjYKcG1UVzJ0TDBXY0JwWDJhMy9kZGdCaWE3RXoycVBLR3Y4TU45QmpaL1Y0cXo2N0VGMzRNSWExcXZzL0VMQVZncAp2QmxNVEpnY1hkYWNIZFUxY0hPd0RXWDZ6Sm9IWDU3eDhveCswRG1HcVQ0UEdyMXZ3VGQ5dGd2V3d3RUNBd0VBCkFhTmhNRjh3RGdZRFZSMFBBUUgvQkFRREFnS2tNQjBHQTFVZEpRUVdNQlFHQ0NzR0FRVUZCd01CQmdnckJnRUYKQlFjREFqQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCVEw1cTJTVXFzanhOMU9SZnZFMXhKNApYUnR1blRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQWV5UkJhNFRXMmovT0swTjVPcEprU1k0SnpxdlR3dm1HCmladUtGdnNPSFV0TzhQQThzQ0QxUjFyWjI5bjlBeUladEVPckQvcFF6Zi9IWld2UjU3Y1dtbkNFek1jUVFFTXAKWjVBbzBDa3R0NUswbmdwUTZsSEtWYWJNNEhIM2RFWnQwV0dlQXhYUmU2NjhNcElHczFudkd5c2tnNXJXd1pKLwpKS2J6dllKMmU1dTRidC9kMGU5Z2tnc2NzSWd2emxhQUlub3cwckdHZ3hicXhTSWthVGdxYWJBNjVnQko5VDR3CktIdFkweW93QzN4MjhFc0ZSdDhjQjVreXFtVVN5a25ra0FMcFQ1Ym92YWxzR0wraVJIYlRmRHAyNDZEY2xFU2cKQmNPZFhNeFcwN1kvcWg2anBNbHJob1AyZnVCTElkdDl6WGhkN2NsK1FtdlcxQTdJWHdiNjJRPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
    service:
      name: kong-kong-validation-webhook
      namespace: plevion-local
  failurePolicy: Ignore
  name: validations.kong.konghq.com
  objectSelector:
    matchExpressions:
    - key: owner
      operator: NotIn
      values:
      - helm
  rules:
  - apiGroups:
    - configuration.konghq.com
    apiVersions:
    - '*'
    operations:
    - CREATE
    - UPDATE
    resources:
    - kongconsumers
    - kongplugins
    - kongclusterplugins
    - kongingresses
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - secrets
    - services
  - apiGroups:
    - networking.k8s.io
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - ingresses
  - apiGroups:
    - gateway.networking.k8s.io
    apiVersions:
    - v1alpha2
    - v1beta1
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - gateways
    - httproutes
  sideEffects: None
