acre.yaml

# Copyright 2019 Copyright (c) 2019 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

dependency_versions: (( &temporary( read( __ctx.DIR "/dependency-versions.yaml", "yaml" ) ) ))
meta: (( ~~ ))
landscape:
  name: (( error("landscape name required") ))
  domain:
  namespace: garden
  defaultTTL: 120
  cluster:
    kubeconfig: ./kubeconfig
    networks: ~
  clusters: (( valid(landscape.cluster.networks) ? [ landscape.cluster ] :error("no cluster networks definition found") ))
  components: []
  versions:
    kube-apiserver:
      image_repo: k8s.gcr.io/kube-apiserver
      image_tag: v1.23.13
    kube-controller-manager:
      image_repo: k8s.gcr.io/kube-controller-manager
      image_tag: (( kube-apiserver.image_tag ))
    etcd:
      etcd:
        image_repo: quay.io/coreos/etcd
        image_tag: "v3.3.13"
      backup_restore:
        image_repo: eu.gcr.io/gardener-project/gardener/etcdbrctl
        image_tag: "v0.15.1"
    gardener:
      <<: (( merge ))
      repo: "https://github.com/gardener/gardener.git"
      tag: (( valid( branch ) -or valid( commit ) ? ~~ :.dependency_versions.versions.gardener.core.version ))
      apiserver:
        <<: (( merge ))
        image_repo: "eu.gcr.io/gardener-project/gardener/apiserver"
        image_tag: (( valid( tag ) ? tag :~~ ))
      controller_manager:
        <<: (( merge ))
        image_repo: "eu.gcr.io/gardener-project/gardener/controller-manager"
        image_tag: (( valid( tag ) ? tag :~~ ))
      admission_controller:
        <<: (( merge ))
        image_repo: "eu.gcr.io/gardener-project/gardener/admission-controller"
        image_tag: (( valid( tag ) ? tag :~~ ))
      scheduler:
        <<: (( merge ))
        image_repo: "eu.gcr.io/gardener-project/gardener/scheduler"
        image_tag: (( valid( tag ) ? tag :~~ ))
      gardenlet:
        <<: (( merge ))
        image_repo: "eu.gcr.io/gardener-project/gardener/gardenlet"
        image_tag: (( valid( tag ) ? tag :~~ ))
      extensions:
        os-coreos:
          <<: (( merge ))
          tag: (( valid( os-coreos.branch ) -or valid( os-coreos.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.os-coreos.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.os-coreos.repo ))
          chart_path: charts/gardener-extension-os-coreos
          image_tag: (( valid( os-coreos.tag ) ? os-coreos.tag :~~ ))
          image_repo: (( ~~ ))
        os-ubuntu:
          <<: (( merge ))
          tag: (( valid( os-ubuntu.branch ) -or valid( os-ubuntu.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.os-ubuntu.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.os-ubuntu.repo ))
          chart_path: charts/gardener-extension-os-ubuntu
          image_tag: (( valid( os-ubuntu.tag ) ? os-ubuntu.tag :~~ ))
          image_repo: (( ~~ ))
        os-gardenlinux:
          <<: (( merge ))
          tag: (( valid( os-gardenlinux.branch ) -or valid( os-gardenlinux.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.os-gardenlinux.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.os-gardenlinux.repo ))
          chart_path: charts/gardener-extension-os-gardenlinux
          image_tag: (( valid( os-gardenlinux.tag ) ? os-gardenlinux.tag :~~ ))
          image_repo: (( ~~ ))
        os-suse-chost:
          <<: (( merge ))
          tag: (( valid( os-suse-chost.branch ) -or valid( os-suse-chost.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.os-suse-chost.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.os-suse-chost.repo ))
          chart_path: charts/gardener-extension-os-suse-chost
          image_tag: (( valid( os-suse-chost.tag ) ? os-suse-chost.tag :~~ ))
          image_repo: (( ~~ ))
        provider-aws:
          <<: (( merge ))
          tag: (( valid( provider-aws.branch ) -or valid( provider-aws.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.provider-aws.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.provider-aws.repo ))
          chart_path: charts/gardener-extension-provider-aws
          admission_controller_name: gardener-extension-admission-aws
          image_tag: (( valid( provider-aws.tag ) ? provider-aws.tag :~~ ))
          image_repo: (( ~~ ))
        provider-alicloud:
          <<: (( merge ))
          tag: (( valid( provider-alicloud.branch ) -or valid( provider-alicloud.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.provider-alicloud.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.provider-alicloud.repo ))
          chart_path: charts/gardener-extension-provider-alicloud
          admission_controller_name: gardener-extension-admission-alicloud
          image_tag: (( valid( provider-alicloud.tag ) ? provider-alicloud.tag :~~ ))
          image_repo: (( ~~ ))
        provider-gcp:
          <<: (( merge ))
          tag: (( valid( provider-gcp.branch ) -or valid( provider-gcp.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.provider-gcp.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.provider-gcp.repo ))
          chart_path: charts/gardener-extension-provider-gcp
          admission_controller_name: gardener-extension-admission-gcp
          image_tag: (( valid( provider-gcp.tag ) ? provider-gcp.tag :~~ ))
          image_repo: (( ~~ ))
        provider-azure:
          <<: (( merge ))
          tag: (( valid( provider-azure.branch ) -or valid( provider-azure.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.provider-azure.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.provider-azure.repo ))
          chart_path: charts/gardener-extension-provider-azure
          admission_controller_name: gardener-extension-admission-azure
          image_tag: (( valid( provider-azure.tag ) ? provider-azure.tag :~~ ))
          image_repo: (( ~~ ))
        provider-openstack:
          <<: (( merge ))
          tag: (( valid( provider-openstack.branch ) -or valid( provider-openstack.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.provider-openstack.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.provider-openstack.repo ))
          chart_path: charts/gardener-extension-provider-openstack
          admission_controller_name: gardener-extension-admission-openstack
          image_tag: (( valid( provider-openstack.tag ) ? provider-openstack.tag :~~ ))
          image_repo: (( ~~ ))
        networking-calico:
          <<: (( merge ))
          tag: (( valid( networking-calico.branch ) -or valid( networking-calico.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.networking-calico.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.networking-calico.repo ))
          chart_path: charts/gardener-extension-networking-calico
          admission_controller_name: gardener-extension-admission-calico
          image_tag: (( valid( networking-calico.tag ) ? networking-calico.tag :~~ ))
          image_repo: (( ~~ ))
        shoot-cert-service:
          <<: (( merge ))
          tag: (( valid( shoot-cert-service.branch ) -or valid( shoot-cert-service.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.shoot-cert-service.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.shoot-cert-service.repo ))
          chart_path: charts/gardener-extension-shoot-cert-service
          image_tag: (( valid( shoot-cert-service.tag ) ? shoot-cert-service.tag :~~ ))
          image_repo: (( ~~ ))
        shoot-dns-service:
          <<: (( merge ))
          tag: (( valid( shoot-dns-service.branch ) -or valid( shoot-dns-service.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.shoot-dns-service.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.shoot-dns-service.repo ))
          chart_path: charts/gardener-extension-shoot-dns-service
          admission_controller_name: gardener-extension-admission-shoot-dns-service
          image_tag: (( valid( shoot-dns-service.tag ) ? shoot-dns-service.tag :~~ ))
          image_repo: (( ~~ ))
          dns-controller-manager:
            image_tag: (( valid( versions.dns-controller-manager.image_tag ) ? versions.dns-controller-manager.image_tag :~~ ))
            image_repo: (( valid( versions.dns-controller-manager.image_repo ) ? versions.dns-controller-manager.image_repo :~~ ))
        provider-vsphere:
          <<: (( merge ))
          tag: (( valid( provider-vsphere.branch ) -or valid( provider-vsphere.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.provider-vsphere.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.provider-vsphere.repo ))
          chart_path: charts/gardener-extension-provider-vsphere
          image_tag: (( valid( provider-vsphere.tag ) ? provider-vsphere.tag :~~ ))
          image_repo: (( ~~ ))
        runtime-gvisor:
          <<: (( merge ))
          tag: (( valid( runtime-gvisor.branch ) -or valid( runtime-gvisor.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.runtime-gvisor.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.runtime-gvisor.repo ))
          chart_path: charts/gardener-extension-runtime-gvisor
          image_tag: (( valid( runtime-gvisor.tag ) ? runtime-gvisor.tag :~~ ))
          image_repo: (( ~~ ))
    dashboard:
      <<: (( merge ))
      repo: (( .dependency_versions.versions.dashboard.core.repo ))
      tag: (( valid( branch ) -or valid( commit ) ? ~~ :.dependency_versions.versions.dashboard.core.version ))
      image_tag: (( valid( tag ) ? tag :~~ ))
    ingress-controller:
      <<: (( merge ))
      repo: https://github.com/kubernetes/ingress-nginx.git
      image_tag: (( valid( tag ) ? substr(tag, length("controller-")) :~~ ))
      image_repo: eu.gcr.io/k8s-artifacts-prod/ingress-nginx/controller
      tag: (( valid( branch ) -or valid( commit ) ? ~~ :"controller-v1.3.0" ))
    nginx-ingress-k8s-backend:
      <<: (( merge ))
      image_tag: "0.9.0"
      image_repo: eu.gcr.io/gardener-project/gardener/ingress-default-backend
    identity:
      <<: (( merge ))
      repo: (( .dependency_versions.versions.dashboard.identity.repo ))
      tag: (( valid( branch ) -or valid( commit ) ? ~~ :.dependency_versions.versions.dashboard.identity.version ))
      branch: (( valid( commit ) ? ~~ :( dashboard.branch || ~~ ) ))
      commit: (( dashboard.commit || ~~ ))
    terminal-controller-manager:
      <<: (( merge ))
      repo: (( .dependency_versions.versions.dashboard.terminals.terminal-controller-manager.repo ))
      tag: (( valid( branch ) -or valid( commit ) ? ~~ :.dependency_versions.versions.dashboard.terminals.terminal-controller-manager.version ))
      image_tag: (( valid( tag ) ? tag :~~ ))
      image_repo: eu.gcr.io/gardener-project/gardener/terminal-controller-manager
    terminal-kube-rbac-proxy:
      <<: (( merge ))
      # to overwrite:
      # set image_repo here (mandatory)
      # set image_tag here (defaults to latest, if image_repo is set and image_tag is not given)
    terminal-image:
      container:
        <<: (( merge ))
        image_tag: 0.22.0
        image_repo: eu.gcr.io/gardener-project/gardener/ops-toolbelt
      containerOperator:
        <<: (( merge ))
        image_tag: (( container.image_tag ))
        image_repo: (( container.image_repo ))
    dns-controller-manager:
      <<: (( merge ))
      tag: (( valid( branch ) -or valid( commit ) ? ~~ :.dependency_versions.versions.dns-controller-manager.version ))
      image_tag: (( valid( tag ) ? tag :~~ ))
      image_repo: (( ~~ ))
      repo: (( .dependency_versions.versions.dns-controller-manager.repo ))
    cert-manager:
      controller:
        <<: (( merge ))
        tag: (( valid( branch ) -or valid( commit ) ? ~~ :.dependency_versions.versions.cert-management.version ))
        image_tag: (( valid( tag ) ? tag :~~ ))
        image_repo: (( ~~ ))
        repo: (( .dependency_versions.versions.cert-management.repo ))
      cert-dns-bridge:
        <<: (( merge ))
        tag: (( valid( branch ) -or valid( commit ) ? ~~ :"2.1.0" ))
        image_tag: (( valid( tag ) ? tag :~~ ))
        image_repo: (( ~~ ))
        repo: "https://github.com/gardener/certificate-dns-bridge.git"
    monitoring:
      prometheus:
        image_repo: quay.io/prometheus/prometheus
        image_tag: v2.12.0
      blackbox-exporter:
        image_repo: quay.io/prometheus/blackbox-exporter
        image_tag: v0.14.0
      configmap-reload:
        image_repo: quay.io/coreos/configmap-reload
        image_tag: v0.0.1
      grafana:
        image_repo: grafana/grafana
        image_tag: "7.0.3"
      gardener-metrics-exporter:
        <<: (( merge ))
        repo: https://github.com/gardener/gardener-metrics-exporter.git
        tag: (( valid( branch ) -or valid( commit ) ? ~~ :"0.13.0" ))
        image_tag: (( valid( tag ) ? tag :~~ ))
        image_repo: (( ~~ ))
  iaas: (( merge none // map[ select[stub()|e|-> ( ! defined( e.mode ) ) -or ( e.mode != "inactive" ) ] |idx,v|-> v { "mode" = v.mode || "seed" } ] ))
  iaas_shooted_seeds: (( merge none // sum[landscape.iaas|[]|s,e|-> ( e.mode == "seed" -or e.mode == "soil" ) -and valid( e.seeds ) ? s map[e.seeds|x|-> x {"seed" = e.name}] :s] ))
  etcd:
    <<: (( merge ))
    backup:
      <<: (( merge ))
      active: true
      type: (( active ? .backup_type_mapping[iaas[0].type] :~~ ))
      region: (( active ? iaas[0].region :~~ ))
      credentials: (( active ? iaas[0].credentials :~~ ))
  dashboard: (( ~~ ))
  identity:
  ingress:
    annotations: (( ~~ ))
  gardener: (( ~~ ))
  monitoring:
    active: false
    username: admin
    password: (( ~~ ))
    hash: (( ~~ ))
    customScrapeConfigPath: (( ~~ ))
    remoteWrite: (( ~~ ))
    externalLabels: (( ~~ ))
  cert-manager:
    <<: (( merge ))
    server: (( merge none // valid( stub() ) ? ( type( stub() ) == "map" ? stub() :{ "url" = stub() } ) :{"url" = "self-signed"} ))
  dns:
    <<: (( merge ))
    type: (( .dns_type_mapping[iaas[0].type] ))
    credentials: (( iaas[0].credentials ))
  domains:
    <<: (( merge none ))
    wildcard_ingress_dns: (( "*." ingress_dns ))
    ingress_dns: (( "ing." landscape.domain ))
    issuer_url: (( .landscape.identity.issuerUrl || "https://" identity_dns "/oidc" ))
    callback_url: (( dashboard_url "/auth/callback" ))
    connector_callback_url: (( dashboard_url "/oidc/callback" ))
    dashboard_url: (( "https://" dashboard_dns ))
    identity_url: (( "https://" identity_dns ))
    identity_dns: (( ( .landscape.identity.useIdentityDomain || false ) ? "identity." ingress_dns :dashboard_dns ))
    dashboard_dns: (( "gardener." ingress_dns ))

dns_type_mapping:
  <<: (( &temporary ))
  gcp: google-clouddns
  aws: aws-route53
  azure: azure-dns
  openstack: openstack-designate
  alicloud: alicloud-dns

backup_type_mapping:
  <<: (( &temporary ))
  gcp: gcs
  aws: s3
  azure: abs
  openstack: swift
  alicloud: oss


######################
##### VALIDATION #####
######################

validation:
  <<: (( &temporary ))

  ### AUXILIARY FUNCTIONS ###
  return_true: (( |x|-> true )) # dummy validator that never fails
  instantiate_validator: (( |values,validator|-> *validator )) # instantiates a validator with given values
  email_regex: "[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*@[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)+$" # a simple email regex
  flatten: (( |l|-> sum[l|[]|s,e|-> s e.[*]] )) # flattens a list of lists to a list of elements
  length_validator: (( |x,l|-> [length( x ) <= l, x, "exceeded maximum allowed length (" l "):" " " x] )) # returns true if the length of x is equals or lesser than l

  ### VALIDATOR DEFINITIONS ###
  types:
    iaas:
      # <type>.config: validated for each iaas entry
      # <type>.profileConfig: validated for each iaas entry that results in a cloudprofile (= doesn't have a 'cloudprofile' field referencing another iaas entry)
      # <type>.networks: validated for shooted seed iaas entries
      gcp:
        credentials:
          - mapfield
          - serviceaccount.json
        config:
          - ["mapfield", "region"]
          - ["mapfield", "zones", ["list"]]
        profileConfig:
          - (( return_true ))
        networks:
          - ["mapfield", "workers", ["cidr"]]
      aws:
        credentials:
          - and
          - ["mapfield", "accessKeyID"]
          - ["mapfield", "secretAccessKey"]
        config:
          - ["mapfield", "region"]
          - ["mapfield", "zones", ["list"]]
        profileConfig:
          - (( return_true ))
        networks:
          - ["mapfield", "internal", ["cidr"]]
          - ["mapfield", "public", ["cidr"]]
          - ["mapfield", "vpc", ["or", ["mapfield", "id"], ["mapfield", "cidr", ["cidr"]]]]
      alicloud:
        credentials:
          - and
          - ["mapfield", "accessKeyID"]
          - ["mapfield", "accessKeySecret"]
        config:
          - ["mapfield", "region"]
          - ["mapfield", "zones", ["list"]]
        profileConfig:
          - (( return_true ))
        networks:
          - ["mapfield", "vpc", ["or", ["mapfield", "id"], ["mapfield", "cidr", ["cidr"]]]]
      azure:
        credentials:
          - and
          - ["mapfield", "clientID"]
          - ["mapfield", "clientSecret"]
          - ["mapfield", "subscriptionID"]
          - ["mapfield", "tenantID"]
        config:
          - ["mapfield", "region"]
        profileConfig:
          - (( return_true ))
        networks:
          - ["mapfield", "workers", ["cidr"]]
          - ["mapfield", "vnet", ["or", ["mapfield", "name"], ["mapfield", "cidr", ["cidr"]]]]
      vsphere:
        credentials:
          - and
          - ["mapfield", "nsxtPassword"]
          - ["mapfield", "nsxtUsername"]
          - ["mapfield", "vspherePassword"]
          - ["mapfield", "vsphereUsername"]
        config:
          - ["mapfield", "region"]
          - ["mapfield", "zones", ["list"]]
        profileConfig:
          - and
          - - mapfield
            - loadBalancerConfig
            - - and
              - - mapfield
                - size
                - ["valueset", ["SMALL", "MEDIUM", "LARGE"]]
              - - mapfield
                - classes
                - - list
                  - ["mapfield", "name"]
          - ["mapfield", "defaultClassStoragePolicyName"]
          - ["mapfield", "dnsServers", ["list", ["ip"]]]
          - ["mapfield", "folder"]
          - - mapfield
            - machineImageDefinitions
            - - list
              - - and
                - ["mapfield", "name"]
                - - mapfield
                  - versions
                  - - list
                    - - and
                      - ["optionalfield", "guestId"]
                      - ["mapfield", "path"]
                      - ["mapfield", "version"]
          - - optionalfield
            - machineTypeOptions
            - - list
              - - and
                - ["mapfield", "name"]
                - ["mapfield", "memoryReservationLockedToMax", ["type", "bool"]]
                - ["optionalfield", "extraConfig", "map"]
          - - mapfield
            - regionDefinitions
            - - list
              - - and
                - ["mapfield", "name"]
                - ["mapfield", "vsphereHost"]
                - ["optionalfield", "vsphereInsecureSSL", ["type", "bool"]]
                - ["mapfield", "nsxtHost"]
                - ["optionalfield", "nsxtInsecureSSL", ["type", "bool"]]
                - ["optionalfield", "nsxtRemoteAuth", ["type", "bool"]]
                - ["mapfield", "transportZone"]
                - ["mapfield", "logicalTier0Router"]
                - ["mapfield", "edgeCluster"]
                - ["mapfield", "snatIPPool"]
          - ["optionalfield", "csiResizerDisabled", ["type", "bool"]]
          - - optionalfield
            - failureDomainLabels
            - - and
              - ["mapfield", "region"]
              - ["mapfield", "zone"]
        networks: []
      openstack:
        credentials:
          - and
          - ["mapfield", "domainName"]
          - ["mapfield", "tenantName"]
          - ["mapfield", "username"]
          - ["mapfield", "password"]
          - ["mapfield", "authURL"]
        config:
          - ["mapfield", "region"]
          - ["mapfield", "zones", ["list"]]
        profileConfig:
          - and
          - - mapfield
            - floatingPools
            - - list
              - ["mapfield", "name"]
          - - mapfield
            - machineImages
            - - list
              - - and
                - ["mapfield", "name"]
                - - mapfield
                  - versions
                  - - list
                    - ["mapfield", "version"]
          - - mapfield
            - loadBalancerProviders
            - - list
              - ["mapfield", "name"]
          - - mapfield
            - machineTypes
            - - list
              - - and
                - ["mapfield", "name"]
                - ["mapfield", "cpu"]
                - ["mapfield", "gpu"]
                - ["mapfield", "memory"]
                - ["mapfield", "usable"]
                - - optionalfield
                  - storage
                  - - and
                    - ["mapfield", "class"]
                    - ["mapfield", "type"]
                    - ["mapfield", "size"]
          - ["optionalfield", "dhcpDomain", "dnsdomain"]
          - ["optionalfield", "keystoneURL", "dnsdomain"]
          - ["optionalfield", "useOctavia", ["type", "bool"]]
          - ["optionalfield", "dnsServers", ["list", ["ip"]]]
          - ["optionalfield", "nodeVolumeAttachLimit", ["type", "int"]]
          - - mapfield
            - machineImageDefinitions
            - - list
              - - and
                - ["mapfield", "name"]
                - - mapfield
                  - versions
                  - - list
                    - - and
                      - - or
                        - ["mapfield", "image"]
                        - - mapfield
                          - regions
                          - - list
                            - - and
                              - ["mapfield", "name"]
                              - ["mapfield", "id"]
                      - ["mapfield", "version"]
        networks:
          - ["mapfield", "workers", ["cidr"]]
    etcd_backup:
      gcs:
        credentials: (( iaas.gcp.credentials ))
        config: (( return_true ))
      s3:
        credentials: (( iaas.aws.credentials ))
        config: (( return_true ))
      abs:
        credentials: (( iaas.azure.credentials ))
        config: ["mapfield", "resourceGroup"]
      swift:
        credentials: (( iaas.openstack.credentials ))
        config: (( return_true ))
      oss:
        credentials: (( iaas.alicloud.credentials ))
        config: (( return_true ))
    backup_config:
      - <<: (( &template ))
      - and
      - - mapfield
        - type
        - - valueset
          - (( keys( types.etcd_backup ) ))
      - ["mapfield", "region"]
      - ["optionalfield", "schedule", ["type", "string"]]
      - ["optionalfield", "maxBackups", ["type", "int"]]
      - - mapfield
        - credentials
        - (( types.etcd_backup[values.type].credentials ))
    dns:
      google-clouddns:
        credentials: (( iaas.gcp.credentials ))
        config: (( return_true ))
      aws-route53:
        credentials: (( iaas.aws.credentials ))
        config: (( return_true ))
      azure-dns:
        credentials: (( iaas.azure.credentials ))
        config: (( return_true ))
      alicloud-dns:
        credentials: (( iaas.alicloud.credentials ))
        config: (( return_true ))
      openstack-designate:
        credentials:
          - <<: (( iaas.openstack.credentials ))
          - ["mapfield", "region"]
        config: (( return_true ))
      cloudflare-dns:
        credentials:
          - mapfield
          - apiToken
        config: (( return_true ))
      infoblox-dns:
        credentials:
          - and
          - ["mapfield", "USERNAME"]
          - ["mapfield", "PASSWORD"]
          - ["mapfield", "HOST", ["ip"]]
          - ["optionalfield", "PORT", ["type", "int"]]
          - ["optionalfield", "SSL_VERIFY", ["type", "bool"]]
          - ["optionalfield", "VERSION"]
          - ["optionalfield", "VIEW"]
          - ["optionalfield", "HTTP_POOL_CONNECTIONS", ["type", "int"]]
          - ["optionalfield", "HTTP_REQUEST_TIMEOUT", ["type", "int"]]
          - ["optionalfield", "CA_CERT", ["ca"]]
          - ["optionalfield", "PROXY_URL"]
        config: (( return_true ))
# providerConfig support not complete in Gardener
#        config:
#          - mapfield
#          - providerConfig
#          - - and
#            - ["mapfield", "host", ["ip"]]
#            - ["optionalfield", "port", ["type", "int"]]
#            - ["optionalfield", "sslVerify", ["type", "bool"]]
#            - ["optionalfield", "version"]
#            - ["optionalfield", "view"]
#            - ["optionalfield", "httpPoolConnections", ["type", "int"]]
#            - ["optionalfield", "httpRequestTimeout", ["type", "int"]]
#            - ["optionalfield", "caCert", ["ca"]]
#            - ["optionalfield", "maxResults", ["type", "int"]]
#            - ["optionalfield", "proxyUrl"]
  iaas_entry_validators:
    basic:
      - <<: (( &template ))
      - and
      - ["mapfield", "name"]
      - ["mapfield", "type", ["valueset", (( keys( types.iaas ) ))]]
      - ["mapfield", "mode", ["valueset", ["seed", "profile", "cloudprofile", "soil"]]]
      - - optionalfield
        - shootDefaultNetworks
        - - and
          - ["mapfield", "pods", ["cidr"]]
          - ["mapfield", "services", ["cidr"]]
      - - optionalfield
        - credentials
        - (( types.iaas[values.type].credentials ))
      - - optionalfield
        - featureGates
        - - and
          - ["optionalfield", "HVPA", ["type", "bool"]]
          - ["optionalfield", "HVPAForShootedSeed", ["type", "bool"]]
          - ["optionalfield", "SeedChange", ["type", "bool"]]
          - ["optionalfield", "SeedKubeScheduler", ["type", "bool"]]
          - ["optionalfield", "CopyEtcdBackupsDuringControlPlaneMigration", ["type", "bool"]]
          - ["optionalfield", "ForceRestore", ["type", "bool"]]
          - ["optionalfield", "ShootCARotation", ["type", "bool"]]
          - ["optionalfield", "ShootSARotation", ["type", "bool"]]
          - ["optionalfield", "HAControlPlanes", ["type", "bool"]]
          - ["optionalfield", "NodeLocalDNS", ["type", "bool"]]
          - ["optionalfield", "KonnectivityTunnel", ["type", "bool"]]
          - ["optionalfield", "MountHostCADirectories", ["type", "bool"]]
          - ["optionalfield", "DisallowKubeconfigRotationForShootInDeletion", ["type", "bool"]]
          - ["optionalfield", "Logging", ["type", "bool"]]
          - ["optionalfield", "AdminKubeconfigRequest", ["type", "bool"]]
          - ["optionalfield", "UseDNSRecords", ["type", "bool"]]
          - ["optionalfield", "CachedRuntimeClients", ["type", "bool"]]
          - ["optionalfield", "DenyInvalidExtensionResources", ["type", "bool"]]
          - ["optionalfield", "RotateSSHKeypairOnMaintenance", ["type", "bool"]]
          - ["optionalfield", "ShootMaxTokenExpirationOverwrite", ["type", "bool"]]
          - ["optionalfield", "ShootMaxTokenExpirationValidation", ["type", "bool"]]
          - ["optionalfield", "WorkerPoolKubernetesVersion", ["type", "bool"]]
          - ["optionalfield", "DisableDNSProviderManagement", ["type", "bool"]]
          - ["optionalfield", "SecretBindingProviderValidation", ["type", "bool"]]
      - - optionalfield
        - gardenClientConnection
        - - and
          - ["optionalfield", "qps", ["type", "int"]]
          - ["optionalfield", "burst", ["type", "int"]]
      - - optionalfield
        - seedClientConnection
        - - and
          - ["optionalfield", "qps", ["type", "int"]]
          - ["optionalfield", "burst", ["type", "int"]]
      - - optionalfield
        - shootClientConnection
        - - and
          - ["optionalfield", "qps", ["type", "int"]]
          - ["optionalfield", "burst", ["type", "int"]]
      - - optionalfield
        - imageVectorOverwrite
        - - mapfield
          - images
          - - list
            - - and
              - ["mapfield", "name"]
              - ["optionalfield", "sourceRepository"]
              - ["mapfield", "repository"]
              - ["optionalfield", "tag"]
              - ["optionalfield", "version"]
      - - optionalfield
        - componentImageVectorOverwrite
        - - mapfield
          - components
          - - list
            - - and
              - ["mapfield", "name"]
              - - mapfield
                - imageVectorOverwrite
                - - mapfield
                  - images
                  - - list
                    - - and
                      - ["mapfield", "name"]
                      - ["optionalfield", "sourceRepository"]
                      - ["mapfield", "repository"]
                      - ["optionalfield", "tag"]
                      - ["optionalfield", "version"]
      - <<: (( types.iaas[values.type].config ))
    seeds_common:
      - <<: (( &template ))
      - - mapfield
        - credentials
        - (( types.iaas[values.type].credentials ))
      - - optionalfield
        - logging
        - - and
          - ["optionalfield", "enabled", ["type", "bool"]]
      - - optionalfield
        - seedConfig
        - - and
          - - optionalfield
            - backup
            - - and
              - ["optionalfield", "active", ["type", "bool"]]
              - (( defined( values.seedConfig.backup.type ) -or defined( values.seedConfig.backup.credentials ) -or defined( values.seedConfig.backup.region ) ? validation.instantiate_validator( values.seedConfig.backup, validation.types.backup_config ) :~~ ))
          - ["optionalfield", "providerConfig", "map"]
    initial_seed:
      - <<: (( &template ))
      - and
      - ["mapfield", "mode", ["valueset", ["seed", "soil"]]]
      - <<: (( *validation.iaas_entry_validators.seeds_common ))
    seed:
      - <<: (( &template ))
      - and
      - - mapfield
        - cluster
        - - and
          - ["mapfield", "kubeconfig"]
          - - mapfield
            - networks
            - (( validation.networks ))
      - <<: (( *validation.iaas_entry_validators.seeds_common ))
    cloudprofile:
      - <<: (( &template ))
      - <<: (( types.iaas[values.type].profileConfig ))
    shooted_seed:
      - <<: (( &template ))
      - and
      - - mapfield
        - name
        - - (( validation.length_validator ))
          - 15
      - - mapfield
        - mode
        - ["valueset", ["seed", "soil"]]
      - - mapfield
        - cluster
        - - mapfield
          - networks
          - (( validation.networks types.iaas[values.type].networks ))
      - <<: (( *validation.iaas_entry_validators.seeds_common ))
  dashboard_validator:
    - and
    - - optionalfield
      - cname
      - - and
        - - mapfield
          - domain
          - - dnsdomain
        - - optionalfield
          - dns
          - - and
            - - mapfield
              - type
              - - valueset
                - (( keys( validation.types.dns ) ))
            - - mapfield
              - credentials
              - (( types.dns[landscape.dashboard.cname.dns.type].credentials || [] ))
    - - optionalfield
      - terminals
      - - and
        - - mapfield
          - active
          - - type
            - bool
        - - optionalfield
          - cert
          - - and
            - - optionalfield
              - email
              - - match
                - (( validation.email_regex ))
            - - optionalfield
              - server
            - - optionalfield
              - privateKey
              - privatekey
    - - optionalfield
      - resources
      - (( validation.resources_validator ))
  dashboard_no_seed_strategy_validator: (( |db|-> [! defined( db.frontendConfig.seedCandidateDeterminationStrategy ), "valid", "the 'frontendConfig.seedCandidateDeterminationStrategy' value for the dashboard is derived from the Gardener config and cannot be set here - set 'landscape.gardener.seedCandidateDeterminationStrategy' instead"] ))
  dashboard_terminals_validator: (( |db,cm|-> [! (( db.terminals.active || false ) -and ( cm.server.url == "self-signed" -or cm.server.url == "staging" )), "valid", "the 'dashboard terminals' feature requires trusted certificates, please configure the cert-manager accordingly"] ))
  networks:
    - and
    - ["mapfield", "nodes", "cidr"]
    - ["mapfield", "pods", "cidr"]
    - ["mapfield", "services", "cidr"]
  cert-manager_validators:
    basic:
      - and
      - - optionalfield
        - email
        - - match
          - (( validation.email_regex ))
      - - mapfield
        - server
        - - and
          - - mapfield
            - url
            - - or
              - ["valueset", ["self-signed", "staging", "live"]]
              - dnsdomain
          - - optionalfield
            - ca
            - ["and", [(( cert-manager_validators.selfsigned )), (( landscape.cert-manager.server.url ))], [(( cert-manager_validators.acme )), (( landscape.cert-manager.server.url ))]]
      - - optionalfield
        - privateKey
        - privatekey
    selfsigned: (( |ca,url|-> [url == "self-signed" ? valid( ca.crt ) -and valid( ca.key ) :true, "valid", "if 'landscape.cert-manager.server.url' is set to 'self-signed', you should either specify a CA with key ('server.ca.crt' and 'server.ca.key' set), or no CA at all ('server.ca' node not present)"] ))
    acme: (( |ca,url|-> [url != "self-signed" ? valid( ca.crt ) -and ( ! defined( ca.key ) ) :true, "if 'landscape.cert-manager.server.url' is not set to 'self-signed', you should either specify a CA without key ('server.ca.crt' set, no 'server.ca.key'), or the 'server.ca' node should not be present at all"] ))
    email: (( |ca,id|-> [valid( ca.email ) -or valid( id.users[0].email ), "either 'landscape.cert-manager.email' or 'landscape.identity.users[0].email' needs to be set"] ))
  identity_validator:
    - and
    - - optionalfield
      - users
      - - list
        - - and
          - - mapfield
            - email
            - - match
              - (( validation.email_regex ))
          - - mapfield
            - username
          - - or
            - ["mapfield", "password"]
            - ["mapfield", "hash"]
    - - optionalfield
      - connectors
      - - list
        - - and
          - ["mapfield", "type"]
          - ["mapfield", "id"]
          - ["mapfield", "name"]
    - ["optionalfield", "allowProjectCreationForAll", ["type", "bool"]]
    - ["optionalfield", "useIdentityDomain", ["type", "bool"]]

  resources_validator:                      # resource nodes are
    - map                                   # maps that contain
    - ["valueset", ["limits", "requests"]]  # the keys 'limits' or 'requests' only,
    - - map                                 # which in turn contain a map
      - - or                                # with the following keys:
        - ["valueset", ["cpu", "memory"]]   # 'cpu' or 'memory' exactly, or
        - ["match", "^hugepages-"]          # a key starting with 'hugepages-'.
      - - or                                # these maps either contain
        - ["type", "int"]                   # integers or
        - ["type", "string"]                # strings


  ### VALIDATIONS ###
  # structure resembles structure of landscape where possible
  ##### landscape.name
  name: (( validate( landscape.name, "dnslabel" ) ))
  ##### landscape.domain
  domain: (( validate( landscape.domain, "dnsdomain" ) ))
  ##### landscape.cluster.networks
  cluster:
    networks: (( validate( landscape.clusters[0].networks, validation.networks ) ))
  ##### landscape.iaas
  iaas:
    basic: (( map[landscape.iaas|entry|-> validate( entry, validation.instantiate_validator(entry, iaas_entry_validators.basic) )] ))
    initial_seed: (( validate( landscape.iaas[0], validation.instantiate_validator(landscape.iaas[0], iaas_entry_validators.initial_seed) ) ))
    seed_soil: (( map[select[landscape.iaas.[1..]|elem|-> elem.mode == "seed" -or elem.mode == "soil"]|id,entry|-> validate( entry, validation.instantiate_validator(entry, iaas_entry_validators.seed) )] ))
    cloudprofile: (( map[select[landscape.iaas landscape.iaas_shooted_seeds|elem|-> ! valid( elem.cloudprofile )]|id,entry|-> validate( entry, validation.instantiate_validator(entry, iaas_entry_validators.cloudprofile) )] ))
    shooted_seed: (( map[validation.flatten( select[select[landscape.iaas|elem|-> elem.mode == "seed" -or elem.mode == "soil"]|elem|-> valid( elem.seeds )].[*].seeds ) |entry|-> validate( entry, validation.instantiate_validator(entry, iaas_entry_validators.basic), validation.instantiate_validator(entry, iaas_entry_validators.shooted_seed) )] ))
  ##### landscape.etcd
  etcd:
    resources: (( defined( landscape.etcd.resources ) ? validate( landscape.etcd.resources, validation.resources_validator ) :~~ ))
    backup_active: (( validate( landscape.etcd.backup.active, ["type", "bool"] ) ))
    backup: (( landscape.etcd.backup.active == true ? validate( landscape.etcd.backup, [ "and", validation.instantiate_validator( landscape.etcd.backup, validation.types.backup_config ), validation.types.etcd_backup[landscape.etcd.backup.type].config ] ) :~~ ))
  ##### landscape.dns
  dns:
    type: (( validate( landscape.dns, ["mapfield", "type", ["valueset", keys( types.dns )]] ) ))
    hostedZoneIDs: (( validate( landscape.dns, ["optionalfield", "hostedZoneIDs", ["map", ["valueset", ["include", "exclude"]], "list"]] ) ))
    provider_config: (( validate( landscape.dns, types.dns[landscape.dns.type].config ) ))
    credentials: (( validate( landscape.dns, ["mapfield", "credentials", types.dns[landscape.dns.type].credentials] ) ))
  ##### landscape.gardener
  gardener:
    resources:
      apiserver: (( defined( landscape.gardener.resources.apiserver ) ? validate( landscape.gardener.resources.apiserver, validation.resources_validator ) :~~ ))
      admission: (( defined( landscape.gardener.resources.admission ) ? validate( landscape.gardener.resources.admission, validation.resources_validator ) :~~ ))
      controller: (( defined( landscape.gardener.resources.controller ) ? validate( landscape.gardener.resources.controller, validation.resources_validator ) :~~ ))
      scheduler: (( defined( landscape.gardener.resources.scheduler ) ? validate( landscape.gardener.resources.scheduler, validation.resources_validator ) :~~ ))
    seedCandidateDeterminationStrategy: (( defined( landscape.gardener.seedCandidateDeterminationStrategy ) ? validate( landscape.gardener, ["optionalfield", "seedCandidateDeterminationStrategy", ["valueset", ["SameRegion", "MinimalDistance"]]] ) :~~ ))
    network-policies: (( defined( landscape.gardener.network-policies ) ? validate( landscape.gardener.network-policies, ["optionalfield", "active", ["type", "bool"]] ) :~~ ))
    extensions: (( defined( landscape.gardener.extensions ) ? validate( keys( landscape.gardener.extensions ), ["list", ["valueset", keys( landscape.versions.gardener.extensions )]] ) :~~ ))
    shootDomainPrefix: (( defined( landscape.gardener.shootDomainPrefix ) ? validate( landscape.gardener, ["optionalfield", "shootDomainPrefix", "dnslabel"] ) :~~ ))
  ##### landscape.dashboard
  dashboard: (( defined( landscape.dashboard ) ? validate( landscape.dashboard, validation.dashboard_validator, validation.dashboard_no_seed_strategy_validator, [validation.dashboard_terminals_validator, landscape.cert-manager] ) :~~ ))
  ##### landscape.certmanager
  cert-manager: (( validate( landscape.cert-manager, validation.cert-manager_validators.basic, [validation.cert-manager_validators.email, landscape.identity] ) ))
  ##### landscape.identity TODO
  identity:
    identityspec: (( |id|-> [valid( id.users || id.connectors ), "valid", "identity config needs to contain either 'users' or 'connectors' (or both)"] ))
    validator: (( validate( landscape.identity, identityspec, validation.identity_validator ) ))