merge(cloud): embed argo gitops-engine under /v1/deploy — reconcile + RED HIGH-1 prune fuse (inert: DEPLOY_ENGINE_ENABLED off)

This commit is contained in:
z
2026-07-18 11:27:44 -07:00
committed by GitHub
5 changed files with 569 additions and 34 deletions
+3
View File
@@ -150,6 +150,9 @@ func routes(app *zip.App, s *cloud.Service[state]) {
app.Get("/v1/deploy/:name/logs", guard(s, cloud.Handle(s, appLogs)))
app.Post("/v1/deploy/:name/rollback", guard(s, cloud.Handle(s, rollback)))
app.Post("/v1/deploy/:name/sync", guard(s, cloud.Handle(s, sync)))
// Engine (write) routes — the embedded gitops-engine reconcile that replaces
// universe-crs. Gated by DEPLOY_ENGINE_ENABLED; see engine_mount.go.
registerEngineRoutes(app, s)
}
// guard wraps a handler with the SuperAdmin gate (fail-closed: a non-SuperAdmin is
+282
View File
@@ -0,0 +1,282 @@
// engine.go embeds the argo gitops-engine (github.com/hanzoai/deploy/
// gitops-engine, the fork's independently-importable submodule) in-process, so
// the cloud binary reconciles git → cluster the way the retired argocd
// application-controller did — three-way merge (server-side apply), scoped
// prune, drift-correction, health, sync status — with NO separate argocd
// process and NO redis. It is the write/reconcile half of /v1/deploy; the
// existing routes are the read/visualize half.
//
// The apply-set is scoped by a tracking LABEL (deploy.hanzo.ai/instance): the
// isManaged predicate that drives pruning returns true ONLY for live objects
// carrying THIS instance's label, so a prune can never delete an App CR (or any
// object) this plane did not create. This is the prune-safety boundary for the
// 60+ live App CRs — the exact property universe-crs enforced with prune:false,
// kept here and made explicit.
//
// Enablement is opt-in and fail-safe (DEPLOY_ENGINE_ENABLED, default off): the
// first deploy of this binary is inert for the reconcile path, so it ships
// dark and is turned on deliberately after the shadow proof — mirroring the
// operator's gate discipline and the argocd shadow-then-flip cutover.
package deploy
import (
"context"
"fmt"
"os"
"os/exec"
"path/filepath"
"strings"
"github.com/go-logr/logr"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
"k8s.io/client-go/rest"
"github.com/hanzoai/deploy/gitops-engine/pkg/cache"
"github.com/hanzoai/deploy/gitops-engine/pkg/engine"
enginehealth "github.com/hanzoai/deploy/gitops-engine/pkg/health"
enginesync "github.com/hanzoai/deploy/gitops-engine/pkg/sync"
synccommon "github.com/hanzoai/deploy/gitops-engine/pkg/sync/common"
"github.com/hanzoai/deploy/gitops-engine/pkg/utils/kube"
)
// engineTrackingLabel scopes an apply-set. Every object the engine declares
// carries deploy.hanzo.ai/instance=<instance>; pruning only ever considers live
// objects with THIS value.
const engineTrackingLabel = "deploy.hanzo.ai/instance"
// engineFieldManager is the server-side-apply manager for git-sourced applies —
// distinct from the operator's own `hanzo-operator` manager, so a delivery apply
// is attributable and never silently fights a per-Kind reconcile.
const engineFieldManager = "hanzo-deploy"
// engineResInfo is cached per live resource; `tracked` records whether the
// object carries THIS instance's tracking label (the prune predicate).
type engineResInfo struct{ tracked bool }
// reconciler embeds the argo gitops-engine over one apply-set (one git source,
// one tracking-label instance) across a fixed set of namespaces.
type reconciler struct {
instance string
namespaces []string
log logr.Logger
cache cache.ClusterCache
engine engine.GitOpsEngine
}
// newReconciler builds an engine-backed reconciler. `namespaces` is the platform
// tier the engine watches (empty = all); `instance` tags this apply-set.
func newReconciler(cfg *rest.Config, namespaces []string, instance string, log logr.Logger) *reconciler {
cc := cache.NewClusterCache(cfg,
cache.SetNamespaces(namespaces),
cache.SetLogr(log),
cache.SetPopulateResourceInfoHandler(func(un *unstructured.Unstructured, _ bool) (any, bool) {
v := un.GetLabels()[engineTrackingLabel]
return &engineResInfo{tracked: v == instance}, v != ""
}),
)
return &reconciler{
instance: instance,
namespaces: namespaces,
log: log,
cache: cc,
engine: engine.NewEngine(cfg, cc, engine.WithLogr(log)),
}
}
// run starts the cluster informer cache; the returned StopFunc tears it down.
func (r *reconciler) run() (engine.StopFunc, error) { return r.engine.Run() }
// stamp puts the tracking label on every desired object so an applied object is
// cached as managed by THIS instance.
func (r *reconciler) stamp(objs []*unstructured.Unstructured) {
for _, o := range objs {
l := o.GetLabels()
if l == nil {
l = map[string]string{}
}
l[engineTrackingLabel] = r.instance
o.SetLabels(l)
}
}
// PruneFuse bounds how much a single reconcile may delete — the circuit breaker
// against a silent empty/partial render sweeping the fleet. Both limits are
// checked; either one trips the fuse. Zero disables that check.
type PruneFuse struct {
MaxDeletions int // absolute cap on objects pruned in one reconcile
MaxRatio float64 // cap as a fraction of the managed set (0..1)
}
// isProtectedKind is the data-anchor exclusion: PersistentVolumeClaim (delete =
// irreversible data loss) and KMSSecret (kms.hanzo.ai) are NEVER prune
// candidates, even when absent from the desired set. They are still applied
// (target side); they are only removed from the prune decision.
func isProtectedKind(group, kind string) bool {
if group == "" && kind == "PersistentVolumeClaim" {
return true
}
if kind == "KMSSecret" {
return true
}
return false
}
// managed is the prune predicate: an object is a prune candidate only if it
// carries THIS instance's tracking label AND is not a protected data anchor.
func (r *reconciler) managed(res *cache.Resource) bool {
ri, ok := res.Info.(*engineResInfo)
if !ok || !ri.tracked {
return false
}
k := res.ResourceKey()
return !isProtectedKind(k.Group, k.Kind)
}
// reconcile syncs `target` → cluster at `revision`. With prune, a live object
// carrying THIS instance's tracking label but absent from `target` is deleted —
// UNLESS it is a protected data anchor (PVC/KMSSecret) or the PruneFuse trips.
// An UNTRACKED object is never touched.
//
// Prune safety (RED HIGH-1), all enforced here:
// - refuse an EMPTY desired set (a silent target=[] would sweep everything);
// - pre-flight DRY-RUN sizes the prune set before any deletion;
// - the PruneFuse caps the prune set by count and by ratio;
// - protected data anchors (PVC/KMSSecret) are excluded from prune entirely.
func (r *reconciler) reconcile(ctx context.Context, target []*unstructured.Unstructured, revision, defaultNS string, prune bool, fuse PruneFuse) ([]synccommon.ResourceSyncResult, error) {
// (i) Never reconcile nothing — an empty render must not delete the fleet.
if len(target) == 0 {
return nil, fmt.Errorf("prune fuse: refusing to reconcile an empty desired set (render produced 0 objects)")
}
r.stamp(target)
if prune {
// (ii)/(iii) Size the prune set with a dry-run BEFORE any deletion, then
// apply the fuse. A partial render that would prune most of the fleet is
// refused here, before a single object is removed.
dry, err := r.engine.Sync(ctx, target, r.managed, revision, defaultNS,
enginesync.WithOperationSettings(true /*dryRun*/, true /*prune*/, false, false),
enginesync.WithLogr(r.log))
if err != nil {
return nil, fmt.Errorf("prune fuse dry-run: %w", err)
}
pruneN, managedN := 0, 0
for _, rr := range dry {
managedN++
if rr.Status == synccommon.ResultCodePruned {
pruneN++
}
}
if fuse.MaxDeletions > 0 && pruneN > fuse.MaxDeletions {
return nil, fmt.Errorf("prune fuse tripped: reconcile would prune %d object(s) (> max %d); refusing — fix the git source or raise DEPLOY_ENGINE_PRUNE_MAX", pruneN, fuse.MaxDeletions)
}
if fuse.MaxRatio > 0 && managedN > 0 && float64(pruneN)/float64(managedN) > fuse.MaxRatio {
return nil, fmt.Errorf("prune fuse tripped: reconcile would prune %d/%d managed (> %.0f%%); refusing", pruneN, managedN, fuse.MaxRatio*100)
}
}
return r.engine.Sync(ctx, target, r.managed, revision, defaultNS,
enginesync.WithPrune(prune),
enginesync.WithPruneConfirmed(prune), // prune only after the fuse above confirms it
enginesync.WithServerSideApply(true),
enginesync.WithServerSideApplyManager(engineFieldManager),
enginesync.WithLogr(r.log),
)
}
// resourceHealth assesses one live object with the engine's built-in per-GVK
// checks — the SAME health library the ArgoCD dashboard uses.
func engineResourceHealth(un *unstructured.Unstructured) (*enginehealth.HealthStatus, error) {
return enginehealth.GetResourceHealth(un, nil)
}
// gitSource is the desired-state source: a shallow clone of repo@ref, from which
// `path` is rendered into the manifest set. It shells the `git` CLI — the same
// mechanism clients/git and the operator use — so there is ONE git strategy and
// no vendored transport. The revision is the cloned HEAD sha.
type gitSource struct {
repo string // https URL or local path
ref string // branch/tag/sha
path string // repo-relative dir of CR manifests
}
// render shallow-clones and parses the source into (objects, revision). The
// clone dir is removed before return.
func (g gitSource) render(ctx context.Context) ([]*unstructured.Unstructured, string, error) {
dir, err := os.MkdirTemp("", "deploy-src-")
if err != nil {
return nil, "", fmt.Errorf("workdir: %w", err)
}
defer os.RemoveAll(dir)
clone := exec.CommandContext(ctx, "git", "clone", "--depth", "1", "--single-branch", "--branch", g.ref, g.repo, dir)
clone.Env = hardenedGitEnv()
if out, err := clone.CombinedOutput(); err != nil {
return nil, "", fmt.Errorf("git clone: %v: %s", err, strings.TrimSpace(string(out)))
}
rev := exec.CommandContext(ctx, "git", "-C", dir, "rev-parse", "--short", "HEAD")
rev.Env = hardenedGitEnv()
revBytes, err := rev.Output()
if err != nil {
return nil, "", fmt.Errorf("git rev-parse: %w", err)
}
revision := strings.TrimSpace(string(revBytes))
objs, err := parseManifestDir(filepath.Join(dir, g.path))
if err != nil {
return nil, "", err
}
return objs, revision, nil
}
// parseManifestDir walks dir RECURSIVELY and splits every *.yaml/*.yml/*.json
// into typed objects, skipping kustomization inputs. Recursive on purpose (RED
// HIGH-1 (v)): a non-recursive read silently drops manifests in subdirectories,
// which — combined with prune — would delete the objects those nested files
// declare. Walking every subdir means the desired set is complete, so prune
// never mistakes a nested-but-present object for a removed one.
func parseManifestDir(dir string) ([]*unstructured.Unstructured, error) {
var objs []*unstructured.Unstructured
err := filepath.WalkDir(dir, func(path string, d os.DirEntry, err error) error {
if err != nil {
return err
}
if d.IsDir() {
return nil
}
name := d.Name()
if name == "kustomization.yaml" || name == "kustomization.yml" {
return nil
}
ext := strings.ToLower(filepath.Ext(name))
if ext != ".yaml" && ext != ".yml" && ext != ".json" {
return nil
}
data, err := os.ReadFile(path)
if err != nil {
return fmt.Errorf("read %s: %w", path, err)
}
items, err := kube.SplitYAML(data)
if err != nil {
return fmt.Errorf("parse %s: %w", path, err)
}
objs = append(objs, items...)
return nil
})
if err != nil {
return nil, fmt.Errorf("walk manifest dir %s: %w", dir, err)
}
return objs, nil
}
// hardenedGitEnv is the minimal, credential-free git environment: no interactive
// prompt, no ambient user/system config, no inherited secrets.
func hardenedGitEnv() []string {
return []string{
"GIT_TERMINAL_PROMPT=0",
"GIT_CONFIG_GLOBAL=/dev/null",
"GIT_CONFIG_SYSTEM=/dev/null",
"HOME=" + os.TempDir(),
"PATH=" + os.Getenv("PATH"),
}
}
+160
View File
@@ -0,0 +1,160 @@
// engine_mount.go wires the embedded gitops-engine (engine.go) into the
// /v1/deploy surface: a SuperAdmin-gated, one-shot reconcile endpoint that
// renders the configured git source and syncs it → cluster. This is the write
// half of /v1/deploy that replaces the retired universe-crs Application — the
// operator still renders each App CR into workloads (the domain half).
//
// Fail-safe: the whole path is gated by DEPLOY_ENGINE_ENABLED (default off), so
// the first deploy of this binary is inert and the engine is turned on
// deliberately after the shadow proof.
package deploy
import (
"net/http"
"os"
"strconv"
"time"
"github.com/go-logr/logr"
"github.com/hanzoai/cloud"
"github.com/zap-proto/zip"
"k8s.io/client-go/rest"
"k8s.io/client-go/tools/clientcmd"
synccommon "github.com/hanzoai/deploy/gitops-engine/pkg/sync/common"
)
// Engine config — all optional; defaults target the live universe manifest repo
// (the exact source universe-crs syncs). Configure only what must vary.
func engineEnabled() bool { return os.Getenv("DEPLOY_ENGINE_ENABLED") == "true" }
func enginePrune() bool { return os.Getenv("DEPLOY_ENGINE_PRUNE") == "true" }
// pruneFuse bounds a single reconcile's deletions (RED HIGH-1). Conservative
// defaults: at most 10 objects OR 20% of the managed set, whichever is smaller,
// unless explicitly raised. A silent empty/partial render trips the fuse instead
// of sweeping the fleet.
func pruneFuse() PruneFuse {
return PruneFuse{
MaxDeletions: envInt("DEPLOY_ENGINE_PRUNE_MAX", 10),
MaxRatio: envFloat("DEPLOY_ENGINE_PRUNE_MAX_RATIO", 0.20),
}
}
func envInt(k string, d int) int {
if v := os.Getenv(k); v != "" {
if n, err := strconv.Atoi(v); err == nil {
return n
}
}
return d
}
func envFloat(k string, d float64) float64 {
if v := os.Getenv(k); v != "" {
if f, err := strconv.ParseFloat(v, 64); err == nil {
return f
}
}
return d
}
func engineRepo() string { return envOr("DEPLOY_ENGINE_REPO", "https://github.com/hanzoai/universe") }
func engineRef() string { return envOr("DEPLOY_ENGINE_REF", "main") }
func enginePath() string { return envOr("DEPLOY_ENGINE_PATH", "infra/k8s/operator/crs") }
func engineInstance() string { return envOr("DEPLOY_ENGINE_INSTANCE", "universe") }
func engineDefaultNS() string { return envOr("DEPLOY_ENGINE_NAMESPACE", "hanzo") }
func envOr(k, d string) string {
if v := os.Getenv(k); v != "" {
return v
}
return d
}
// registerEngineRoutes adds the engine (write) routes alongside the existing
// read/visualize routes. Called from routes() in deploy.go.
func registerEngineRoutes(app *zip.App, s *cloud.Service[state]) {
app.Post("/v1/deploy/reconcile", guard(s, cloud.Handle(s, engineReconcile)))
}
// engineReconcile is POST /v1/deploy/reconcile — a SuperAdmin-gated, one-shot
// engine sync: render the configured git source and reconcile it → cluster via
// the embedded gitops-engine (three-way server-side apply, scoped prune,
// per-resource health). The write half that replaces universe-crs.
func engineReconcile(s *cloud.Service[state], c *zip.Ctx) error {
if !engineEnabled() {
return zip.Errorf(http.StatusServiceUnavailable, "deploy engine disabled (set DEPLOY_ENGINE_ENABLED=true)")
}
cfg, err := engineRestConfig()
if err != nil {
return zip.Errorf(http.StatusServiceUnavailable, "engine: kube config: %v", err)
}
ctx := c.Context()
rec := newReconciler(cfg, []string{engineDefaultNS()}, engineInstance(), logr.Discard())
stop, err := rec.run()
if err != nil {
return zip.Errorf(http.StatusBadGateway, "engine start: %v", err)
}
defer stop()
// Let the informer cache warm before the first sync so live state is known.
time.Sleep(2 * time.Second)
objs, revision, err := gitSource{repo: engineRepo(), ref: engineRef(), path: enginePath()}.render(ctx)
if err != nil {
return zip.Errorf(http.StatusBadGateway, "engine: render git source: %v", err)
}
results, err := rec.reconcile(ctx, objs, revision, engineDefaultNS(), enginePrune(), pruneFuse())
if err != nil {
return zip.Errorf(http.StatusBadGateway, "engine: sync: %v", err)
}
synced, pruned, failed := 0, 0, 0
items := make([]map[string]any, 0, len(results))
for _, rr := range results {
switch rr.Status {
case synccommon.ResultCodeSynced:
synced++
case synccommon.ResultCodePruned:
pruned++
case synccommon.ResultCodeSyncFailed:
failed++
}
items = append(items, map[string]any{
"resource": rr.ResourceKey.String(),
"status": string(rr.Status),
"message": rr.Message,
})
}
s.Log.Info("deploy engine reconcile", "revision", revision, "objects", len(objs),
"synced", synced, "pruned", pruned, "failed", failed, "prune", enginePrune())
return c.JSON(http.StatusOK, map[string]any{
"revision": revision,
"source": map[string]any{"repo": engineRepo(), "ref": engineRef(), "path": enginePath()},
"instance": engineInstance(),
"prune": enginePrune(),
"declared": len(objs),
"synced": synced,
"pruned": pruned,
"failed": failed,
"results": items,
})
}
// engineRestConfig builds a rest.Config from the in-cluster service account,
// falling back to KUBECONFIG for local/dev — the SAME construction as
// newClients() (deploy.go), so the engine talks to the same cluster.
func engineRestConfig() (*rest.Config, error) {
cfg, err := rest.InClusterConfig()
if err != nil {
cc := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(
clientcmd.NewDefaultClientConfigLoadingRules(), &clientcmd.ConfigOverrides{})
cfg, err = cc.ClientConfig()
if err != nil {
return nil, err
}
}
cfg.UserAgent = userAgent
return cfg, nil
}
+68 -13
View File
@@ -66,12 +66,17 @@ require (
require (
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
github.com/MakeNowJust/heredoc v1.0.0 // indirect
github.com/beego/beego v1.12.14 // indirect
github.com/chai2010/gettext-go v1.0.3 // indirect
github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 // indirect
github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
github.com/docker/cli v29.5.3+incompatible // indirect
github.com/docker/docker-credential-helpers v0.9.3 // indirect
github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
github.com/fatih/camelcase v1.0.0 // indirect
github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
github.com/hanzo-ds/mock v0.14.4 // indirect
github.com/hanzo-ds/sqlbuilder v1.42.2 // indirect
github.com/hanzo-ds/sqlparser v0.4.16 // indirect
@@ -79,18 +84,28 @@ require (
github.com/hanzoai/go-cosyvoice v1.0.0 // indirect
github.com/hanzoai/go-openai-realtime v1.0.0 // indirect
github.com/hanzoai/go-openai-realtime/contrib/ws-gorilla v1.0.0 // indirect
github.com/luxfi/go-bip32 v1.1.0 // indirect
github.com/luxfi/go-bip39 v1.2.0 // indirect
github.com/luxfi/protocol v0.0.2 // indirect
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
github.com/mattetti/filebuffer v1.0.1 // indirect
github.com/minio/minio-go/v7 v7.0.100 // indirect
github.com/mitchellh/go-wordwrap v1.0.1 // indirect
github.com/moby/term v0.5.2 // indirect
github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect
github.com/sendgrid/sendgrid-go v3.16.1+incompatible // indirect
k8s.io/apiserver v0.35.3 // indirect
k8s.io/cli-runtime v0.35.3 // indirect
k8s.io/component-base v0.35.3 // indirect
k8s.io/component-helpers v0.35.3 // indirect
k8s.io/controller-manager v0.34.0 // indirect
k8s.io/kube-aggregator v0.34.0 // indirect
k8s.io/kubectl v0.34.0 // indirect
rsc.io/qr v0.2.0 // indirect
)
require (
github.com/google/go-github/v84 v84.0.0 // indirect
github.com/hanzoai/captable v1.0.0
github.com/luxfi/keys v1.4.1 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
)
@@ -349,7 +364,6 @@ require (
github.com/bytedance/sonic v1.15.2 // indirect
github.com/bytedance/sonic/loader v0.5.1 // indirect
github.com/caarlos0/go-reddit/v3 v3.0.1 // indirect
github.com/carapace-sh/carapace-shlex v1.0.1 // indirect
github.com/carmel/gooxml v0.0.0-20220216072414-40ff56130850 // indirect
github.com/cenkalti/backoff v2.2.1+incompatible // indirect
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
@@ -420,7 +434,7 @@ require (
github.com/go-acme/alidns-20150109/v4 v4.7.0 // indirect
github.com/go-acme/lego/v4 v4.34.0 // indirect
github.com/go-asn1-ber/asn1-ber v1.5.8 // indirect
github.com/go-errors/errors v1.4.2 // indirect
github.com/go-errors/errors v1.5.1 // indirect
github.com/go-faster/city v1.0.1 // indirect
github.com/go-faster/errors v0.7.1 // indirect
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
@@ -430,7 +444,7 @@ require (
github.com/go-jose/go-jose/v4 v4.1.4
github.com/go-lark/lark v1.15.1 // indirect
github.com/go-ldap/ldap/v3 v3.4.14 // indirect
github.com/go-logr/logr v1.4.3 // indirect
github.com/go-logr/logr v1.4.3
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-ole/go-ole v1.3.0 // indirect
github.com/go-openapi/analysis v0.24.2 // indirect
@@ -594,7 +608,7 @@ require (
github.com/luxfi/fhe v1.8.2 // indirect
github.com/luxfi/geth v1.20.1
github.com/luxfi/ids v1.3.2 // indirect
github.com/luxfi/kms v1.12.4
github.com/luxfi/kms v1.11.8
github.com/luxfi/lattice/v7 v7.1.4 // indirect
github.com/luxfi/lens v0.2.1 // indirect
github.com/luxfi/magnetar v1.2.3 // indirect
@@ -804,7 +818,7 @@ require (
k8s.io/api v0.35.3
k8s.io/klog/v2 v2.140.0 // indirect
k8s.io/kube-openapi v0.0.0-20260330154417-16be699c7b31 // indirect
k8s.io/metrics v0.30.0 // indirect
k8s.io/metrics v0.35.3 // indirect
k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 // indirect
layeh.com/radius v0.0.0-20231213012653-1006025d24f8 // indirect
maunium.net/go/mautrix v0.22.1 // indirect
@@ -813,8 +827,8 @@ require (
modernc.org/memory v1.11.0 // indirect
rsc.io/binaryregexp v0.2.0 // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
sigs.k8s.io/kustomize/api v0.20.0 // indirect
sigs.k8s.io/kustomize/kyaml v0.20.0 // indirect
sigs.k8s.io/kustomize/api v0.20.1 // indirect
sigs.k8s.io/kustomize/kyaml v0.20.1 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
sigs.k8s.io/yaml v1.6.0
@@ -824,7 +838,7 @@ require (
github.com/andybalholm/brotli v1.2.1 // indirect
github.com/gofiber/schema v1.7.1 // indirect
github.com/gofiber/utils/v2 v2.0.4 // indirect
github.com/google/uuid v1.6.0
github.com/google/uuid v1.6.1-0.20241114170450-2d3c2a9cc518
github.com/hanzo-ds/go v1.0.1
github.com/hanzo-ds/native v0.72.0 // indirect
github.com/hanzoai/agent v0.1.3
@@ -834,9 +848,9 @@ require (
github.com/hanzoai/licensing v0.1.5
github.com/hanzoai/metrics v1.110.2
github.com/hanzoai/o11y v1.5.28
github.com/hanzoai/thinking v0.1.1 // indirect
github.com/hanzoai/thinking v0.1.0 // indirect
github.com/hanzoai/vfs v0.6.4
github.com/hanzoai/zen v1.4.1
github.com/hanzoai/zen v1.4.0
github.com/klauspost/compress v1.18.6 // indirect
github.com/mattn/go-colorable v0.1.15 // indirect
github.com/mattn/go-isatty v0.0.22 // indirect
@@ -870,3 +884,44 @@ replace github.com/vulcand/oxy/v2 => github.com/traefik/oxy/v2 v2.0.0-2026012609
replace github.com/krakend/krakend-otel => github.com/hanzoai/krakend-otel v0.13.1
exclude github.com/ugorji/go v0.0.0-20171122102828-84cb69a8af83
// --- /v1/deploy engine embed (argo gitops-engine, in-process) ---
require (
github.com/hanzoai/deploy/gitops-engine v0.7.2
k8s.io/kubernetes v1.35.3 // indirect
)
// gitops-engine drags the k8s.io/kubernetes staging tree via pkg/utils/kube.
// Pin EVERY staging module to cloud's k8s line (0.35.3) so embedding the engine
// does NOT move the money binary's k8s stack. Proven to build at 0.35.3.
replace (
k8s.io/apiserver => k8s.io/apiserver v0.35.3
k8s.io/cli-runtime => k8s.io/cli-runtime v0.35.3
k8s.io/cloud-provider => k8s.io/cloud-provider v0.35.3
k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.35.3
k8s.io/code-generator => k8s.io/code-generator v0.35.3
k8s.io/component-base => k8s.io/component-base v0.35.3
k8s.io/component-helpers => k8s.io/component-helpers v0.35.3
k8s.io/controller-manager => k8s.io/controller-manager v0.35.3
k8s.io/cri-api => k8s.io/cri-api v0.35.3
k8s.io/cri-client => k8s.io/cri-client v0.35.3
k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.35.3
k8s.io/dynamic-resource-allocation => k8s.io/dynamic-resource-allocation v0.35.3
k8s.io/endpointslice => k8s.io/endpointslice v0.35.3
k8s.io/externaljwt => k8s.io/externaljwt v0.35.3
k8s.io/kms => k8s.io/kms v0.35.3
k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.35.3
k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.35.3
k8s.io/kube-proxy => k8s.io/kube-proxy v0.35.3
k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.35.3
k8s.io/kubectl => k8s.io/kubectl v0.35.3
k8s.io/kubelet => k8s.io/kubelet v0.35.3
k8s.io/kubernetes => k8s.io/kubernetes v1.35.3
k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.35.3
k8s.io/metrics => k8s.io/metrics v0.35.3
k8s.io/mount-utils => k8s.io/mount-utils v0.35.3
k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.35.3
k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.35.3
k8s.io/sample-cli-plugin => k8s.io/sample-cli-plugin v0.35.3
k8s.io/sample-controller => k8s.io/sample-controller v0.35.3
)
+56 -21
View File
@@ -174,6 +174,8 @@ github.com/Knetic/govaluate v3.0.0+incompatible/go.mod h1:r7JcOSlj0wfOMncg0iLm8L
github.com/Knetic/govaluate v3.0.1-0.20171022003610-9aa49832a739+incompatible/go.mod h1:r7JcOSlj0wfOMncg0iLm8Leh48TZaKVeNIfJntJ2wa0=
github.com/Machiel/slugify v1.0.1 h1:EfWSlRWstMadsgzmiV7d0yVd2IFlagWH68Q+DcYCm4E=
github.com/Machiel/slugify v1.0.1/go.mod h1:fTFGn5uWEynW4CUMG7sWkYXOf1UgDxyTM3DbR6Qfg3k=
github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
@@ -499,8 +501,6 @@ github.com/bytedance/sonic/loader v0.5.1/go.mod h1:AR4NYCk5DdzZizZ5djGqQ92eEhCCc
github.com/caarlos0/go-reddit/v3 v3.0.1 h1:w8ugvsrHhaE/m4ez0BO/sTBOBWI9WZTjG7VTecHnql4=
github.com/caarlos0/go-reddit/v3 v3.0.1/go.mod h1:QlwgmG5SAqxMeQvg/A2dD1x9cIZCO56BMnMdjXLoisI=
github.com/cactus/go-statsd-client/statsd v0.0.0-20200423205355-cb0885a1018c/go.mod h1:l/bIBLeOl9eX+wxJAzxS4TveKRtAqlyDpHjhkfO0MEI=
github.com/carapace-sh/carapace-shlex v1.0.1 h1:ww0JCgWpOVuqWG7k3724pJ18Lq8gh5pHQs9j3ojUs1c=
github.com/carapace-sh/carapace-shlex v1.0.1/go.mod h1:lJ4ZsdxytE0wHJ8Ta9S7Qq0XpjgjU0mdfCqiI2FHx7M=
github.com/carmel/gooxml v0.0.0-20220216072414-40ff56130850 h1:5HOeLYzNkwXRWppRFonU+3ecOq+PjLvnwpAaTSdvsNs=
github.com/carmel/gooxml v0.0.0-20220216072414-40ff56130850/go.mod h1:2u6ODG4PzDELX8qnX0wOGCdPJpWxnC5hBM7542SFrYc=
github.com/casbin/casbin v1.7.0/go.mod h1:c67qKN6Oum3UF5Q1+BByfFxkwKvhwW57ITjqwtzR1KE=
@@ -523,6 +523,8 @@ github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
github.com/chai2010/gettext-go v1.0.3 h1:9liNh8t+u26xl5ddmWLmsOsdNLwkdRTg5AG+JnTiM80=
github.com/chai2010/gettext-go v1.0.3/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA=
github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
@@ -604,6 +606,8 @@ github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6N
github.com/crate-crypto/go-eth-kzg v1.5.0 h1:FYRiJMJG2iv+2Dy3fi14SVGjcPteZ5HAAUe4YWlJygc=
github.com/crate-crypto/go-eth-kzg v1.5.0/go.mod h1:J9/u5sWfznSObptgfa92Jq8rTswn6ahQWEuiLHOjCUI=
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
github.com/cronokirby/saferith v0.33.0 h1:TgoQlfsD4LIwx71+ChfRcIpjkw+RPOapDEVxa+LhwLo=
github.com/cronokirby/saferith v0.33.0/go.mod h1:QKJhjoqUtBsXCAVEjw38mFqoi7DebT7kthcD7UzbnoA=
github.com/cschomburg/go-pushbullet v0.0.0-20171206132031-67759df45fbb h1:7X9nrm+LNWdxzQOiCjy0G51rNUxbH35IDHCjAMvogyM=
@@ -748,18 +752,22 @@ github.com/ethereum/c-kzg-4844/v2 v2.1.7 h1:aat3CuITdDbPC6pmEGRT0zJ5eOxzrZj8TJT5
github.com/ethereum/c-kzg-4844/v2 v2.1.7/go.mod h1:8HMkUZ5JRv4hpw/XUrYWSQNAUzhHMg2UDb/U+5m+XNw=
github.com/ethereum/go-bigmodexpfix v0.0.0-20250911101455-f9e208c548ab h1:rvv6MJhy07IMfEKuARQ9TKojGqLVNxQajaXEp/BoqSk=
github.com/ethereum/go-bigmodexpfix v0.0.0-20250911101455-f9e208c548ab/go.mod h1:IuLm4IsPipXKF7CW5Lzf68PIbZ5yl7FFd74l/E0o9A8=
github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH5pOlLGNtQ5lPWQu84=
github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
github.com/evanphx/json-patch v0.5.2 h1:xVCHIVMUu1wtM/VkR9jVZ45N3FhZfYMMYGorLCR8P3k=
github.com/evanphx/json-patch v0.5.2/go.mod h1:ZWS5hhDbVDyob71nXKNL0+PWn6ToqBHMikGIFbs31qQ=
github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
github.com/evanw/esbuild v0.28.1 h1:ds+yuRyUaZGx++GR56CrCeuXh8PVhVM4xq8v7PNELFc=
github.com/evanw/esbuild v0.28.1/go.mod h1:D2vIQZqV/vIf/VRHtViaUtViZmG7o+kKmlBfVQuRi48=
github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f h1:Wl78ApPPB2Wvf/TIe2xdyJxTlb6obmF18d8QdkxNDu4=
github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f/go.mod h1:OSYXu++VVOHnXeitef/D8n/6y4QV8uLHSFXX4NeXMGc=
github.com/expr-lang/expr v1.17.7 h1:Q0xY/e/2aCIp8g9s/LGvMDCC5PxYlvHgDZRQ4y16JX8=
github.com/expr-lang/expr v1.17.7/go.mod h1:8/vRC7+7HBzESEqt5kKpYXxrxkr31SaO8r40VO/1IT4=
github.com/facette/natsort v0.0.0-20181210072756-2cd4dd1e2dcb h1:IT4JYU7k4ikYg1SCxNI1/Tieq/NFvh6dzLdgi7eu0tM=
github.com/facette/natsort v0.0.0-20181210072756-2cd4dd1e2dcb/go.mod h1:bH6Xx7IW64qjjJq8M2u4dxNaBiDfKK+z/3eGDpXEQhc=
github.com/fasthttp/websocket v1.5.12 h1:e4RGPpWW2HTbL3zV0Y/t7g0ub294LkiuXXUuTOUInlE=
github.com/fasthttp/websocket v1.5.12/go.mod h1:I+liyL7/4moHojiOgUOIKEWm9EIxHqxZChS+aMFltyg=
github.com/fatih/camelcase v1.0.0 h1:hxNvNX/xYBp0ovncs8WyWZrOrpBNub/JfaMvbURyft8=
github.com/fatih/camelcase v1.0.0/go.mod h1:yN2Sb0lFhZJUdVvtELVWefmrXpuZESvPmqwoZc+/fpc=
github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
@@ -819,8 +827,8 @@ github.com/go-acme/lego/v4 v4.34.0 h1:oRsIuPJ4ORX7ufviXvelUpBSez2XxeKGwo5pNG9BVe
github.com/go-acme/lego/v4 v4.34.0/go.mod h1:gsmdlx/ZS6OUeXbOj0U+VnCLLfEFj4WCYRkcGpZw+pc=
github.com/go-asn1-ber/asn1-ber v1.5.8 h1:H9AZkK22UOmfX8J84ubyaZxKJZ3FMHVwn8swoMML7iQ=
github.com/go-asn1-ber/asn1-ber v1.5.8/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
github.com/go-faster/city v1.0.1 h1:4WAxSZ3V2Ws4QRDrscLEDcibJY8uf41H6AhXDrNDcGw=
github.com/go-faster/city v1.0.1/go.mod h1:jKcUJId49qdW3L1qKHH/3wPeUstCVpVSXTM6vO3VcTw=
github.com/go-faster/errors v0.7.1 h1:MkJTnDoEdi9pDabt1dpWf7AA8/BaSYZqibYyhZ20AYg=
@@ -1119,8 +1127,8 @@ github.com/google/uuid v0.0.0-20171113160352-8c31c18f31ed/go.mod h1:TIyPZe4Mgqvf
github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/google/uuid v1.6.1-0.20241114170450-2d3c2a9cc518 h1:UBg1xk+oAsIVbFuGg6hdfAm7EvCv3EL80vFxJNsslqw=
github.com/google/uuid v1.6.1-0.20241114170450-2d3c2a9cc518/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/googleapis/enterprise-certificate-proxy v0.0.0-20220520183353-fd19c99a87aa/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=
github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
@@ -1176,6 +1184,8 @@ github.com/graph-gophers/graphql-go v1.9.0 h1:yu0ucKHLc5qGpRwLYKIWtr9bOoxovkWasu
github.com/graph-gophers/graphql-go v1.9.0/go.mod h1:23olKZ7duEvHlF/2ELEoSZaY1aNPfShjP782SOoNTyM=
github.com/gregdel/pushover v1.3.1 h1:4bMLITOZ15+Zpi6qqoGqOPuVHCwSUvMCgVnN5Xhilfo=
github.com/gregdel/pushover v1.3.1/go.mod h1:EcaO66Nn1StkpEm1iKtBTV3d2A16SoMsVER1PthX7to=
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk=
@@ -1228,6 +1238,8 @@ github.com/hanzoai/dbx v1.16.0 h1:C8wsb9BIiit4nYnXizpcB4SyzVaepPkQFwq5i9fxAV0=
github.com/hanzoai/dbx v1.16.0/go.mod h1:ynP6HSiDDoFZ8M3DC+XvSglBPFRygfTd/gjTWabh4yA=
github.com/hanzoai/decimal v0.1.1 h1:vANjwEzfdq1EmsgaPR0CMMi2qxuR8+pbK6/InJVkRmo=
github.com/hanzoai/decimal v0.1.1/go.mod h1:jTNufaSe93avQTuXYP3ns2THBtRPR2SbaC0EdODLAFI=
github.com/hanzoai/deploy/gitops-engine v0.7.2 h1:+c7zwlp/ykA28PL/N9YNZoglf5a/bIIBaTZeGNZ7Ukw=
github.com/hanzoai/deploy/gitops-engine v0.7.2/go.mod h1:c67nIJzxnhdgY9Lvjb7rSk9ImGNXASPMWAKmGH5N0dE=
github.com/hanzoai/go-cosyvoice v1.0.0 h1:XS68KB2VMCmHdAMpcdbkZhK20ZOTPAYm2N1Gx67yJpE=
github.com/hanzoai/go-cosyvoice v1.0.0/go.mod h1:uKPJVkJDE8+/j5+HebHrnh/VZ7skUvtJfQrqTJfY6IA=
github.com/hanzoai/go-openai v1.41.0 h1:/jF/fZbBHyK7N14mQquUKzCnjwomcuy5YVBIn8AR3NQ=
@@ -1304,14 +1316,14 @@ github.com/hanzoai/stream v1.2.0 h1:AVKg/YBgzZ/x8hGjg+bnpldMR34x1FzSp84GVdAPhfI=
github.com/hanzoai/stream v1.2.0/go.mod h1:mn5cnMQYzdGh5vlslCnh1fdI79qFvbet4MpvY0ME5YU=
github.com/hanzoai/tasks v1.51.1 h1:bikFmbynC+Tw7yvj0hmtlT8Ai3yVKj8FufdwXEUw/zM=
github.com/hanzoai/tasks v1.51.1/go.mod h1:+Oqq+L3nY4uKeLyPanimlbcym/HoIUDaBezgIs6v4Hk=
github.com/hanzoai/thinking v0.1.1 h1:JuJ9s3q53NRSHSU+/zEdg089vppuNUKK/9BG7bairLw=
github.com/hanzoai/thinking v0.1.1/go.mod h1:2lkNDDi+7mAipRhZZ57uqoqrzLKGBdoU5Rb6fGSOoR4=
github.com/hanzoai/thinking v0.1.0 h1:i1FHh0qcbfFz1oqjOwIXCvLXaXKPNivw5oeeB8VUXNU=
github.com/hanzoai/thinking v0.1.0/go.mod h1:2lkNDDi+7mAipRhZZ57uqoqrzLKGBdoU5Rb6fGSOoR4=
github.com/hanzoai/vfs v0.6.4 h1:7T1b/ONc2/3RhYwIAYB8MYAjXbP5fqnqsK2gZ3yQOSU=
github.com/hanzoai/vfs v0.6.4/go.mod h1:NyQJ+POT174+iJj6fxncG748FjMgUfaVpSgaH00vOMU=
github.com/hanzoai/xorm v1.4.1 h1:NPCfPp16gfi1kWrVdkS3xjy/Ec1shr/S6Ze+bEalwso=
github.com/hanzoai/xorm v1.4.1/go.mod h1:sNW6Xi3JeWX7Z6lg2anTo1eKzEY1dhIWQijwiBp10as=
github.com/hanzoai/zen v1.4.1 h1:a14JzPRdFimNjTTLJ2fSeFkY9exVzhZuLzeApShuYds=
github.com/hanzoai/zen v1.4.1/go.mod h1:gUs+2PLEiGD104AR4U5ZIUqMuJ0YriI9xQjkD3JlfxA=
github.com/hanzoai/zen v1.4.0 h1:xGtGzXVmcL1qu57MjisAWrNIuiJeYDfpwqLlaqTPxYc=
github.com/hanzoai/zen v1.4.0/go.mod h1:pOUtKwYxKwx1w3FvcxpPaWHINQf99gv+hA8QedOGF2U=
github.com/hashicorp/consul/api v1.10.1/go.mod h1:XjsvQN+RJGWI2TWy1/kqaE16HrR2J/FWgkYjdZQsX9M=
github.com/hashicorp/consul/api v1.12.0/go.mod h1:6pVBMo0ebnYdt2S3H87XhekM/HHrUoTD2XXb/VrZVy0=
github.com/hashicorp/consul/api v1.13.0/go.mod h1:ZlVrynguJKcYr54zGaDbaL3fOvKC9m72FhPvA8T35KQ=
@@ -1595,6 +1607,8 @@ github.com/leverly/ChatGLM v1.2.0/go.mod h1:DoxwOIyOup0Ct+dhm2FxKrakCB5AscJ0N0jk
github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
github.com/lib/pq v1.12.3 h1:tTWxr2YLKwIvK90ZXEw8GP7UFHtcbTtty8zsI+YjrfQ=
github.com/lib/pq v1.12.3/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0=
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE=
github.com/likexian/gokit v0.25.13 h1:p2Uw3+6fGG53CwdU2Dz0T6bOycdb2+bAFAa3ymwWVkM=
github.com/likexian/gokit v0.25.13/go.mod h1:qQhEWFBEfqLCO3/vOEo2EDKd+EycekVtUK4tex+l2H4=
github.com/likexian/whois v1.15.1 h1:6vTMI8n9s1eJdmcO4R9h1x99aQWIZZX1CD3am68gApU=
@@ -1605,6 +1619,8 @@ github.com/line/line-bot-sdk-go v7.8.0+incompatible h1:Uf9/OxV0zCVfqyvwZPH8CrdiH
github.com/line/line-bot-sdk-go v7.8.0+incompatible/go.mod h1:0RjLjJEAU/3GIcHkC3av6O4jInAbt25nnZVmOFUgDBg=
github.com/linode/linodego v1.67.0 h1:pomhFuuCCJI4N6emtB9027h1yXHY2/MIT0hwHEFwvq4=
github.com/linode/linodego v1.67.0/go.mod h1:+9mbdu0P3WMRCl0QbVfiFavR+Iel7TCRDJk3nInyx14=
github.com/lithammer/dedent v1.1.0 h1:VNzHMVCBNG1j0fh3OrsFRkVUwStdDArbgBWoPAffktY=
github.com/lithammer/dedent v1.1.0/go.mod h1:jrXYCQtgg0nJiN+StA2KgR7w6CiQNv9Fd/Z9BP0jIOc=
github.com/lithammer/shortuuid v3.0.0+incompatible h1:NcD0xWW/MZYXEHa6ITy6kaXN5nwm/V115vj2YXfhS0w=
github.com/lithammer/shortuuid v3.0.0+incompatible/go.mod h1:FR74pbAuElzOUuenUHTK2Tciko1/vKuIKS9dSkDrA4w=
github.com/lor00x/goldap v0.0.0-20180618054307-a546dffdd1a3/go.mod h1:37YR9jabpiIxsb8X9VCIx8qFOjTDIIrIHHODa8C4gz0=
@@ -1660,8 +1676,8 @@ github.com/luxfi/ids v1.3.2 h1:c6Rft5kZB4XqiCtWaGH47bfhaNFm3FGRfhEzI01GVeI=
github.com/luxfi/ids v1.3.2/go.mod h1:+5l8cYMbKpORJbQ2r98CYJo9TQATgUdnmzpYFZWMwwc=
github.com/luxfi/keys v1.4.1 h1:2Zcoovaz9OLPz7m7VGXfRrGnrlqt0GeUpJclsPBi4EU=
github.com/luxfi/keys v1.4.1/go.mod h1:P8EUP5DKrR1SUZBGZjDT3rWcp2P1miUlVh7IBRNBphU=
github.com/luxfi/kms v1.12.4 h1:7eIGopBtGN4YqbJCTo7SE3oOcnVUoUDv2u1gS3UeMcw=
github.com/luxfi/kms v1.12.4/go.mod h1:hdbnJp5S+BKW2RcH1+qSC87NZkIGEL5Z8/9UJyKBikw=
github.com/luxfi/kms v1.11.8 h1:cDEEpx/zAyfRZoGIxFd97Hs9cB7k8tvLet9iLCif7XM=
github.com/luxfi/kms v1.11.8/go.mod h1:XhLUVqN4RBv6j4Bj3MNgTZmHCnm74jH7RqqK0b9xbzw=
github.com/luxfi/lattice/v7 v7.1.4 h1:hQR02M6cHTAV5+joOPi9gb9Gm+z/hKJnhJF4IlciIJs=
github.com/luxfi/lattice/v7 v7.1.4/go.mod h1:DmIQFi3mJiehVsR235l1NKYEU0JhU649OX5p7gMEW2c=
github.com/luxfi/lens v0.2.1 h1:5Qd0GdjbM+XUVgwDbZ452tKkR7yeE8QnBTHHaH8fJNY=
@@ -1801,6 +1817,8 @@ github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrk
github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
github.com/mitchellh/mapstructure v1.4.2/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
@@ -1971,6 +1989,8 @@ github.com/perses/spec v0.1.2 h1:yGoygcR3ZusuGDCmRMwsVXCMvMwi1qZndKV6NYNreEw=
github.com/perses/spec v0.1.2/go.mod h1:NoGI5jmGwRdkdPgyYSZJTBL4/Py+dqIPKS2QV8NOvGE=
github.com/petar-dambovaliev/aho-corasick v0.0.0-20240411101913-e07a1f0e8eb4 h1:1Kw2vDBXmjop+LclnzCb/fFy+sgb3gYARwfmoUcQe6o=
github.com/petar-dambovaliev/aho-corasick v0.0.0-20240411101913-e07a1f0e8eb4/go.mod h1:EHPiTAKtiFmrMldLUNswFwfZ2eJIYBHktdaUTZxYWRw=
github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
github.com/peterh/liner v1.0.1-0.20171122030339-3681c2a91233/go.mod h1:xIteQHvHuaLYG9IFj6mSxM0fCKrs34IrEQUhOYuGPHc=
github.com/peterh/liner v1.2.2 h1:aJ4AOodmL+JxOZZEL2u9iJf8omNRpqHc/EbrK+3mAXw=
github.com/peterh/liner v1.2.2/go.mod h1:xFwJyiKIXJZUKItq5dGHZSTBRAuG/CpeNpWLyiNRNwI=
@@ -2105,7 +2125,6 @@ github.com/russellhaering/gosaml2 v0.11.0 h1:wlWm7dWMrpJBzh0xEOZof70nVen4f/2BEF8
github.com/russellhaering/gosaml2 v0.11.0/go.mod h1:GmL5LeCP7PBYzSkkFxtmHuRzC2eUZ/6JSLYQd5fzKK4=
github.com/russellhaering/goxmldsig v1.6.0 h1:8fdWXEPh2k/NZNQBPFNoVfS3JmzS4ZprY/sAOpKQLks=
github.com/russellhaering/goxmldsig v1.6.0/go.mod h1:TrnaquDcYxWXfJrOjeMBTX4mLBeYAqaHEyUeWPxZlBM=
github.com/russross/blackfriday v1.6.0 h1:KqfZb0pUVN2lYqZUYRddxF4OR8ZMURnJIG5Y3VRLtww=
github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
@@ -3413,14 +3432,30 @@ k8s.io/apiextensions-apiserver v0.35.0 h1:3xHk2rTOdWXXJM+RDQZJvdx0yEOgC0FgQ1PlJa
k8s.io/apiextensions-apiserver v0.35.0/go.mod h1:E1Ahk9SADaLQ4qtzYFkwUqusXTcaV2uw3l14aqpL2LU=
k8s.io/apimachinery v0.35.3 h1:MeaUwQCV3tjKP4bcwWGgZ/cp/vpsRnQzqO6J6tJyoF8=
k8s.io/apimachinery v0.35.3/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
k8s.io/apiserver v0.35.3 h1:D2eIcfJ05hEAEewoSDg+05e0aSRwx8Y4Agvd/wiomUI=
k8s.io/apiserver v0.35.3/go.mod h1:JI0n9bHYzSgIxgIrfe21dbduJ9NHzKJ6RchcsmIKWKY=
k8s.io/cli-runtime v0.35.3 h1:UZq4ipNimtzBmhN7PPKbfAdqo8quK0H0UdGl6qAQnqI=
k8s.io/cli-runtime v0.35.3/go.mod h1:O7MUmCqcKSd5xI+O5X7/pRkB5l0O2NIhOdUVwbHLXu4=
k8s.io/client-go v0.35.3 h1:s1lZbpN4uI6IxeTM2cpdtrwHcSOBML1ODNTCCfsP1pg=
k8s.io/client-go v0.35.3/go.mod h1:RzoXkc0mzpWIDvBrRnD+VlfXP+lRzqQjCmKtiwZ8Q9c=
k8s.io/component-base v0.35.3 h1:mbKbzoIMy7JDWS/wqZobYW1JDVRn/RKRaoMQHP9c4P0=
k8s.io/component-base v0.35.3/go.mod h1:IZ8LEG30kPN4Et5NeC7vjNv5aU73ku5MS15iZyvyMYk=
k8s.io/component-helpers v0.35.3 h1:Rl2p3wNMC0YU21rziLkWXavr7MwkB5Td3lNZ/+gYGm8=
k8s.io/component-helpers v0.35.3/go.mod h1:8BkyfcBA6XsCtFYxDB+mCfZqM6P39Aco12AKigNn0C8=
k8s.io/controller-manager v0.35.3 h1:BlX95jtN41/vCwuTsmfzR9UpqweX7KDWdwm/mRHez/o=
k8s.io/controller-manager v0.35.3/go.mod h1:OaG4bXsMfN5zpqowtdyfoRX20LrfwUh6V0zmpF7hw30=
k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
k8s.io/kube-aggregator v0.35.3 h1:erIo8Dfapd0Fg44XAbgCNioJMtr3Z5mI/G1PSpj9B7Q=
k8s.io/kube-aggregator v0.35.3/go.mod h1:lOLyWTEuiKT2kS/Wkj0foq+P+Xt4gs/xkrhz2r33lAQ=
k8s.io/kube-openapi v0.0.0-20260330154417-16be699c7b31 h1:V+sn9a/1fEYDGwnllCmqXBk8x7obZ+hl869Q3Abumkg=
k8s.io/kube-openapi v0.0.0-20260330154417-16be699c7b31/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
k8s.io/metrics v0.30.0 h1:tqB+T0GJY288KahaO3Eb41HaDVeLR18gBmyPo0R417s=
k8s.io/metrics v0.30.0/go.mod h1:nSDA8V19WHhCTBhRYuyzJT9yPJBxSpqbyrGCCQ4jPj4=
k8s.io/kubectl v0.35.3 h1:1KqSYXk/sodU7VeDvK6atX2kAGUZd2QTeR5K7Hb9r9w=
k8s.io/kubectl v0.35.3/go.mod h1:GPHxZqRe+u/i3gTBoVQHeIyq2NilfNPj9hDWeuN3x5s=
k8s.io/kubernetes v1.35.3 h1:J3dk2wybKFHwoH4eydDUGHJo4HAD+9CZbSlvk/YQuao=
k8s.io/kubernetes v1.35.3/go.mod h1:AaPpCpiS8oAqRbEwpY5r3RitLpwpVp5lVXKFkJril58=
k8s.io/metrics v0.35.3 h1:WonA18pEwrtb7a6XfhFg1ZY1Le0RFkcEw7CFApMTZos=
k8s.io/metrics v0.35.3/go.mod h1:/O8UBb5QVyAekR2QvL/WWxskpdV1wVSEl4MSLAy4Ql4=
k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 h1:kBawHLSnx/mYHmRnNUf9d4CpjREbeZuxoSGOX/J+aYM=
k8s.io/utils v0.0.0-20260319190234-28399d86e0b5/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
layeh.com/radius v0.0.0-20231213012653-1006025d24f8 h1:orYXpi6BJZdvgytfHH4ybOe4wHnLbbS71Cmd8mWdZjs=
@@ -3466,10 +3501,10 @@ sigs.k8s.io/controller-runtime v0.23.3 h1:VjB/vhoPoA9l1kEKZHBMnQF33tdCLQKJtydy4i
sigs.k8s.io/controller-runtime v0.23.3/go.mod h1:B6COOxKptp+YaUT5q4l6LqUJTRpizbgf9KSRNdQGns0=
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
sigs.k8s.io/kustomize/api v0.20.0 h1:xPLqcobHI0bThyRUteO+nCV8G4d1Rlo5HafO57VRcas=
sigs.k8s.io/kustomize/api v0.20.0/go.mod h1:F6CfaV27oevRCMJgehLqyX81dlUnRX/Fc13Uo7+OSo4=
sigs.k8s.io/kustomize/kyaml v0.20.0 h1:tT8KMKi4R3hCJ1+9HDdek2VoXpkerP92ZfF6fDgGw14=
sigs.k8s.io/kustomize/kyaml v0.20.0/go.mod h1:0EmkQHRUsJxY8Ug9Niig1pUMSCGHxQ5RklbpV/Ri6po=
sigs.k8s.io/kustomize/api v0.20.1 h1:iWP1Ydh3/lmldBnH/S5RXgT98vWYMaTUL1ADcr+Sv7I=
sigs.k8s.io/kustomize/api v0.20.1/go.mod h1:t6hUFxO+Ph0VxIk1sKp1WS0dOjbPCtLJ4p8aADLwqjM=
sigs.k8s.io/kustomize/kyaml v0.20.1 h1:PCMnA2mrVbRP3NIB6v9kYCAc38uvFLVs8j/CD567A78=
sigs.k8s.io/kustomize/kyaml v0.20.1/go.mod h1:0EmkQHRUsJxY8Ug9Niig1pUMSCGHxQ5RklbpV/Ri6po=
sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8=