summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--site/intel-pod17/baremetal/nodes.yaml254
-rw-r--r--site/intel-pod17/networks/common-addresses.yaml155
-rw-r--r--site/intel-pod17/networks/physical/networks.yaml365
-rw-r--r--site/intel-pod17/pki/pki-catalog.yaml299
-rw-r--r--site/intel-pod17/profiles/region.yaml53
-rw-r--r--site/intel-pod17/secrets/certificates/certificates.yaml2525
-rw-r--r--site/intel-pod17/secrets/certificates/ingress.yaml135
-rw-r--r--site/intel-pod17/secrets/passphrases/apiserver-encryption-key-key1.yaml13
-rw-r--r--site/intel-pod17/secrets/passphrases/ceph_fsid.yaml12
-rw-r--r--site/intel-pod17/secrets/passphrases/ceph_swift_keystone_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ipmi_admin_password.yaml13
-rw-r--r--site/intel-pod17/secrets/passphrases/maas-region-key.yaml12
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_barbican_oslo_db_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_barbican_oslo_messaging_admin_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_barbican_oslo_messaging_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_barbican_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_barbican_rabbitmq_erlang_cookie.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_cinder_oslo_db_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_cinder_oslo_messaging_admin_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_cinder_oslo_messaging_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_cinder_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_cinder_rabbitmq_erlang_cookie.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_glance_oslo_db_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_glance_oslo_messaging_admin_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_glance_oslo_messaging_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_glance_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_glance_rabbitmq_erlang_cookie.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_heat_oslo_db_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_heat_oslo_messaging_admin_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_heat_oslo_messaging_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_heat_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_heat_rabbitmq_erlang_cookie.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_heat_stack_user_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_heat_trustee_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_horizon_oslo_db_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_infra_elasticsearch_admin_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_infra_grafana_admin_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_infra_grafana_oslo_db_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_infra_grafana_oslo_db_session_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_infra_nagios_admin_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_infra_openstack_exporter_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_infra_oslo_db_admin_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_infra_oslo_db_exporter_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_infra_prometheus_admin_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_infra_rgw_s3_admin_access_key.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_infra_rgw_s3_admin_secret_key.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_infra_rgw_s3_elasticsearch_access_key.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_infra_rgw_s3_elasticsearch_secret_key.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_keystone_admin_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_keystone_ldap_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_keystone_oslo_db_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_keystone_oslo_messaging_admin_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_keystone_oslo_messaging_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_keystone_rabbitmq_erlang_cookie.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_neutron_oslo_db_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_neutron_oslo_messaging_admin_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_neutron_oslo_messaging_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_neutron_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_neutron_rabbitmq_erlang_cookie.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_nova_metadata_proxy_shared_secret.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_nova_oslo_db_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_nova_oslo_messaging_admin_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_nova_oslo_messaging_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_nova_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_nova_rabbitmq_erlang_cookie.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_oslo_cache_secret_key.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_oslo_db_admin_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_oslo_db_exporter_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_oslo_messaging_admin_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_placement_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_rabbitmq_erlang_cookie.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/osh_tempest_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/tenant_ceph_fsid.yaml12
-rw-r--r--site/intel-pod17/secrets/passphrases/ubuntu_crypt_password.yaml12
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_airflow_oslo_messaging_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_airflow_postgres_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_armada_keystone_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_barbican_keystone_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_barbican_oslo_db_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_deckhand_keystone_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_deckhand_postgres_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_drydock_keystone_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_drydock_postgres_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_keystone_admin_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_keystone_oslo_db_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_maas_admin_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_maas_postgres_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_openstack_exporter_keystone_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_oslo_db_admin_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_oslo_messaging_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_postgres_admin_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_postgres_exporter_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_postgres_replication_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_promenade_keystone_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_rabbitmq_erlang_cookie.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_shipyard_keystone_password.yaml11
-rw-r--r--site/intel-pod17/secrets/passphrases/ucp_shipyard_postgres_password.yaml11
-rw-r--r--site/intel-pod17/secrets/publickey/grego_ssh_public_key.yaml11
-rw-r--r--site/intel-pod17/secrets/publickey/kasparss_ssh_public_key.yaml11
-rw-r--r--site/intel-pod17/site-definition.yaml17
-rw-r--r--site/intel-pod17/software/charts/kubernetes/container-networking/etcd.yaml127
-rw-r--r--site/intel-pod17/software/charts/kubernetes/etcd/etcd.yaml131
-rw-r--r--site/intel-pod17/software/charts/ucp/ceph/ceph-client-update.yaml26
-rw-r--r--site/intel-pod17/software/charts/ucp/ceph/ceph-client.yaml100
-rw-r--r--site/intel-pod17/software/charts/ucp/ceph/ceph-osd.yaml30
-rw-r--r--site/intel-pod17/software/charts/ucp/divingbell/divingbell.yaml72
-rw-r--r--site/intel-pod17/software/config/common-software-config.yaml16
-rw-r--r--type/cntt/bootactions/promjoin.yaml32
-rw-r--r--type/cntt/deployment/deployment-configuration.yaml41
-rw-r--r--type/cntt/network/KubernetesNetwork.yaml97
-rw-r--r--type/cntt/profiles/genesis.yaml49
-rw-r--r--type/cntt/profiles/hardware/intel-s2600wt.yaml109
-rw-r--r--type/cntt/profiles/host/cp-intel-s2600wt.yaml96
-rw-r--r--type/cntt/profiles/host/dp-intel-s2600wt.yaml103
-rw-r--r--type/cntt/software/charts/kubernetes/ingress/ingress.yaml31
-rw-r--r--type/cntt/software/charts/osh-infra/elasticsearch.yaml34
-rw-r--r--type/cntt/software/charts/osh-infra/fluentbit.yaml22
-rw-r--r--type/cntt/software/charts/osh-infra/fluentd.yaml22
-rw-r--r--type/cntt/software/charts/osh-infra/grafana.yaml23
-rw-r--r--type/cntt/software/charts/osh-infra/ingress.yaml24
-rw-r--r--type/cntt/software/charts/osh-infra/mariadb.yaml24
-rw-r--r--type/cntt/software/charts/osh-infra/prometheus.yaml35
-rw-r--r--type/cntt/software/charts/osh/openstack-compute-kit/neutron.yaml28
-rw-r--r--type/cntt/software/charts/osh/openstack-compute-kit/nova.yaml25
-rw-r--r--type/cntt/software/charts/osh/openstack-heat/heat.yaml21
-rw-r--r--type/cntt/software/charts/osh/openstack-tenant-ceph/ceph-client.yaml23
-rw-r--r--type/cntt/software/charts/osh/openstack-tenant-ceph/ceph-osd.yaml34
-rw-r--r--type/cntt/software/charts/ucp/comps/chart-group.yaml14
-rw-r--r--type/cntt/software/charts/ucp/comps/drydock.yaml25
-rw-r--r--type/cntt/software/charts/ucp/comps/maas-scaled.yaml32
-rw-r--r--type/cntt/software/charts/ucp/comps/maas.yaml29
-rw-r--r--type/cntt/software/charts/ucp/promenade/promenade.yaml50
-rw-r--r--type/cntt/software/config/endpoints.yaml1088
-rw-r--r--type/cntt/software/config/service_accounts.yaml435
-rw-r--r--type/cntt/software/manifests/bootstrap.yaml39
-rw-r--r--type/cntt/software/manifests/full-site.yaml61
136 files changed, 7971 insertions, 0 deletions
diff --git a/site/intel-pod17/baremetal/nodes.yaml b/site/intel-pod17/baremetal/nodes.yaml
new file mode 100644
index 0000000..cd88a66
--- /dev/null
+++ b/site/intel-pod17/baremetal/nodes.yaml
@@ -0,0 +1,254 @@
+---
+# Drydock BaremetalNode resources for a specific rack are stored in this file.
+#
+# NOTE: For new sites, you should complete the networks/physical/networks.yaml
+# file before working on this file.
+#
+# In this file, you should make the number of `drydock/BaremetalNode/v1`
+# resources equal the number of bare metal nodes you have, either by deleting
+# excess BaremetalNode definitions (if there are too many), or by copying and
+# pasting the last BaremetalNode in the file until you have the correct number
+# of baremetal nodes (if there are too few).
+#
+# Then in each file, address all additional NEWSITE-CHANGEME markers to update
+# the data in these files with the right values for your new site.
+#
+# *NOTE: The Genesis node is counted as one of the control plane nodes. Note
+# that the Genesis node does not appear on this bare metal list, because the
+# procedure to reprovision the Genesis host with MaaS has not yet been
+# implemented. Therefore there will be only three bare metal nodes in this file
+# with the 'masters' tag, as the genesis roles are assigned in a difference
+# place (profiles/genesis.yaml).
+# NOTE: The host profiles for the control plane are further divided into two
+# variants: primary and secondary. The only significance this has is that the
+# "primary" nodes are active Ceph nodes, whereas the "secondary" nodes are Ceph
+# standby nodes. For Ceph quorum, this means that the control plane split will
+# be 3 primary + 1 standby host profile, and the Genesis node counts toward one
+# of the 3 primary profiles. Other control plane services are not affected by
+# primary vs secondary designation.
+#
+# TODO: Include the hostname naming convention
+#
+schema: 'drydock/BaremetalNode/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ # NEWSITE-CHANGEME: Replace with the hostname of the first node in the rack,
+ # after (excluding) genesis.
+ name: pod17-node1
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ # NEWSITE-CHANGEME: The IPv4 address assigned to each logical network on this
+ # node. In the reference Airship deployment, this is all logical Networks defined
+ # in networks/physical/networks.yaml. IP addresses are manually assigned, by-hand.
+ # (what could possibly go wrong!) The instructions differ for each logical
+ # network, which are laid out below.
+ addressing:
+ # The iDrac/iLo IP of the node. It's important that this match up with the
+ # node's hostname above, so that the rack number and node position encoded
+ # in the hostname are accurate and matching the node that IPMI operations
+ # will be performed against (for poweron, poweroff, PXE boot to wipe disk or
+ # reconfigure identity, etc - very important to get right for these reasons).
+ # These addresses should already be assigned to nodes racked and stacked in
+ # the environment; these are not addresses which MaaS assigns.
+ - network: oob
+ address: 10.10.170.11
+ # The IP of the node on the PXE network. Refer to the static IP range
+ # defined for the PXE network in networks/physical/networks.yaml. Begin allocating
+ # IPs from this network, starting with the second IP (inclusive) from the
+ # allocation range of this subnet (Genesis node will have the first IP).
+ # Ex: If the start IP for the PXE "static" network is 10.23.20.11, then
+ # genesis will have 10.23.20.11, this node will have 10.23.20.12, and
+ # so on with incrementing IP addresses with each additional node.
+ - network: dmz
+ address: 10.10.170.21
+ # Genesis node gets first IP, all other nodes increment IPs from there
+ # within the allocation range defined for the network in
+ # networks/physical/networks.yaml
+ - network: admin
+ address: 10.10.171.21
+ # Genesis node gets first IP, all other nodes increment IPs from there
+ # within the allocation range defined for the network in
+ # networks/physical/networks.yaml
+ - network: private
+ address: 10.10.172.21
+ # Genesis node gets first IP, all other nodes increment IPs from there
+ # within the allocation range defined for the network in
+ # networks/physical/networks.yaml
+ - network: storage
+ address: 10.10.173.21
+ # Genesis node gets first IP, all other nodes increment IPs from there
+ # within the allocation range defined for the network in
+ # networks/physical/networks.yaml
+ - network: management
+ address: 10.10.174.21
+ # NEWSITE-CHANGEME: Set the host profile for the node.
+ # Note that there are different host profiles depending if this is a control
+ # plane vs data plane node, and different profiles that map to different types
+ # hardware. Control plane host profiles are further broken down into "primary"
+ # and "secondary" profiles (refer to the Notes section at the top of this doc).
+ # Select the host profile that matches up to your type of
+ # hardware and function. E.g., the r720 here refers to Dell R720 hardware, the
+ # 'cp' refers to a control plane profile, and the "primary" means it will be
+ # an active member in the ceph quorum. Refer to profiles/host/ for the list
+ # of available host profiles specific to this site (otherwise, you may find
+ # a general set of host profiles at the "type" or "global" layers/folders.
+ # If you have hardware that is not on this list of profiles, you may need to
+ # create a new host profile for that hardware.
+ # Regarding control plane vs other data plane profiles, refer to the notes at
+ # the beginning of this file. There should be one control plane node per rack,
+ # including Genesis. Note Genesis won't actually be listed in this file as a
+ # BaremetalNode, but the rest are.
+ # This is the second "primary" control plane node after Genesis.
+ host_profile: cp-intel-s2600wt
+ metadata:
+ tags:
+ # NEWSITE-CHANGEME: See previous comment. Apply 'masters' tag for control
+ # plane node, and 'workers' tag for data plane hosts.
+ - 'masters'
+ # NEWSITE-CHANGEME: Refer to site engineering package or other supporting
+ # documentation for the specific rack name. This should be a rack name that
+ # is meaningful to data center personnel (i.e. a rack they could locate if
+ # you gave them this rack designation).
+ rack: pod17-rack
+...
+---
+schema: 'drydock/BaremetalNode/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ # NEWSITE-CHANGEME: The next node's hostname
+ name: pod17-node2
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ # NEWSITE-CHANGEME: The next node's IPv4 addressing
+ addressing:
+ - network: oob
+ address: 10.10.170.12
+ - network: dmz
+ address: 10.10.170.22
+ - network: admin
+ address: 10.10.171.22
+ - network: private
+ address: 10.10.172.22
+ - network: storage
+ address: 10.10.173.22
+ - network: management
+ address: 10.10.174.22
+ # NEWSITE-CHANGEME: The next node's host profile
+ host_profile: cp-intel-s2600wt
+ metadata:
+ # NEWSITE-CHANGEME: The next node's rack designation
+ rack: pod17-rack
+ # NEWSITE-CHANGEME: The next node's role desigatnion
+ tags:
+ - 'masters'
+...
+---
+schema: 'drydock/BaremetalNode/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ # NEWSITE-CHANGEME: The next node's hostname
+ name: pod17-node3
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ # NEWSITE-CHANGEME: The next node's IPv4 addressing
+ addressing:
+ - network: oob
+ address: 10.10.170.13
+ - network: dmz
+ address: 10.10.170.23
+ - network: admin
+ address: 10.10.171.23
+ - network: private
+ address: 10.10.172.23
+ - network: storage
+ address: 10.10.173.23
+ - network: management
+ address: 10.10.174.23
+ # NEWSITE-CHANGEME: The next node's host profile
+ # This is the third "primary" control plane profile after genesis
+ host_profile: dp-intel-s2600wt
+ metadata:
+ # NEWSITE-CHANGEME: The next node's rack designation
+ rack: pod17-rack
+ # NEWSITE-CHANGEME: The next node's role desigatnion
+ tags:
+ - 'workers'
+...
+---
+schema: 'drydock/BaremetalNode/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ # NEWSITE-CHANGEME: The next node's hostname
+ name: pod17-node4
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ # NEWSITE-CHANGEME: The next node's IPv4 addressing
+ addressing:
+ - network: oob
+ address: 10.10.170.14
+ - network: dmz
+ address: 10.10.170.24
+ - network: admin
+ address: 10.10.171.24
+ - network: private
+ address: 10.10.172.24
+ - network: storage
+ address: 10.10.173.24
+ - network: management
+ address: 10.10.174.24
+ # NEWSITE-CHANGEME: The next node's host profile
+ # This is the one and only appearance of the "secondary" control plane profile
+ host_profile: dp-intel-s2600wt
+ metadata:
+ # NEWSITE-CHANGEME: The next node's rack designation
+ rack: pod17-rack
+ # NEWSITE-CHANGEME: The next node's role desigatnion
+ tags:
+ - 'workers'
+...
+---
+schema: 'drydock/BaremetalNode/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ # NEWSITE-CHANGEME: The next node's hostname
+ name: pod17-node5
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ # NEWSITE-CHANGEME: The next node's IPv4 addressing
+ addressing:
+ - network: oob
+ address: 10.10.170.15
+ - network: dmz
+ address: 10.10.170.25
+ - network: admin
+ address: 10.10.171.25
+ - network: private
+ address: 10.10.172.25
+ - network: storage
+ address: 10.10.173.25
+ - network: management
+ address: 10.10.174.25
+ # NEWSITE-CHANGEME: The next node's host profile
+ host_profile: dp-intel-s2600wt
+ metadata:
+ # NEWSITE-CHANGEME: The next node's rack designation
+ rack: pod17-rack
+ # NEWSITE-CHANGEME: The next node's role desigatnion
+ tags:
+ - 'workers'
+...
diff --git a/site/intel-pod17/networks/common-addresses.yaml b/site/intel-pod17/networks/common-addresses.yaml
new file mode 100644
index 0000000..1fe0357
--- /dev/null
+++ b/site/intel-pod17/networks/common-addresses.yaml
@@ -0,0 +1,155 @@
+---
+# The purpose of this file is to define network related paramters that are
+# referenced elsewhere in the manifests for this site.
+#
+schema: pegleg/CommonAddresses/v1
+metadata:
+ schema: metadata/Document/v1
+ name: common-addresses
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ calico:
+ # NEWSITE-CHANGEME: The interface that calico will use. Update if your
+ # logical bond interface name or calico VLAN have changed from the reference
+ # site design.
+ # This should be whichever
+ # bond and VLAN number specified in networks/physical/networks.yaml for the Calico
+ # network. E.g. VLAN 22 for the calico network as a member of bond0, you
+ # would set "interface=bond0.22" as shown here.
+ ip_autodetection_method: interface=ens785f0
+ etcd:
+ # etcd service IP address
+ service_ip: 10.96.232.136
+
+ vip:
+ ingress_vip: '10.10.170.100/32'
+ maas_vip: '10.10.171.100/32'
+
+ dns:
+ # Kubernetes cluster domain. Do not change. This is internal to the cluster.
+ cluster_domain: cluster.local
+ # DNS service ip
+ service_ip: 10.96.0.10
+ # List of upstream DNS forwards. Verify you can reach them from your
+ # environment. If so, you should not need to change them.
+ upstream_servers:
+ - 8.8.8.8
+ - 8.8.4.4
+ # Repeat the same values as above, but formatted as a common separated
+ # string
+ upstream_servers_joined: 8.8.8.8,8.8.4.4
+ # NEWSITE-CHANGEME: FQDN for ingress (i.e. "publicly facing" access point)
+ # Choose FQDN according to the ingress/public FQDN naming conventions at
+ # the top of this document.
+ ingress_domain: intel-pod17.opnfv.org
+
+ genesis:
+ # NEWSITE-CHANGEME: Update with the hostname for the node which will take on
+ # the Genesis role. Refer to the hostname naming stardards in
+ # networks/physical/networks.yaml
+ # NOTE: Ensure that the genesis node is manually configured with this
+ # hostname before running `genesis.sh` on the node.
+ hostname: pod17-jump
+ # NEWSITE-CHANGEME: Calico IP of the Genesis node. Use the "start" value for
+ # the calico network defined in networks/physical/networks.yaml for this IP.
+ ip: 10.10.172.20
+
+ bootstrap:
+ # NEWSITE-CHANGEME: Update with the "start" value/IP of the static range
+ # defined for the pxe network in networks/physical/networks.yaml
+ ip: 10.10.171.20
+
+ kubernetes:
+ # K8s API service IP
+ api_service_ip: 10.96.0.1
+ # etcd service IP
+ etcd_service_ip: 10.96.0.2
+ # k8s pod CIDR (network which pod traffic will traverse)
+ pod_cidr: 10.97.0.0/16
+ # k8s service CIDR (network which k8s API traffic will traverse)
+ service_cidr: 10.96.0.0/16
+ # misc k8s port settings
+ apiserver_port: 6443
+ haproxy_port: 6553
+ service_node_port_range: 30000-32767
+
+ # etcd port settings
+ etcd:
+ container_port: 2379
+ haproxy_port: 2378
+
+ # NEWSITE-CHANGEME: A list of nodes (apart from Genesis) which act as the
+ # control plane servers. Ensure that this matches the nodes with the 'masters'
+ # tags applied in baremetal/nodes.yaml
+ masters:
+ - hostname: pod17-node1
+ - hostname: pod17-node2
+
+ # NEWSITE-CHANGEME: Environment proxy information.
+ # NOTE: Reference Airship sites do not deploy behind a proxy, so this proxy section
+ # should be commented out.
+ # However if you are in a lab that requires proxy, ensure that these proxy
+ # settings are correct and reachable in your environment; otherwise update
+ # them with the correct values for your environment.
+ proxy:
+ http: ""
+ https: ""
+ no_proxy: []
+
+ node_ports:
+ drydock_api: 30000
+ maas_api: 30001
+ maas_proxy: 31800 # hardcoded in MAAS
+
+ ntp:
+ # comma separated NTP server list. Verify that these upstream NTP servers are
+ # reachable in your environment; otherwise update them with the correct
+ # values for your environment.
+ servers_joined: '0.ubuntu.pool.ntp.org,1.ubuntu.pool.ntp.org,2.ubuntu.pool.ntp.org,4.ubuntu.pool.ntp.org'
+
+ # NOTE: This will be updated soon
+ ldap:
+ # NEWSITE-CHANGEME: FQDN for LDAP. Update to the FQDN that is
+ # relevant for your type of deployment (test vs prod values, etc).
+ base_url: 'ldap.example.com'
+ # NEWSITE-CHANGEME: As above, with the protocol included to create a full URI
+ url: 'ldap://ldap.example.com'
+ # NEWSITE-CHANGEME: Update to the correct expression relevant for this
+ # deployment (test vs prod values, etc)
+ auth_path: DC=test,DC=test,DC=com?sAMAccountName?sub?memberof=CN=test,OU=Application,OU=Groups,DC=test,DC=test,DC=com
+ # NEWSITE-CHANGEME: Update to the correct AD group that contains the users
+ # relevant for this deployment (test users vs prod users/values, etc)
+ common_name: test
+ # NEWSITE-CHANGEME: Update to the correct subdomain for your type of
+ # deployment (test vs prod values, etc)
+ subdomain: test
+ # NEWSITE-CHANGEME: Update to the correct domain for your type of
+ # deployment (test vs prod values, etc)
+ domain: example
+
+ storage:
+ ceph:
+ # NEWSITE-CHANGEME: CIDRs for Ceph. Update to match the network CIDR
+ # used for the `storage` network in networks/physical/networks.yaml
+ public_cidr: '10.10.173.0/24'
+ cluster_cidr: '10.10.173.0/24'
+
+ neutron:
+ # NEWSITE-CHANGEME: Overlay network for VM traffic. Ensure the bond name and
+ # VLAN number are consistent with what's defined for the bond and the overlay
+ # network in networks/physical/networks.yaml
+ tunnel_device: 'ens785f0'
+ # bond which the overlay is a member of. Ensure the bond name is consistent
+ # with the bond assigned to the overlay network in
+ # networks/physical/networks.yaml
+ external_iface: 'ens785f1.1173'
+
+ openvswitch:
+ # bond which the overlay is a member of. Ensure the bond name is consistent
+ # with the bond assigned to the overlay network in
+ # networks/physical/networks.yaml
+ external_iface: 'ens785f1.1173'
+...
diff --git a/site/intel-pod17/networks/physical/networks.yaml b/site/intel-pod17/networks/physical/networks.yaml
new file mode 100644
index 0000000..d149b07
--- /dev/null
+++ b/site/intel-pod17/networks/physical/networks.yaml
@@ -0,0 +1,365 @@
+---
+# The purpose of this file is to define all of the NetworkLinks (i.e. layer 1
+# devices) and Networks (i.e. layer 3 configurations). The following is standard
+# for the logical networks in Airship:
+#
+# https://wiki.opnfv.org/display/pharos/Intel+POD17
+# +--------+------------+-----------------------------------+----------+----------+----------------+
+# | | | | | | |
+# +--------+------------+-----------------------------------+----------+----------+----------------+
+# |IF0 1G | dmz | OoB & OAM (default route) | VLAN 170 | untagged | 10.10.170.0/24 |
+# |IF1 1G | admin | PXE boot network | VLAN 171 | untagged | 10.10.171.0/24 |
+# |IF2 10G | private | Underlay calico and ovs overlay | VLAN 172 | untagged | 10.10.172.0/24 |
+# | | management | Management (unused for now) | VLAN 174 | tagged | 10.10.174.0/24 |
+# |IF3 10G | storage | Storage network | VLAN 173 | untagged | 10.10.173.0/24 |
+# | | public | Public network for VMs | VLAN 175 | tagged | 10.10.175.0/24 |
+# +--------+------------+-----------------------------------+----------+----------+----------------+
+#
+# For standard Airship deployments, you should not need to modify the number of
+# NetworkLinks and Networks in this file. Only the IP addresses and CIDRs should
+# need editing.
+#
+# TODO: Given that we expect all network broadcast domains to span all racks in
+# Airship, we should choose network names that do not include the rack number.
+#
+# TODO: FQDN naming standards for hosts
+#
+schema: 'drydock/NetworkLink/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ name: oob
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ # MaaS doesnt own this network like it does the others, so the noconfig label
+ # is specified.
+ labels:
+ noconfig: enabled
+ bonding:
+ mode: disabled
+ mtu: 1500
+ linkspeed: auto
+ trunking:
+ mode: disabled
+ default_network: oob
+ allowed_networks:
+ - oob
+...
+---
+schema: 'drydock/Network/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ name: oob
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ # NEWSITE-CHANGEME: Update with the site's out-of-band CIDR
+ cidr: 10.10.170.0/24
+ routes:
+ # NEWSITE-CHANGEME: Update with the site's out-of-band gateway IP
+ - subnet: '0.0.0.0/0'
+ gateway: 10.10.170.1
+ metric: 100
+ # NEWSITE-CHANGEME: Update with the site's out-of-band IP allocation range
+ # FIXME: Is this IP range actually used/allocated for anything? The HW already
+ # has its OOB IPs assigned. None of the Ubuntu OS's should need IPs on OOB
+ # network either, as they should be routable via the default gw on OAM network
+ ranges:
+ - type: static
+ start: 10.10.170.20
+ end: 10.10.170.39
+...
+---
+schema: 'drydock/NetworkLink/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ name: dmz
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ bonding:
+ mode: disabled
+ mtu: 1500
+ linkspeed: auto
+ trunking:
+ mode: disabled
+ default_network: dmz
+ allowed_networks:
+ - dmz
+...
+---
+schema: 'drydock/Network/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ name: dmz
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ # NEWSITE-CHANGEME: Update with the site's PXE network CIDR
+ # NOTE: The CIDR minimum size = (number of nodes * 2) + 10
+ cidr: 10.10.170.0/24
+ routes:
+ - subnet: 0.0.0.0/0
+ # NEWSITE-CHANGEME: Set the OAM network gateway IP address
+ gateway: 10.10.170.1
+ metric: 100
+ # NOTE: The first 10 IPs in the subnet are reserved for network infrastructure.
+ # The remainder of the range is divided between two subnets of equal size:
+ # one static, and one DHCP.
+ # The DHCP addresses are used when nodes perform a PXE boot (DHCP address gets
+ # assigned), and when a node is commissioning in MaaS (also uses DHCP to get
+ # its IP address). However, when MaaS installs the operating system
+ # ("Deploying/Deployed" states), it will write a static IP assignment to
+ # /etc/network/interfaces[.d] with IPs from the "static" subnet defined here.
+ ranges:
+ # NEWSITE-CHANGEME: Update to the first 10 IPs in the CIDR
+ - type: reserved
+ start: 10.10.170.1
+ end: 10.10.170.19
+ # NEWSITE-CHANGEME: Update to the first half of the remaining range after
+ # excluding the 10 reserved IPs.
+ - type: static
+ start: 10.10.170.20
+ end: 10.10.170.39
+ # NEWSITE-CHANGEME: Update to the second half of the remaining range after
+ # excluding the 10 reserved IPs.
+ - type: dhcp
+ start: 10.10.170.40
+ end: 10.10.170.79
+ dns:
+ # NEWSITE-CHANGEME: FQDN for bare metal nodes.
+ # Choose FQDN according to the node FQDN naming conventions at the top of
+ # this document.
+ domain: intel-pod17.opnfv.org
+ # List of upstream DNS forwards. Verify you can reach them from your
+ # environment. If so, you should not need to change them.
+ # TODO: This should be populated via substitution from common-addresses
+ servers: '8.8.8.8,8.8.4.4'
+...
+---
+schema: 'drydock/NetworkLink/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ name: admin
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ bonding:
+ mode: disabled
+ mtu: 1500
+ linkspeed: auto
+ trunking:
+ mode: disabled
+ default_network: admin
+ allowed_networks:
+ - admin
+...
+---
+schema: 'drydock/Network/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ name: admin
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ # NEWSITE-CHANGEME: Update with the site's PXE network CIDR
+ # NOTE: The CIDR minimum size = (number of nodes * 2) + 10
+ cidr: 10.10.171.0/24
+ # routes:
+ # - subnet: 0.0.0.0/0
+ # # NEWSITE-CHANGEME: Set the OAM network gateway IP address
+ # gateway: 10.10.171.1
+ # metric: 100
+ # NOTE: The first 10 IPs in the subnet are reserved for network infrastructure.
+ # The remainder of the range is divided between two subnets of equal size:
+ # one static, and one DHCP.
+ # The DHCP addresses are used when nodes perform a PXE boot (DHCP address gets
+ # assigned), and when a node is commissioning in MaaS (also uses DHCP to get
+ # its IP address). However, when MaaS installs the operating system
+ # ("Deploying/Deployed" states), it will write a static IP assignment to
+ # /etc/network/interfaces[.d] with IPs from the "static" subnet defined here.
+ ranges:
+ # NEWSITE-CHANGEME: Update to the first 10 IPs in the CIDR
+ - type: reserved
+ start: 10.10.171.1
+ end: 10.10.171.19
+ # NEWSITE-CHANGEME: Update to the first half of the remaining range after
+ # excluding the 10 reserved IPs.
+ - type: static
+ start: 10.10.171.20
+ end: 10.10.171.39
+ # NEWSITE-CHANGEME: Update to the second half of the remaining range after
+ # excluding the 10 reserved IPs.
+ - type: dhcp
+ start: 10.10.171.40
+ end: 10.10.171.79
+ dns:
+ # NEWSITE-CHANGEME: FQDN for bare metal nodes.
+ # Choose FQDN according to the node FQDN naming conventions at the top of
+ # this document.
+ domain: intel-pod17.opnfv.org
+ # List of upstream DNS forwards. Verify you can reach them from your
+ # environment. If so, you should not need to change them.
+ # TODO: This should be populated via substitution from common-addresses
+ servers: '10.10.171.100'
+...
+---
+schema: 'drydock/NetworkLink/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ name: data1
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ bonding:
+ mode: disabled
+ # NEWSITE-CHANGEME: Ensure the network switches in the environment are
+ # configured for this MTU or greater. Even if switches are configured for or
+ # can support a slightly higher MTU, there is no need (and negliable benefit)
+ # to squeeze every last byte into the MTU (e.g., 9216 vs 9100). Leave MTU at
+ # 9100 for maximum compatibility.
+ mtu: 1500
+ linkspeed: auto
+ trunking:
+ mode: 802.1q
+ allowed_networks:
+ - private
+ - management
+...
+---
+schema: 'drydock/Network/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ name: private
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ # NEWSITE-CHANGEME: Set the VLAN ID which the storage network is on
+ vlan: '0'
+ mtu: 1500
+ # NEWSITE-CHANGEME: Set the CIDR for the storage network
+ # NOTE: The CIDR minimum size = number of nodes + 10
+ cidr: 10.10.172.0/24
+ ranges:
+ # NEWSITE-CHANGEME: Update to the remaining range after excluding the 10
+ # 10 reserved IPs.
+ - type: static
+ start: 10.10.172.1
+ end: 10.10.172.19
+...
+---
+schema: 'drydock/Network/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ name: management
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ # NEWSITE-CHANGEME: Set the VLAN ID which the OAM network is on
+ vlan: '174'
+ mtu: 1500
+ # NEWSITE-CHANGEME: Set the CIDR for the OAM network
+ # NOTE: The CIDR minimum size = number of nodes + 10
+ cidr: 10.10.174.0/24
+ routes:
+ - subnet: 0.0.0.0/0
+ # NEWSITE-CHANGEME: Set the OAM network gateway IP address
+ gateway: 10.10.174.1
+ metric: 100
+ ranges:
+ # NEWSITE-CHANGEME: Update to the remaining range after excluding the 10
+ # 10 reserved IPs.
+ - type: static
+ start: 10.10.174.1
+ end: 10.23.21.19
+ dns:
+ # NEWSITE-CHANGEME: FQDN for bare metal nodes.
+ # Choose FQDN according to the node FQDN naming conventions at the top of
+ # this document.
+ domain: intel-pod17.opnfv.org
+ # List of upstream DNS forwards. Verify you can reach them from your
+ # environment. If so, you should not need to change them.
+ # TODO: This should be populated via substitution from common-addresses
+ servers: '8.8.8.8,8.8.4.4'
+...
+---
+schema: 'drydock/NetworkLink/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ name: data2
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ bonding:
+ mode: disabled
+ # NEWSITE-CHANGEME: Ensure the network switches in the environment are
+ # configured for this MTU or greater. Even if switches are configured for or
+ # can support a slightly higher MTU, there is no need (and negliable benefit)
+ # to squeeze every last byte into the MTU (e.g., 9216 vs 9100). Leave MTU at
+ # 9100 for maximum compatibility.
+ mtu: 1500
+ linkspeed: auto
+ trunking:
+ mode: 802.1q
+ default_network: storage
+ allowed_networks:
+ - storage
+ - public
+...
+---
+schema: 'drydock/Network/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ name: storage
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ # NEWSITE-CHANGEME: Set the VLAN ID which the storage network is on
+ vlan: '0'
+ mtu: 1500
+ # NEWSITE-CHANGEME: Set the CIDR for the storage network
+ # NOTE: The CIDR minimum size = number of nodes + 10
+ cidr: 10.10.173.0/24
+ ranges:
+ # NEWSITE-CHANGEME: Update to the remaining range after excluding the 10
+ # 10 reserved IPs.
+ - type: static
+ start: 10.10.173.1
+ end: 10.10.173.19
+...
+---
+schema: 'drydock/Network/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ name: public
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ vlan: '1173'
+ mtu: 1500
+ cidr: 10.10.175.0/24
+...
diff --git a/site/intel-pod17/pki/pki-catalog.yaml b/site/intel-pod17/pki/pki-catalog.yaml
new file mode 100644
index 0000000..d1f9935
--- /dev/null
+++ b/site/intel-pod17/pki/pki-catalog.yaml
@@ -0,0 +1,299 @@
+---
+# The purpose of this file is to define the PKI certificates for the environment
+#
+# NOTE: When deploying a new site, this file should not be configured until
+# baremetal/nodes.yaml is complete.
+#
+schema: promenade/PKICatalog/v1
+metadata:
+ schema: metadata/Document/v1
+ name: cluster-certificates
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ certificate_authorities:
+ kubernetes:
+ description: CA for Kubernetes components
+ certificates:
+ - document_name: apiserver
+ description: Service certificate for Kubernetes apiserver
+ common_name: apiserver
+ hosts:
+ - localhost
+ - 127.0.0.1
+ # FIXME: Repetition of api_service_ip in common-addresses; use
+ # substitution
+ - 10.96.0.1
+ kubernetes_service_names:
+ - kubernetes.default.svc.cluster.local
+
+ # NEWSITE-CHANGEME: The following should be a list of all the nodes in
+ # the environment (genesis, control plane, data plane, everything).
+ # Add/delete from this list as necessary until all nodes are listed.
+ # For each node, the `hosts` list should be comprised of:
+ # 1. The node's hostname, as already defined in baremetal/nodes.yaml
+ # 2. The node's oam IP address, as already defined in baremetal/nodes.yaml
+ # 3. The node's Calico IP address, as already defined in baremetal/nodes.yaml
+ # NOTE: This list also needs to include the Genesis node, which is not
+ # listed in baremetal/nodes.yaml, but by convention should be allocated
+ # the first non-reserved IP in each logical network allocation range
+ # defined in networks/physical/networks.yaml
+ # NOTE: The genesis node needs to be defined twice (the first two entries
+ # on this list) with all of the same paramters except the document_name.
+ # In the first case the document_name is `kubelet-genesis`, and in the
+ # second case the document_name format is `kubelete-YOUR_GENESIS_HOSTNAME`.
+ - document_name: kubelet-genesis
+ common_name: system:node:pod17-jump
+ hosts:
+ - pod17-jump
+ - 10.10.172.20
+ groups:
+ - system:nodes
+ - document_name: kubelet-pod17-jump
+ common_name: system:node:pod17-jump
+ hosts:
+ - pod17-jump
+ - 10.10.172.20
+ groups:
+ - system:nodes
+ - document_name: kubelet-pod17-node1
+ common_name: system:node:pod17-node1
+ hosts:
+ - pod17-node1
+ - 10.10.172.21
+ groups:
+ - system:nodes
+ - document_name: kubelet-pod17-node2
+ common_name: system:node:pod17-node2
+ hosts:
+ - pod17-node2
+ - 10.10.172.22
+ groups:
+ - system:nodes
+ - document_name: kubelet-pod17-node3
+ common_name: system:node:pod17-node3
+ hosts:
+ - pod17-node3
+ - 10.10.172.23
+ groups:
+ - system:nodes
+ - document_name: kubelet-pod17-node4
+ common_name: system:node:pod17-node4
+ hosts:
+ - pod17-node4
+ - 10.10.172.24
+ groups:
+ - system:nodes
+ - document_name: kubelet-pod17-node5
+ common_name: system:node:pod17-node5
+ hosts:
+ - pod17-node5
+ - 10.10.172.25
+ groups:
+ - system:nodes
+ # End node list
+ - document_name: scheduler
+ description: Service certificate for Kubernetes scheduler
+ common_name: system:kube-scheduler
+ - document_name: controller-manager
+ description: certificate for controller-manager
+ common_name: system:kube-controller-manager
+ - document_name: admin
+ common_name: admin
+ groups:
+ - system:masters
+ - document_name: armada
+ common_name: armada
+ groups:
+ - system:masters
+ kubernetes-etcd:
+ description: Certificates for Kubernetes's etcd servers
+ certificates:
+ - document_name: apiserver-etcd
+ description: etcd client certificate for use by Kubernetes apiserver
+ common_name: apiserver
+ # NOTE(mark-burnett): hosts not required for client certificates
+ - document_name: kubernetes-etcd-anchor
+ description: anchor
+ common_name: anchor
+ # NEWSITE-CHANGEME: The following should be a list of the control plane
+ # nodes in the environment, including genesis.
+ # For each node, the `hosts` list should be comprised of:
+ # 1. The node's hostname, as already defined in baremetal/nodes.yaml
+ # 2. The node's oam IP address, as already defined in baremetal/nodes.yaml
+ # 3. The node's Calico IP address, as already defined in baremetal/nodes.yaml
+ # 4. 127.0.0.1
+ # 5. localhost
+ # 6. kubernetes-etcd.kube-system.svc.cluster.local
+ # NOTE: This list also needs to include the Genesis node, which is not
+ # listed in baremetal/nodes.yaml, but by convention should be allocated
+ # the first non-reserved IP in each logical network allocation range
+ # defined in networks/physical/networks.yaml, except for the kubernetes
+ # service_cidr where it should start with the second IP in the range.
+ # NOTE: The genesis node is defined twice with the same `hosts` data:
+ # Once with its hostname in the common/document name, and once with
+ # `genesis` defined instead of the host. For now, this duplicated
+ # genesis definition is required. FIXME: Remove duplicate definition
+ # after Promenade addresses this issue.
+ - document_name: kubernetes-etcd-genesis
+ common_name: kubernetes-etcd-genesis
+ hosts:
+ - pod17-jump
+ - 10.10.172.20
+ - 127.0.0.1
+ - localhost
+ - kubernetes-etcd.kube-system.svc.cluster.local
+ - 10.96.0.2
+ - document_name: kubernetes-etcd-pod17-jump
+ common_name: kubernetes-etcd-pod17-jump
+ hosts:
+ - pod17-jump
+ - 10.10.172.20
+ - 127.0.0.1
+ - localhost
+ - kubernetes-etcd.kube-system.svc.cluster.local
+ - 10.96.0.2
+ - document_name: kubernetes-etcd-pod17-node1
+ common_name: kubernetes-etcd-pod17-node1
+ hosts:
+ - pod17-node1
+ - 10.10.172.21
+ - 127.0.0.1
+ - localhost
+ - kubernetes-etcd.kube-system.svc.cluster.local
+ - 10.96.0.2
+ - document_name: kubernetes-etcd-pod17-node2
+ common_name: kubernetes-etcd-pod17-node2
+ hosts:
+ - pod17-node2
+ - 10.10.172.22
+ - 127.0.0.1
+ - localhost
+ - kubernetes-etcd.kube-system.svc.cluster.local
+ - 10.96.0.2
+ # End node list
+ kubernetes-etcd-peer:
+ certificates:
+ # NEWSITE-CHANGEME: This list should be identical to the previous list,
+ # except that `-peer` has been appended to the document/common names.
+ - document_name: kubernetes-etcd-genesis-peer
+ common_name: kubernetes-etcd-genesis-peer
+ hosts:
+ - pod17-jump
+ - 10.10.172.20
+ - 127.0.0.1
+ - localhost
+ - kubernetes-etcd.kube-system.svc.cluster.local
+ - 10.96.0.2
+ - document_name: kubernetes-etcd-pod17-jump-peer
+ common_name: kubernetes-etcd-pod17-jump-peer
+ hosts:
+ - pod17-jump
+ - 10.10.172.20
+ - 127.0.0.1
+ - localhost
+ - kubernetes-etcd.kube-system.svc.cluster.local
+ - 10.96.0.2
+ - document_name: kubernetes-etcd-pod17-node1-peer
+ common_name: kubernetes-etcd-pod17-node1-peer
+ hosts:
+ - pod17-node1
+ - 10.10.172.21
+ - 127.0.0.1
+ - localhost
+ - kubernetes-etcd.kube-system.svc.cluster.local
+ - 10.96.0.2
+ - document_name: kubernetes-etcd-pod17-node2-peer
+ common_name: kubernetes-etcd-pod17-node2-peer
+ hosts:
+ - pod17-node2
+ - 10.10.172.22
+ - 127.0.0.1
+ - localhost
+ - kubernetes-etcd.kube-system.svc.cluster.local
+ - 10.96.0.2
+ # End node list
+ calico-etcd:
+ description: Certificates for Calico etcd client traffic
+ certificates:
+ - document_name: calico-etcd-anchor
+ description: anchor
+ common_name: anchor
+ # NEWSITE-CHANGEME: The following should be a list of the control plane
+ # nodes in the environment, including genesis.
+ # For each node, the `hosts` list should be comprised of:
+ # 1. The node's hostname, as already defined in baremetal/nodes.yaml
+ # 2. The node's oam IP address, as already defined in baremetal/nodes.yaml
+ # 3. The node's Calico IP address, as already defined in baremetal/nodes.yaml
+ # 4. 127.0.0.1
+ # 5. localhost
+ # 6. The calico/etcd/service_ip defined in networks/common-addresses.yaml
+ # NOTE: This list also needs to include the Genesis node, which is not
+ # listed in baremetal/nodes.yaml, but by convention should be allocated
+ # the first non-reserved IP in each logical network allocation range
+ # defined in networks/physical/networks.yaml
+ - document_name: calico-etcd-pod17-jump
+ common_name: calico-etcd-pod17-jump
+ hosts:
+ - pod17-jump
+ - 10.10.172.20
+ - 127.0.0.1
+ - localhost
+ - 10.96.232.136
+ - document_name: calico-etcd-pod17-node1
+ common_name: calico-etcd-pod17-node1
+ hosts:
+ - pod17-node1
+ - 10.10.172.21
+ - 127.0.0.1
+ - localhost
+ - 10.96.232.136
+ - document_name: calico-etcd-pod17-node2
+ common_name: calico-etcd-pod17-node2
+ hosts:
+ - pod17-node2
+ - 10.10.172.22
+ - 127.0.0.1
+ - localhost
+ - 10.96.232.136
+ - document_name: calico-node
+ common_name: calcico-node
+ # End node list
+ calico-etcd-peer:
+ description: Certificates for Calico etcd clients
+ certificates:
+ # NEWSITE-CHANGEME: This list should be identical to the previous list,
+ # except that `-peer` has been appended to the document/common names.
+ - document_name: calico-etcd-pod17-jump-peer
+ common_name: calico-etcd-pod17-jump-peer
+ hosts:
+ - pod17-jump
+ - 10.10.172.20
+ - 127.0.0.1
+ - localhost
+ - 10.96.232.136
+ - document_name: calico-etcd-pod17-node1-peer
+ common_name: calico-etcd-pod17-node1-peer
+ hosts:
+ - pod17-node1
+ - 10.10.172.21
+ - 127.0.0.1
+ - localhost
+ - 10.96.232.136
+ - document_name: calico-etcd-pod17-node2-peer
+ common_name: calico-etcd-pod17-node2-peer
+ hosts:
+ - pod17-node2
+ - 10.10.172.22
+ - 127.0.0.1
+ - localhost
+ - 10.96.232.136
+ - document_name: calico-node-peer
+ common_name: calcico-node-peer
+ # End node list
+ keypairs:
+ - name: service-account
+ description: Service account signing key for use by Kubernetes controller-manager.
+...
diff --git a/site/intel-pod17/profiles/region.yaml b/site/intel-pod17/profiles/region.yaml
new file mode 100644
index 0000000..f8ac846
--- /dev/null
+++ b/site/intel-pod17/profiles/region.yaml
@@ -0,0 +1,53 @@
+---
+# The purpose of this file is to define the drydock Region, which in turn drives
+# the MaaS region.
+schema: 'drydock/Region/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ # NEWSITE-CHANGEME: Replace with the site name
+ name: seaworthy
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+ substitutions:
+ # NEWSITE-CHANGEME: Substitutions from deckhand SSH public keys into the
+ # list of authorized keys which MaaS will register for the build-in "ubuntu"
+ # account during the PXE process. Create a substitution rule for each SSH
+ # key that should have access to the "ubuntu" account (useful for trouble-
+ # shooting problems before UAM or UAM-lite is operational). SSH keys are
+ # stored as secrets in site/seaworthy/secrets.
+ - dest:
+ # Add/replace the first item in the list
+ path: .authorized_keys[0]
+ src:
+ schema: deckhand/PublicKey/v1
+ # This should match the "name" metadata of the SSH key which will be
+ # substituted, located in site/seaworthy/secrets folder.
+ name: airship_ssh_public_key
+ path: .
+ - dest:
+ path: .repositories.main_archive
+ src:
+ schema: pegleg/SoftwareVersions/v1
+ name: software-versions
+ path: .packages.repositories.main_archive
+ # Second key example
+ #- dest:
+ # # Increment the list index
+ # path: .authorized_keys[1]
+ # src:
+ # schema: deckhand/PublicKey/v1
+ # # your ssh key
+ # name: MY_USER_ssh_public_key
+ # path: .
+data:
+ tag_definitions: []
+ # This is the list of SSH keys which MaaS will register for the built-in
+ # "ubuntu" account during the PXE process. This list is populated by
+ # substitution, so the same SSH keys do not need to be repeated in multiple
+ # manifests.
+ authorized_keys: []
+ repositories:
+ remove_unlisted: true
+...
diff --git a/site/intel-pod17/secrets/certificates/certificates.yaml b/site/intel-pod17/secrets/certificates/certificates.yaml
new file mode 100644
index 0000000..eb4382a
--- /dev/null
+++ b/site/intel-pod17/secrets/certificates/certificates.yaml
@@ -0,0 +1,2525 @@
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDSDCCAjCgAwIBAgIUKYDWHOar6ZsQ9ppv2nhGUQcmXWAwDQYJKoZIhvcNAQEL
+ BQAwKjETMBEGA1UEChMKS3ViZXJuZXRlczETMBEGA1UEAxMKa3ViZXJuZXRlczAe
+ Fw0xOTA4MDUxNjIzMDBaFw0yNDA4MDMxNjIzMDBaMCoxEzARBgNVBAoTCkt1YmVy
+ bmV0ZXMxEzARBgNVBAMTCmt1YmVybmV0ZXMwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+ DwAwggEKAoIBAQCpZGUxEqLrgHW4w3GA8Ix5pYUBvE/WinjcanDiTQOGDxaaqN24
+ wMTWoYQQ7Bal4HZ3T42//G61PJJFEobelfKs0EwRKacKBKvfj89xz2FaMQ6UvITV
+ wxwSQYCZgZqGMd8/wWWcR4h9LQHEGuPXEOJAhtH8lASKu2KEM8W9AZQCNwdsWDLf
+ 2aG55tGm9U8IqlVho7YFcpSCsjOlxilnndAodJZPpnZ00stMWtfPp8ZgV9xJX1sS
+ /Yo/BmwcofVzmgAIy4qE6Qrd8CZuEJIGjG/VIigmsIrVixOu4+3aRDFkIugjOufi
+ yKUZ6cbaz/2un5bdgFqPqORB+f+ki4I+QD/TAgMBAAGjZjBkMA4GA1UdDwEB/wQE
+ AwIBBjASBgNVHRMBAf8ECDAGAQH/AgECMB0GA1UdDgQWBBRKoDdKith5IO42xJ88
+ bx6fCL2bNjAfBgNVHSMEGDAWgBRKoDdKith5IO42xJ88bx6fCL2bNjANBgkqhkiG
+ 9w0BAQsFAAOCAQEAc/cYd90vM8g3/I8eCdT+oKiImfHiaIZtaUnjedSGqtriLY9t
+ Arl4Lscfsu7yQA51E2BW9qESU8+Gi1E3NKznOmNs83n3pmAmmKUo8+M4vsvgz4HO
+ wb5XbHBh8nvQDkBBr8XkD48ElAl5rJMeClj7AEqVJ9ZXUltEW7EjjqJQ0KJpwfy0
+ k2WEQEwwyJ4Hi2UVDotabpIpfilCFdWz+uHGOWGi692PZA6tTP04Xx8uab9lWxDi
+ dkBIdqjf35ej34TdflW/pY+IpIT2J8cb1qvlO7TmoyOz4seGW7BXMI9Om72e8LP0
+ w/Cy9UelgAcNzMIGIIynHQpaFwl6csJJIrDXcA==
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateAuthority/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDUjCCAjqgAwIBAgIUXRyYMUbFIX9w+JjAKebJAXB2reMwDQYJKoZIhvcNAQEL
+ BQAwLzETMBEGA1UEChMKS3ViZXJuZXRlczEYMBYGA1UEAxMPa3ViZXJuZXRlcy1l
+ dGNkMB4XDTE5MDgwNTE2MjMwMFoXDTI0MDgwMzE2MjMwMFowLzETMBEGA1UEChMK
+ S3ViZXJuZXRlczEYMBYGA1UEAxMPa3ViZXJuZXRlcy1ldGNkMIIBIjANBgkqhkiG
+ 9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqBEQbaKoG+0cD4/BYqufo9zgI26X2n1ragGH
+ X8fO0ONbOABevwt6sqaEA3qJSZ/9P5byD4kZjwpvTVSDl5ZDRY0cMWdquU7MBMwU
+ XDJoB2NRoaPW7oGx8AaiT7tcxyVGKUVCiM5C3BS3NU6U1tNQYWB90Y41GHXH2q0z
+ nWt8Pln4dRGC/4HhlLfWZbqG+uUdqmdT+FVdxgA3JdvQfbsO8GVkS7fv2LDOn0C0
+ F6E1rcnCVDEza7jqocNUWTukhiDTiETVRbT29H7RHKfMXsVsMYC6a/jQG/Y1dwus
+ HB0VAUbiKKU+55cDjHQ9Mg4Rv41gQUX1yK7eF7l1/4H+E+gtJwIDAQABo2YwZDAO
+ BgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBAjAdBgNVHQ4EFgQUSkqk
+ mO9ScQrpng9HFA/0CMmeq4MwHwYDVR0jBBgwFoAUSkqkmO9ScQrpng9HFA/0CMme
+ q4MwDQYJKoZIhvcNAQELBQADggEBADiOSywzguhl/dNGoYWd5g94reGU8hjBemYd
+ UPusRbTZOmCwAdrs2SDu4mufPwXSWAcj4Apn/SdofnxhgSK/DgRlDxOe46Y33sce
+ gRbYAPu1TWuac2U06lI7ATstspEULC9DAyipdgYDTl6dMhufDDSY+T3GoSR5V+Za
+ S5N899o7+zRxXjVJGw/2FuW6YxgW6Czy30I3RfP1GOoJiRL0pUrxc3GzekL6YlI8
+ SAoKvnUrRqJOzutepeWMbVSCxKw3KHZoeiJWTBAFqmSjaRE0R8Ts1IO/DNTERYg4
+ bmqZdWXaFDU9gw1hwe5S+Kv/EHJRYIB3CrFJ/yQ0OU5Wdm6kRb8=
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateAuthority/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDXDCCAkSgAwIBAgIUGnkMT14tcuVvsnecVFwV0PFkfpYwDQYJKoZIhvcNAQEL
+ BQAwNDETMBEGA1UEChMKS3ViZXJuZXRlczEdMBsGA1UEAxMUa3ViZXJuZXRlcy1l
+ dGNkLXBlZXIwHhcNMTkwODA1MTYyMzAwWhcNMjQwODAzMTYyMzAwWjA0MRMwEQYD
+ VQQKEwpLdWJlcm5ldGVzMR0wGwYDVQQDExRrdWJlcm5ldGVzLWV0Y2QtcGVlcjCC
+ ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKL8PFbG7CoYtT8vJZMkZAV5
+ UNJx56cdlLVjJ6fZNOo198lQ5ysav/VpBRGDTXP57hwIQyowP+87W8fb4l8OnOrC
+ S8DQ6kU7qfuBgjTlQ1bWMDAW1pmsHCJmaW0edvSK7F0tt+ki+3AuTxYD7+If/z2X
+ TcLcruqfS7zggPI/5GNRcbzXcFH1ONnJlo92YY9QG3bgSnBqScq01u00gCCLfs8I
+ VTzT0ObsZCZVl/aVKv3dEbfSKKvv3E2TQeGH8RVBL/mVjACeWH1yD4N/yd4Ohzwn
+ NxuQ0+pGMCYHc75xESqUjoP5yyeKfT/Ywz47RQ05qko9BpTN7FqvF4UjnLS6zMsC
+ AwEAAaNmMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQIwHQYD
+ VR0OBBYEFIZCZKq3pZiIt7X1Y6CVvK6OCZjRMB8GA1UdIwQYMBaAFIZCZKq3pZiI
+ t7X1Y6CVvK6OCZjRMA0GCSqGSIb3DQEBCwUAA4IBAQAGdhNPduKFlI7gRumaZreG
+ Wnw0zddci9D54JweCV0Vm7inCTy/xLsXzdLwfR9RKp3fuAwSLTaBmrtlw7j69MY1
+ g3HlUTNR9B7YgM7iKyChf0Vvsa0vZSn1Voy3yi5JrFqPrGQo5YcIpakwB8FAW5g+
+ mah/D8FyHTBaqqNq1idrfscWCefnsjs2+FSVbyxIwPEHa/71ORnI+yo/5XsHNar7
+ VDdRSyWbwXXcUf3oXUwb0c71qR/EFIcw5HVO1LTEVKDgPQmTsghDiyxGs71smWk0
+ yH17RjNP2pQmkQw+1cz8tD5gpsyoQGJ3W/MFxE4n2Sz8wZd2wAHrZ6A8CwE45gDg
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateAuthority/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDSjCCAjKgAwIBAgIUZkqKs5BY/wzgvv5l8YhQpbWvP7YwDQYJKoZIhvcNAQEL
+ BQAwKzETMBEGA1UEChMKS3ViZXJuZXRlczEUMBIGA1UEAxMLY2FsaWNvLWV0Y2Qw
+ HhcNMTkwODA1MTYyMzAwWhcNMjQwODAzMTYyMzAwWjArMRMwEQYDVQQKEwpLdWJl
+ cm5ldGVzMRQwEgYDVQQDEwtjYWxpY28tZXRjZDCCASIwDQYJKoZIhvcNAQEBBQAD
+ ggEPADCCAQoCggEBALbKO5hAK05sYVaZz3jsF/DN8dJ3MH7e++C8zUOafkYDAFXC
+ 32wOc5QWO3bs1RNfJcap/4OnRQl8++z9A20FCUH+PCeN+dElUIanFdiqfnQYQb73
+ pWQ/CxmWjLPLRt5+ZWvsxBwSJsnN8YT80GeUmxAXY6mLL6qSqlHih5YxlYvA88QZ
+ sWkqJA2jbQM+8+Lvcav5mruRCsxiZ4dOsU4DYNX/TNiDoackXL2U15ywQp0U4Gw8
+ sqExGuBMBHO/B3U126hHKCxPJwNxEEjoiSvNU7WVh3+AfXQzC/oUy/A9eMnQuVGH
+ e36x8Tz2vWPbPaJoAq1SbKbyhyEDCYnnwbkvEeECAwEAAaNmMGQwDgYDVR0PAQH/
+ BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQIwHQYDVR0OBBYEFG/YDADw6yQQ8uH6
+ vaVmB9X8yo2MMB8GA1UdIwQYMBaAFG/YDADw6yQQ8uH6vaVmB9X8yo2MMA0GCSqG
+ SIb3DQEBCwUAA4IBAQCcw3UYZ1sD7Vx+neXZKiYgw7QqZL7eF1CQ4klL3HWb6lvP
+ AbcOGr7MoXyN2Df+uAoZ+GZZh+SrXFLacBXdYp+C4YaetZZ2tUGI39Ua+UvZ0LsD
+ /2h47hMK5DT0GK6MaKBX4+mZ/MfZu/qjfON5qH+FCs4N+dnCuwhCJgJM6AsoHOBw
+ kXrAbtsay7d6YyheJpVALNTrFCv+z9SBHINHDb6VXDHVAPobgsTu9gW/QrMTv1a3
+ 935rCW2gG/5uREK1M+1qfDDYcIvXbKGt+6+aHelkesmFheheXbD9G162bU9sCe1J
+ Angeom5UY2YlSkjkexXBScmiX4dqoFdshuqP8vNr
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-etcd
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateAuthority/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDVDCCAjygAwIBAgIUPGN7DgZ0kZUBtBPpGSojEKhC6AEwDQYJKoZIhvcNAQEL
+ BQAwMDETMBEGA1UEChMKS3ViZXJuZXRlczEZMBcGA1UEAxMQY2FsaWNvLWV0Y2Qt
+ cGVlcjAeFw0xOTA4MDUxNjIzMDBaFw0yNDA4MDMxNjIzMDBaMDAxEzARBgNVBAoT
+ Ckt1YmVybmV0ZXMxGTAXBgNVBAMTEGNhbGljby1ldGNkLXBlZXIwggEiMA0GCSqG
+ SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDQa57iWnyX5JVRNyuhjx06VLrSiLCHOqvt
+ JdyDBNgmrfW71LG6G/mE1pIIBzZkZRFO2eF36tQyHpcxdY2P1zse09Xsnnb5u/7U
+ eFhQWi1jQ/TJafcEB+MKPZMbccpoaGpXc0uePlqkzcPH1AiBtCquLEzslCY0VYw+
+ a1bDT3xqIDn0jBssTTIpPLgradpC4T7uJJl6JMwBPh5n3858B9K4jVh+Q+3Ul6cM
+ 0MdxNJlWH6lxybsdW0aMd/qyQh7GBUf4zs8fOnFfWQf23dCDml+xGoIvyJk04cGl
+ PfWj0vqT9KHM/hPIkW/nnqs5wbzS+1CPk5FJOUleIIZ5ZdA13MRbAgMBAAGjZjBk
+ MA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgECMB0GA1UdDgQWBBSv
+ APyGdVXJeVcR6Q7O3jk1ILVLhDAfBgNVHSMEGDAWgBSvAPyGdVXJeVcR6Q7O3jk1
+ ILVLhDANBgkqhkiG9w0BAQsFAAOCAQEAhW0xsLPrmKaXtpuc1hDNaift5UDnGLDT
+ vSZQd+fdV4l5rvnK85TOY3Z+Qij+p5fvX2uGi6Ge7OVUYiPDi+fmCoxn5fIfu3e7
+ QNLw9qMMwyauLFBeNWL1iEe9YBcCn0GDS637I62B2gIOU7AVvOkrwwvRMMFJXae/
+ uX9SPL7ohjnwWyPjp89KVhhaxEkoM/Jv0MaOU8gIKZqrgmnuR3qs7vYgnw3zMMJZ
+ Pg7fHZ1Jq4nDrvqMKjMBd2Gx+T+4pX7aJqvjTk3lddtWdSXLg96sFVoFSI5QDRpH
+ 3tdkWPZ2hwHLasSIuDi2gKlMklEUUkePpU+KdlVceeuMvanRTNMSKw==
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-etcd-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateAuthority/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEpAIBAAKCAQEAqWRlMRKi64B1uMNxgPCMeaWFAbxP1op43Gpw4k0Dhg8Wmqjd
+ uMDE1qGEEOwWpeB2d0+Nv/xutTySRRKG3pXyrNBMESmnCgSr34/Pcc9hWjEOlLyE
+ 1cMcEkGAmYGahjHfP8FlnEeIfS0BxBrj1xDiQIbR/JQEirtihDPFvQGUAjcHbFgy
+ 39mhuebRpvVPCKpVYaO2BXKUgrIzpcYpZ53QKHSWT6Z2dNLLTFrXz6fGYFfcSV9b
+ Ev2KPwZsHKH1c5oACMuKhOkK3fAmbhCSBoxv1SIoJrCK1YsTruPt2kQxZCLoIzrn
+ 4silGenG2s/9rp+W3YBaj6jkQfn/pIuCPkA/0wIDAQABAoIBAAy2y12Wj4Hrn2ph
+ yQgrhe+ve784mil5NT8eAiEKNMSAJ2suV44BcgTGFLqMbdq/cUTdRL9vPAQAat4i
+ WNsmGBPegocbQD1hQmFCUwiwzxbM7dI+IB5HSbkZD4T2FFoULjSD2JOVTupOUX6d
+ ohJHYyQCuoohtgGPtQJFPIdGMgzEY050cFUeniu8KIhl3Xa1BdLQWuHtNtOSPmbX
+ 6+9SaN+6pR5VezmQXwwS0wDX8r3/fuSW5E1D3heg/ISj9Fh4H2tRWR3poAN47cBO
+ Mf4N6mQ5ObbBYKV80QQUs0f9RFpN2hlg4kJ6RzvAXae9AdG4bA58dSQFaPnga1p4
+ BY0mFXECgYEAxgOlYpzU6G7TxmlB93J0VI1n0jrHB+8FOe+6vhn02nwUd+Ixazfz
+ XMQrnka2evpjqoMl5qbkhEwD0n04JqY0y/WcCYjvm3SDfcc+hWfzpy4AOSnhWFqC
+ qhPdB89mVuw/gh0UH3SMiq6rAgQbVR1FKkYII6PFRn3yMd11S2gGbykCgYEA2v8Q
+ cztRk4ssopr+PUZ0orELJCeCjVEOjsIMu1U9iFLVlotMeSaD6H9yqymM0iQAvhP8
+ 7y8K2VKOo/JYbRhqxyA1XLJYyDE4jVEbuhDwtqOCbLmDTCUV6uLPJEAGsH3qJKVa
+ KxXjv8IgQB+VZ1HmboWk4w4a1YqAlXkN/YdLopsCgYEAuaQ9b4BdUzRkM0YHZHfX
+ fFW+Giik5FlAaxrH1uX62sMtZV+YuU6RSE1aH19oQU9yFTAzXlTlNOsXQkXHWOTF
+ 5tnzWjUZfoLzq/4aLXRRyFCmQPF0pSLmEZHhzSqyZZfDyrZ8YSkhgftTs+YpwdhZ
+ OdLCWrd1gisd34YiK3nxXlECgYEApOEww3E/w/Qe0PYcwImROwRMvRW6JyeF7FmR
+ OGG/CCpFgSizlOs4mQ2Lie6ohXZx0Ko/3tzuMB0GI81MYibmDbHkOzxTt7XHPC56
+ z6X9daS5h55MikHJtKS7DDHgV3UVmi2cK6A5bqB7o4uj8rwo38FjGUf/UBMNKHyR
+ 2fXJLk0CgYBP4hiCgEGFZkmaVzOCbgH8zNBVb3vc8Yau8Yf/q27pEOnnU3dy6NJ9
+ zzp6cliLnAILmNfTNruTRWWgHs94MNReSSRe9yyEzyGdC4t5fyg2UcJTOVSjR3CL
+ HM76WBcoqsshKzn2NcY6kCLLiVNZC5sJOIbaLDlXmAriGWDrmDVR/w==
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateAuthorityKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEpAIBAAKCAQEAqBEQbaKoG+0cD4/BYqufo9zgI26X2n1ragGHX8fO0ONbOABe
+ vwt6sqaEA3qJSZ/9P5byD4kZjwpvTVSDl5ZDRY0cMWdquU7MBMwUXDJoB2NRoaPW
+ 7oGx8AaiT7tcxyVGKUVCiM5C3BS3NU6U1tNQYWB90Y41GHXH2q0znWt8Pln4dRGC
+ /4HhlLfWZbqG+uUdqmdT+FVdxgA3JdvQfbsO8GVkS7fv2LDOn0C0F6E1rcnCVDEz
+ a7jqocNUWTukhiDTiETVRbT29H7RHKfMXsVsMYC6a/jQG/Y1dwusHB0VAUbiKKU+
+ 55cDjHQ9Mg4Rv41gQUX1yK7eF7l1/4H+E+gtJwIDAQABAoIBAFW1jhk7UFwdiaft
+ +gNl3t3kMHIhXlPQjkzbRrxz22bv638dwTPQmNwuyzgy73yamL4rLnr5wg0Ol0Bq
+ j0lpGhmIIw6W3Phv1N/Fa8Sw+Bh8cA7szRmJDsOHvpLGzEPLIIK/jXTTK4mtDtmi
+ n4kG7wEaAlAyI6W7uxYsKhxnyk7JI5XzFM24seF8VAtFRxkD46DZ1JNkoR4RMRMc
+ aArRNOEhc+3clMEs9QPpUqGXdJEYuJsOaMY5vZdpgWdmF4Mv9/6NTYEpTJVDXnux
+ YXwHqN98aS7OAMHxBQRi0PFGsqyfXK8wxWsn3HsSOOoZPdHPi6BFPmio+XmTRJfr
+ t4813EECgYEAyAniEezx0HzajgCIwuRtxc0Bl2/FkklvA+8lfhW+1GePSnmsx31z
+ 3jyo7kdR8R9K+fTb3UX82CE0hBntgsv8sbjSd7ZTW5tM0mtzGH7l6eZYI25fDUim
+ fjGwu1iF+oIHbNzL8Wkx41VVdZ22abKrNXm9cKMUjvilBDzpQ1kgXfcCgYEA1xV0
+ JIv00xRazAlkLcXlChlA/W6GamNJvgjR132PfrPdlXen9fU6t1w3q7+oLfTdKrlD
+ 0AXCanTcYkdd8xXkYS6dhPUn/jrZJSqBNpkipXUzN1vKJIBb/p4CTvYdqw4B+Nal
+ OlhgzwA17VbF7M91SD1gq2ZYvdwszPooOpO0nlECgYEAxqix//VdbR0he9bh+xMa
+ RU9EHl3dS1tsSe7tQBteadjzABZ4VaGsOW/qoMDpitn1/uiClWyVHxtS6UJKkxP8
+ P496TXMfs6E2mN4m7pPPxwuASqeo9CtLVZYJmvTeEZuiviVE0NoUtl0fwu++oZfT
+ 2gat8Te0Cgy67MuFKOJRd58CgYBD0DDRQQtM7fL+t8tNH0LqnzG9dfaNXoamkvNO
+ ZPk0MpOfh51+T/ZWT44B6ail7Lk6ujTmRpqYpAXEOsolVXavKVpizETyxC0oqbEZ
+ vMiOsFgYkSk3vvzCV6FUsgaCoyT+BvcLYUgMm/1kumInGvXYc/mhsOAz5FJ/wjOi
+ 3GUrMQKBgQC7tv2DEH81u6tU2ZB/3E3QQtUmctEqARvaV5ZO/fHCGOq16X3OGi/S
+ IgysS3v8zInt3zTydTjeGp2SFcs8FnKEDu9jGLBIm7zsSfiJUbdevnaM2Wj9Eqn9
+ hRDMoo+tSmEhnN9O8K52eA5syOQ0N++CYTxHN1FaPV+uhMyN0JEQFA==
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateAuthorityKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEogIBAAKCAQEAovw8VsbsKhi1Py8lkyRkBXlQ0nHnpx2UtWMnp9k06jX3yVDn
+ Kxq/9WkFEYNNc/nuHAhDKjA/7ztbx9viXw6c6sJLwNDqRTup+4GCNOVDVtYwMBbW
+ mawcImZpbR529IrsXS236SL7cC5PFgPv4h//PZdNwtyu6p9LvOCA8j/kY1FxvNdw
+ UfU42cmWj3Zhj1AbduBKcGpJyrTW7TSAIIt+zwhVPNPQ5uxkJlWX9pUq/d0Rt9Io
+ q+/cTZNB4YfxFUEv+ZWMAJ5YfXIPg3/J3g6HPCc3G5DT6kYwJgdzvnERKpSOg/nL
+ J4p9P9jDPjtFDTmqSj0GlM3sWq8XhSOctLrMywIDAQABAoIBAC0FTcmOozexoYc1
+ h8SQXcyhSTEIY7vm0OgV3qNfvV0g0TRb0681cWbhvpOq2F8734kAw0TJFTAJDn4z
+ f+FQEQpL5074pm2/YGHn0Ua5OZOoEKGH/XlvcEoUTfTlYGiGY2oNseqFTj0bnZ7w
+ MXgd7Ixf2gwEl5CZtfsTbKr9+SFxsgamsbPD0btDHctWV8S61OPE8O5qiFFrfuQK
+ rYhA0VmsubAG7TurKwQK1pxgfhMP9WNx9ZQIEqYvISZY8SPD7ZO53lSgW+6xMeWb
+ z5Y6oI/7ZPsEnekOTZy11hSvAFsT/zP10OvYOJ4S/w0LiDuCoTYr1HrgmFNYZkKV
+ I1o8vrECgYEAyyLikrjmSMFz7bqjc7FYXZJagOyGfp7Db+sACPYpHSnAZb3i4Alr
+ ffwZk0oIHB/vthT9ELEVum74BHd622O58fcla5CFnKJiYo0KdnssMWNBB88pGTcQ
+ bJsZXj9P3urs+McrXwQe3iEiesR6a3ZY0EY7uxmWBi0Behu7ek6KctMCgYEAzWZ1
+ NQNPCItR1y4cNTkZllhXnruSW44WFJ0hBvgtf6Hi0fGsze2FGn+8HXXvkvsy/1u9
+ OQrZz8Ly+2G8FzJTiWp0gnyWeGpEthnNMm+8TFXv6h0F/FH/6x+/KoRyFX+N3z6f
+ i7FBchcCr9HUzKZEGWZX1JXcCMwULFaQnzDcUykCgYAPio23F/pWWqaZ64uR0GGo
+ VwghkPcBPPhK2bnY9axTlNwpbIutBEt7CgyS3jkcnbzjO1vZKRM2fkLvZIy7uDeD
+ sZrlTdtLDolkbNH+GpJY/PT+ufS0/yd8h6k7MrDTpzmWFvbUgCY0bGiM5/dNvXIy
+ DQ2I1P5LXqocQ37mbpfdDQKBgEN1ZwEmOQrBVvuo9TK1siWilgRX7lWLcM0MXhB/
+ 6dGFRY1WJj7rx09QrGOwnCJVxgYAB0F4wthtWogdLT0hFjaHdAR3DqQ1oqN8DdyG
+ vf0ELGtjZNfdxoNeRdac8SsGXX34f0XNzYS+8e70p0MfSDZfWnFDVqS9AdMeCxl9
+ Xp8hAoGAd9DwL85VnZxfy/Ri4LegqZ9ZkB2pvjhcvaFdlHshpq+VI+pIu82oAiAk
+ EV/EFH1mn/7dlF7kL8JPS2dJSoVtRdfMIMuU+xbEg0PhjmwZAQ9e8S5H4NSKBAFR
+ 4W0KcgMpttk1CqAd6JXuD7P93cA6zn9k7XqNo453w4y5t8hhaFk=
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateAuthorityKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEogIBAAKCAQEAtso7mEArTmxhVpnPeOwX8M3x0ncwft774LzNQ5p+RgMAVcLf
+ bA5zlBY7duzVE18lxqn/g6dFCXz77P0DbQUJQf48J4350SVQhqcV2Kp+dBhBvvel
+ ZD8LGZaMs8tG3n5la+zEHBImyc3xhPzQZ5SbEBdjqYsvqpKqUeKHljGVi8DzxBmx
+ aSokDaNtAz7z4u9xq/mau5EKzGJnh06xTgNg1f9M2IOhpyRcvZTXnLBCnRTgbDyy
+ oTEa4EwEc78HdTXbqEcoLE8nA3EQSOiJK81TtZWHf4B9dDML+hTL8D14ydC5UYd7
+ frHxPPa9Y9s9omgCrVJspvKHIQMJiefBuS8R4QIDAQABAoIBABFsb4fQvhAIprKh
+ kLQ/FP0gNGfScq31RV8jwBEsndLAoHyMSc28BupbwClS4/CnxisMs01yWVNRNZZe
+ e8AdlcdTm5pNnz1/aBCdxqhTgCBC26l/Y6WNmNpEjn7o5oV42OQTupHObSIZXmdF
+ zfvBn5JGGHrlyJJizpdll3UKnu2mOnEmv9Ckf8B/w9d6PNTCxnyHk1Tt3iFmM4cA
+ ip1uO/QQkuyuFlc/JYPwoKW6IBiVahs08yz6m6nFO1WvAEbzVva9WOFKk4l/AWCk
+ kAHiHOTNS/VQGGUjWQpcWT6Kf0FJKAzfHG4yxYeM/ciTsLNUxF0rKHMOeuU50dwG
+ 7P5l/p0CgYEA6+bLlG78gmLxweSpXzvxKOdxshOpS6xos3VCDBvZl5mIbMXv92NJ
+ C4eKCnj8TCURAB9FM02Ec5pyWO+swHWR2ZuFsNFwLBNU7OHd/Ee/7t23zxAnUO2l
+ CiufyYAc0QOPSG5QpZdvvrEh7fBNpShz/XxNri5FP8mZFDmPVL7nzucCgYEAxl0H
+ 6pjhMDGzaqYE0+zMPOl99NjeJ6cx2TsRNbEAYYEf6reE/ld3S6zgm/MHSBy7hM7+
+ M83ieXEriwXCH2oKIgK+cwajm5NEy5j09+lVcgBOIzP3cwrEAs1LL3qrgLrOMT63
+ FuznzrTfH6AUHtkMQHNiW3Sp65mblMWjVe8M5/cCgYAfgMLPH8M45l3CtvancSnT
+ fJUCYv3IzU1uKcqYM1/rjuVZIVXag7fNglw86ctHn+uVSJfFMiTuC0IZ/mfji8/e
+ b5Z69n00ZaCBwegTOMG49IMHc/DMLfBMW2cLUcCHaSJJWfILKx4RKTaOv/iehbh3
+ sZHuIN++lP2MZeNuPdBXIQKBgHjqSqIRcOtc0H5JFxZL+S+EMRhoffrz6un9HH97
+ Fr1Y5ajBF5umm3yQtBW77gtiIFhTiRbxAIWAm8dRykQ18llLDOa2/FIgUkY9Rc48
+ +K3WS8sfqU4CGPuQQq19fD+rH3dbQGYEIUWacYwomzs2mUZMT39qPQ31g6YLV4ZR
+ gq9/AoGAJck7HiHVlC7iDQt8ODD01kYLZNf7TVEa7NFKfJTUXqPNTF2XBaHtdMmc
+ 647rhCDPr4yYsm6iV81KdLpRwo4c6wLKYklzbk4kjE9Q/LGD+5VK8h5u1V/mwnT6
+ F2shi9uzLjSc/d6b6z5bP1WS20X5PqMl4JG4PDpYqH81/NmzxDM=
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-etcd
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateAuthorityKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEpAIBAAKCAQEA0Gue4lp8l+SVUTcroY8dOlS60oiwhzqr7SXcgwTYJq31u9Sx
+ uhv5hNaSCAc2ZGURTtnhd+rUMh6XMXWNj9c7HtPV7J52+bv+1HhYUFotY0P0yWn3
+ BAfjCj2TG3HKaGhqV3NLnj5apM3Dx9QIgbQqrixM7JQmNFWMPmtWw098aiA59Iwb
+ LE0yKTy4K2naQuE+7iSZeiTMAT4eZ9/OfAfSuI1YfkPt1JenDNDHcTSZVh+pccm7
+ HVtGjHf6skIexgVH+M7PHzpxX1kH9t3Qg5pfsRqCL8iZNOHBpT31o9L6k/ShzP4T
+ yJFv556rOcG80vtQj5ORSTlJXiCGeWXQNdzEWwIDAQABAoIBAGwuQFUbRKqOslZq
+ fZIpN7GMQ0B+RKqccJryWQgEnrFNAEzTdMC2PoiN21ShccEgmKBGBXr5/9RX/oBk
+ lOsBe6VfrR1Zj0XHJ9le8fAbLo3kuw1EnDuSYG1zUoUfRkF1WSU1Kh3kHaaHS0TQ
+ sO2p97FaOz9dEot9kALiMjHEcz6dtSLYbKNTJBPvAxsZll8EZFpuHyOMGwDY6p3k
+ oafELM+NMAyxVqjZn0pBL1svp9SU8UEyICNC7/Bu9H81mAyXzh7HweNC6LPiydsd
+ 7LxvQiiuXz83u1+vcmeElKR+RkfEaWgHWv3uxw0LVQqJQnreU2epewkdefVUwDwB
+ vgFL5okCgYEA1nK3XfZVVJVwMWk120nRZ5OxEmDYeVOnYWIrZ4bU3uJjVHMv77Yi
+ WCAA3A+OMqEvwmlrAxcvfS9ZCi2FIr0Gu2UO0L4pYri5xQLgtXwBMhEitvgke1ID
+ byTJ7OM9mEaCOgCYBr5xw+Ivuh5KD5QXpvlXLR9d9EmZ7Gh0kIsAT60CgYEA+M3p
+ PiwWtcvTo0mZcC07QP/t4B1cMqv+df02weE0ZKAjM1fGzpP6BaYTNY8Y6U4bvZhu
+ PeMvCUD0AZfMzS3VXvW0agiPGsa3HqpE4uaTaqiJITNzD2N/iTqCjrc+rNgBAfcv
+ Cc0lJpfCWwBu3yHZawDvd2MV4Z+E6W0MiV+TRScCgYEAnMUEM9avDsSoXhbR3lua
+ kCOyIQNXfWqgRFrl7CrvV3kcsFH8yzrU5KOQvU9J3s1jArbaGkpK1zNT3lLkrz6M
+ u1XnfMZnrtnoRJQT/diHbziDrkq9MMIF7KxySZDeKIHzFb/1Y4i51j92MJOQBM94
+ cwJ4rm3t23Yq5l5+SGS1d4kCgYEAnZ1sLeumM2K9XsroPg0ZZXL8Eabn2l3k5IAV
+ qTrugvSDeCoaEpHhqKRttNdDE8Fch35CEEiUaotQSJYOsshfTDnhIe7sIS1TokSB
+ QTCKoN3FiVfbgxsoFxoOzTQ+qyZndQRPMylXaJxpDlc25Xm/Dy9XhE0r9nOksm9X
+ qsr2M68CgYArF+luAV8WEg1dsJgoxmPCAaSKKTMxBww+8v5vrV4kPZymiEHV71WY
+ PB9CF8SXuktUQuvVmkrE1snyyi9wthX6MEjSFgQviBS31BjbZxYYh3RzkbQXkm5u
+ eIvo+HBgEQeothVECvxWlG1SakjIkPNWzRUdJenVGESe4SO86/j6vw==
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-etcd-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateAuthorityKey/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIID8jCCAtqgAwIBAgIUJKkGA1FUkVoSQ/B44+qGdnlPXNkwDQYJKoZIhvcNAQEL
+ BQAwKjETMBEGA1UEChMKS3ViZXJuZXRlczETMBEGA1UEAxMKa3ViZXJuZXRlczAe
+ Fw0xOTA4MDUxNjIzMDBaFw0yMDA4MDQxNjIzMDBaMBQxEjAQBgNVBAMTCWFwaXNl
+ cnZlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK8A3Rr6WMB6VdM+
+ q8UwAdEArvznVCwlTtj+7ApI1ItuGyu0LxOYendUr99L+/Xob0WSGp8+sY4IYkOZ
+ qiGu9qIHmTJ04fY+xplmcIBhzqekEstGdCCnH8G42MJQKlpb5WZXLnkbLiLv0ze9
+ MsLCaISYAnxPBcEryHvWpSJ1X/iFaU8jU771PyXYC95C1/Dy5d6C44pg+/0H7c88
+ dBSt502xRnmCDyrPMxkwY2MmhiZCSwNV9Jq5C/REAYG70RjOBEATLC0sqhaH2128
+ TYiXg/kwRcT9pWz9jr0jyLRhN6HR0f0DGkXs/tski6Yj+9foJQiC0S2TgjMcaTB+
+ UVdzwlUCAwEAAaOCASQwggEgMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggr
+ BgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUVluFZ3v8
+ cr998QFxiMewu7XN42UwHwYDVR0jBBgwFoAUSqA3SorYeSDuNsSfPG8enwi9mzYw
+ gaAGA1UdEQSBmDCBlYIJbG9jYWxob3N0ggprdWJlcm5ldGVzghJrdWJlcm5ldGVz
+ LmRlZmF1bHSCFmt1YmVybmV0ZXMuZGVmYXVsdC5zdmOCHmt1YmVybmV0ZXMuZGVm
+ YXVsdC5zdmMuY2x1c3RlcoIka3ViZXJuZXRlcy5kZWZhdWx0LnN2Yy5jbHVzdGVy
+ LmxvY2FshwR/AAABhwQKYAABMA0GCSqGSIb3DQEBCwUAA4IBAQBmgxaxacnu5/xc
+ isA4UmydL7jvM/5JGrU0rqcyOZYdOK8Auz1iTdCpeRAwd477Y+IcKrSDvWQmA3yv
+ neOME5/ffNFek3iPx8vBf+rwwbD+tC/YHky5pllR4WlEa90+KXKBiOYVoz8RGLIr
+ dilJtU51NY+EnKIllCVzRtxeky/5kOV1oraWEk5vPhOpyYfJ+Yx9VVQXvSs6LzdR
+ QMkSmzPVeA1AXHauWyx6Cp61TtnuekCEbPAxrBPbJb+GkW2tFbYIAZBJfR5IiMJA
+ pBQI4JDeD6jkDLBp58gW3XJCYr0zcfQVaQVHsopOZKH5PoFIf+vAKcQAK/SmCSS+
+ tbq3nLaW
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: apiserver
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDjjCCAnagAwIBAgIUatMa/27XHBWZivkFr9aiuvo2liUwDQYJKoZIhvcNAQEL
+ BQAwKjETMBEGA1UEChMKS3ViZXJuZXRlczETMBEGA1UEAxMKa3ViZXJuZXRlczAe
+ Fw0xOTA4MDUxNjIzMDBaFw0yMDA4MDQxNjIzMDBaMDgxFTATBgNVBAoTDHN5c3Rl
+ bTpub2RlczEfMB0GA1UEAxMWc3lzdGVtOm5vZGU6cG9kMTctanVtcDCCASIwDQYJ
+ KoZIhvcNAQEBBQADggEPADCCAQoCggEBAJhsnUwfqTp20kHzpc+aMZeivyVKYWIE
+ 4Y0PoKVWbUuQZQjktGHHzO88ZzeohszvUVZy3bdGwPI4HwPjfa8LB/f6nDx1aqEr
+ dssV50tQydl1t0gQtKUuUDGk5FWIGcluX7MXktFZoJe2rtODpLQ/9nTO3wqqvKfr
+ u/tAmP8fhIw0T3fv+er02NDRvxhbyJpCd9R+gpm0gw9dduN3s2PlqiTPpEdQSQZz
+ QlV1yF6lrJ7R0hPns7xbcGSj+6karLzX3r+lT08QRgW7+10k5PpHoaEbwZoQ1xdR
+ CvZt0+G5xkAOoqB3BWBbfAFv9dwb38h/+VOo4cZeBVjbyo0ihBReDUsCAwEAAaOB
+ nTCBmjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUF
+ BwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFFPUBkcdySUw3bF1vawtgT9ba/8m
+ MB8GA1UdIwQYMBaAFEqgN0qK2Hkg7jbEnzxvHp8IvZs2MBsGA1UdEQQUMBKCCnBv
+ ZDE3LWp1bXCHBAoKrBQwDQYJKoZIhvcNAQELBQADggEBAKMoJGGPPlFd3X3F2lHI
+ LMReBe0j2VyuVykPSCbpaujcnTFZse+EVaFMFLWO1VhD45qji9bWg8BkHpw7TJZI
+ hz+xw0HdFRYLSwLQRNoi5tGD/6fHsWhyyxJ1bYHJl1GbYcd4hpIAkRIYj7tiLDD1
+ 21027+1jls+MARdGd8y1hZB9YQCK6IzBoz8n+LNRe2YolAYykIYIRLAQt/x6LCP8
+ plhpVBAUxxecnulDJUHZLnSe1t7+S+dIyFucvgCT1eOATWh8TYIrxK5e97fkN5vt
+ 1sYa65trF/dLAbL56GhHL7JOI8BNsBbjOPKbEpYNS/aFPSosw/8MyxeR08vSOwZB
+ q1k=
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubelet-genesis
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDjjCCAnagAwIBAgIUOASPsyDJETFZ5lCi6z/UkwzZ2WYwDQYJKoZIhvcNAQEL
+ BQAwKjETMBEGA1UEChMKS3ViZXJuZXRlczETMBEGA1UEAxMKa3ViZXJuZXRlczAe
+ Fw0xOTA4MDUxNjIzMDBaFw0yMDA4MDQxNjIzMDBaMDgxFTATBgNVBAoTDHN5c3Rl
+ bTpub2RlczEfMB0GA1UEAxMWc3lzdGVtOm5vZGU6cG9kMTctanVtcDCCASIwDQYJ
+ KoZIhvcNAQEBBQADggEPADCCAQoCggEBANja6HreKd9S1RYKWRMrJDL/EDA5yX9s
+ var2MOB/75ZXayQ1jzCnvol3hsopPXPBy8fikvU7Fu+MluFxSFBkbwHSmt/FrkAK
+ avaSzBHzhysm3SmySCu+6xkDjVcYrNKHVZNkuiRDcTRwsJC/mWQH9azayOKclaE7
+ 15OwIlSp30j3Mhd0POys6oQ/486KKBOQPeOZRxgp05iifGz+oTzqYl2ihlnvLtg9
+ tfqqP5DIJ9CnoJRRUIRZ9SHFH6uYsSZXuHzWVOZnSnqgWB6zy9rx3BZqND6fZQ6f
+ 1wp6Xa7OEFVCZy1EBQ+8ZtZsrCNAggrlzUGe56+Pd4ranIfMl8OhNkUCAwEAAaOB
+ nTCBmjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUF
+ BwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFKAoSxgiR2V5RhhoQM7qQtEi7zow
+ MB8GA1UdIwQYMBaAFEqgN0qK2Hkg7jbEnzxvHp8IvZs2MBsGA1UdEQQUMBKCCnBv
+ ZDE3LWp1bXCHBAoKrBQwDQYJKoZIhvcNAQELBQADggEBAEtbZOsFzGN9ot4MWlZL
+ R2MVrmVQpwHY3SCofpVxUMlkZg3FFSDydRTIiQXaxfa3Zczl2dviNkAIUJs7nd7p
+ YBhgGI9ezHhvS7t5pO5nG4Hyk1myw8WPV+Q/mU+i5DoES/apAw+9Zsqfw2xSnysi
+ QH1GTe5Tse7pqat5dMeAl5u2dGu3p9qe2Rd+q08Ts386njSxZuCEbmvglWSxUjva
+ hp+2deeqgTd9FaWlFvToiEDlZJ2s8d7l9Be3P0UbxuKwhHXBwkFjW8/KL8QIrJ7S
+ yCEGTmFajwa1HFsws+6Jxgo1BBLj9n4O7Y7oinNyw3ygDkn1jlkgcz/rPrAEe1Yi
+ DmI=
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubelet-pod17-jump
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDkDCCAnigAwIBAgIUeZ/tqTn4wiSSReN5fEEcMBZBP9MwDQYJKoZIhvcNAQEL
+ BQAwKjETMBEGA1UEChMKS3ViZXJuZXRlczETMBEGA1UEAxMKa3ViZXJuZXRlczAe
+ Fw0xOTA4MDUxNjIzMDBaFw0yMDA4MDQxNjIzMDBaMDkxFTATBgNVBAoTDHN5c3Rl
+ bTpub2RlczEgMB4GA1UEAxMXc3lzdGVtOm5vZGU6cG9kMTctbm9kZTEwggEiMA0G
+ CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCr7ZsgQOHGrJ7AwWv5JdUgl01JQvxd
+ LsHZ5HiXlUZOkHHBKbQV2snRc93MG0bNnsn7QPP5hT8ScveVcwkZOusH/hQggUrX
+ 95Ua3Fic9nybeNorHhsWpRApBz58XU6l9GWQm+mmb2yCvW9rb2SvbRdIZixWSMUP
+ ltdlG8K0dH5yZJPaAEFpVtX6wSSH2zPxgI8ZCeK10c4egECpKXCKyNBHMAH7HDsU
+ wnYAizKHPlax2qCIzBhcCfhBJwX9/SubDRv/vSsyFCNRj0IG7IGx00GQd49tf9TY
+ ofIP5tFtMNxmCCXm+1N6gg8oaWRhav1e1CrayXWfKNZbP4SmXm1dssZbAgMBAAGj
+ gZ4wgZswDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEF
+ BQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBQHeh4XFT8hjpRNLiPGcXEm7SO/
+ szAfBgNVHSMEGDAWgBRKoDdKith5IO42xJ88bx6fCL2bNjAcBgNVHREEFTATggtw
+ b2QxNy1ub2RlMYcECgqsFTANBgkqhkiG9w0BAQsFAAOCAQEARB6DNhJTNe+cZxSd
+ Vt5ja8fYl3IjAApy97ZUKhQOFY3WPVAru+uv9OQ8VFDQzD3jsZ86pnvT6gOnH2z3
+ QuO9IKyb/Mzd2StwMAej25QN+PNE7jYvsW021cBrMmhKsGw5t9WAUu81pY9zhzpf
+ AywQXZz68GSyn160lz9C80UKLaDEdy+xrivh5Jn/XkzJkdI0X97nA/N0JPrllmjM
+ Duw/JQQb7FQcAkTa5ZvfjapOHR9hSblDJc3xTcYhav6yZ4qMCz1BCvpFXFrvAwJE
+ M/QMQOfw7DvyJj2B3JqsuQGVK1J5Ph6gEy5qAlj6zC0cb/C3j8pih53PHQi6nlbu
+ py8GrQ==
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubelet-pod17-node1
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDkDCCAnigAwIBAgIUZEh0TD3e+gQCjtZMnO9BgJRelIMwDQYJKoZIhvcNAQEL
+ BQAwKjETMBEGA1UEChMKS3ViZXJuZXRlczETMBEGA1UEAxMKa3ViZXJuZXRlczAe
+ Fw0xOTA4MDUxNjIzMDBaFw0yMDA4MDQxNjIzMDBaMDkxFTATBgNVBAoTDHN5c3Rl
+ bTpub2RlczEgMB4GA1UEAxMXc3lzdGVtOm5vZGU6cG9kMTctbm9kZTIwggEiMA0G
+ CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCcgX/YKhGzS9xYf6eMgXWxjQZ9igUh
+ IY4eW8U5kFOmslRKQLHvHTqeK3vvsYzlWSeE3bvSyM51xiYJR+kJ+0iuHKzArT76
+ x+17sp6Whg3nOIgEpwrkKW08GOJfhD4b5owY90JqrYZwyggLiIn1HusAwxGkFfOX
+ HA9xvOYpkB/PIgwBV4R9YeG6tRQCDoQC64Uj/AVwtocX5LgWUZ3HWfsmk6GTjRvz
+ 1LnMUhi94R9SL02jCcPlKF7i9FkAILd1D0I2xoEr86n/evvHtN1130A7kT+ZnP2x
+ j3QMyYh77iHMDLYKeicPR4WqAp05tLIUwv7IR8+cNfckdzOcJTuvPSAZAgMBAAGj
+ gZ4wgZswDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEF
+ BQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBT9O6b1bnmbT9dm+4+NcFUZ5EXf
+ FDAfBgNVHSMEGDAWgBRKoDdKith5IO42xJ88bx6fCL2bNjAcBgNVHREEFTATggtw
+ b2QxNy1ub2RlMocECgqsFjANBgkqhkiG9w0BAQsFAAOCAQEAd/4jX1X1PqLQr7iX
+ tS5L7bE/QJD5z5wKERFkVks2MMZ3xC7OoqNiguZBteNzYqZ2vcCktMv1QiAb08kb
+ jn2DBOxg8F6RuLqGGJ+4hdbHV4ewlZviH7R0MdH/BANbqVoAOtujB+9tq3nkeGHA
+ E/75SkDwXaxEKrypwbpelUdh+SnxI6IosxPLNbyHesXpP5WeGFajitUYvqPzi6XN
+ WD7tOfPIarnzryPB+3J+Om0djawNCVMecHgVRZwCRUTNUfq734+2bp18hGLP8UuS
+ WZljv4KM6EA4ZaeNCQ/heytZE6jiYSJJ6ZQEKr/6O1PKe3SoOhO9N+zqDfS4ALQq
+ GsbDmA==
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubelet-pod17-node2
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDkDCCAnigAwIBAgIUdIZhQJbEXfJPmo7+MBg40oe7dZkwDQYJKoZIhvcNAQEL
+ BQAwKjETMBEGA1UEChMKS3ViZXJuZXRlczETMBEGA1UEAxMKa3ViZXJuZXRlczAe
+ Fw0xOTA4MDUxNjIzMDBaFw0yMDA4MDQxNjIzMDBaMDkxFTATBgNVBAoTDHN5c3Rl
+ bTpub2RlczEgMB4GA1UEAxMXc3lzdGVtOm5vZGU6cG9kMTctbm9kZTMwggEiMA0G
+ CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDVPYu1B0MjSdlhS1F99ovPC15owcEW
+ 7cbA9mDWix93nthaE1UZo98kVOAr7wY4C42YS0MHZlT5AOrPrwJpHwwC1W1zgDc5
+ +OlKnd3Tum+e2vvFW9PhFoSkZ4ZwliTIOyYIoaD5xAKcmOaFSbItg3mPbBTrXw6U
+ FHGbJypN9NvE/H8aMeRrQJ+DA6MqMKh0lmXHEptdYrVGTaxwT4AxsaDYpGgY1WHr
+ 07Bcgd1no4coWnHYN9Vg/f80tE+uNebeRDgvH+gC4OEjD3+kV/CCfjkFYHLlU2so
+ YTu8WEfpG8HCxZrrpvB7EdX8kyaqANjeQhEgzycfHaDJyyf8Zrw0C3uhAgMBAAGj
+ gZ4wgZswDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEF
+ BQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBQDsLIMg506lEk+MFaD2Ie5YRdN
+ XzAfBgNVHSMEGDAWgBRKoDdKith5IO42xJ88bx6fCL2bNjAcBgNVHREEFTATggtw
+ b2QxNy1ub2RlM4cECgqsFzANBgkqhkiG9w0BAQsFAAOCAQEAWiPWzQNzOZvjVvHH
+ TQ1zW3rHKv1lKZ8gHb7s9aiUeuq/7PKUZpUBzOxYdxZLEiKp1ZRHfuO3BlUDFC/R
+ V7L6N4eco3bfvYpAd8NUrKX6ruyydvHqbKWF0Xo8MfcUZu9EIrHh2l/CmrCZ5eUP
+ kJlSD+mNvsmaAL6teOpnyj9RVEvk/mTbyCj4e9e7MpPNE/0kB7cFtrUdIHJc9bsy
+ WZJc/ISngSmnVoWMfaqxGX99iFW032aWuLWUrSTKOkvtZqIPDDMUAsFgwUKWmtOP
+ R1tOBXJrj4C/wdO/fgDEgO5F8O/KfG0jtwcTPi4kmR1FgzJUdv+cDbI5gylFhtS4
+ mixiFw==
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubelet-pod17-node3
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDkDCCAnigAwIBAgIUKFO+qu84cEUT6dxT+eXiHyC91AowDQYJKoZIhvcNAQEL
+ BQAwKjETMBEGA1UEChMKS3ViZXJuZXRlczETMBEGA1UEAxMKa3ViZXJuZXRlczAe
+ Fw0xOTA4MDUxNjIzMDBaFw0yMDA4MDQxNjIzMDBaMDkxFTATBgNVBAoTDHN5c3Rl
+ bTpub2RlczEgMB4GA1UEAxMXc3lzdGVtOm5vZGU6cG9kMTctbm9kZTQwggEiMA0G
+ CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDBib5O3QeE2WVARl8aGz0ll4AsyD2o
+ JNiNCccEM7nRsAT6ShXqPjWmO4OGPhNUe52DSmXcU/2GblCzeZ4iIPpYncDqC1e9
+ G68iBvArw6dwr1ENM+7eQ3DIWRt1zExgTRfbaw+aCPFEJMNqaYxVYky48WY39aa1
+ q/nfUuac8WHLtNz8fpaNfdfCmfk9fPyHiggSCCD4hZ4+kvwBd4QG2KFkrmpMH3hZ
+ DYcwxZkbeYopyqHVc+QeoQ3azWDRfYgKX2zWSgleCRJtkWt5miXELGsLgCiIykUs
+ fVM3OOBoEVTZnF4xz5Xkzf54xABInKcZjkgw8kMRiJPHRRrUdsjgVp3RAgMBAAGj
+ gZ4wgZswDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEF
+ BQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBTGvOFfJ0ZcijahG5L1R+uzmmEj
+ qTAfBgNVHSMEGDAWgBRKoDdKith5IO42xJ88bx6fCL2bNjAcBgNVHREEFTATggtw
+ b2QxNy1ub2RlNIcECgqsGDANBgkqhkiG9w0BAQsFAAOCAQEAN9WXZk1uwjwhVN0X
+ EExOpYSTBs87AAmW9SM0xp+eTLB3M91jUro5Bq9hqPC+e5eQqWzJcPwdpXUHlUCG
+ 0Q1q8B5ldBn4HFyhKU994ZX+nMudIV0ZX3L4eC/Q6GDrGblpDCxeoqX+sRBPpitQ
+ GH//wS1/oB9ggXqHqYlkcWqUwzJCfZ3UZs04/o3X8+TQXaGcHhA8IK1ftyvGj3RU
+ likT/E54fmkCHvE14QKBSlipd2xQJDlUYs/be/yDHN7OwVoHWj+90GBTDWphAlON
+ QnJuHAx2OlM6c8Q4NRhvnjE1id41pctLZaUNjOf+MKbYS8r4Hhf5E8esCjHpG8j0
+ Tz1sfg==
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubelet-pod17-node4
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDkDCCAnigAwIBAgIUXfIj3ULerEYZxEkv17nlBfVO5FAwDQYJKoZIhvcNAQEL
+ BQAwKjETMBEGA1UEChMKS3ViZXJuZXRlczETMBEGA1UEAxMKa3ViZXJuZXRlczAe
+ Fw0xOTA4MDUxNjIzMDBaFw0yMDA4MDQxNjIzMDBaMDkxFTATBgNVBAoTDHN5c3Rl
+ bTpub2RlczEgMB4GA1UEAxMXc3lzdGVtOm5vZGU6cG9kMTctbm9kZTUwggEiMA0G
+ CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZbzwDTSIQhMJQvYbNVKvjpMf2NBGV
+ QXSC1CUlQlK43pIG0GC9EOLrHzKMDZMi35848NTEj4YtuSuesQHIHiSaKaLSNVpo
+ 3uj2Kf8JajsNucfE+SyOeKANtfMZXveIdp4qhrbUsyoIg4vBaqDpftFv+bjBOYbW
+ 9T8NzwUJG0GjphfgLIGZZib8BpbadwrcFENGXR3BFyS3KVN6XJznlUPX+p9Rfib+
+ YbzZCGVUYLgO0SrbPAyYmWLJC0Hj0KF3q0sjrQpyYMhnRFfz2B+kY90Dir5dC1ZX
+ uVmVHI1IS3FuprlizzygnVrRLJDFHPIM4LeXSY1wQmtuc8Wb4enC0WhDAgMBAAGj
+ gZ4wgZswDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEF
+ BQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBTwn3d4InIiDPBmY9i/1Kje+vUv
+ 2DAfBgNVHSMEGDAWgBRKoDdKith5IO42xJ88bx6fCL2bNjAcBgNVHREEFTATggtw
+ b2QxNy1ub2RlNYcECgqsGTANBgkqhkiG9w0BAQsFAAOCAQEAK2gKG8ShPRiTdplU
+ 6G7q3uopwfmfKaiQVYEKQQ9OLNtlaUOF9MAtsdgxmt1g54hyEkuLMZrZRohqInbE
+ O9waS6KvFYdxUPUHRgNh2DpUXunWPORwcf7VNwU0c4MHd12UK0UBAwuzDekTp7eh
+ 8aFvS9Ig8iCP7c+W/x7HnKqNaEHtVEkbn8sdE6EzvPNwErjlGn6CuGwSf90EL92c
+ b5DgA/RZi6pxXIDM19n3O3MpeM8r7HT4ScUO3NWJDxIepWXnWGZ5hHsYqPoFxkU3
+ If0UfjkJh2n4xfyFyn+S6EoWl1Eldf7vSa78eb4HjcAJddCqHVpULTsSNxZyBVEJ
+ 0O/wBw==
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubelet-pod17-node5
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDVzCCAj+gAwIBAgIUVkBkvmk1zxhXmntTkCrIzW5QNdgwDQYJKoZIhvcNAQEL
+ BQAwKjETMBEGA1UEChMKS3ViZXJuZXRlczETMBEGA1UEAxMKa3ViZXJuZXRlczAe
+ Fw0xOTA4MDUxNjIzMDBaFw0yMDA4MDQxNjIzMDBaMCAxHjAcBgNVBAMTFXN5c3Rl
+ bTprdWJlLXNjaGVkdWxlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ AN+kUGrLcFeX+HP1Dg039vHOp8yIypTn5aLWycD3o0kmgUpMQEwWZMn8BuxUq+fe
+ BirCJz62pPBs0Shuw5ugP8vp+4h2Me3DIggQDaWYYfZrhMSGbiH6W9F6QhWwWCjf
+ 9JPCa0xI+vVRv19p6Z6Q2PGCL9op1q2kpEqB91ALI3trMmYc2O4zIE8JWEBUeQEC
+ gt6GLP6ts0v0b1eU14cjszHz1rZK90xOZ8a6dbVj7C6wF/RkjbT+hAvG1nZjFhJt
+ W9csKDiRQyYLkd786u5gqKvEppUrVqN4daZHMuBSoHG+o/C5NX2I5hTCKuJLt0QE
+ 0NWQeW6N/XyLUQHkxKqWPoECAwEAAaN/MH0wDgYDVR0PAQH/BAQDAgWgMB0GA1Ud
+ JQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQW
+ BBTKVr0D3u4EXt670HQwXkvHK80IfTAfBgNVHSMEGDAWgBRKoDdKith5IO42xJ88
+ bx6fCL2bNjANBgkqhkiG9w0BAQsFAAOCAQEAhrLFJ5mYiSMxNE9qKmPD7I3Ck39j
+ H7ELOVQ55WcKosSw0bxxN6uFdtPe46YL/IBWLrOUtxojni0MOTe2eRT/WxOri0tX
+ UcUrb8aEbHySUxTljRntKKKUUBY0SFgSUWGv6s/XbBTugl+SKk59zTXFApLXkHXR
+ FWuT1cyzDGyCINQTNU6sW4I1P6RptwUiHLsHvsvQzRGLXEmenhQtyQOgIdlWkBEa
+ XugbOB7MrVA2Okknm60tY6MjdhzLuLpsfrfgVPbOhhJgx4s5R9jUPYkJt2+AM91F
+ AatvYzGF8PXZ42AD86koVQMaKVkkik/+B84hC1WLJyi6j6q2XlNlbPI2IA==
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: scheduler
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDXzCCAkegAwIBAgITUnedsZPFK24+0RLcQnBCy6sfaDANBgkqhkiG9w0BAQsF
+ ADAqMRMwEQYDVQQKEwpLdWJlcm5ldGVzMRMwEQYDVQQDEwprdWJlcm5ldGVzMB4X
+ DTE5MDgwNTE2MjMwMFoXDTIwMDgwNDE2MjMwMFowKTEnMCUGA1UEAxMec3lzdGVt
+ Omt1YmUtY29udHJvbGxlci1tYW5hZ2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+ MIIBCgKCAQEAx4qVolEaF1s0eKEqkCYybqL9v4ODiX+GAglz7KIQxXZzaF+RSVcH
+ xrbeMJV1eD57tpIdm6kbcjllTsnytTef5iaJeEyJu5cxyr6xhwyQNnuWlbHl9H7L
+ lF12eaNv94WAJ/S1I1bhjt3gj6vvXbFuridLydC9v/ELzVG15d70drVsfDvrRGbB
+ TPBTt1HX0pPD6uvaKLUwy5vLqx1uP+l75+EhmE1BmVy5c4SnuUdL+/8zqoPFI/07
+ wWY0Jq3+G9zSNeweVIxOv+vmgsUwNlNFsiu9XzzI65ngwaVHvelT1JT1ahMeO97o
+ qOd+XgYFNrKphJzvoLNVtt6/GdnAzjv1/wIDAQABo38wfTAOBgNVHQ8BAf8EBAMC
+ BaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAw
+ HQYDVR0OBBYEFOne9MK3El73DSrS0A1Uz4SQhjP+MB8GA1UdIwQYMBaAFEqgN0qK
+ 2Hkg7jbEnzxvHp8IvZs2MA0GCSqGSIb3DQEBCwUAA4IBAQCdho1eaIcOFSzyCgkx
+ vYuL3nwFmofMQh9P5t//dCIrs1YGmMC+i/paYK5LcBlqRfR5zV73y/Fvw4njIz+J
+ 5dR1PC2lNmEXXyy//yhy4fw0G6zdY9dZ927znS7t7aeDf8XbUg2bnnOSj2vBTMXK
+ +SKZYSzYrhaYpem1Xv7pZpEGVhQ2kti6SkXmgrhbiFlzTqBK8IqrV63q4UIW1tdd
+ vPfg61tF44lUweAfDqe0qTra1HyHRscI9uXJSShY40U8O+UZX5BVhGlYbKP4rWyp
+ tx7vCUcRPNWsGVDw0YXiRzhZVl6edL92PTd56Y8zc24ELAbCodVFUoGIbKiBlC9+
+ giRY
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: controller-manager
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDYDCCAkigAwIBAgIUXVDbDAa6v2oTEGQolp4wy4+bNiIwDQYJKoZIhvcNAQEL
+ BQAwKjETMBEGA1UEChMKS3ViZXJuZXRlczETMBEGA1UEAxMKa3ViZXJuZXRlczAe
+ Fw0xOTA4MDUxNjIzMDBaFw0yMDA4MDQxNjIzMDBaMCkxFzAVBgNVBAoTDnN5c3Rl
+ bTptYXN0ZXJzMQ4wDAYDVQQDEwVhZG1pbjCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ ADCCAQoCggEBANFOOJFFMQ2i1rnX6rtQAjdh3KtvjXv6Pfkd5bMY+7tKAHsy0x6H
+ TlwrN44dx4E4lGLJ1ZEqCRD9F6Vznrhjro2/Bq7MA2GmDbe0w0LCar9gXdKg7RMN
+ p/Prm+KAxWPF7r7KVBCc+/FZb8e97Cd7riFxAwD8z+IcIN/PwOnELauEmF9svL52
+ qSlcnWSaI3A5Sj5XYBDtrgb809e2jwRcYx72tWZ5+BnAkXqgmylh+ARedlQALTM2
+ gIR6iJblbTY5b9nWI+/0DW0kLkWrnbU8kq8R1mVKImq4TI5xlBqRVeJvrerxHSdc
+ szjybwbG9m8crW5c+Hdk3iJUEjskonGa3O8CAwEAAaN/MH0wDgYDVR0PAQH/BAQD
+ AgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAA
+ MB0GA1UdDgQWBBRojpJQ8kbw/zd+BkCuQY8dbfeA0TAfBgNVHSMEGDAWgBRKoDdK
+ ith5IO42xJ88bx6fCL2bNjANBgkqhkiG9w0BAQsFAAOCAQEADbQMLo5fAELUbK1o
+ prklo9UUoD5dQQyMB3/kR9n+aPDT/EQvp2oj3wJQfBoHYxorCa4UThd1GYON0nt3
+ /AmiGmIcPmlX2XzeuIS4C5xRr+8rTx4umEqzg+ykdNwKV7Ed7QJkdIX9ExTbkfws
+ d85tmAeL8Js0GW0oWL3N8NKZNNu4ygAb7Ha67ZwtpHiJ1LIyd5XaZE1sxhtRCYEu
+ 7GRQRJkX3qXCb3BoptHmjYrBR6AIKjKnRG0GE25z709wXS8cmbwFWS+NTOWo/5W2
+ J/TfCe0+RnIO2Mj/898hk7DImvav7PKuPraAV4G1ClGq1FqtVqa48hL/3tma85LN
+ PTZlCQ==
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: admin
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDYTCCAkmgAwIBAgIUciDyPOzv2gb4bPSoKHoupoallj0wDQYJKoZIhvcNAQEL
+ BQAwKjETMBEGA1UEChMKS3ViZXJuZXRlczETMBEGA1UEAxMKa3ViZXJuZXRlczAe
+ Fw0xOTA4MDUxNjIzMDBaFw0yMDA4MDQxNjIzMDBaMCoxFzAVBgNVBAoTDnN5c3Rl
+ bTptYXN0ZXJzMQ8wDQYDVQQDEwZhcm1hZGEwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+ DwAwggEKAoIBAQCxoEU4+cHjqNFCs1PcBHC6q5iw5K4vhXJDn7JljpaAGwB7UTul
+ n5WMxdbl6Sj0OA2EtukQP5c+sQEcW2ZbvYkUajmeubsuP6+a/d/xr4kveCTTuloU
+ sBYi4+Q3Rz5wFO86Pyh2uoLh2HYGMBuQlo6IeT/DanL25pLmoijAaBN6jluLwvjL
+ S83uCNWcfRpAHhUarr58ldb1m3dwGHJh+Lj8oDmPI39WU88W8lOQCOSx7F62uk2v
+ 9kVaxFCJIVtPGWkki8Zna12ZEQS2x/A8JiCL79jILWkIBHk8Xjzxdidy58Aab8Qm
+ 65ozGJOaaGdtpUiGOBKYWecWFS5f68AjhPMzAgMBAAGjfzB9MA4GA1UdDwEB/wQE
+ AwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIw
+ ADAdBgNVHQ4EFgQUpLt0EVpJCPlGVnPdiPJKGl2W01QwHwYDVR0jBBgwFoAUSqA3
+ SorYeSDuNsSfPG8enwi9mzYwDQYJKoZIhvcNAQELBQADggEBAEwaNNwVUgZ8OIcM
+ h0RQ8Ly6HWsTODBcpRQW20lPDjpOde68zrnxI2pLdAV7KgcfdhvxrEUU67K4BS8k
+ 7djFfLPOnuOty4imvIGaha8OXCqlP7gplFehbKsCDUwZibNm8FcQXTeVVqzGEFwO
+ WEdsKaYlHGMn0hPUvCG/qtvXTH+vY+q696+nDqIirCfRbNmUYTypKhdzDSiVFoTN
+ U5Ek6GKXBSv8rs7EoCJqiFD5dN5zpT7ErF8xgMkW0DVw/09u1vtRV4D9u/NlTIrh
+ 5WtDiyRlFeRZeXnJz2CTgzItr1Lt6eoTh3/64hYQl2+ThDFTQz5WkrlHGfkRQWj+
+ QIpMP3Q=
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: armada
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDUDCCAjigAwIBAgIUXLNalbN5I1hNhCAPUaS4nLXTZG4wDQYJKoZIhvcNAQEL
+ BQAwLzETMBEGA1UEChMKS3ViZXJuZXRlczEYMBYGA1UEAxMPa3ViZXJuZXRlcy1l
+ dGNkMB4XDTE5MDgwNTE2MjMwMFoXDTIwMDgwNDE2MjMwMFowFDESMBAGA1UEAxMJ
+ YXBpc2VydmVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3C7GPaX+
+ CBwPz0rAbWorFholDrZqV4Q5yOoxPfrTRJsKkjpNPG9Wot3wZNukGWoUzm6uTwu+
+ tasfaOGHUH1EmwhHXtKavWhfuzJziXXPL2DWAoWhdrIkM0c5oYHqNSIiQk0Ld805
+ jtI8L467Sn0Sy21oSwIbPGVpcQeYtI0rOHLxev5Pw+KkmqUBImjv4otLtIScRlcV
+ LiOFqitIQMX6QtJ+0sQTmPye4ezaYg4o0kT6R7xuaPdPHH25ksh/yzQTYpileV9T
+ VSv5IhRrilqS+TGVNT/5MnIuMj6cDX8T7ZM03/uU5mVVLHlxURDZACAhad8d+t+q
+ RkfIuc20PQt2pwIDAQABo38wfTAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYI
+ KwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFFiawe/1
+ NzSv3p4ojD4mBlLnDopxMB8GA1UdIwQYMBaAFEpKpJjvUnEK6Z4PRxQP9AjJnquD
+ MA0GCSqGSIb3DQEBCwUAA4IBAQAfE27rBTdIC69SOCs6KM+2p9Jlmv1H6bdcfV5o
+ oIQV6PgR7PUnazlXf/Qw7t5vt07oAlNuyQnDLAbz5qC8/Yjvk9rNXZD/ROQgXSK1
+ QnjTWJ7zCRzcmvF2OD5GDI8n9YdGjgbI2lJwOYlsP8c0eBKlOhG6tfRt3x8FRfw6
+ x4dTKKiCdC/PcYbKeGENAvhiBR7spm1d/BZ+gtmlApOJCUDXquUJOuXMbxcnbr/z
+ i9Ps7+rf8eMqF/HLw9SzM92UnFJuL8apL2xBgZSFSRaLoHD2Qyvu9ZFpkHBj02Af
+ uLuIRTUPpsCGtjN8ZXLryg5iGvgyJIkJL9ZC3aTIdVtlktYy
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: apiserver-etcd
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDTTCCAjWgAwIBAgIUZsDwxAyPFvCBD2qAoDt7LbN+gBMwDQYJKoZIhvcNAQEL
+ BQAwLzETMBEGA1UEChMKS3ViZXJuZXRlczEYMBYGA1UEAxMPa3ViZXJuZXRlcy1l
+ dGNkMB4XDTE5MDgwNTE2MjMwMFoXDTIwMDgwNDE2MjMwMFowETEPMA0GA1UEAxMG
+ YW5jaG9yMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsLJuWpNsBvXt
+ Nny+kzFW3BPOVt7hkgAMRtKtykDNev6PawxZoo5tuL4tRb/htj/htig1uI+eCKCo
+ 4TBPS9GdVgvnWN8wUzqs7DQcGKlPrGlvg74Mnh4jOh913gdOSZRDQgqcOSE0tAOW
+ HVGUhFSFgdmqzCL7d5XVpqjLDleAM2OgSmhf8juqQmjtcoLg0Ioso5QzZO+MUIq8
+ qWoo8bfFHry+Dy0PVZyDm1tLDBCcFrjNndrvxh7gCdvbN0wHTUR/RUwFLGcT1OUT
+ LN7aS9379l2ROHjSs+T8JpjIwYYZ0/XzKc7WofUeO1wTNjrrWsNNa8Syw75io3Lu
+ LQcTMu9CcwIDAQABo38wfTAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYB
+ BQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFBCxp8LnC1Ft
+ 4yBb//j1AyxclY/lMB8GA1UdIwQYMBaAFEpKpJjvUnEK6Z4PRxQP9AjJnquDMA0G
+ CSqGSIb3DQEBCwUAA4IBAQAR85WvVUHHukLczFgOv3jwlTY+bJLDjJd15ITEsNMK
+ F12kiCDdyUor1deiMnZzr1UMlVUV7zlxB+hVudboxbv/2E9gwixnXlIiuRkNxnc/
+ VlUp44GgQS1uSYcrMxUOUgPkyAswTIXTdmbSsAz5m8q+0cjKThglt8djNQTtR86n
+ OW+aYjmPhCh9ndyeoakPj/I+ICDgWKRDgLeoxgQiDt/m4F4QFV7UWCc9Wa5t5tcY
+ KJV4i3dLLY/Wnrt5jLI6ds7hyvsO/3qBbDnpkbLH6cXjtG18zcNGQb0bRwxNITL8
+ ZmRKx9GqVVeJF0e+RlrjfXLiwjW9dF3jDBbffgD+NgvX
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-anchor
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDwzCCAqugAwIBAgIUToZl7A7yvof8fxse7GAoLdpZglQwDQYJKoZIhvcNAQEL
+ BQAwLzETMBEGA1UEChMKS3ViZXJuZXRlczEYMBYGA1UEAxMPa3ViZXJuZXRlcy1l
+ dGNkMB4XDTE5MDgwNTE2MjMwMFoXDTIwMDgwNDE2MjMwMFowIjEgMB4GA1UEAxMX
+ a3ViZXJuZXRlcy1ldGNkLWdlbmVzaXMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ ggEKAoIBAQCj/8sNN4HKAxqKkMcrOPHPUZwyAsn938pTql/ZKrd7zvyU4r3DQSKq
+ 9WkkYOrlHfgepGpemBC7G9MeggrhOaQzMj1AsZOca2BO+jnuow/ffcSV/4SDKP+b
+ 2h43DOmfLeVogAwXPOOKTeYjVoSYyrrl2c+IztKuu14IN18z7DrwpVMxs3/NLR1p
+ 4WLOhCPKt8QxL9+Fc3SWIo+ayVz9RZNbBj+bOiq0AcMpSU1YyA0OeSkUQf7KcTvk
+ zLaZq3uffuK00V3Vx9ykGPPOBBlbqsafa1eWuP0RZribWRs2qoS44fyYr1TGPaDG
+ JjRoodYS++hjvLhu3e4wqGR1hsixNRZnAgMBAAGjgeMwgeAwDgYDVR0PAQH/BAQD
+ AgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAA
+ MB0GA1UdDgQWBBSFBe7lFhSQb9E/duHuKEx+GlG0FTAfBgNVHSMEGDAWgBRKSqSY
+ 71JxCumeD0cUD/QIyZ6rgzBhBgNVHREEWjBYggpwb2QxNy1qdW1wgglsb2NhbGhv
+ c3SCLWt1YmVybmV0ZXMtZXRjZC5rdWJlLXN5c3RlbS5zdmMuY2x1c3Rlci5sb2Nh
+ bIcECgqsFIcEfwAAAYcECmAAAjANBgkqhkiG9w0BAQsFAAOCAQEAb+hyTabp6x0d
+ PwzV+9DLh79EBJVvzDhDVeGg7L5a4efa9x1otEQ3tBQqSPv6s3iGj3TM4VRhJGmO
+ 4nnOLQRt8IH9SRiEa5D78PjhrO0Oc3Zy60lib1fHoSQ5qhqmHNgdtGETk9bcO28e
+ fxIdKsjyGU+NQG+b/IGi9sGb+62M+NVxN3z/XnGOuEF3OrwQvf1r2Co00a2r6oX2
+ ZSjv6ebQH4R7XZPU5Rl7QKXbnsL3Id6sPEPQ/zaCB87i3YWR4dz4ntsubc00XHyc
+ RVqg4xiEErn4kHdxB3Z0nbA9VlMNmIsy67gvS1WwV+WjUXBXKKH9p3mz0wGF6w9G
+ cJyDTKUeGw==
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-genesis
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDxjCCAq6gAwIBAgIUCidfjso0k+ZOmAVeFEEHhPW2BK8wDQYJKoZIhvcNAQEL
+ BQAwLzETMBEGA1UEChMKS3ViZXJuZXRlczEYMBYGA1UEAxMPa3ViZXJuZXRlcy1l
+ dGNkMB4XDTE5MDgwNTE2MjMwMFoXDTIwMDgwNDE2MjMwMFowJTEjMCEGA1UEAxMa
+ a3ViZXJuZXRlcy1ldGNkLXBvZDE3LWp1bXAwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+ DwAwggEKAoIBAQDorb8oyJ1+JiQihjFDPpIIuHLb02qSoUKhnCBJ8ERpdjArAGoP
+ w2B8fZ+v3ZFksbo5NcjasQ56FLaqpFAQ8Vl2bypF336ZsnQSB0ZtvopoaIhWC+ft
+ GcMTggQU7iHyFlmEvyvHIQOMEACdS2xo5uzyxNY1ZlMbC7/4vyiTY39uqyeWPDsm
+ JtSUa56fAiukTKPRJueiCvA5zfNTBn1Ubjo0YmTse01QU5J9zaaSD6X670o0eUpz
+ lKxx3XByFkqCenHcYodjsxQg2SZbw5pj/5hX8o0MSSnSmi9OhwfG1uCR+z/n3/70
+ NZH6cXt0/dFkv0Ih+Z0wgKiKy+bgaGVq3A6VAgMBAAGjgeMwgeAwDgYDVR0PAQH/
+ BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8E
+ AjAAMB0GA1UdDgQWBBSX7JQjFdBoydobT5N3r9cg1xYZlTAfBgNVHSMEGDAWgBRK
+ SqSY71JxCumeD0cUD/QIyZ6rgzBhBgNVHREEWjBYggpwb2QxNy1qdW1wgglsb2Nh
+ bGhvc3SCLWt1YmVybmV0ZXMtZXRjZC5rdWJlLXN5c3RlbS5zdmMuY2x1c3Rlci5s
+ b2NhbIcECgqsFIcEfwAAAYcECmAAAjANBgkqhkiG9w0BAQsFAAOCAQEAfIRL33lN
+ y2UV7JSd28g/FuHftVSAakz3OCAYykMlE4Dn52f/DazBqOap50W4HgJZNXW9RgqV
+ yAFaRTGBblx/3lq3pgi/652NSdMVMbLtUAWqfN6eQvpW4S8J9TKtF2PJmFjCmO4L
+ QYugCIofZrcSuqyBDOrzgSgB7hD5weMlNPdASicvpeiFu2sfIMi2D2t8rA1KwQxO
+ cf/r8RJ/Lc7QyL9bNoOq/64dFdnPNh13AKkaORhEXDHEdQvlu8th3T3HHRh+qImq
+ sIis3mp4LsDmQkCM9H33AsjbG+4eLMgCxvPjXtHwGMATSFOwdIuO41DQrUooTAoi
+ TmB9tl94BzthHg==
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-pod17-jump
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDyDCCArCgAwIBAgIUMHqI/4QsQFGrhEYLBFA+kS/1nYgwDQYJKoZIhvcNAQEL
+ BQAwLzETMBEGA1UEChMKS3ViZXJuZXRlczEYMBYGA1UEAxMPa3ViZXJuZXRlcy1l
+ dGNkMB4XDTE5MDgwNTE2MjMwMFoXDTIwMDgwNDE2MjMwMFowJjEkMCIGA1UEAxMb
+ a3ViZXJuZXRlcy1ldGNkLXBvZDE3LW5vZGUxMIIBIjANBgkqhkiG9w0BAQEFAAOC
+ AQ8AMIIBCgKCAQEAzV5tuExTU+9A/tNkCqoVhBtYsZeNWrvuGiYWXc+6CXYKAhLo
+ eqVbDNTtxwsQA+KPRJtiJlTS1+EYeFd7ZTQHAj/vt8NSdFmIVSpaJdkDBTBLX/D9
+ 9b3hdx1u+4ZR3jiU7VDsezci/apB69oBuihLcvCmm3m2EhgFFf0cUAa83Z0U/Pdy
+ Hg1VRSiLcMxxU5QATKuDNUpt+NG5rVP+dkVjYzp+Vmzxws4pY9T9xJSYup/rdb0T
+ gWpPFi8uNIazNCbUXRwHFM5VXq3S0ueNCCVIdA24M21QwrG7NZCsoG6n2d4yhLv3
+ 89uSBzY4UQ30Y7Uqpi1vjn5QmqkYLrEuc/5FmwIDAQABo4HkMIHhMA4GA1UdDwEB
+ /wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/
+ BAIwADAdBgNVHQ4EFgQU4Q3H82QjIU2oyn7tG1HUbWZ1k7gwHwYDVR0jBBgwFoAU
+ SkqkmO9ScQrpng9HFA/0CMmeq4MwYgYDVR0RBFswWYILcG9kMTctbm9kZTGCCWxv
+ Y2FsaG9zdIIta3ViZXJuZXRlcy1ldGNkLmt1YmUtc3lzdGVtLnN2Yy5jbHVzdGVy
+ LmxvY2FshwQKCqwVhwR/AAABhwQKYAACMA0GCSqGSIb3DQEBCwUAA4IBAQBnSTl4
+ ymVkF5dAwrEd1A+YsB7BagB3kT9QSPNVzckyc114vJmGeUbpQsJ4q0sSZxw3bRNe
+ sf/ZS4XIaCVwPDhjNxVmOu9OPE16z55qeAHqt6+sGB5gz0EdT/sdGMbaHTiTlOwL
+ 3NUBeCWoG7EByRxYhlKino3CB2Ozt7ol7XKddaOUOjcWCpRZOFwDQ+KgT9Ep6/K+
+ jYadGMMNQaKQied/tS3sDWMLa55kmbVOyAHYK9L3gnoli4+ZeEuXZuNvW+zemqZs
+ AwzuWB4zEahwOVJkCYwAMPOlzPlflRtoUArUHIgiSLa0BrjOeXEF8YRXcjEbRvjw
+ 694njClwubBNq4sd
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-pod17-node1
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDyDCCArCgAwIBAgIULkPrqYtWovpB408xMGMkFt9/UTowDQYJKoZIhvcNAQEL
+ BQAwLzETMBEGA1UEChMKS3ViZXJuZXRlczEYMBYGA1UEAxMPa3ViZXJuZXRlcy1l
+ dGNkMB4XDTE5MDgwNTE2MjMwMFoXDTIwMDgwNDE2MjMwMFowJjEkMCIGA1UEAxMb
+ a3ViZXJuZXRlcy1ldGNkLXBvZDE3LW5vZGUyMIIBIjANBgkqhkiG9w0BAQEFAAOC
+ AQ8AMIIBCgKCAQEA5U4DMNAvkkGBgR6CJddKECt1+Y8VBVMbGQs9hC7Z8qRQHnqf
+ AFEs3N5rq+CASmoTdx1/ZjRqJnwoNVF3j1KUY8WNBtx84M0DTY3M2j6FXmOmmESJ
+ LHdxBYiNcs8C/j5517/yuHERs0aYxGOIK7SORw65159yQ2cFlXBW4+BGUkIKUkUj
+ R2TuoyBYRO943CWZRMHTN+eK98TuSdEaxk1vqNzXsvs6dk3ppetXa1pnHPs0KZm3
+ CrOZCg5CWEG5J0gK3vojQaR6ygrRV+sGN85q8433tsfMRy/hmahJbAQVwxhm6Oza
+ +cL6voHCuBkKju8JdZTl5b/91YbaF+pUKVS9CwIDAQABo4HkMIHhMA4GA1UdDwEB
+ /wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/
+ BAIwADAdBgNVHQ4EFgQU0GzAO+78ztY3or5VLtICWSFJWUAwHwYDVR0jBBgwFoAU
+ SkqkmO9ScQrpng9HFA/0CMmeq4MwYgYDVR0RBFswWYILcG9kMTctbm9kZTKCCWxv
+ Y2FsaG9zdIIta3ViZXJuZXRlcy1ldGNkLmt1YmUtc3lzdGVtLnN2Yy5jbHVzdGVy
+ LmxvY2FshwQKCqwWhwR/AAABhwQKYAACMA0GCSqGSIb3DQEBCwUAA4IBAQA1vb/3
+ hu45aT8BeMWTHR7REtfxZ7dwYp2WF0i5nfOZLxkrptaK2b/mjDo5L+FrJm6MjmeZ
+ P74O10UutDtSvZKOVeGc1+etvqEKymXL/HKOmxmT+1nG5ON4JaD01Tl56btFXSJX
+ J3GTUAX3S3RSTolvPYekc8klaVQi/YD6AY42SAFqrk9/DQJTPZosJwUoyirfapE1
+ 5jf/jkwmrmIW6g3hORGYFihMwfw9FU7VfBF9M6QjdRTNyv4V+0l4FSd6AvdsN1ol
+ 2SKJEQsLxpbXwjjM2spp4reAB0Mn1Mr0dEXRv4cJ59OQY3mSb3qhhsJAthrvRXkA
+ SRjyOHnfoiHvbIMj
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-pod17-node2
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDzTCCArWgAwIBAgIUbYHkC2Uah5N6oh4pji29G5LqntowDQYJKoZIhvcNAQEL
+ BQAwNDETMBEGA1UEChMKS3ViZXJuZXRlczEdMBsGA1UEAxMUa3ViZXJuZXRlcy1l
+ dGNkLXBlZXIwHhcNMTkwODA1MTYyMzAwWhcNMjAwODA0MTYyMzAwWjAnMSUwIwYD
+ VQQDExxrdWJlcm5ldGVzLWV0Y2QtZ2VuZXNpcy1wZWVyMIIBIjANBgkqhkiG9w0B
+ AQEFAAOCAQ8AMIIBCgKCAQEA5LKMumJCGGvh2YiPaih1JqfObaxIKLbTEvtqrj5g
+ fSMiF/mlOe8hoV0ce8edR5uhGGzY+MaRmZ4tbuxBSD+u4mjx02ggc007stMW0M+I
+ zhy1/EFveKznz8orA9Z/HwoIOnqJsRhRd5qKjAoo8a5rg/+PTKjTBQt4Ndzx9q3H
+ x1AhDvN4ViYswqe2z2vn73wOH/QAcT4ZZ3snTb2oGroYuZHo4aTRSZVGk1nZzNZP
+ OAZLookgNgdIEuWGIUwY+dXoXPfTsjuJ1EijjjtA3VwjfAKKrU5sUFJ/3IiXJE5N
+ 0Ll4zhQ3eG19aDCv0jIpShyOR1XIeM3uz+QX1X49/hCU+wIDAQABo4HjMIHgMA4G
+ A1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYD
+ VR0TAQH/BAIwADAdBgNVHQ4EFgQUC7NPtIAgMaINmbjzLknt4duM788wHwYDVR0j
+ BBgwFoAUhkJkqrelmIi3tfVjoJW8ro4JmNEwYQYDVR0RBFowWIIKcG9kMTctanVt
+ cIIJbG9jYWxob3N0gi1rdWJlcm5ldGVzLWV0Y2Qua3ViZS1zeXN0ZW0uc3ZjLmNs
+ dXN0ZXIubG9jYWyHBAoKrBSHBH8AAAGHBApgAAIwDQYJKoZIhvcNAQELBQADggEB
+ ABQpwlULulZFJsfcKqRqMKzilPXpNARygcjfXnkOCvs95OsuKnUUaSjPtC4CFGhE
+ o4+e84VyjeUlnywbfEbBrUjLns7MBPmUb92M+0dadCCa4JilgXI8ZOcswko4gx4P
+ YrUAASog/VO9XYJnd/Ch+KrY46qyfis21inFmWrroz9pg1+glhV/IbybAJMWg+OT
+ lGblWWiL6DpeE3DaQzP/eYdeVlVYPaExjSsN5D0LAWOy/Rgz9+n3zLsuSLB6h9mY
+ 2pJuy5eikkl28Q8OxMdxWQhEamny7rlgYP7W3DI2iP3VDYZrf1hXNlOtque1J3xr
+ WVwSS5clRh8ar1rxYU1ByEI=
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-genesis-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIID0DCCArigAwIBAgIUBFKTOX2Sdx7PAY7wD1OsBC2yCwEwDQYJKoZIhvcNAQEL
+ BQAwNDETMBEGA1UEChMKS3ViZXJuZXRlczEdMBsGA1UEAxMUa3ViZXJuZXRlcy1l
+ dGNkLXBlZXIwHhcNMTkwODA1MTYyMzAwWhcNMjAwODA0MTYyMzAwWjAqMSgwJgYD
+ VQQDEx9rdWJlcm5ldGVzLWV0Y2QtcG9kMTctanVtcC1wZWVyMIIBIjANBgkqhkiG
+ 9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx84cvFlUdir2iio1iPlFxQ67x2PqGCr1/jRj
+ 1ptPjnlnXfLnAbypA0jpbKS9r1lnSUsJtK+TNG78jFtmfnT2DLX+J9tZm4qI1Z+q
+ rWhM0qlYyPuGqXuSDI+TR5wbz973/2IioTAbSo6E32cTHHWhEaCT4o+iD/K9jZB0
+ LToWX2k6+iQFBg61rFFAk7SOAO4/8CcsgMBw3Qnl/Ewn8WNCHcInkLqhgSOF21yM
+ lcBsoPv1IAARkhXmF5tr8RGmV13K70lv5IhusGuznZ2FYF9gl07VxQ+kWNIdRgYw
+ Pgb2qKpT2pbljzBX074rc4GUJ3gTimchGLROukOm5rMxRkYMhwIDAQABo4HjMIHg
+ MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIw
+ DAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUa/Kd3D99+S8L5HyI8VKXwCJE7pswHwYD
+ VR0jBBgwFoAUhkJkqrelmIi3tfVjoJW8ro4JmNEwYQYDVR0RBFowWIIKcG9kMTct
+ anVtcIIJbG9jYWxob3N0gi1rdWJlcm5ldGVzLWV0Y2Qua3ViZS1zeXN0ZW0uc3Zj
+ LmNsdXN0ZXIubG9jYWyHBAoKrBSHBH8AAAGHBApgAAIwDQYJKoZIhvcNAQELBQAD
+ ggEBAIj7MoexxflrK9Q97t95eDIaacwupUT8LeVRP627xGWcyzAk+wR2sKt52ra8
+ VLTMNThCF6IbMDyGZ2r1TNPKBEENStL/BGhm/1WYxEs81/GGolnZAbcNie2kB0RX
+ oDc71m/RJAI6Zm0h80yuT9U8hviuhN1gdfU5IbsB9wX9ZhUf69Fggtw5aOYXoxYn
+ SUIJpEd0fECTCwwbbxr87FbCj19MfnM2wo+NjCjQHDMf/09Z/QEHoxuDyfWiZ35U
+ XsYbvpfte6ssV5I8FARyc33U8igdWssuIz4PeDKqDVWZ5WxRw6cDqAlJhculAVAH
+ peRFZDYSAcQ0xLHuPkHD2e0Eq4c=
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-pod17-jump-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIID0jCCArqgAwIBAgIUeh4Ggm8kIMINi0ZI7cwvYcUCi8QwDQYJKoZIhvcNAQEL
+ BQAwNDETMBEGA1UEChMKS3ViZXJuZXRlczEdMBsGA1UEAxMUa3ViZXJuZXRlcy1l
+ dGNkLXBlZXIwHhcNMTkwODA1MTYyMzAwWhcNMjAwODA0MTYyMzAwWjArMSkwJwYD
+ VQQDEyBrdWJlcm5ldGVzLWV0Y2QtcG9kMTctbm9kZTEtcGVlcjCCASIwDQYJKoZI
+ hvcNAQEBBQADggEPADCCAQoCggEBAL4FvXvuaXsBx5nxFEybOSeJEGgKr1y6WIqx
+ wGm41csuMERhLhiul5+RWpfCRJYq3zz8bbK7sDSdKvLMD7C+OAsWXb/jD8JUuR6z
+ RZCqP1hwk+j/gzJWoKYaf54A9kmGrK2HP3xtUmDm3FtH5kJfdaHgRF7ed83ULQWZ
+ Hsfdl5r4jH9RewTZcg7isxp4oFpdvc48p6N3qpjQn0gZUmir2enn72h7GZrGa8r4
+ g7WftL9E0nZCouglDiZYflMEaLbI9PkMxS0vdwgAqWJQUvP7K7vHucT+KsDH1E9U
+ Mmh2l/ayk3NOEU78hx9LQ2ABn0c4Hk5iUF/sk6mXVTnvFqyy+h8CAwEAAaOB5DCB
+ 4TAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC
+ MAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFFNlE95sWo6M8GR87C2km+fIb2/yMB8G
+ A1UdIwQYMBaAFIZCZKq3pZiIt7X1Y6CVvK6OCZjRMGIGA1UdEQRbMFmCC3BvZDE3
+ LW5vZGUxgglsb2NhbGhvc3SCLWt1YmVybmV0ZXMtZXRjZC5rdWJlLXN5c3RlbS5z
+ dmMuY2x1c3Rlci5sb2NhbIcECgqsFYcEfwAAAYcECmAAAjANBgkqhkiG9w0BAQsF
+ AAOCAQEAKyk87UAyZNGaRyE30opnPNvd2GhgmYQn0mHQgZqK+5lEHnsokhEj2p2T
+ AnprYIKczHtjZONKFSeFQImOgky/wImJl2mg006FzbbZ3cvRmW5faJiqxc8aLjSj
+ Z9dTxYEnLTnRIX2MgzAL1w5ZhA31FwoMN9Ch4UCXS9PsFbjJLSGmnrVMRilg8+En
+ 7tl6oL0ZfA6SoRlTHf58HW5BopctG/zYVjykLFBBaDxl0jtJRQ81Tdq3lb5PxYKh
+ i+1w1vxOPE+27UpjkVDrG9fFc56Y/tYT2nJGhT2kl+ycsLmHTvLFniqnvh5QNIit
+ /Y1hFk8t/IGKnX53p0TCTTHkuBWlIA==
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-pod17-node1-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIID0jCCArqgAwIBAgIUIyUyrm9IjcFUKYyrg/aRTyx4GB8wDQYJKoZIhvcNAQEL
+ BQAwNDETMBEGA1UEChMKS3ViZXJuZXRlczEdMBsGA1UEAxMUa3ViZXJuZXRlcy1l
+ dGNkLXBlZXIwHhcNMTkwODA1MTYyMzAwWhcNMjAwODA0MTYyMzAwWjArMSkwJwYD
+ VQQDEyBrdWJlcm5ldGVzLWV0Y2QtcG9kMTctbm9kZTItcGVlcjCCASIwDQYJKoZI
+ hvcNAQEBBQADggEPADCCAQoCggEBAMEZup7AAKbOGQ24RMtIuciVk7uPRa3Vxf2C
+ oIR61dRXCFpG+RC6gT4yHEikqF/Lh8X0IAsVWMW/zdPOjombO5WxWU9AyscTShp0
+ UYe5V5MSHbFY7A2YC23ni6+svC94LfJcAgffzI3xQjF2/dOfYl+99ywusjw2dw89
+ LzBCc8UtppzrL5bWO8QuOLfMoD9FHnj2D+DGj11xcoz9Np+GZEiv0TVrDb2s7DKU
+ 3Yxt+9F36zbnt4pVm3RqvCK0y4iEVGfK0GYQHlRvLDXVgocXIvPWKUsPYegCqSfZ
+ AtTRHyf1S1w1+gK96XyXf18D9FMfDC9o8bgRGoVRFm5as/TTJA8CAwEAAaOB5DCB
+ 4TAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC
+ MAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFC7YjLWMGWn8PP8J5UiXUd/r4aj6MB8G
+ A1UdIwQYMBaAFIZCZKq3pZiIt7X1Y6CVvK6OCZjRMGIGA1UdEQRbMFmCC3BvZDE3
+ LW5vZGUygglsb2NhbGhvc3SCLWt1YmVybmV0ZXMtZXRjZC5rdWJlLXN5c3RlbS5z
+ dmMuY2x1c3Rlci5sb2NhbIcECgqsFocEfwAAAYcECmAAAjANBgkqhkiG9w0BAQsF
+ AAOCAQEAmjbfjuh0fx7FmvbIMPRXq7z36Vjhe+Kwk5w1KItL7hjTdyD8602snqY0
+ IytOKEKz91CaswvYTd2HekxXrAJhUIL90w4DiPyxttY7Fk21gJvbamogscHQyENE
+ 22X5egWUdRFikmg83k+EJBNixsioIUyA7BkWBz/1302GkR/j0CmYNRSEEX3YJ8YP
+ VV5wKr5zEgQDCPcwpRP898sk6QICCCDb8GpanjLurk1l0sgil8Ib3OH5vNO+Zb0i
+ urVbp2Y4GqONRqEOZE/4et4y8kStQvIcWph7hEGBObL7kVYo176foJXAxyob2zaj
+ p0vbKl8WELAGXPWRm5FdBhUyJyocXw==
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-pod17-node2-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDSTCCAjGgAwIBAgIUAOnApTHu98LW7syQYeJa6PqRDngwDQYJKoZIhvcNAQEL
+ BQAwKzETMBEGA1UEChMKS3ViZXJuZXRlczEUMBIGA1UEAxMLY2FsaWNvLWV0Y2Qw
+ HhcNMTkwODA1MTYyMzAwWhcNMjAwODA0MTYyMzAwWjARMQ8wDQYDVQQDEwZhbmNo
+ b3IwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqqPUZqx8Y/a4ZOAU+
+ Qfi0bbKGrR1n2FZCabpnmDY7UYt9HMFek4bUT1U2O3vsS4qKTejKynCEGFHh+2u1
+ hU5KqTbrSkTEotHMJqt3mL8PZOU+PcpdoZVhQLK3kwZzAAggJ6yZsieqawtWl6D2
+ 6zpoyPnFDX8JcJqPBh0WVEn4jAG0Y4YaY+vYQ/YE3AJgvJySGeNVsb9f+fUJjBqo
+ 3nxwE+cg9PWdQKRqL6RjJzbxa5sMn7kaUU0JS9UmfrEV/scGWU5WdQnOsrg7n4EA
+ 61aBUKawsmwr1KSV1lfnsmt94btuEalxwwA1HT8jnB0WFXOiMhMmkZqjldS1iKDO
+ 13DPAgMBAAGjfzB9MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcD
+ AQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUdnux2j1q7sBcGWNT
+ 3E/GPe8v9ikwHwYDVR0jBBgwFoAUb9gMAPDrJBDy4fq9pWYH1fzKjYwwDQYJKoZI
+ hvcNAQELBQADggEBAD89WTs/MKIpZ/MDAfNm/hpCXXWg4zRSTgakWIsO/kpNvBop
+ KkVQ4S0tGPDIGgWyv9RBfVBsZknom6Qk5SkGhjtSMrgY/um0hsHTlIQuo6F+stZq
+ HAGdTbjfE1bXgvD+0TNwfx8ypHPsPFs6zxPz8zkS68kBawRBCjFcKvM/cFgP/vYd
+ x7qKmh0M/llWz7csJLG8dbAVv640mkN6MJGO6M2nsyUDmo8hp90FL3zahFwTiGEl
+ rttIRuHfHfH6o5lf/RoYIc1kP4APW5bz5oycdlVX4v27D0aqFPoRsjv8WiND2pwo
+ Y361cWrEapeM0AgkT5A7XISmfl8ksDoXRKOCFFg=
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-etcd-anchor
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDjzCCAnegAwIBAgIUVrrClpDO5jsxeOtpQGdSQctKmeswDQYJKoZIhvcNAQEL
+ BQAwKzETMBEGA1UEChMKS3ViZXJuZXRlczEUMBIGA1UEAxMLY2FsaWNvLWV0Y2Qw
+ HhcNMTkwODA1MTYyMzAwWhcNMjAwODA0MTYyMzAwWjAhMR8wHQYDVQQDExZjYWxp
+ Y28tZXRjZC1wb2QxNy1qdW1wMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+ AQEAtT29xK+8i3lxNgWG/YYmE1mNmVuWHjZrB+K112+ix7CDldYF0fJgPwR+urDg
+ TiQFN5cLL7GcTGIYmgArdBZcvUmeUsPjxxUuik/w/WaqyJQJc4Evsl42owqpfjpY
+ L5u/n5o9azsx6OTxZP3b+rmtPqSCafgkZ/VcJawIDc+jhGAKvhVzJj6zjmvb77XF
+ R4eUjmBGVwO64lrsH7juVt6n6EnwsvMPVoxQGGAL1C2Q00kyfjLTDrQScp8Ez7N3
+ YhzzeH/W4pr84NCJ9n8Cg9GkIDpP9dLzmNYbCUC+OzA5Egge3tfun/Daf+JgJ8Mh
+ L0YcjX4CxdlX0t859fmD06d7CQIDAQABo4G0MIGxMA4GA1UdDwEB/wQEAwIFoDAd
+ BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNV
+ HQ4EFgQUkrbIAriRvwk6kUGHkoG6hQIcl7swHwYDVR0jBBgwFoAUb9gMAPDrJBDy
+ 4fq9pWYH1fzKjYwwMgYDVR0RBCswKYIKcG9kMTctanVtcIIJbG9jYWxob3N0hwQK
+ CqwUhwR/AAABhwQKYOiIMA0GCSqGSIb3DQEBCwUAA4IBAQA9wrXnfllZHiKZdpEo
+ 1IDr6IqkK+8Ub2kXgVhaW9wAsWedgaPRuedWleIu8mYZYYuQWn0w49wJlOqVhGsq
+ l8dpBPH85AAWfyrcM7k3wOdJz6TVAQcRk5qLXrawerjCakY2jFpi+Gd1sbRNd0b+
+ dSlVo+7bjxhuq+EBS6OoFQQqx0SYLZEIPt6xW0yMEOQw+53IANN2Aeql1Th7C+p7
+ Avt5vnSNAEywVg/b4d47ffvbVF4hE0fGjDsYzNh/U6FLm+WKF/DP+zHPjXfeMC01
+ mqjTLmFrg+4qWOeW3CMiCFKYiTcbqa9QbJ17I2zWy0d1n0VkrX7ROF5WCCO+acNA
+ yK89
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-etcd-pod17-jump
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDkTCCAnmgAwIBAgIULrHOif0uejOAG1EFl8cJsNKAqMwwDQYJKoZIhvcNAQEL
+ BQAwKzETMBEGA1UEChMKS3ViZXJuZXRlczEUMBIGA1UEAxMLY2FsaWNvLWV0Y2Qw
+ HhcNMTkwODA1MTYyMzAwWhcNMjAwODA0MTYyMzAwWjAiMSAwHgYDVQQDExdjYWxp
+ Y28tZXRjZC1wb2QxNy1ub2RlMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ ggEBAOuhXhDZaqedGuUyQ+aocfkaLWITmxAOXhmLQhHbe57RG/KCSE0TlaurzMul
+ DtApeyCTgayKUeZkpoZfkIrErHnJ/FR/YcAuTYQlNDyHHBgL39Gf9vGBF7VhYrRm
+ pwucIDrRPqed7wjuUfLdS5t2BpimWgCk2C+CMpVQi9HtrIazLAdP6CgDGD/VmMYZ
+ vc6EgzsTjBh8iEbmYflxD3lq1nCvsFQclaFl/kcZgXsyA71ovp2euiBVWLeTw4Xl
+ YDL/c+676zXTLOewk+WC+I5D/CX+Qw+CWDT2+pP5+Xcaic9PVYbyjzfOpGQagFOj
+ nOq/ttOo3LG5mMbmq66l1U7KU6ECAwEAAaOBtTCBsjAOBgNVHQ8BAf8EBAMCBaAw
+ HQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYD
+ VR0OBBYEFJiDwOkvLBXAXAu7IbvYt8dDAkTeMB8GA1UdIwQYMBaAFG/YDADw6yQQ
+ 8uH6vaVmB9X8yo2MMDMGA1UdEQQsMCqCC3BvZDE3LW5vZGUxgglsb2NhbGhvc3SH
+ BAoKrBWHBH8AAAGHBApg6IgwDQYJKoZIhvcNAQELBQADggEBAE/Yw0XgzVFuFNyY
+ b//eOHV2oj+rZXFBwEQCx5hMcct/bZdPqjjvHt+Df/gCp5/A+1KuHl3C+bCfRvWo
+ XtFn8WyMXWprAu0GbaGI+8Y/auh5bgTmvfqTPerWK36OtDVXzrxLVlXTHm2d8yGd
+ ydXNbh6FqsBXVN9VhBdP2EFDvuR/7u08ckHptgFa6RY/2iaSQhLAKBtyrIfj8/DJ
+ zoVl4rBOZb0uHz6k+njb2DmY79FWB8YIOTL1xcAfhS4dVPRrY0GTf0H7r+gGfhhv
+ egqMyMoLabwh7zYi2WgWicXX8/BZBG+Fw5IPEtY1cGzG7o8/2hwax9hlGLCI7nQQ
+ 0S3uB4s=
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-etcd-pod17-node1
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDkTCCAnmgAwIBAgIUSK5lrtrbA4UUnOPEI5//XPigjQwwDQYJKoZIhvcNAQEL
+ BQAwKzETMBEGA1UEChMKS3ViZXJuZXRlczEUMBIGA1UEAxMLY2FsaWNvLWV0Y2Qw
+ HhcNMTkwODA1MTYyMzAwWhcNMjAwODA0MTYyMzAwWjAiMSAwHgYDVQQDExdjYWxp
+ Y28tZXRjZC1wb2QxNy1ub2RlMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ ggEBAN7hAskLB6wk2AqOz/yrhTUV6ak+Yf0TeXPAsQVSra9vfTR9PnuFugZBm7ha
+ 49SPppGCY7UkPAQC+dw9g3+09vSDRy/G0qSpu77OFYao23e7cSVy7ci1W0Nf5pqC
+ n07tGmSdZ5V2dqS/LQnRdpUQUuWAFSZS/wC+tu+5diVlHXku2bC4ilnVnhkM9jFz
+ qb0B5cAdNN16v5CHF0jsiZ6Du9lNRiL1h2f5XN6bFc7Vofms7WN05W7n+uu6IQgm
+ oiVg9hFZeUOh4WmgMfPitxuC2yZMyvmDSv6eP163TEczTeVNCmnOPn92iME0d/tv
+ 9GPDAMuRm4iM+ieJqb9HwF/oyfcCAwEAAaOBtTCBsjAOBgNVHQ8BAf8EBAMCBaAw
+ HQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYD
+ VR0OBBYEFGtr+u9MwT/VqB2yDySDzuecjWObMB8GA1UdIwQYMBaAFG/YDADw6yQQ
+ 8uH6vaVmB9X8yo2MMDMGA1UdEQQsMCqCC3BvZDE3LW5vZGUygglsb2NhbGhvc3SH
+ BAoKrBaHBH8AAAGHBApg6IgwDQYJKoZIhvcNAQELBQADggEBAKz1v7MdVWW3mrvi
+ qP5KWatJT9CXl1R6e36wwR/atSx87h0141YAT/PS0muW73fFZDcBobnhtb0r/phK
+ Q+73QwrsQijSLj1FQZDE+p+MYVbn1NGxOUhO7ZSn290wCURpr5hWCU2G481ki+Y7
+ AKXe2VHEl8Z1tnxM1Bq45Y6p41yfvFWTV1NjvEkUdMhPWzdoyco0cdF+8bAMrA4R
+ uGnarof4HirEwS+QCoVWA+PPQnDA/8zM1VmKDb5pEwv5cah3k4b4hW5Eatu5YMx2
+ APtgfWgEQAqnjJwBexbrTjb3Lbq5gSDbdy/KUABS0FKu5w4SnARznOU8ncYfQiCc
+ /bMmUV8=
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-etcd-pod17-node2
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDTzCCAjegAwIBAgIURv1P/PZ+Gznq1ZZ0BjmlKIjEHLcwDQYJKoZIhvcNAQEL
+ BQAwKzETMBEGA1UEChMKS3ViZXJuZXRlczEUMBIGA1UEAxMLY2FsaWNvLWV0Y2Qw
+ HhcNMTkwODA1MTYyMzAwWhcNMjAwODA0MTYyMzAwWjAXMRUwEwYDVQQDEwxjYWxj
+ aWNvLW5vZGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDDlAyYrTSe
+ y4izRLv548RXhItJJ5VO9CQoV/Nt20rQJrcFsJbCRsH3LCvY9VfqC5jvtPYfFpTI
+ k664JYVDb7CMi/A4VjQN7hLuDgYe77zyg/BQoCnIcsViq2fa8avRNdJQNbdR4JWV
+ dlzvIpwbTzP4H3i5sGDp91E7jUIpJ3CNL3CwGoI3s+4QSiA6ii9T45Y5o9Xg0vwT
+ g6olYqIXRfPcG4SRk6sIE/yFf0a7egHYd03GhMYhz5/mk5ltYW/Fhmc1d5UtoMNx
+ i3/I5cpagCdzVtpp4eRB91IekzlwN1f8X0lUNQS+L+FGmFpOfTnOuIumUNS/fqrA
+ LrRJlf/Ll1sZAgMBAAGjfzB9MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggr
+ BgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUVq41W6/V
+ cLmdtvwks4AS1R4v3w8wHwYDVR0jBBgwFoAUb9gMAPDrJBDy4fq9pWYH1fzKjYww
+ DQYJKoZIhvcNAQELBQADggEBAK2Y2uxccfaaZQxHPtg8rw6NG/QVaLRhGqVhZg/c
+ l8KOE+Dm+wrgMLRlkIERRcKn6r8DxUIqFV+ghWW7GUDAdeuxrSdHuCXFZJoGA834
+ ksUTOSCOQjHQhWBcJUgAXtHk8hm9zaN28mbx+YS7va++mzw1pu5MK3Tu3XxgbGHR
+ EWg8To4p0iMJprypnlwIMwSw0XO5AUdzw6ClvJpdjU/aF8jBeJ/mubdu+MG84EaM
+ EskUFBQV2FzgcVAg5zh+5ZwRy+hWaOM5zGB0K0wF+hVcCuJrxtzZxoG5tFIN0tRy
+ TG/WnKaHw7Uj/hE5HT6KbFd3Wboxr6uzlqExaOSZOLq4h4w=
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-node
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDmTCCAoGgAwIBAgIUSWqXl4uMdAv5loIW6a5TbNVxLiswDQYJKoZIhvcNAQEL
+ BQAwMDETMBEGA1UEChMKS3ViZXJuZXRlczEZMBcGA1UEAxMQY2FsaWNvLWV0Y2Qt
+ cGVlcjAeFw0xOTA4MDUxNjIzMDBaFw0yMDA4MDQxNjIzMDBaMCYxJDAiBgNVBAMT
+ G2NhbGljby1ldGNkLXBvZDE3LWp1bXAtcGVlcjCCASIwDQYJKoZIhvcNAQEBBQAD
+ ggEPADCCAQoCggEBAL+L5bQ3kN/cbHz8Jky9rz/XBUeYyjztaacS4VNzz5+/hNaI
+ yZSqzN2yRagTJZH/m6MdBSmI3KIhEoHvHZNEO47tnL9J9sX8RtwV53mfWroHhuCQ
+ 5Z1FuswnR2I9yhaPvcXVQhPGxpCszf66Cm2S6JctZzKMUkRlPb2XV/KCWluK9Dxe
+ 7khQqpZOVJvL3uHrKfBQXIgLlZXxMLTz2s/jMDeqDsrhxBi91770YwRiVw5HX4Lj
+ R8gMJ0Y1NJ9fdeWOJyllfP8yfcTdUQ8JQIzk2vDKpjRopqYYUT23brQN7EqGK8uk
+ ub9AyHgmuZOKFg+FXmkmXRi7qZZJaTAHaccEoQUCAwEAAaOBtDCBsTAOBgNVHQ8B
+ Af8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB
+ /wQCMAAwHQYDVR0OBBYEFKvkppVjL5NHRRPR1+MXWvg63lMCMB8GA1UdIwQYMBaA
+ FK8A/IZ1Vcl5VxHpDs7eOTUgtUuEMDIGA1UdEQQrMCmCCnBvZDE3LWp1bXCCCWxv
+ Y2FsaG9zdIcECgqsFIcEfwAAAYcECmDoiDANBgkqhkiG9w0BAQsFAAOCAQEAmXcd
+ NMysKMi+YHPGipz9+Zj3P/c8bYxGML5eWKoYwrrbHGNNknwTKhvRTSlpiT6+u0xY
+ 0aUrUHazM0fuum/hlNf0PZaIUDPfi73Gd1Xq+BxEMBpmewEuHIbnZdsP3OQ9z8Kz
+ JYpGfpIXb3Iy9Y9+O4KYAH4YUfLjBKg8JoACrrzYC96sN32SzbLOy7aGojuDCZ7v
+ VZttvHJ6VkpakR0bZjWmqMxb7XsAcyjk+/2uZickt2QJrixKsx/cHby7/c+ywhwt
+ QAAA40sqJOYUeqhqDPLDnl6gXyfJ3JCbMzKsvu/FRgGd2GbKgNCMDVpSElVTDNuA
+ GTW2U8c1AII6JfKdzA==
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-etcd-pod17-jump-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDmzCCAoOgAwIBAgIUMM0JvwRtsl6bVW2TrQkK+QUhPu4wDQYJKoZIhvcNAQEL
+ BQAwMDETMBEGA1UEChMKS3ViZXJuZXRlczEZMBcGA1UEAxMQY2FsaWNvLWV0Y2Qt
+ cGVlcjAeFw0xOTA4MDUxNjIzMDBaFw0yMDA4MDQxNjIzMDBaMCcxJTAjBgNVBAMT
+ HGNhbGljby1ldGNkLXBvZDE3LW5vZGUxLXBlZXIwggEiMA0GCSqGSIb3DQEBAQUA
+ A4IBDwAwggEKAoIBAQC0UDXQP1pR78DZh86E2fOXKiAVcorEfg75dP/pFQwgj7D8
+ 9N6bdclTTuVy1U8xj6HlJA+7WeGPq42WOnVPNKldX495PRCHMKUamYRguBUvgDHk
+ hYBXhhh8rFs6PqvcUN0y0jkUcy9rrSqRyK093h1BDPVF/xicjw2XJ6wTevDYrUOD
+ zw731Cs2bmlVgqPH76uMznrXKaEYIm14IMW/YCSD6s5BT3oZQlKhbfPYIHSyJUCV
+ TCffhLF0RiEbznsq6gaS5ymvUdf/nnOeYqtWJS8OV9y8B/HM/C2fWIfmzV8ZHIno
+ z0sNa0XMtHGzryXN5g2kH6Cv6iFypHzOrX8J6WRtAgMBAAGjgbUwgbIwDgYDVR0P
+ AQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMB
+ Af8EAjAAMB0GA1UdDgQWBBSXthiFCby/8efbtyXaBlB5Y5aMGDAfBgNVHSMEGDAW
+ gBSvAPyGdVXJeVcR6Q7O3jk1ILVLhDAzBgNVHREELDAqggtwb2QxNy1ub2RlMYIJ
+ bG9jYWxob3N0hwQKCqwVhwR/AAABhwQKYOiIMA0GCSqGSIb3DQEBCwUAA4IBAQAB
+ uRVBVY7ACmusaDqmVMWGwOc4TlCOufFxj7MZULoPrMQbYSdAZpVdSXjy24eAZXdG
+ HXouitQgAPTu/M7tMFfQCUP8XYHaMl/SCcOLsTlEOQeeYmWjst/02ymswFL8Y8X5
+ +x2m3FSzO6QxCj/i5gXp/xmUXTn0qshvAUaM/mK1PiR94Iue1cHzjA+VoGi5/nsM
+ e7sTjwM3JBrojwr9cNmCPlMBAVymIYlc8d1bNst4bX/3uTJRudKK0zdTVNHFa83T
+ F/NVsDwzIRzuy1srNGkOu6U7+l9Hu6x/0SsTH4nGKBMldA42FflJK1ho+hnV8PjC
+ K0N8RChJ4jkljGCAHePB
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-etcd-pod17-node1-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDmzCCAoOgAwIBAgIUSkpRUJYqQ/QIbowiYY1EVFFYT5kwDQYJKoZIhvcNAQEL
+ BQAwMDETMBEGA1UEChMKS3ViZXJuZXRlczEZMBcGA1UEAxMQY2FsaWNvLWV0Y2Qt
+ cGVlcjAeFw0xOTA4MDUxNjIzMDBaFw0yMDA4MDQxNjIzMDBaMCcxJTAjBgNVBAMT
+ HGNhbGljby1ldGNkLXBvZDE3LW5vZGUyLXBlZXIwggEiMA0GCSqGSIb3DQEBAQUA
+ A4IBDwAwggEKAoIBAQDA6m3jH0jFh6fTMg/Mv5T3CY4mWzAnH+RgaA7UcgKpNSqf
+ GRWs7Ju913jBZUk00SvTCG+sKIOUtsd+fKDJfCRALU+1X0cRQHDXgAg+NIXoOGG8
+ WiVR4rQ96TjinudePgrW3tyu3V7E/gmKC3LgMB73valxrAdKqSDShP/mYwqqO6Ht
+ 2xG410Vp42APOOW9VsZBbtZ6f4WMJ2zpXCw9gBs6aA5xs2wGm0JfWLOfBcunUvSx
+ GNHFbEU/OZUjZ/l4Hu2xK3aaCyg65k9NBsvuLXd4bOWqw6oTFavX38uVVosv9A4/
+ /kGYMaDorYUHcF+M6YeJjixj4RDpb1uaB3Re52VxAgMBAAGjgbUwgbIwDgYDVR0P
+ AQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMB
+ Af8EAjAAMB0GA1UdDgQWBBQQe5Y4COHamJ4Sc3YlW94B/wCfzTAfBgNVHSMEGDAW
+ gBSvAPyGdVXJeVcR6Q7O3jk1ILVLhDAzBgNVHREELDAqggtwb2QxNy1ub2RlMoIJ
+ bG9jYWxob3N0hwQKCqwWhwR/AAABhwQKYOiIMA0GCSqGSIb3DQEBCwUAA4IBAQAA
+ +hOEObAmt9cN3bz5nUNqUTmoc/FihiJnFq/2/iu0SMTuuEPJtLWPxgt+7pNV/zen
+ PJp5ttyRNWFX/b5RzNC4piso8MJDiFh3if+4niGlQ1MKEXlNWQgUQgQeQQ3onrhJ
+ fcSMHZ6iJ+O0gDfQQtv/ZsqBMS3w/lOFJBLsTPsnk31dcoFl0EU7/R/5OVMUoxzM
+ A+OA6s/TafxzmauLPUDyaMuhEUcRFJ+vnoz/HzojD3sADXMJIr0vDOQm8ly39sxm
+ fbyW5Bav66J8m4NmFzFV32qILvrXOt046+WKW1W+zMfP/lQyU8PIdSuJp3n8mI7v
+ Q6f94camDu5jpUjj+Pc6
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-etcd-pod17-node2-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIDWTCCAkGgAwIBAgIUQolLUlVe9jtOatwQegOgwBX+eE4wDQYJKoZIhvcNAQEL
+ BQAwMDETMBEGA1UEChMKS3ViZXJuZXRlczEZMBcGA1UEAxMQY2FsaWNvLWV0Y2Qt
+ cGVlcjAeFw0xOTA4MDUxNjIzMDBaFw0yMDA4MDQxNjIzMDBaMBwxGjAYBgNVBAMT
+ EWNhbGNpY28tbm9kZS1wZWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+ AQEA7xv2/Y36/LeeUMFWWJ6ztNHw1BIEK8EVjQumZgl3fk7yXquv9NFbto9LXQo9
+ Yib8741Q6BFtZ4ID4n3h/c65atA66V4zWnaVivs7UVsIoHGLz7lwrb9plkHIN118
+ o56ipWWcojiUfulAHC7wMIklEI9F9zOhRlzgvZbGpy5dSGQ6ZjqRlWkOQNxVnvY8
+ qqJnrrC6ucPGZqibhUo7UaLS4qlf0Yp/TjGsJjYsNwTACFUZOMpyZZuqoC8vLVWr
+ NYMAZrMSoUalP5NNrKCQVGBj4saOIFDNcoWAF/Xdd21TTnYHyENrEaLrfBEdiKL/
+ Qjl0/l3YXVZ6IMNLcn8PVQQ3NQIDAQABo38wfTAOBgNVHQ8BAf8EBAMCBaAwHQYD
+ VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0O
+ BBYEFL4u6Gx5hZrTzP+wWpzj7STuOi3LMB8GA1UdIwQYMBaAFK8A/IZ1Vcl5VxHp
+ Ds7eOTUgtUuEMA0GCSqGSIb3DQEBCwUAA4IBAQCulsqsgGGw8DxUyrujvxdOSNqK
+ G1RRsLdhLFVbgAZT6W8EHE4sfGTkhSZY9zpV4O1TWzfTxH9RsUa6VprE5mqn8Rpm
+ 0mCtgII7wEtLHMKtoTYrBaWO3tfx6SgBB0DxDrr/kZWQ9tfMpMpKbhGMZa+HacEi
+ wBwARUinvzoOYBwuPOtzWH+Yc04j4aMcqZZGw9IiCQcC9tnXMhsBslyFhmLjoFla
+ dUSdQPwpVCdMwpNU26rnxtWjUUpX3pT2BkATvfY22Z5e6ZZsaX1zTY6hqMhPSHiq
+ rjjAEbBvbGCaD5obp+9+orrBH4fg9ljRekJPmiSFEXorqlDiUzYtg9URuA5A
+ -----END CERTIFICATE-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-node-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEpQIBAAKCAQEArwDdGvpYwHpV0z6rxTAB0QCu/OdULCVO2P7sCkjUi24bK7Qv
+ E5h6d1Sv30v79ehvRZIanz6xjghiQ5mqIa72ogeZMnTh9j7GmWZwgGHOp6QSy0Z0
+ IKcfwbjYwlAqWlvlZlcueRsuIu/TN70ywsJohJgCfE8FwSvIe9alInVf+IVpTyNT
+ vvU/JdgL3kLX8PLl3oLjimD7/Qftzzx0FK3nTbFGeYIPKs8zGTBjYyaGJkJLA1X0
+ mrkL9EQBgbvRGM4EQBMsLSyqFofbXbxNiJeD+TBFxP2lbP2OvSPItGE3odHR/QMa
+ Rez+2ySLpiP71+glCILRLZOCMxxpMH5RV3PCVQIDAQABAoIBAQCJ68JV+qtrtn5h
+ Z+j0FSu5TjKa+q1pxVVoyy+3w0JPSM19Ghpn9Sm/ViztbPL8EN1xFP6KNly0tYLM
+ CBT/SubxN8/S5i8XZM4cI5HSfELj9/kf3zyyZ0Qt5sJeEdPvNrGKgHcN1w/7VMtA
+ CIoy2AiLR0neMmE0po7wmm+2wo6KSzvAOg/84NImL+NetMzuFzE/ACi7vl2KIbPR
+ RmXHBM8h1tThMt50Zkzs/Ax87cMme4EAFd84+7dJNZqYGDqE+I94XkZiDIbPwmxY
+ mbH9AyeO+sOYI1mrQgOFg8/M2U7SkzUKizOsqr3OtsRNMiiDC28wRrJAgYSAuX0A
+ 09ofBRaZAoGBAOWoXJUIe2JQwccMQqBUNW5vXrgtyQ8/kJIit/zv/NoE+NPobMrf
+ 3jxexNAvKuIgWzmaboUwaPTcqrQsr1BmjA++cTu/bJhwCbSKNd2DYypU6H+oqugj
+ ui0Tx3OSsKGnfVZz2ByXUHiEXEy3mbIoaxxs1YNgrUNryTqYTK1b0lGzAoGBAMMT
+ o/WqRO7FCbELz9gd+8rFTpP2fELwo+gk97ys1QZkMvynJn8/jDFdzKT96DD2jeJq
+ NU3lRwTCOYjmcmJbYsEuzUZIUxy9z8iegD/AQ8MI5Pq0MZTwEZhc9ye8vdI4Dq2R
+ PF38fqy7+FF4FDyiWqeVE1gsV3mZtLdUxa9E9cfXAoGBAMEGOAJ/JY0lySjukhVF
+ kb8nVhpBSUtKps1c5v1uDDyGj0k0gjQl4xkkohFEg6uZfHM27It/e8fKrKNRJ2zR
+ NAmLjIqmQrUA/fdDbzCmXLPYt62Ma1E/rhxzEmF+On00VDFUnqCxQU56GUXVzxWh
+ yR0UEIUivZ38Ox7HoTLYCTbnAoGAWghriMtf6y9HTM4dzCnyduBfZszBBwgXLeI5
+ 8Ht4Ce4e1hqzGtGSe4pGE/QXwNlaHKBWH7Bs+ZZGhZeOPTTePDjEhuaEbWRxTK9S
+ k5nB7Hbjb43QwGOYS1DExTNIDIjQxWydhucs874BWmBoPp/T5TpZZj141eeJz38x
+ ibXzFZsCgYEA1rxRbGrErVcrUBLMWIkmwMH7O5WH7ECfiFllHp7cMIISPxSepCFc
+ bONruM1Pbc0Vh3DGjpmCwTlgQ1pcgzZnKWyjuzYeWt/1cTiejodxORVdpEmIbCVC
+ 5484mvHCqBhF62eNJsVvPKhVfFFt3QgC04vUR3GsfvVqYsXKD40XIhE=
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: apiserver
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEogIBAAKCAQEAmGydTB+pOnbSQfOlz5oxl6K/JUphYgThjQ+gpVZtS5BlCOS0
+ YcfM7zxnN6iGzO9RVnLdt0bA8jgfA+N9rwsH9/qcPHVqoSt2yxXnS1DJ2XW3SBC0
+ pS5QMaTkVYgZyW5fsxeS0Vmgl7au04OktD/2dM7fCqq8p+u7+0CY/x+EjDRPd+/5
+ 6vTY0NG/GFvImkJ31H6CmbSDD11243ezY+WqJM+kR1BJBnNCVXXIXqWsntHSE+ez
+ vFtwZKP7qRqsvNfev6VPTxBGBbv7XSTk+kehoRvBmhDXF1EK9m3T4bnGQA6ioHcF
+ YFt8AW/13BvfyH/5U6jhxl4FWNvKjSKEFF4NSwIDAQABAoIBACtk8LtVYDZ20ZFZ
+ LmGWQnwrJ0QUkvj27sfcJR4tJtyWdU0832XfHicWCUS9Q/NgRsXX2ettx0yuUZYn
+ 1AZbm58ryAMmYn8UArP6vmigzXaNnupzZxqHvukDSsZXAxBnzfMMyQ20+JV4uvkY
+ x3FRrHbA1psQ1Ljx0gjL8ULg1Dmd0m/E2zL35Iw7imNl1q62VwhRg6Xzo+AvbYYb
+ x3seb1mpyyh40G93UyNZ5ACmy+OKURUY5N/dwiKR5SBRrG2KevtvTIydR9nXKqnv
+ YNLm+6u57PhwOtZSNyVteiUAAmi5t19udXoLWap7z56iwanWDQhydOpMf/2ux9R1
+ OvDZ7NECgYEAxKh3gsdM4MLD8S2DsVVZSPH3C0rql8o2oDzH97gfIhW+IH6mJT9q
+ HsV0K9lfe7jqDljKY1S1w6AWYfAE6BNUhf9Sd2UWYvIN/iS9Wo4vVo2nIVhJ86J5
+ P0W4fPZv6/D2KcXYcugGvNk5U8yEdrJatUOV4W4Gur59w5ZwMBDGPD0CgYEAxmsn
+ oy9bzGvm6ViGH2Jeanp21kobJc4J3Uxb9dyYQk08F6lTtvD/K1/AFyX8qxbwrKkr
+ EARiHUXNIZwDgm36+88HPilXJ1XhroDnYR6FXVeZDvpGnD0YX1RVFM5yD/leAcw+
+ E3b5njrTZ2Kfqo2oCguGpdVRFfDL/cD6ugMkYCcCgYB5aLg/mOMxb4ygfMTs2hBB
+ JICsDBhAlaqbymp52MX/uQSj8wyHulq9nJFX8N8t9r8pFE/+evGsUE0BMbkVvblU
+ 8IftBg+IDn/tAqmUGmvHN7SStXsSWqAYG+cF3u7B7wVKTMaQSga+2Cy4O28cCIhP
+ l+YUQmUNLUVfVqT0R6ba0QKBgB193dVee6mFvDugwca2a0wuSa2ONDzJRCQVbnG7
+ yRHJww3NSDkf1v2ObNHD/qs7bKhtOI5X6HFrZ5MASnE/gZed7PirUl3xYOr8E+gW
+ jkISfBiC0K32UsIQmdjO2ptPOE7SGcPw4idHnRZ3zT2fcoOTtP6/Fx9IvDlKTroJ
+ L4XvAoGAA7RWLfFfZH6LtoO0VLxaUN3TJ3bQ8JPGOxbo3tbJEwj/Hzm2Svh+z+ut
+ 5bIh0UFvVvanC03Z8LXe514gvHrsTklCcWidKOIsj+ncxqqMRSMvnFTeIJqqZ0Op
+ aDGADTQC0Nc2VvRq9CwRhO5FmVKPQvFcp3Fu0hVMUnk0wbakFz0=
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubelet-genesis
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEpAIBAAKCAQEA2Nroet4p31LVFgpZEyskMv8QMDnJf2y9qvYw4H/vlldrJDWP
+ MKe+iXeGyik9c8HLx+KS9TsW74yW4XFIUGRvAdKa38WuQApq9pLMEfOHKybdKbJI
+ K77rGQONVxis0odVk2S6JENxNHCwkL+ZZAf1rNrI4pyVoTvXk7AiVKnfSPcyF3Q8
+ 7KzqhD/jzoooE5A945lHGCnTmKJ8bP6hPOpiXaKGWe8u2D21+qo/kMgn0KeglFFQ
+ hFn1IcUfq5ixJle4fNZU5mdKeqBYHrPL2vHcFmo0Pp9lDp/XCnpdrs4QVUJnLUQF
+ D7xm1mysI0CCCuXNQZ7nr493itqch8yXw6E2RQIDAQABAoIBAAaTJIdNIxHdTg6c
+ A7VcEn3lU9VSezR81IdRbYvw9Q+m2N3BLfU4sMM0N4b7lxxiXM5TpUcAIqLirVRq
+ fdnKIb95Zi6wrKbOag3Nx5gnvQpm5D+2Yw/IexJIFEn2uo6rgcG1RRuCW/VOEVxi
+ IsFwqFc0TvDn9HVt/gxBQ9kzSUzJ+5IXItJQ28d6E7wLQ7HFau59ywt2nu/LBFPD
+ QZyaTG4e3JNnzpc2R3tCoQu3WGHr+mwadpRinvQ/RdpLd8ZI2t/Yv6DqBhXZKnlf
+ 72T04c3ZuKO7dLIH0PFc4or7PjSvfcFCxQpVjXV2JEO5CGG9xbWNlfyWQuuWGve4
+ 820EuQECgYEA9x2LZVNJdj6HvuVtKUiunXqNZHm5LcX25I/brKtl2GV5uLEay/Iq
+ 0bDcKVwuHTuAOlcHomb9Mb5MggtXHEPG9rIqKNVcs19ECAwitSPqieSn5WPnMLp6
+ fW0m3nTH3DsPZqBB9oo+ouTtd0ukeGFL1WVmwmfajjF8aXr/uP3DfMECgYEA4KbY
+ 4LA744twWr/Bruig3BLjv2nJ4WvdLh3d2ajZT0tZzPsbgU1KEtuigBC8Cq1UMMLo
+ MOd7gvyhL8iKfqDG+iHQs2OrxBZusetY8gKe3V+OtbywKVCZ841fXLcnKWsE81AA
+ FdoPotSPWK0vBx1oDNGd25AU1H8+LSVKNb385oUCgYEAkVDrZyNqIMG2u9hYsB1Q
+ qcSmnv5Bmhw/CrtaGBkWpAFQaf6j3mjDK1pQrXXKnGAgEK6bC7J6lCTvAs4+ZJ2q
+ w+mThz2o7MZJ0F2qj1DWnE49OVTdYDdYzqdAYzLTULveW6BECgHTwaDT0AJIbo3w
+ tUWS/yFpUZLiMXkmJhf8PEECgYA9VbBe4B7pyDc7v6D8xSyuCUY/C33/2rg/kA3z
+ EEOMf7Eb4u8mhViU/3xFZMxCSgJzcbN9LqYtJBZJ+oG9gt3wiuz1HWBXIBzG3M+i
+ +44uOJm5CrQ6A3SU52NC6Ap8J2jpmUz8qlWcilY8ysPNOH0hCtYDjTnyrm7mWokB
+ VUbIFQKBgQC6TOhoriorfTk5sz44+QpjePB+vcZWvV7NjXn7Ky6xBwvryUo+yhIB
+ DlCToms8q1JZB68kLt95r9xWJFrDmLvKy1yMNmLJ9qF2HuGmtEgr15rlKL+ea5Xz
+ Y3cMY7J1tfL0+/+3rSSeot3CrhBBAUo0m8yTWejKq5KpKFltsdUARA==
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubelet-pod17-jump
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEogIBAAKCAQEAq+2bIEDhxqyewMFr+SXVIJdNSUL8XS7B2eR4l5VGTpBxwSm0
+ FdrJ0XPdzBtGzZ7J+0Dz+YU/EnL3lXMJGTrrB/4UIIFK1/eVGtxYnPZ8m3jaKx4b
+ FqUQKQc+fF1OpfRlkJvppm9sgr1va29kr20XSGYsVkjFD5bXZRvCtHR+cmST2gBB
+ aVbV+sEkh9sz8YCPGQnitdHOHoBAqSlwisjQRzAB+xw7FMJ2AIsyhz5WsdqgiMwY
+ XAn4QScF/f0rmw0b/70rMhQjUY9CBuyBsdNBkHePbX/U2KHyD+bRbTDcZggl5vtT
+ eoIPKGlkYWr9XtQq2sl1nyjWWz+Epl5tXbLGWwIDAQABAoIBACsQuWq61dMOKjXe
+ PU2LTHd9br6LKOuuaqBJums92P6U7+mSqKlQxHzSqRwXOQUIYU+uVW6LEeFtKtck
+ mYLYX0cBPclmmXi/a3nu98NZepz3CK8EO4TQk9uzFNPSC4FGVqqCY2RtRKD7Eo22
+ uWG30b0w2qpCUBo3jnylF4BcLdA5N/zojnloq1qslv7BCQi0H2u+ynQwzr97CSGS
+ 1d1VD0E1FOZBkxcsrvtggQh6ZI4iY0wqwSte9Y/y9cTj28HgYLDp9Szpro0mO5lo
+ 8WiDbSM8cErTGEolRsp/PqrwrbZL3DCbrAS7WMNVMICKEWlp2huKv1TS/FBBIEN2
+ 4ZZrLwECgYEA396fEWu4TX/xquFIC45mU8rthy4YsaE/zRp4Nd0jt/gycMqjAKf7
+ T1bja4LZU4KsdZ0ICBPUzNnygFmv/4OU4lHR63vsIuDjQVolBue2j9hw06pBNRyK
+ Iurx2YhQoCjbi95MW72QSucA82ggv6nj8LeWfgiWlqCVGirjKJgHad8CgYEAxJqP
+ a1gUulSC2Ulhof9XfC4zdy348NHu+dkcJ3aU7gsOMHN90r2focvYvOWGvi+SMy1r
+ B3QesufSH/e88Z3EiUD3IWnSvTb1uNIiofC2Dm8E7ozMTHDHM7OVgvaZ/MEEZDG6
+ /zeW+6r71+7lKHGk0cHQPXVZl4HRFRPShPBi6wUCgYAbEHvkjERMwkICKZgfJYkD
+ ak4LAKyllNv0vNV5lZGC5TOb5TONmcFNFzEJR1lkujCFS4W0DEm2tkaV88HOPycZ
+ sVCSinnCwbNXrEE7s3mjrEP/ot6dQCUHEaZJaSxuIGJiZ26NzL4MAB9iTd1frndL
+ G7bK59jkvucnsbWiq7aBuwKBgHmiLgz5Z4mH85Q+5Bp3gUagxtJ7LMLA/xqwicyY
+ frdvO44aRcP18ScGmMb1MhHEGK108fygiMWiystgWBMbypYoDT0s3WaW9BsuVqLd
+ 66SuZty3W0YHmBaSinOF4esP94mNguWXHOAC/uCvOjN1a8UiJZWAXrdvZ02k/9+j
+ YW+JAoGAR1BbnZ3F3sxMtFZBFmOvjrQGCDofrI3onAt5rSxtTj6G3IAgqMbG5es+
+ MtTvb0rLW7fnOvg3N+Sma33MAgAO/eSVO/M4pg+yqOPuFEROiY95pKvNadJDB9UW
+ +iYyU/0//f96gq/V7YemZpC0lFylbeGYmISNpgmB5rHdh/RMVKw=
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubelet-pod17-node1
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEowIBAAKCAQEAnIF/2CoRs0vcWH+njIF1sY0GfYoFISGOHlvFOZBTprJUSkCx
+ 7x06nit777GM5VknhN270sjOdcYmCUfpCftIrhyswK0++sfte7KeloYN5ziIBKcK
+ 5CltPBjiX4Q+G+aMGPdCaq2GcMoIC4iJ9R7rAMMRpBXzlxwPcbzmKZAfzyIMAVeE
+ fWHhurUUAg6EAuuFI/wFcLaHF+S4FlGdx1n7JpOhk40b89S5zFIYveEfUi9NownD
+ 5She4vRZACC3dQ9CNsaBK/Op/3r7x7Tddd9AO5E/mZz9sY90DMmIe+4hzAy2Cnon
+ D0eFqgKdObSyFML+yEfPnDX3JHcznCU7rz0gGQIDAQABAoIBADDGp1puWg/gH68x
+ Mb23hz+rrQ8pGcomlA1gGoqDMZ7tSxnNKedU27T55mlgk4HTFF7zYBskXDwWYjpY
+ QAfNWexxoWF3XP55mskHdSeCZgje9H1Gtj0/r/yf4MVWCKlXY+hP/1IR/KlgPbui
+ dSSA20rkgLX75Wv94c5Xyf/AHDnIbNBiHpdKvMk1FE12eb21l0g5p7RDM84ANzOi
+ 4HkC9UbGLUz6WvxTpqsBkb40+1NJnYfsphS9mo/nEpGlpZe68EMu3d34Ip+W8vyw
+ opik+BuUuuVjcXYI2uXhoe+Y2aoE8Djal2HPHECT8PnkkRP6ANF2HEW1tUrocB7s
+ zmRbuVECgYEAwWdlMMpifq7PVkLOm1oLv11nfjMkMCiIdewEunab2KPCI+MDUNbw
+ lG2aqgkIhEQt+djucz73kO4TpmOSFppj++4+AlCjW13fSW1QjTf0oeRMFjDCgRah
+ mlWxUwJ52XQUFBvSMd6HtI3wEJhCA2ReYP1OSBx4x5J0lTsWonO4670CgYEAzyjk
+ 0OSNNEvu/0deMzuNJpm8TGiWnNuU/uyLx84vzIiQypGyfZvS+ZTouwBqPXmbflwL
+ 352iVKMMz24RLQnWzdVVrvaC/5W+ggpU4YQZDw/OJg/FwgkiNFMIHjJQ2/RFXE90
+ tGYfvHVFp5e3Dcmigpn+e8HXfnMRaHRsJVTofY0CgYA25s8G5qzHIYCiEBzuZMVo
+ 8W7rmEDxmtACCZneBMWA3hvCbDMIw7tPpz18f0v3oBMdFcO622kTr0HMvf8+g11W
+ qu7XYWS+DwvPoER5kiTTwCcJNZZBZtdBJIpN8in83MLGYo9ssKr9Sj2XuGEk7V0N
+ U1rhhZOTs7N8mWV3gDpCUQKBgQCJapYGH2WvaCNcgSnykDE8hsRKZyJpYJtAUwcR
+ /irk4T4ysV0WR1Q2rNmImmje6JkFw+c4aWdx/0qTGm8YUiuEFFynF+yjv+BEgLf3
+ dFnvDMvxoYrMAKUI0n9TEItkrG+KIUbIF+o7aAtRdak+4x8CxUXzMA1TWt8UTA4k
+ 4WLrTQKBgB47ULCLv3eRs4+2bFddQkP9H51QdLBvk5EkPdTaPLFQ+mziNEOzLZYV
+ eTbk8+cRvjV7GxVitPv58EqipYUL9Z8PP9KQqjUEzxJgU+YvnFpPTbLIG2s1WNRF
+ zEsXkNrhSB4tq+dAVL6rZbZXGv6wPm/W/wNk9X6Kc8qK4SP1xT8U
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubelet-pod17-node2
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEpAIBAAKCAQEA1T2LtQdDI0nZYUtRffaLzwteaMHBFu3GwPZg1osfd57YWhNV
+ GaPfJFTgK+8GOAuNmEtDB2ZU+QDqz68CaR8MAtVtc4A3OfjpSp3d07pvntr7xVvT
+ 4RaEpGeGcJYkyDsmCKGg+cQCnJjmhUmyLYN5j2wU618OlBRxmycqTfTbxPx/GjHk
+ a0CfgwOjKjCodJZlxxKbXWK1Rk2scE+AMbGg2KRoGNVh69OwXIHdZ6OHKFpx2DfV
+ YP3/NLRPrjXm3kQ4Lx/oAuDhIw9/pFfwgn45BWBy5VNrKGE7vFhH6RvBwsWa66bw
+ exHV/JMmqgDY3kIRIM8nHx2gycsn/Ga8NAt7oQIDAQABAoIBAQCYcbti26I/pBfn
+ 2nST3KHujm4b7gggYDRq1rg8KJGCbui03IVGI0TvME5imiqT/o5nhcaRj7LHoMQ9
+ XRwYEr3/eJ0aqVrR8wS0908SgoIxytObMB61F+gTsH8IFg6Nptt16Daw2FQVp6mF
+ OD5NE2TgB6Cc9AP0EPl2tfUkbhx/IcT5FxP/BwzNAz6CpUzMzFxmT7C7xiylyy8u
+ I7dcon/ixyif4QLpUJqPDtfM3xGhVMCRqNMbOIIFb/+tfno9K2Ut87Y+a9JfJ40T
+ sjby2KDryBLsi+VmEkk3j4WYqObZSJKVGjFl0uG9CeKSw9dX81Q7ZxoaTMjHWoce
+ UjOaj+xRAoGBANu0wU7Mg3PTVxNQRvnZF8HvFESPrG/MJgKDm9Ck1zGlzwWotqsD
+ /12r5c3HlUTfkYzttWBZqHEUPB+GHkokbcrdJUETxYgJoj1J1c7xjgUB2mHlZ7o7
+ 8M4VIEMQ3reebK/fUQJ+fjj6Ey7UWPgFE7MkH8xq4IRRNMnZyE0mNXajAoGBAPh3
+ XIlY6f+UkoMZS+JlERdF13DFgAW5JR+GWyN+ovuSsw1KwlBM8CsWq3Q1VrhOCf42
+ UhXjlG2jWrhVY1hL6iDcQexyTCX2NMgpEuQlFLnWDsLh+/wvYtDenrE+iHIZbCb3
+ 5WEPBYeMLFlUtrUBmahTkQKHcJvvUDI+Xm3Cp1zrAoGAHfXbOoynDF9wi2CyHRYe
+ qEKbB/JzuFclg8hAskYYVlvfDE2Cg3WrGDH9x38E+vxl08sCpd30G1+AB2h5rvCi
+ zDw1/Vbd4/w0VJlB/9Nu433qMtleuMW9w8ybtqmRRYbkGWOhn25ydgCcJxGsBD5k
+ /lPZxj142nJceX4qU2L3fXMCgYBpYJ4zdi1QAyAcT9c6PmkAONPFdU31n29aLm5q
+ 4GOZVL9xrLo6ulbFv4iZ8aFE63wbf8hSlkG2OijYswY+RXwX0bJ36IXZN9Fs7taf
+ QgbHRjzedF+dti8vrKsbOw09bwDKiiqTfn523YFVpbMTk4kqtb5zlyOwTs/xbzg3
+ Tu4SXwKBgQC9oIiWyXsasqOcQHoD64dAziSFWvcDoPu6feFOGiMSwcACRJGVU0r3
+ 6U8dlqVmaKRa1Vy1OlWs4W7qHutZLWCzqhB8YQv+iJi1wPt7WWxbO454dJMOBV1H
+ 7dQlpucItzhIq05+Al4FbJoVsyVrPrOan514/8iBpsNE2J1hX6yIyA==
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubelet-pod17-node3
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEpAIBAAKCAQEAwYm+Tt0HhNllQEZfGhs9JZeALMg9qCTYjQnHBDO50bAE+koV
+ 6j41pjuDhj4TVHudg0pl3FP9hm5Qs3meIiD6WJ3A6gtXvRuvIgbwK8OncK9RDTPu
+ 3kNwyFkbdcxMYE0X22sPmgjxRCTDammMVWJMuPFmN/Wmtav531LmnPFhy7Tc/H6W
+ jX3Xwpn5PXz8h4oIEggg+IWePpL8AXeEBtihZK5qTB94WQ2HMMWZG3mKKcqh1XPk
+ HqEN2s1g0X2ICl9s1koJXgkSbZFreZolxCxrC4AoiMpFLH1TNzjgaBFU2ZxeMc+V
+ 5M3+eMQASJynGY5IMPJDEYiTx0Ua1HbI4Fad0QIDAQABAoIBAQCaTlRpVFjWVu4f
+ XPweOHF8M1qCWfSuxxHRAWantwYEZS7Sz5bBeHAV5YVr1rpatWRUdVDZZi3QrMuz
+ DNhDpb90P/K7p+eAYz4zBw0eF5S8h0s8F5fvph2Z31HBje2nKlBHJQj/avnRtu4H
+ Pbghq4o4Ol+hZj5QwpkqsVIk919dpaTYnU3Z45mD3+wxxQsoTx4pV6hNyB+11VKI
+ j6/kNLkVcokEQ9YvbPp+lf6Rqg3k/rwrxN9KLNlllE0SG7Y8rxSWV+fGIF4KTSZC
+ xgIAF4DodrXrlUuTNzCSqzG8PRGGoldKMq5Tnvj4NRZpLpVK+9MguYGTpPcp5ew2
+ QOU1jDpBAoGBAMXx7XMbgfNeOBGnND4Co7+Mw9pfdw2iFlTFYfCjEjKp9ElHVNyp
+ 3CZKsB9hDhsh4BLK7VxoQwn72OjQ92ZxevkSjOpaQTMaU1aLUJMRK5oPM5FKXSGw
+ 84EbH79z6pIQnUZ8nPsRHgK41c4xHKU1D7wqmSkiIOZzR4kUpDpqX491AoGBAPpM
+ 7r4rkEk+Gg96m02hwVmMZCcPB9/4jNa/v3Z79InrfLLoO+NqCblD6d2jGIUBEt1h
+ BeXX0bhKrFZrhYWjwzB120VlX/JmX5wsIqEc0kmRb9CsItRindmqTC2EtQxp7jC2
+ G+2YQw76jjv6MnfcYCQi+gX6vUi4jwevagHgjEVtAoGAHp4KJWjW0+b58zkSqpjL
+ 7T//t1JW3uP4YkpZmNgQY4fIQmFnLe6UH9Qjo+bmQKoft6htyIJUBEJRTcmsysq4
+ w7fr1f/538atp1BLOURJoz3AszN2blSphYnFgl6SpN8vBI0X1vnR04f1gjw0exVX
+ BrrsD+G4hwzDvt9Te7miaFUCgYEAto0hmsU/CIwoiZ2MY0RUNjF0YiBOSAWJAp76
+ zzl8kpKTchB6jVQrH1nu2V04Ztjvn1JB8O5E4Lplkun8igl0NIXglG5pWetcVBTE
+ dOkGXe2atYC2Llx2b+gKgzBEs3cW56QKHnFshyIqVogWAuFRpUl1PKMxJjak6p//
+ Grtg0skCgYBnOPDHBUabmeeDTGZGJyuZgWVNFR5vuDSXgA7lR0At+4XXpCGq1s4w
+ AN5qDf4ORr++YlYmdTBHkMXRTMO9U/JBs73klKeczCMR0CIxVT76qIW7wsbRhfN2
+ SHn6rRNZdkQLy9d7x/0r+aA2Z0TSL7NZtDOyaXgOj3tu/7WjBcZvrA==
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubelet-pod17-node4
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEpAIBAAKCAQEA2W88A00iEITCUL2GzVSr46TH9jQRlUF0gtQlJUJSuN6SBtBg
+ vRDi6x8yjA2TIt+fOPDUxI+GLbkrnrEByB4kmimi0jVaaN7o9in/CWo7DbnHxPks
+ jnigDbXzGV73iHaeKoa21LMqCIOLwWqg6X7Rb/m4wTmG1vU/Dc8FCRtBo6YX4CyB
+ mWYm/AaW2ncK3BRDRl0dwRcktylTelyc55VD1/qfUX4m/mG82QhlVGC4DtEq2zwM
+ mJliyQtB49Chd6tLI60KcmDIZ0RX89gfpGPdA4q+XQtWV7lZlRyNSEtxbqa5Ys88
+ oJ1a0SyQxRzyDOC3l0mNcEJrbnPFm+HpwtFoQwIDAQABAoIBAQDI+oFNR+GhxSTb
+ fqP4bThIvco675wFCzCHsVH4Y5qU2N2/QKL6f35P+FE/lViYVn0VI753RXawEsWX
+ 9GMCN6J7gNrIVJqR7uEEkIL1j+Sv5jYaAnvF4QeIRNNEczx4PbQq+MRMTKMgpX7r
+ tASybw9l4jx9FhBl5uB2ghFUfoYonSya0BrV5pvamszDF7wumtCU/xpiokCiEOnx
+ CsLldLIFSL71b5friKXo6HlyZmEsKzcGLVyjTNKJYtUl0bVwOR7RMqXjwOATLGRD
+ YxRvhNxVm6gFJCwvkvkZkGynt1FENw5IeSOWGzHwyN79DA89k8etgv2TVKhrC2No
+ kdiHqI4BAoGBAPDXnnf2rg/Ld7DW+zLodCF5Y2b+pfuI7XIg0Mw0NUo/AMBkLiTJ
+ J7gn81m6f2kOliY5PB07E/LInowRZtBlLJBleNzpAux/7zAA4hcoBTwTfOuRuNPT
+ w4t7/f5Eao/lVDGlGn1hSpbg5XTl+ijJt5Wu/EQHp2ZScapQGCEzk5NDAoGBAOce
+ eflU4vGLGATRTC989oLfkSs5yEZpIkqpnRu/8Mtvz7LBfH6Xji+sG0b28TIvfzva
+ Rq8Hm8Bp4jIcX6bp5+pDZ/0US0T5ojLqomRzOBNDLhLkJ1OwHO9rBqfDHV0szgrO
+ BnHA8NB5Gsh1atsJ3kwBgMsOubXeUl2LHTi//QcBAoGBAI9lEakDamdlEYJsvWt2
+ E47Ko3BzNYgp4pYNC8RJYWEvWdcyznaAffGbd7x42dtHIAbqFOyifCIVaLCku75g
+ PsRKZkfBREhjc5n1LKf04AkA4WOwg4c7kjW+QV/ehEPgmtxkHP2Bq9NhW7zaILOg
+ RnoMkY4/sF+vvpVU0skR2E/ZAoGAHZ2sJ6UXB7i5NTTUvGkY9aBMa+uVnGAwgrzF
+ Yx7vbkI/rTpaB6bIE5fMTwWp1rJ7bWIFGLyy2q82yxETuMHUdBJ7KtUE6CvM+xVS
+ Bek10FIVf1o5J+IzcwKV8b1w79Wj+YJ5FO6SbUR3iCRzsunK0JaIuHyEk6ePimkf
+ L3x6ogECgYA/yUTbteFtcPsoXbdk0ooD3RuwSTlfURKwxFvrmJfrUkP8FFAENRvq
+ S4jbm4OnuNoeYb4Oxf2bAEY1qWvS1FeDDRzFi2TWMKCGNjeDh8CBgkzC43K5dzZP
+ 5WJiUB8BUhcNbGrkQzJdr/nJYSNk3um6HxFwlSWhM7V6QR3/v69p6A==
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubelet-pod17-node5
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEogIBAAKCAQEA36RQastwV5f4c/UODTf28c6nzIjKlOflotbJwPejSSaBSkxA
+ TBZkyfwG7FSr594GKsInPrak8GzRKG7Dm6A/y+n7iHYx7cMiCBANpZhh9muExIZu
+ Ifpb0XpCFbBYKN/0k8JrTEj69VG/X2npnpDY8YIv2inWraSkSoH3UAsje2syZhzY
+ 7jMgTwlYQFR5AQKC3oYs/q2zS/RvV5TXhyOzMfPWtkr3TE5nxrp1tWPsLrAX9GSN
+ tP6EC8bWdmMWEm1b1ywoOJFDJguR3vzq7mCoq8SmlStWo3h1pkcy4FKgcb6j8Lk1
+ fYjmFMIq4ku3RATQ1ZB5bo39fItRAeTEqpY+gQIDAQABAoIBADvZ2peqGEeo6RoH
+ VBpfhtwRxUBsv2J4aTFaMCZPX8ic4G8E1xRFzfVsWGH5CwSDm7zntt8GvD+Hr7YV
+ Zo4IpeoplWJg113dIgdsXGqbzGPJRH/fxiubt+ToxjTNu9o8jVTZ7CM/SMJMfV3I
+ l3gTJawEfk/xcH2KGVnDTG+Ee5t0hbYu2FoksvD+b0FYLzy+FTXbAycdpmDXNGeb
+ gILCizTd/q4puNfg9812UUJ45GWCHVQZcE8hZsP7PT6EX8DiNBFwK6jBcGRqnK8U
+ RzenzyDD+fTEZratcB/4Vpc4CemZxM1nVkmnkEkkSGuomyDSXBVY7VmSgvj5ioFq
+ l4/EvpECgYEA8SMvCSnI1RdqjO0E1pMCkrtWeSfELbSosAMe9WUJ3j9o00lUK90a
+ W/KJVyGEWaAK9cU5wfVwGqxEmum3FfRcbU4N48mTOSheLUZ9iNrIXeByRe4q1FBG
+ 1tu0tmzo2Teipg7FIBipp/0K3lAc0GKIQuUjl9g+rTputgMscy0QnaUCgYEA7W0S
+ /pdt8QwiGLtB9s97aBps6w3xMTCEQnplnyIwDCiEKOuqmm08T+1/6ba9tipr0TeE
+ /lRwrlVztM1pML9pU3yxijugn0gHjR5qtfYCIZiGqiWtA0AsR/Bax4oSWJRj+TlW
+ glqGjtAksDCbt+8GSLqfyDKEyRPDBcQDZpOK/q0CgYAxBkItzrzx9czH0fhF16WS
+ R1wRTbBoym3xOvE0WtJiyOl661GdiVouj2S0vi+2OP+BcBOKB2g/Q/6+r/11DTUt
+ U80nHng8CqT693XWOQS7cUJKTV2PxLJiRFC9Ne8xGkqLED2rhNgZOyzWfdsd0qp5
+ TzSpTmGPvm17u7FxyRuzsQKBgBZJjubnQCLIiMrZiS+p+mOjV2YZQPLlIwU6iB+Q
+ DgKWKxHMTY+BgY/fM4q05Moc4VIabBmTw6AZ1Wq7fYxd630yz1eykTligZL1r/60
+ wS52Ku3962fKtl1qapsgkuhNxbS3dS93X/o3/7mqVnPFtElPe4BHfb+CY2Q/KjKO
+ 1xVhAoGAaog5dsq4XVRhTaMJJG+iOqMCELRFbaKRRneForcaJZzTvKfWI+G/x7lY
+ hTg7VoROnJHUvfJ5u4GKNaJBvXE1miWZ7Xct5DF9VTlGkiyG0qr4NuwLS4tklGxj
+ WXVjL8jecK8AkQp7km8HZCRJOk3OU/LgJloc096HcIp28GZCUIY=
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: scheduler
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEpQIBAAKCAQEAx4qVolEaF1s0eKEqkCYybqL9v4ODiX+GAglz7KIQxXZzaF+R
+ SVcHxrbeMJV1eD57tpIdm6kbcjllTsnytTef5iaJeEyJu5cxyr6xhwyQNnuWlbHl
+ 9H7LlF12eaNv94WAJ/S1I1bhjt3gj6vvXbFuridLydC9v/ELzVG15d70drVsfDvr
+ RGbBTPBTt1HX0pPD6uvaKLUwy5vLqx1uP+l75+EhmE1BmVy5c4SnuUdL+/8zqoPF
+ I/07wWY0Jq3+G9zSNeweVIxOv+vmgsUwNlNFsiu9XzzI65ngwaVHvelT1JT1ahMe
+ O97oqOd+XgYFNrKphJzvoLNVtt6/GdnAzjv1/wIDAQABAoIBAGV8gqZPgWmnpYRE
+ 1BUEmFnU5CHnjZr9FPcsP512v/juSbwn/wjCDt5uW4tyOJCzltBAeHaXB7KMpo3w
+ AFVSuSyhJQHeS57xQw3O9xOsvBw5t1jjZgV4B6qp7nvnOCc36vpnZ0lWAtpa1r+7
+ vr50Y8qHifBXDmr0+f+vM0h6oPNOZIxapny6V0XUCmlJD1BrkpPes0RLM6yz/ALT
+ 1EprK1LUGAXXOdExwEHiAaL8RyMBVrIUhQ/uXeLytqieP2lDUu9xVKPYBN+YU+/q
+ Xx3Lweu3WFmchG+8Vn+JAenhdUxiass4BZsk7XnTpIEcRnUr1RA3XJpwX9Dljouu
+ YuBOzsECgYEA2S6UWp+5vDehgtGKmS/LUDQzcgh/a/DbKhBgLB0pVItu+3Kykp+8
+ Vtcd7zryyffDb45y7BYw3qf6IZEPoJXs9aO0W+/TXr5+x6tAiQEmGECpnOwPRuwp
+ cdFVKc6ghC3L8ISYFklzK3Hh0yZKEiL5A4VqyQDF7yzE3vsy1T7F/OkCgYEA6zTW
+ hBVDRwJ7JRgia7FKv5l2wxle92RDZ/Mn/ZwyHbrjLmVjJGNvCSdOJbsFQvOMVbO2
+ OhFtg2YJSqAGscO6IO90ZwT9cLsBBBzOur7BOayq7I3t5i2D3Nw5nix0iKP95YxW
+ MKDWJxcAhT2QsoVIszTkskUEBlduZNNwdmZP6qcCgYEAlbU+Hpor9kqC0yKOX7pK
+ dCcHr3ucGlQVP5G6Oa6AZv8Wqc4OunPR6CqxP89qvT5FQgj3vzYsyc8Q5UKReyje
+ BxWpphZTpeO6kPjDq61XDTDFup4eic0RZJvgEMmWbIcFJe7Ax9wpv7Do8hxawtXI
+ wVyel6Ao0Q4TR4HxMH3tDMECgYEAkIHpHkOWDyW2FSdL1pCZ1TfrYJjQ4Pwn8dDS
+ DB4QKHXvKE1AaVXyHVSZzdKmu+i4mtsMJYcZmrZxFPlWw5b2X0/fW4AUWlN6n1U3
+ qkKSouW0KhxVQqtKLcLcX5L+kgj3cDYVqlDW4jNerX4SzavX68qei+ydOWw0Nhw2
+ J3hat1cCgYEAzaThgGbFLplA7X5Fz5fC9QrZRzYHRQPMATcaFmmRQSAT4cOgsf3O
+ Fg4pPyw9zRE4T2/BMPIj/ScJ5Z+jKoblNnZ1FKvYIp8pQQoSA/2vkeprOrXlhukZ
+ kK6ghUCh/s/gHNDxIiAdHQmnWxj6QMDeCkm2Yt0IZdDZGRo+SvEbb1I=
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: controller-manager
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEowIBAAKCAQEA0U44kUUxDaLWudfqu1ACN2Hcq2+Ne/o9+R3lsxj7u0oAezLT
+ HodOXCs3jh3HgTiUYsnVkSoJEP0XpXOeuGOujb8GrswDYaYNt7TDQsJqv2Bd0qDt
+ Ew2n8+ub4oDFY8XuvspUEJz78Vlvx73sJ3uuIXEDAPzP4hwg38/A6cQtq4SYX2y8
+ vnapKVydZJojcDlKPldgEO2uBvzT17aPBFxjHva1Znn4GcCReqCbKWH4BF52VAAt
+ MzaAhHqIluVtNjlv2dYj7/QNbSQuRaudtTySrxHWZUoiarhMjnGUGpFV4m+t6vEd
+ J1yzOPJvBsb2bxytblz4d2TeIlQSOySicZrc7wIDAQABAoIBAGN7Bx3cwhTWGbLY
+ 8gM3YuZJyCVfbuLHLJ9z21IFhNgesx3bKUbwTok2LUCJ3OIJL1XI0o4daZO+h3em
+ /YBsOHG8ooOACfdmgkyXSNs5Jp1xQwayYBvXOMWRbVT5mVfzoqbh6ZS/2Gt888j+
+ 9vhJK5lPansUrgWtEt7tkqZJDN/g2BgDiQNt6xkSMz/CdkLVUwD+xQ5Fn0Z5bxsA
+ zzo231TFiYUny/9Kx7q/LQIYwAD5e1M1xCMbdKEG8U8yFNe04Z0zXkLtOhf+dkcb
+ xzd4IuJC/bIW+pDZIAiuzmzCfW5BJd3t/5bZQl+a0+1bsyiplyC1PvqGxjkVuTxh
+ 6KtvwzkCgYEA+WTqjbATD5n/aGwUrARmeL1qb/Ax+3bTXgeileax0RfU4rGmTURw
+ EBI97wWlEMV7tXUQSGYktKFUcWRXUzTa/L5GZmTieMSlf9CAORSpT4MbQRq9PWv/
+ JBc7X5gsNsQY5/o9VgWqx1FDfFsYULUS5HfjvWdvvGuYbuW9MHw0rL0CgYEA1tl5
+ E9H3fRD8HDVmC/giW+SzZCYiq+4R07sfExHlgFHdVdxWzStwSVg4Ze0aVt08ra7b
+ lTSPndfLVIxEBObdyRCfaulQrKeR3p0gsJj8kngoldMjKEYJzLDIuYnf5agLYAeI
+ 1v6k4pHhRAyfi63aJuYEVRvcLInvG7XD+j6CCRsCgYEA8syo/iB5rirDWao/xejS
+ yqG+ShSS1LqutVDBnSbn3yVQgRNrULZcU4ku+tGIDnf1JIg/vfyTp7eZOnvx+HPw
+ 7zdf2rhFNEZeybz32Jqg62Q82Hlr26yUzVJA36SLBxaLGO2rYWBLD5myFhOp7Ikd
+ R4jhE7jsM4ic8vp/4gBKWBECgYAb1FWbnKHrIE0Xtk7+k+iXcJtQCKSLEq5ad62B
+ wdqxcWkzGvRfZRYJWhUMFtdHkyat9K1auVE1B+O9kuGopOLrjWyo44ngo2AAruey
+ GE73Bftz1MKED/Zq/icx6UsIK2k1yiQOfTOMaYr9TolIBX/xc+/xukcducwwEa5N
+ 9tTPKwKBgAzgaU0mhI6/42sMgU4j9zuOvjWvtaPGTgG7NCozoZWFcQCB9Gp1RN7B
+ N3okwosJCKnrqLiXkgDMRTZxC5iTkTczN7S+U84NZd1E3GGIsos28xAoC3Cw3sNj
+ UrhnQYn5LZS81ZmUcpwAUeViid1MpIUX9MY+xY6ezhVjSFC5z6Ci
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: admin
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEowIBAAKCAQEAsaBFOPnB46jRQrNT3ARwuquYsOSuL4VyQ5+yZY6WgBsAe1E7
+ pZ+VjMXW5eko9DgNhLbpED+XPrEBHFtmW72JFGo5nrm7Lj+vmv3f8a+JL3gk07pa
+ FLAWIuPkN0c+cBTvOj8odrqC4dh2BjAbkJaOiHk/w2py9uaS5qIowGgTeo5bi8L4
+ y0vN7gjVnH0aQB4VGq6+fJXW9Zt3cBhyYfi4/KA5jyN/VlPPFvJTkAjksexetrpN
+ r/ZFWsRQiSFbTxlpJIvGZ2tdmREEtsfwPCYgi+/YyC1pCAR5PF488XYncufAGm/E
+ JuuaMxiTmmhnbaVIhjgSmFnnFhUuX+vAI4TzMwIDAQABAoIBAGGDtl0IKJyeUnvG
+ zXQNcAHbMNF0SfhGz6s2Yg8FD7S2njYVK6TKjqSg/FBuB5DDsRA6BotoDdVaAV0b
+ BH+69yWhB48PMia6yeJSG/6oOq03zSf7t3aCETUIXYLHdwy7QXZ9s+4yiKYKWwkc
+ ohVnwkpEHnBe4UyQ2vcI8UxoFsGBuZtKiJFfxjcmxXNwJBSA62ydZHwwfmCNuz4c
+ 817q/LeUIZgynezO4gqrr6sWizrDP2HB9id64EgmEU3lL342yXbZCX/yfel8/eio
+ jwXA1IS3ae9swt0KzrUM720sLTqBtzi8E8BYVyAEMwQ2Af6++dpMv510n/0JDX1B
+ ZUsldOECgYEA29OSj8vOhnObi2d3G3gEzUmYLyi6+9ngQc38wX4gqMTZNWdEFj83
+ 1l8dxfOSq2zCO7Np4bdzO2S4Ky3Xe+WGKNuXyduNIIcuUXg/7sQ9NqLIszQCDraZ
+ 8Xe/aM9hnTVeSa3SI1+Tir5PUaVA2YVYq24MuLuIY5eof1Mu2ITA/UMCgYEAztr1
+ 3BLj59I444hL1cAdjNoybCq6lYrFcyckDhnTL1QyZDPL3wIroE6Y9d9qN88ygNeE
+ a7RP1tSnLVjomOIR9kR7Krl6HRRtJzm7dV3ed3GTBhSm24LgbMYU44ef/TmqqhId
+ Vh9S08rM3Wbe1bsKD3LtZigCwygQ+oMUayf6W1ECgYAGQk3n/juRJHWHUJjZlV89
+ oRzOKvC3/wodlYne0IKJi6FLnfcYUxB58Bde7YJ9kwksvf0Dyj9jr4h24kVCZ9Sc
+ ETSPMMsh4/dzpmLbn4bGqXfhclekp5pWf7xZdZ4n5b8bhfF3xF7lEmobvwLLrrpJ
+ l0aRc/V8MHNBvNKWo6EDFQKBgF4OE3KQqE4VOUbEB29WnlkYMYsbVqF+as80QeGj
+ fnHrv8nt/0oUa4/FjSlm/54GuTj6RbzPTOoq4STuYzx4tqAafUJs+YhVbFhEmOcB
+ 2pDG9In0Q/ZVqQPsgTz/wxBZ8y7Hc81gCsJAWSxmhPX7yNRDdoxXrwHbqvStO1CJ
+ 6f0xAoGBAJErnksoLP1Kl2bznS2a1AeQV+qdKTpdVYwP6pgouPItwBQ89vBT2234
+ N6on1lRfewIx8Cz6xZjcSQgNoK4zXaVhLydFLEB4GHPgDqqR1gtNcfV+JyE8Mn8m
+ fvMbANbHnzFqDMF7xLnpTaDQ2Cx57K66tJFAJLMDPSm5zBXcn4M0
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: armada
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEpAIBAAKCAQEA3C7GPaX+CBwPz0rAbWorFholDrZqV4Q5yOoxPfrTRJsKkjpN
+ PG9Wot3wZNukGWoUzm6uTwu+tasfaOGHUH1EmwhHXtKavWhfuzJziXXPL2DWAoWh
+ drIkM0c5oYHqNSIiQk0Ld805jtI8L467Sn0Sy21oSwIbPGVpcQeYtI0rOHLxev5P
+ w+KkmqUBImjv4otLtIScRlcVLiOFqitIQMX6QtJ+0sQTmPye4ezaYg4o0kT6R7xu
+ aPdPHH25ksh/yzQTYpileV9TVSv5IhRrilqS+TGVNT/5MnIuMj6cDX8T7ZM03/uU
+ 5mVVLHlxURDZACAhad8d+t+qRkfIuc20PQt2pwIDAQABAoIBAQCgDEgBi+VJ08wS
+ LA4P+npzSHHjbemC0BSI3OMKYIated2HSWXXJj9dh+I0DgwMhTW2kHGX97uaplbg
+ j/8iHMx/vNbUMFZWk8XydsvRAZemosctciFZ/EegFofnxF2QXc11UDejz8Ok82DY
+ WPH/RUciI9cJnvBZSIYKqTDxHSRrlJfBCgfghaqBaYqk/21iBivKQc1m0jTY9TsK
+ MvxLrhFRSLYLeg04xBVpvvUVQ77l/YZ8HbrsLy23fdeDPPP/XaYxM8JmV6KBYjor
+ vESBR9oFUK8Lf+md/mYjliCKzEH2CCBhPve/iYsIAkgZ/vazhJZuVMNmqpXYo92t
+ zBABPHxRAoGBAN1vziOth69Jsst/gqFdzx6uTJLaHdBr3eAMuBZ//1TCv0XDPi8J
+ U7dvM7itkTChZvVT+OAk4qQOsGzovw/HtpwQ2IAG4su1bV2tX0JKDyE5FW1P2PWE
+ UvxY9AWJAmanbBwPMyPfspPD1vP9HLYp6g+wMiWMRREQ8IU5HLMAF1LTAoGBAP6M
+ 3FBFnZEvQzQ8eTRcin16vLViCXbpiHctXKHZI5vicucY9YEQqx3+ZglcOTGICi3e
+ 5sJ6lPban6jEMb7g8uXoqNusnuV9OAxUI8PAiNxOzb/Qba7GDpP5v4BBB68OfWNg
+ Ob/Y5TEGt0ZqlSebLYOq7yKF7/GBS+xRqSj56CBdAoGBALs6zsyB7Ej9Ao1oChbQ
+ z9C8RYihnjXdDqRjfL+hiE2twLaG6CwzMbLW9p9/OlUpE3n5f2ReK7fVp7zearY4
+ AiIhaD2QFPFzPL7JWdMd9X782i4sJmEpelVeDS4k83/CrflnrLD3cvHX1AdHC6DG
+ /d43956h5MASV5v9d1Oujwn7AoGAB09QPFXjcnni+isKaACIUZYmuSa5ktqd+p4o
+ 3NT5es6D8jL7SduKrm/Ryk8FrXB0qmCOS+NtR7F7iEMqEosvLn8B6l0Iqxpvc5su
+ 874hsAHrUqjPnYc+f+1aHHrBl7tYynPG9MVrv36r4K/K3LpOEkvkVh92hn7qCT1H
+ GFAk5FkCgYAnvm8VVMCnwmzPfGAObxo786P3kkQAGMP0vfew/Fyz7hCdE/H3yq07
+ +42aE/jfDo+tLKMYMleLvHJFMDtJFBM/ohTPnD1bV14a8SFJ4kd2V6TZzkVfd335
+ 4E2+iFyyhFQYgS0km/xeVPd+Vo6e3suznqhX9Sr9mEEVJw5XOkTjyQ==
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: apiserver-etcd
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEowIBAAKCAQEAsLJuWpNsBvXtNny+kzFW3BPOVt7hkgAMRtKtykDNev6PawxZ
+ oo5tuL4tRb/htj/htig1uI+eCKCo4TBPS9GdVgvnWN8wUzqs7DQcGKlPrGlvg74M
+ nh4jOh913gdOSZRDQgqcOSE0tAOWHVGUhFSFgdmqzCL7d5XVpqjLDleAM2OgSmhf
+ 8juqQmjtcoLg0Ioso5QzZO+MUIq8qWoo8bfFHry+Dy0PVZyDm1tLDBCcFrjNndrv
+ xh7gCdvbN0wHTUR/RUwFLGcT1OUTLN7aS9379l2ROHjSs+T8JpjIwYYZ0/XzKc7W
+ ofUeO1wTNjrrWsNNa8Syw75io3LuLQcTMu9CcwIDAQABAoIBADQKeWIH5Vsvd0wC
+ 9YYYlAKBetYvErSTewoo5rKY32wIKWlX29Z6qGou6NqQJwQsUGf788aF1f+ogdTB
+ C7nC5NoA64RLR8pbj66JsnS4+RRIgWWFxeWT7sAhn+9iq3YUSrLauSRCWWljXQUJ
+ j/phgmi6GQnCi9musZxCPnvc3Y9EnRri4G2/hZqIkyEdBEzXuYjUcibRJ8dTrPVN
+ va/bMHk6BqauuORYyuNBTk/taal+Os/gdnClhR/dxPhae9rz27DEUvcIfEIouQoa
+ 1kZcFWBj+FieByW4Q8NzQtHDVe7gvRrAlhTfIT3GoIkQV46ioFmdu3dybMOsMQLF
+ WB9NO+ECgYEA1Tf/oNEtKij+pfGLf3qh32Oc1svn3iSvWxyGiFAiMGMnVAEPt97N
+ eHKNpxzbS6ZpsxXi3tnNzrgKwRn/rjVJuqAPi+TEEDHOA1Nww89HuTT5wHJW7ZZq
+ tTRorBe0v9bELrDS9OELPe1pkBgdCje90F/agkbH1Sz/bPj9kPt5WskCgYEA1CZ9
+ SV9/uIubK7V8QWaDIKcZP6Q031EvmLX+q6vWkJAMW3usnOTyprt2KghAkQsdXSLI
+ a/Hcb92RscKxin35kOKrbzwvWEWuDp5Asn7IqcZwPw9rB5NQFN6EzhtmI3MDS2pz
+ sAZlHQKJTpMBCae6MgCB9JPNnty/kkyzjarNlVsCgYBeqUXsd/G9TgYAVoTATAmh
+ y+/NzSlcDp1rrfZsfmcvZFYJjY8U6u3+E52gG8eghnlW8NiQZ9JffIYJxSkmhrH9
+ ESLV0PLa3cHA6EKgLF6Dc2mObzT4tlcZq/LstHmi0g63S/ncji0XiVfciVgbOTQk
+ VuoD/LirhBbCoqiwvXTbQQKBgC1Oevssde5Hgj/3Zi3hYqeah/3bZ585i1yloVmw
+ PQZqfPkclGR9UITjC/01/fP7162IPB0xbc5GF1NLLPdSp/WVMt9yjvnfB6j/ivmT
+ se7v/hC5jjXz8+pBC0Oo/ksbyNxWQ5aYBwgG/qPVKSeStmTvTtGYrxT6N79aug3L
+ KFR5AoGBAJdQB9VA3++LtKvCqrAcemKXismdYMMSQfswFoSe1xRzo2FtQWiTjHvN
+ iekPwH2K0z47Kso/UkcpFuv2RuY3p3M4kPebAKp0PDXoHYjQxbnJ+K0m5b7g2kvb
+ Af+t2zTKsM8Bi0YaTVhnca5NekSLnz2d3Ln9YQ/eEvl2MTM9w0Xc
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-anchor
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEogIBAAKCAQEAo//LDTeBygMaipDHKzjxz1GcMgLJ/d/KU6pf2Sq3e878lOK9
+ w0EiqvVpJGDq5R34HqRqXpgQuxvTHoIK4TmkMzI9QLGTnGtgTvo57qMP333Elf+E
+ gyj/m9oeNwzpny3laIAMFzzjik3mI1aEmMq65dnPiM7SrrteCDdfM+w68KVTMbN/
+ zS0daeFizoQjyrfEMS/fhXN0liKPmslc/UWTWwY/mzoqtAHDKUlNWMgNDnkpFEH+
+ ynE75My2mat7n37itNFd1cfcpBjzzgQZW6rGn2tXlrj9EWa4m1kbNqqEuOH8mK9U
+ xj2gxiY0aKHWEvvoY7y4bt3uMKhkdYbIsTUWZwIDAQABAoIBABttv7cxLmrsA/di
+ 6XzIJGFJQ/d1UfU9BajimO9IXrG9V69LEPPkI/k13GTyNLcnQQVW+Fdj1YCF0dSL
+ aWhr7JOHdokoagjCSLRM032fFhuJ/GQd/Tq2k7GsVFtetIAj+/dzWxJT47aQ+sm0
+ Qa8QURv6RuSZutDwk3SKVkjn3J+8slQi7aBhNkMT1UAjF+CSH3QSFG4Ets7zwWBd
+ IFw3bFbtzNGrDcwfm7/kWE6hbh9mhwrdRxgb54CC9dBYcSBbPIvLipXNIcrnl9kX
+ GfFBfRxwnIWi+u2P3ygLmKdO/vuDZcwfR2NkzRrMuUC8zRnE6lhzWm72ClDVnJk0
+ SXUhwFECgYEAyIFYwBKsokoZFueQoeUotT4zPGlWyl6PCPiBh/OzqQ24thviYrxH
+ h40sHWeeRCwp+B3GU/f6D8Ftaur1KJY6YDLlG2Afwd41JipHlFWtyKWwxRt4+OUj
+ 4fAcwWt1JdQH6/JSnY1o5w6TjMRnDEX/L6fMX2/HWFywRpLao0LfEb8CgYEA0WPV
+ 9HVHpFcEGjPIaoaSZc3K2tV1R6QkmlHhDQkzi8AjhsD/jnBZbVhtbqb4BRM/Uo/x
+ 3t9hk9+tV5wpdMQsaL7g+FI1pgqLzi8lknHJjfzFgOORR8ZFq9A8l2JxmQmOzmbD
+ ZefaV64MPhZL+1MSKMkSWyNHOnbOQOZRjtkc1VkCgYAMD2utMfJcWKSlsgwLEOOf
+ 8zvVuGhWB9YGrhvsd4Yo9wBTQ94cHkMXLjCnHCJy600i9XeGeXX7GKFiOvvAEzkz
+ rBwHx4JhgOIlh4mCrJylYwH8+SgPoIjGAFFaeQI04koPsSWzAFx8+W16nB2uqU8u
+ KKOsYebVs82OkSrBgzYztQKBgEPtvIJi7cv9wsHxXKpaX/IQ8idOKo8ETC+YMod1
+ HbjPq3bS89U0034qus2z8zBKTzespQ3lsBU18llCuxw7bCDLE9bbbLYiI7rPBsRc
+ j8O1ZilrKj17sCyOEKoX8LxyIlcJdYiA0A+z0hruRtYQ3ApJOOBCMKBh3IWncnwC
+ KV15AoGAYty729Ip7dg2YJx/izNoGyralRcVF9NmvExH7LNoLRgfuO3oDBrk+4n4
+ TD7nB5Er5B73/G0zGMoL1++PQAamYqidmPX1QOLkW5CHU0qWpYzaE/o2kzXxc1fA
+ l/hzyKzeCn6BV0vHcsDI2O2aAQxzdHihm0YvmkB6v3G3S/uPxcc=
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-genesis
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEpAIBAAKCAQEA6K2/KMidfiYkIoYxQz6SCLhy29NqkqFCoZwgSfBEaXYwKwBq
+ D8NgfH2fr92RZLG6OTXI2rEOehS2qqRQEPFZdm8qRd9+mbJ0EgdGbb6KaGiIVgvn
+ 7RnDE4IEFO4h8hZZhL8rxyEDjBAAnUtsaObs8sTWNWZTGwu/+L8ok2N/bqsnljw7
+ JibUlGuenwIrpEyj0SbnogrwOc3zUwZ9VG46NGJk7HtNUFOSfc2mkg+l+u9KNHlK
+ c5Sscd1wchZKgnpx3GKHY7MUINkmW8OaY/+YV/KNDEkp0povTocHxtbgkfs/59/+
+ 9DWR+nF7dP3RZL9CIfmdMICoisvm4GhlatwOlQIDAQABAoIBAHhaXtWOp4A35FsD
+ RHn+5HSkS60PN0HvLdMAOedk404VtyaXCUVsDv110WKbXfhSwfuTqXgNO2rEShQL
+ 9+o7nMXZDGmmCAsiNk2Y+8IKW/dTkqnHcMjAmZn+l3PoFSDulJFIfTF8DySkply2
+ RbYhNJECZbarXfNQaZUV87wBLEomO1CqDOIJtWojr/urWJTKzklqtv2C+p5tmsKD
+ yF6w0eazppTVOOpXUSjk6ymQNzEhClycWmXSx5m6KnkuzaakTVMqIFbLsl4ld8TK
+ VRGgOxeObSrSfv9jNwPkxpD/w4pWUwGzFuwumYD8T/r+Gs7IViJ6dBG2CFycYO+l
+ lP81W8UCgYEA9CguvlMdQnR2paypebZNNS2PrZbvAWCeBpBUWhJZNTBZn2ssG680
+ MTq836pFZapm1f8S0D041vX/Xw34u5hTOwc+XccpMnCGEzJwyA5j1La2O54F4zih
+ SY+OOFnd5i5UdLCHEM0cq4qFN3Rp/QiwbtZ812yPkLz7VCUPUOMhdxcCgYEA8/cI
+ aJt/JF4R8L4fevlOudieqYeSQRuJOVfHwIGyif/zvMtPtZQZ+BIbOIMCADRRTJJT
+ 8fINCtV07fxCqWc2S6RWe/cGSCsiRJYXjFoN4dqaYs494pffCXFXLLUwOSq/2SYw
+ WXo9OCa7WFRbY3fJhdB4j9/KzfjmZNTeigIeczMCgYEA4+gKUgCVZG4APoAgpotE
+ IKqJ3njwWvHMMMZS5s0P1nVugz/wKVtvNbDlk0aGhvL8ES+LaTRstUNlgF4zWzFC
+ J+yIC9OXogylKpA/9I5yI6H2E0pbppE7BMZq9DD20CFZFp+dRFKiO4IO/ge908Nj
+ peKzIAenL20okZASbufFWjsCgYEAgoNBaFTna5k3l8beKHd++kU8fA0e3N3SR28C
+ WaYI0XKv/ev2NHmKev+UuGK9i0Zxx7jwV5raB1WyPC6bquygS08bRS4dmjYZGwAA
+ kQEMNCsyNHGJAdOlafPMYwp7Rdns0Epxyyxt28A8sUBPs6K9mGyyUqWyZQYmmwKW
+ GtaPW6kCgYB6Nk8fOoBbKEJxPzWS9dewTDVsMBc+l7VJf1kBm2pHq86y/V31RuO/
+ KYHUGJKtiY/UYnG+eHEhkbkhK56T/PxKtKbJNAzTNz8Xz6JWCIupK3VPN9e/dKPb
+ 5Ik+g8avEUjTy4l2Bi77HBs/lD1vB0fE3ZAPd+xzNu1z0R705efcrw==
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-pod17-jump
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEogIBAAKCAQEAzV5tuExTU+9A/tNkCqoVhBtYsZeNWrvuGiYWXc+6CXYKAhLo
+ eqVbDNTtxwsQA+KPRJtiJlTS1+EYeFd7ZTQHAj/vt8NSdFmIVSpaJdkDBTBLX/D9
+ 9b3hdx1u+4ZR3jiU7VDsezci/apB69oBuihLcvCmm3m2EhgFFf0cUAa83Z0U/Pdy
+ Hg1VRSiLcMxxU5QATKuDNUpt+NG5rVP+dkVjYzp+Vmzxws4pY9T9xJSYup/rdb0T
+ gWpPFi8uNIazNCbUXRwHFM5VXq3S0ueNCCVIdA24M21QwrG7NZCsoG6n2d4yhLv3
+ 89uSBzY4UQ30Y7Uqpi1vjn5QmqkYLrEuc/5FmwIDAQABAoIBAHSrE2viuGfzgJoD
+ n07LpyOAoZdqQFxubOqf/o7Wxpo/W5ooAbhDHgGhKV+tMjDy0W8pUs3x3EHV15/u
+ GuS4dM7bYaSkqr/8aQ3w3Hup2CRndjqP3sZvU5nmt7jear3yqPBUy7OH9DHlOkPx
+ eo+1+n7Wpd+nej63NJR0UVRJL5w5bxzKEUgx8jdrvPGdTneAmi9r2tKMX2inv4We
+ oHOspopKqb9A7e4+uyCwW2rmtZRhkccg+LWb63LBT4Xnl21bn9Sr9necB3WtTq+U
+ 2Z647G0PULthTNXmD7mYn7UikRUyXqBvKlaQ7aXGWqwOl7vfiKhKBJZtp+zvN/x1
+ xp8QsUkCgYEA7PAKnk9MLRqvuZQO/5JCWb+0EB4nlWjukMJKgC1CtBz5H0v//hQu
+ ipW0a5r7S6rN3aovkMjgOUb4MH1Qhu9Yem8ct+SVtiN8azSIWLxYbaaEUzs0PTgO
+ onBpB3V7SdAJTCRHNUfrFumIMvAugspeJXKh+reNDrXunKmL7d6y2f8CgYEA3eQy
+ h19QU3DcnYpZpUrBehqlZ1DfWf0XOwGd53jW0//fDt4ECytXseWcvmTa8Vso48Hk
+ y6oMH5+rQx0SXgte3Ni0KuSYes3jEGlFlTybf3ETuFtamGXoAO71X2tc8JaILASm
+ OJN6yj1woQxKGUKK3lbnQHEGWbp8/bZaC6qpvGUCgYB8ghuiW1tVbGuhYruK88no
+ LcQqoB3+9rg+28qYlrAxw/PpzV9Fnkdizg6UaUna1nP+IvuB4v1pO/EaUg/qCIZ/
+ ODpoLDe8EePE1kM8FiWF4XYx4q+t5/JQzC91Gvhhrm/kUkAVMKjKTogi9HIMitl0
+ ZkvWW3RFobc1HieJJXjo8wKBgEHw0uNP+/sQCz/2IXXxpVW4HXd6nSWNBR5P+LEV
+ RCJ0Y8FzURhQpRsE9XPPXRFk2d31fRzZSAkN1kN3nEG+d06CR+iHTpkQHm5+GmOj
+ Q0K4Q/gBjgbEIhJE8T6OFWyaD5WlPBCMI21+nL3/fPXMxKAWi1qnPA/mT8bGLjRR
+ X2fRAoGACn02YKqBiL3reJorvVmTZsefzbv2EInz2qf878D6wSLO53XxdlxqTi+5
+ s8os57XwO9XwhYtcJIjsIoCHJjWwtAz2jdc8tNCZzVF+0sgjzQxQR7roTedpSSNr
+ Fl4kffJOD5rsc//eBDIaiq2QESGyF+x0TM6VhASPB9xJ/ECMGFs=
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-pod17-node1
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEpAIBAAKCAQEA5U4DMNAvkkGBgR6CJddKECt1+Y8VBVMbGQs9hC7Z8qRQHnqf
+ AFEs3N5rq+CASmoTdx1/ZjRqJnwoNVF3j1KUY8WNBtx84M0DTY3M2j6FXmOmmESJ
+ LHdxBYiNcs8C/j5517/yuHERs0aYxGOIK7SORw65159yQ2cFlXBW4+BGUkIKUkUj
+ R2TuoyBYRO943CWZRMHTN+eK98TuSdEaxk1vqNzXsvs6dk3ppetXa1pnHPs0KZm3
+ CrOZCg5CWEG5J0gK3vojQaR6ygrRV+sGN85q8433tsfMRy/hmahJbAQVwxhm6Oza
+ +cL6voHCuBkKju8JdZTl5b/91YbaF+pUKVS9CwIDAQABAoIBAQCcYarNZH28+g2v
+ GDZcRkoNYwZvLwSAACBv4PmQJz+eOi8lyiyb08CL1OiLbG0x0sv5pVVYR5DJNE1b
+ p3apeQEYVgcK0d4cldSV1IoLoS3lpIJeQAdpGwAqbOlCjimVaNhBqneHEB2pLRFM
+ hjC81cNedI2LnwMXMrBdLSMk/7QVrgeqqldJGJ7WoK1qe7akgoeTA+MR/qWDLGux
+ Bogsh3i8h97aQdNGNRs9ZBUUmUidN84TLelM2mZ1lkxI2fXf1qGLTyf9AxHQGPfs
+ FoJ0YATQidF8xH6xZZ86RXl9xS2b3pEOU/nolwPxKYLhFuqNrL1lGb0F2wNJmZLV
+ Ktjq4LcRAoGBAPmwAX3m9gkElFSviyqqiUlO6kxOHug7Lv4qZVNvBOkVufTSRMBS
+ apfeGcGfdAo3p0Y7vGlfJpugU+M55Az5M7ujqClj0qPWq2O+IdoTQPysoNUtyNL2
+ rUpPIfRTKv8H/TBKtcun8M6rNWm1G4fIN8ef8KZnbviY95rKXScCfWc5AoGBAOsa
+ FoAfBH5gPOoAsDJm02UvILiOU0WiPo0TnWtqpR5KUnhIzHCY/pqMWg0FRbGTvuSJ
+ KmmuEpkwici8mpx7Q1fgC47QiuLCoB9cIVpn+fJmkvI8WQ6B9KSu4DxkXTDGRjqX
+ +jgAE1bJMMY2d2SQna67DYRTXTsqSIHwywSZ4mJjAoGBAOeQYBHP3WZHpPlVRI/x
+ URl34ruZx/hAyzhVQVu7nqY8zBVN3Q0wYkMubFyx8QB41N3CEN74q+mxK5uU2Pdf
+ NqdTBGY+eeAQ+yqp7uM88AxmXVLX/2QH+nbsJOVfLIURd7MN1sRloGNLTWIX4Mxw
+ 16p/nsP1MWnFE/2up+3B1WOhAoGAYdcnigZejmFquE+1BCS60R891NCWYyJUOc3x
+ 82Qcd3CixaA2RJ3HR3Yle8m36WD9Toqu9fAVmV8T2FB1X64Epqt84+ByDFDG5oYm
+ 80LWSETb3qeywFDhCTAl7bwu9D9vtq7M2UVexv1PqQ29vkJY/QCnbWxsHlVIe5tE
+ QhPwnNUCgYAc45f8x9pUcacz8NynFxAG/C7KwLboz+ssHPOYOBHVo09LtjBI3sdy
+ 98ot/ERtr/G5hhCUWUXX2spnbjYLrk/AKFVP5JmaRv2TOz2GKo54DNwsYLb1Ctsd
+ /b7kCHLgoJZQxbqiKmNM74LTLv9D7b06P4BiYqJdgNCe2FBXCOthEw==
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-pod17-node2
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEpQIBAAKCAQEA5LKMumJCGGvh2YiPaih1JqfObaxIKLbTEvtqrj5gfSMiF/ml
+ Oe8hoV0ce8edR5uhGGzY+MaRmZ4tbuxBSD+u4mjx02ggc007stMW0M+Izhy1/EFv
+ eKznz8orA9Z/HwoIOnqJsRhRd5qKjAoo8a5rg/+PTKjTBQt4Ndzx9q3Hx1AhDvN4
+ ViYswqe2z2vn73wOH/QAcT4ZZ3snTb2oGroYuZHo4aTRSZVGk1nZzNZPOAZLookg
+ NgdIEuWGIUwY+dXoXPfTsjuJ1EijjjtA3VwjfAKKrU5sUFJ/3IiXJE5N0Ll4zhQ3
+ eG19aDCv0jIpShyOR1XIeM3uz+QX1X49/hCU+wIDAQABAoIBAQCU1aqGZgnz0Mn0
+ A06qXNgZJx5N+9AeRxVJBjxgV5H9/o5iogKomHr/hBRUbg1qm9sUhUoTZU8+dVXG
+ GZVGysMq7/dpiRuNTlcqwvvXOykiUkcRexhrpcNbVIv3/HFQpvvB6xuPGG90civ2
+ hWouF0A7cGc3Eav7XYKHM1p5GpGooL8+g9tHKt/DX597fDbf6hYh15OeyJlVdclw
+ pVYscKMomvEMcAS5dMR1CYacEx3Nzep5LkuzLnZKvckucytJXaFsE+ZXUbjvbMIO
+ qIBHcEeXZOVK4u02Xy2BWR2Uybl7NZb7AKFZHbZfxZs+/ngJR7KjaJqjjzjYlutn
+ EzmWDpBBAoGBAPk+LXfnYiQIHL8tu8hKjjycXXDqmSzNwU6kkc6YBim/pe6BspB8
+ 7bm+tVRCkD1WkvwdKb2GweCEUG+HiuYG1qojJOTtmAsEzNdXVhdW+gMic+lINKr/
+ Mqj5sbmsY1xqR+1o1IxteSVUtYHK3p5FlNA0BlKuzyvYSoNkq7OFDg/hAoGBAOrl
+ x9JUYRBtkwLZXDj/LahW3hFxBeIUCcQqrRopYRNS+10e6wN0PTQehh3ZNE9frCZb
+ d3L0KdbtN/n/qfvsfbwbGMQMkx6sG8JyQ/9V91dKOwicMYqRqeoyseXgytwM/Ht9
+ +ukpP0pmcZmk//x1+sBOv67bZXmRPukdJFXA7vBbAoGBALpqd+V7aRrb+mw/D3kh
+ 0jqhFP5UaNZq2g8w5WEosUtebQPze5O37LIFYmgwFOPbsbnhMgvwE2gSbnrMXOXo
+ 7Xt5J6oVzqdHItJZHyn7wqi/hwRPHh1bHA/oGbZuqi4/y6ZUxsx1QKvcLJl0G4cz
+ Mbd7gdMrrgX0Et8tV4LAnKDhAoGAPNLnHRVwVNqquJAkCzY4UmC7+/QyO8pIhR0v
+ 2ZhhZKmWIRTCchCFUJueytfVbcAuSXhhw8hplRez6O5Ey9D+9dhmX02KQuT6Ay2n
+ YdSWyWmVQ7N+OI1jXBtoaUf9/2D1d9y1Pe7KTq+cNta82liKZ4V8qQBylDoB+kbr
+ g7EDrgUCgYEAqVKWBVLF37tClQt1jkz+bWEAqnE2e75p8FKz33lO3Aosuu3wL9po
+ MgmaaocFWJm/RSo0vNL3cMGblkoDPXgw5ot1blF80jaJswiMjE14VwFRdf2AyHPl
+ 9RSeTOcub++IQs5eMDdTWWqpjvNfy6POO6gcATVhNobOCsvqrCxiIiU=
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-genesis-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEpAIBAAKCAQEAx84cvFlUdir2iio1iPlFxQ67x2PqGCr1/jRj1ptPjnlnXfLn
+ AbypA0jpbKS9r1lnSUsJtK+TNG78jFtmfnT2DLX+J9tZm4qI1Z+qrWhM0qlYyPuG
+ qXuSDI+TR5wbz973/2IioTAbSo6E32cTHHWhEaCT4o+iD/K9jZB0LToWX2k6+iQF
+ Bg61rFFAk7SOAO4/8CcsgMBw3Qnl/Ewn8WNCHcInkLqhgSOF21yMlcBsoPv1IAAR
+ khXmF5tr8RGmV13K70lv5IhusGuznZ2FYF9gl07VxQ+kWNIdRgYwPgb2qKpT2pbl
+ jzBX074rc4GUJ3gTimchGLROukOm5rMxRkYMhwIDAQABAoIBAQC6rJkwaA1/cdhx
+ ccoetTY4S/Go8nKOLeUyoWP955FGvaqTnhOyDb+isAZWWPxXzaGwWokw5TEVNfSC
+ dgqmb0RKz+Yq+scXiTEa1VgzN1U/JLUs4cMIqcjkL2gc6X8akWkGk3tjOXzmBY2i
+ 47x5RHU98Nb6P9PcLqBmmOXSM4kfjZzKHV+JKLAG1dzN1oBpS2XS+Ak0fARq4Qe9
+ eaBfmTR6V4SeqUmP5PBbxLhJqSKNaXPtsrErI/3sqoamsngybM15HqN/vbQuBGwR
+ YNEsbCDcUTpAJbq6he0Mu7nZkG3FRBMmap56CL9eq9+Z6Rzg63uVJ9B1Ys7tKuDZ
+ MJVYOxERAoGBAOAMgwAraaEdvc2PMWnR7cIVm/21PzAlteXH4TAAYpL+Yt+CNb8M
+ rlzKuSh1qNjDAAEfpuaoJyTBcAjS87bgk29CQs3ghy+n0gGKxJfkMBC0CuEWr2jV
+ OEvyN8T0ChU6PwSnkEgfqDU8RDpvFrxrvGKPvrkU3NVjPjFKNF9m+e3TAoGBAORM
+ hPDs6AVU9n1DIRJfordoPsmhXTWMmd7QQvDP25lCDrO5Vi6vf8D/feeH/+mZe74e
+ 6JRGTUYatL4qWIHCpUPcia/C07uPdXRnxGwFUJQpMh4RHzCZyEL0ZMWxUJgwyuJi
+ OLDVJADyH2XEZ2cU3H42FqbB/qPPaJtIDQDpuRH9AoGAMUbPMSRbMRJngmRyC8Ie
+ Nsel7WEFqsNAhG83ueT7yTSl7l6nD4PsfYAgxSNLpZEN2TFq9eQZ592blHVBIQG3
+ q4q5QqqVUQfqCmjI4FdRsvrGQcdJgRcUMK/vUCQUa6LJ5W4tL4+24S6GGwv/xiUz
+ 48GVwwMxpsUTEqgtaKYvZf0CgYEAzwdRG0ZLFeK5cFh62jWd0mKXZbOOWiw5sSP9
+ QHHOO4n62SJ+M/H0kWlfnKHpAcasv3k6ApRKKQO42iZ+gpWn1wVcWuX7qj/rDHe5
+ WRfsvZ8qErgGJ8WdJJKJ+/jTFGBS676UmE+AydbHgDr+Zi010sJsAic0KwrAWuiY
+ 2jYZHWUCgYARWuy/Vm3kfBR84Kbr8D1RPUP6C0Q1sj4CC5GFpnnCULKy5hP9hzFo
+ PFCCH6oAidnz4yf6KB2oYs2kbWQ/Ri+r/ap/vmeunsAJFmaHr4OWiiiGYOYdSM8K
+ faOKD3Spe7A3vhandsyPRdNOhtch8ETR+bzaH7D9BPaBvGRPUenDww==
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-pod17-jump-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEowIBAAKCAQEAvgW9e+5pewHHmfEUTJs5J4kQaAqvXLpYirHAabjVyy4wRGEu
+ GK6Xn5Fal8JElirfPPxtsruwNJ0q8swPsL44CxZdv+MPwlS5HrNFkKo/WHCT6P+D
+ Mlagphp/ngD2SYasrYc/fG1SYObcW0fmQl91oeBEXt53zdQtBZkex92XmviMf1F7
+ BNlyDuKzGnigWl29zjyno3eqmNCfSBlSaKvZ6efvaHsZmsZryviDtZ+0v0TSdkKi
+ 6CUOJlh+UwRotsj0+QzFLS93CACpYlBS8/sru8e5xP4qwMfUT1QyaHaX9rKTc04R
+ TvyHH0tDYAGfRzgeTmJQX+yTqZdVOe8WrLL6HwIDAQABAoIBAFfXn3ijBe/vKq5n
+ W9LuDsXP/t2Z0ucy3at/8ErvPyXl/DogEocmbsE9GHv/OmWQ/BHdP3jYeuRXo3sK
+ ClbSGGZHuJ70AFz9fXZLuWTeztm7cSTMuYGTukAPD9+i4jerIjg1xYtnniVdk5A+
+ 9JrKNj7WxcR1YzyrUQS9fBU4wtTINLAEYH2T6cVadm5p++idLHAAI9YHj9YpuB2V
+ sJHpk1JktURre0ouZXTs3EES46S4zCpBXQ4WDWqeBdbuv5na1bZV4nMSmMVrN3T2
+ RTDHJcoQtVueoEk2yvc+PygMjp1GY9DCRQ05+qQHSKxFd3g/u4VGfSPW0lc9nzQC
+ CnhXU0ECgYEA8R5TF5xzz1UEOzznPpeRUKsinms6qYLvtlBWwuYi/EZugrJmTPWF
+ D9NS6krqiUUFTQZ9utiaWD0WhvHCDyrNSiZrnUIQYlm9MfnYtnSuNncqdelHr455
+ q8HjEfcMYHf56+gLDNDwLL4KGu9EWKfWYmTwBExeQq6Ese6jlSFrtdsCgYEAycAY
+ 82DsgKUl0k50szJUMP9Ng7nMVWbIQC1ilaoykHlKt1TvJhmDNFNte0jqQ2k+OraR
+ IYZsZXY91sFHkT5s988VfQSy9NdUmHZ6xTNIK6zu7ixCCqT2T6RHxO1tz5Qs+/uy
+ PM6ioNXqUfvxXRXBbF9SxnrQlFOPpJCS+MUPmg0CgYEAnVV4StPgDc4f8LeQ/RrR
+ y52f/Vdi8/FokcJimtKoyYz713SppFYg+W6fkBpKaEANcXFm4WEtdZ6G8I8YXeVE
+ B7qCRh8xqbt85PtvGb+RXiDsJ/yMtlV1t0nQ7YwTG2+uOO01KKu9zLREy8aNBnye
+ O545r9RVPZW7KI/bVhh0vDkCgYBzQx5+HYfAz5lWF6CwqDZVb+aXNVU6DWim0cca
+ /ou44rL/HrUqrTS6dld8MeI09TGqVZeA8c2IAg++W9pJbsLOqS77p+2d2E/qcvYd
+ J/k5iqlOxVZNwoU+Zvrh1UwBZgR1Sg1AlEVxYgVnJWt15PIGukcOQihcNYlBWZ++
+ JMePGQKBgDEorNejlcFoPuc81GadTbdnhWAAIuuL6vkopPF6R9wHc0ETDhNfCWWU
+ SvYIEesjdLRRs2Cyr8mFL4/Lgu97zZx4pc3nZVvS1W1I4Zt0XdIRm+mRMyvFatQ9
+ iiyyDmCz/16Gwqv+1mgF2exDi7M/JjWZFPs4SlDxNMbEbKGjF3es
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-pod17-node1-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEowIBAAKCAQEAwRm6nsAAps4ZDbhEy0i5yJWTu49FrdXF/YKghHrV1FcIWkb5
+ ELqBPjIcSKSoX8uHxfQgCxVYxb/N086OiZs7lbFZT0DKxxNKGnRRh7lXkxIdsVjs
+ DZgLbeeLr6y8L3gt8lwCB9/MjfFCMXb9059iX733LC6yPDZ3Dz0vMEJzxS2mnOsv
+ ltY7xC44t8ygP0UeePYP4MaPXXFyjP02n4ZkSK/RNWsNvazsMpTdjG370XfrNue3
+ ilWbdGq8IrTLiIRUZ8rQZhAeVG8sNdWChxci89YpSw9h6AKpJ9kC1NEfJ/VLXDX6
+ Ar3pfJd/XwP0Ux8ML2jxuBEahVEWblqz9NMkDwIDAQABAoIBAEnlhr1pzNYI2R2e
+ /vSsiCxy0W5djdTQkkxJyRPpzhrMk624q2fzd7JNivVhze2a/gKLQhf7u1Ux6Zq8
+ 2V9fwJWwoPTrXq6Ae0NUcD74dsMZk7NizDMHlJginBpGiF3CKBMvkrdgte87/JDh
+ cJGj1Qm+sPB/jkXssfNq/rwBMjyqaEeQCpzRf2+lk6WTPkSwtD77oCBsYMX2Y+Kq
+ 40piL+BT5Wll02IEKashyhZ1HdU8gTUCDieBQNYDxjkeGG5akkNXCKax4vt0G3LX
+ g1fTbXGL/YJP+iniJ02P5EY5baPpYKCmV323MXQwtPC006FSLllHlmi3q1RQsFZv
+ LKf+zcECgYEA+tA6R5vsvlO5miafqb5ZRUmO11SdpqCzv0yqLFWia0u9KaUR8UUS
+ WilamDYoBAMlPmcekB1TG+OoG1sEc5zQcdpmAJ7QBoHkPRNGwpywWv6wqehbhKBG
+ GkENPY8j3g0nOyCW3nYPeXfYwE3S527ngCJNYxzUyWzikfGxz/Dv7mMCgYEAxRf6
+ Ib6wCl7ZBqZWKUvFn1+/GEBAvcLK1BE4RuhAodUkPpQSQ6s8oBaqf46gPRwzlDeK
+ aGkDuD57n5Y9wq9ThXuUNu+6J9rMrjogcoKLT3XTcLROJ1Neo3uBMoz8/tMzRhtg
+ eVV+WV1SnmOmGsrX7ZkXejBIR4Aty92X9K6ZvWUCgYBiZbSniU2Msa4cAtEat9mv
+ 7BbE9aZPy7YY88vDTulEbNdOcjsiy3VSt+yZ0I1MXauL2srLwSVsyJiX+tI5RSkl
+ sYfY8HUuSGExcNGO4gfx+v91+PmGg5ZdEG5QW0q3/7MHaFan+etCPTlk4GNAdmsO
+ AucXXiVAzJ3qocafjKekfwKBgGFn0Sm+OPhXGcDskeaE2R1Dz4hnsNdXnrAh9oMs
+ o0yXrvryaPhid2rS6N5zmYO6HU+iB1hElh8HWkdrlAhUZ92vTne8EG9D9iYg+go9
+ tCXIIIAxy/IphLsc/aQDA8HYlR2PyCUO+Iun0H4Q13WkTATTxUOQ+xfDJF79m+zE
+ IZz1AoGBANvc+XYrf7qzV79oPr/dAsqWb9sfrMlJAjAKZ2hGgK4FsjWJslbeAaMe
+ hV6aL7jBtPeQnlwTLXtNnmYWAUpI7GYetf7nNVlk39oovW+ls4KUigaW5+/YnPin
+ TxD/Q3tz4K8IKoL9HJgsZuGrQ/YgBIFTN+4QJsnx3pe3W3JfZBZj
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: kubernetes-etcd-pod17-node2-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEpAIBAAKCAQEAqqj1GasfGP2uGTgFPkH4tG2yhq0dZ9hWQmm6Z5g2O1GLfRzB
+ XpOG1E9VNjt77EuKik3oyspwhBhR4ftrtYVOSqk260pExKLRzCard5i/D2TlPj3K
+ XaGVYUCyt5MGcwAIICesmbInqmsLVpeg9us6aMj5xQ1/CXCajwYdFlRJ+IwBtGOG
+ GmPr2EP2BNwCYLyckhnjVbG/X/n1CYwaqN58cBPnIPT1nUCkai+kYyc28WubDJ+5
+ GlFNCUvVJn6xFf7HBllOVnUJzrK4O5+BAOtWgVCmsLJsK9SkldZX57JrfeG7bhGp
+ ccMANR0/I5wdFhVzojITJpGao5XUtYigztdwzwIDAQABAoIBAH6dkhM0OYNCGxwM
+ yx8QtSOwS4bOA4YbJIxrguf/LyU9b98oKXMwwxTbsx3kbiG3Phc0jGWAYpAutvmR
+ nqzzNU4BU4Sn+nNlVYBApHC7++zA77AJCg4Dpx+bb7zxMRS7TkwFA3KYkgNHHgdl
+ wf/QL+q0SVNgmwL270TzxTre2G60wv3XQ/2nw/IL2YdaEcf2/mD4ZH1qY1IzFoZS
+ U/EVUItzhPksCihk3nGw1PBw5GoAFcOTmHLn/BbhoXJ4JWfKwqMG5hkXWrp853VF
+ cOZsLGE49WmNb1Uwx2hMW9pokh9V5rp24Z01SH83uxcJoQ7n0+G9fKMWm3RrhpIl
+ xKqlUpkCgYEA1tBpV3iPlRGG9jlpBy+4L9YbXSx6HzhbT5qplZ29+urOjird9f+R
+ z4HWayr5xo+oViBoO3lgMziOiMq6hahFs6Bpau9tx8izw+QlEytAPg0nLDGRsg5b
+ wCdWobS1uCHB+uiBkBichW2C+g7zRXnFaJRSftHIdzGxm1kLQ9JhOtUCgYEAy2Fb
+ SRAXH0+AwQpHSqPef8iGsLa2+g0v8MicmWFG269Wf6ZuK1mZ4hKKb/lXM6PiHOJa
+ gLokn8dZIUTpvyC/cFutkzIOCO+Vsmg/bw/mGfUcTrHDGvzgRHRKpnf005/Pi3LZ
+ DkEhxjVsjAcb4cZFIUT9nT9AJUbnJBOddaqTRxMCgYA7CfSp0bzEn5iUO5seGoNo
+ wlOq+/pkcjzGWB+bu0rnl3lFoYp3fdI5Udn4gks7w2fko+uBzQ4fhb/G4ND6wxDF
+ GaVfeoaVjhe6Ew4NgqmZZEwL3WPJqCCXYzhwIRaAkOabayOQ0vLRyRNiXpGF2r3i
+ zEEQEeAiwkmqBIMQFNYcMQKBgQCRmAyFbWNgIsYFa5pFsLHjwGXLs8GhmDctpC+X
+ DbBwLEE7+KT9m5Mx6Bv6tQDcEwIXs2MerCLzzv3bdz3ueT8S7E6CBV9OvlTn9wES
+ PMt44aN2IoONmmHiH24hZdZ6ePlW1szUC4RmJHCkfaJUKl/qxTzZiSIejXeCuBgM
+ 2CO+yQKBgQCIsLHu3FGfzgz01riFjLLPKL1MV7W6/jSlIDKrznBPo6/XT6C7pyh1
+ k4r5gDGPHUXpRNjVufzd0BweHPs5RdZsmqeM2IQsvsjwwRjfnFG9amjLIc4omh4F
+ vUTBAdxlYifwrsYAOG+GCJ2Q3T3X4YlXClarhivtSx5RHJLjoVcvtw==
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-etcd-anchor
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEowIBAAKCAQEAtT29xK+8i3lxNgWG/YYmE1mNmVuWHjZrB+K112+ix7CDldYF
+ 0fJgPwR+urDgTiQFN5cLL7GcTGIYmgArdBZcvUmeUsPjxxUuik/w/WaqyJQJc4Ev
+ sl42owqpfjpYL5u/n5o9azsx6OTxZP3b+rmtPqSCafgkZ/VcJawIDc+jhGAKvhVz
+ Jj6zjmvb77XFR4eUjmBGVwO64lrsH7juVt6n6EnwsvMPVoxQGGAL1C2Q00kyfjLT
+ DrQScp8Ez7N3YhzzeH/W4pr84NCJ9n8Cg9GkIDpP9dLzmNYbCUC+OzA5Egge3tfu
+ n/Daf+JgJ8MhL0YcjX4CxdlX0t859fmD06d7CQIDAQABAoIBAE8LsYNh/gJ6odSk
+ zn4uDtcrnKVBG5TruPyEdTiTuNQM+SbVZE5vvmhdpoP39qw964SWPMu9U+TAd+ha
+ oJkN076+p+2DAAnpBBZQzVNHfr7iScj1k/7gNkYftVKXUbTZ4dZTJ+xnsdnYWCvq
+ yBFu/88tYq+jCQXKLjlD8XNMlw15NfCkX1nJE6zT75MskNI/NaqLt2nmjsRCwCoH
+ Fttt/5lK1m4Ge4cqXaMKLiUi2ym04FZI3m+DBDqqO6QxEgpCrz7IveZsiVOF0B5x
+ 9413Qxem6zm9cmy4X7lPyNHgEO26jQSy5IZDHS6zz5wjXYEsNn9RpCGHVjr8fWR5
+ cpLg1A0CgYEA1b08rl3vn4XEsQ+a1PbY2FmCMM3SvFZudUK1BjLUh2JGKQ4rSIJg
+ knqT0SDau66cDxDRTxz3vr02CzZCTrfGl01drAbAp1YuQ13PRYhaM+IPSNLAwS/D
+ zZdgKw4a3WMcfJbnkVJFUxEgp7csoacK+8aI4+atK+oVTpfJc/8pQl8CgYEA2ROQ
+ EeLur4a3qVjs6XcYnkIzO5O5bgKgdzbxpVJTz5UH24TjNICyy6yc/eJF2iUUOdEX
+ Ip708Uo3TyWYC5uiKYiu0jUHDjiujJjdZdeEcCdvy8b3eDlPGCqLTNOsSKKJ129S
+ Jey9CzEFP6wqeDgMDmlvDr1k1OnGxbc04UNQy5cCgYAChIwmcazU8Dp0634jbBT5
+ 13QVJxeIaGw8rWB8hjTCs4GoEiaoYADLOO5s1Do/Y7sq4kPU7r5sXMY6M5VsX/XS
+ 6nJkCGBUmEtLN9utMgH+Anezn+ftXqar0VCssSnX2ccIIK7xo0p1xAnib+HytYkH
+ ljselCUOE1/U4SzaVPMjeQKBgD6VAz4E3KdCAYUTHAoaycAmebq9VgI/Q5/a+UOe
+ PodkAcXpw88JI4LQmtoe9+ByPCiG/VJ/3UILEXMB9ZmzHsc2np//pa8V7EygbYPE
+ 5GupEvP+wq2oaAMhkNNvWwX9xhuT/mzsmXu2gDrhGcVa8y7ceqYXOBCh7SpnLRmc
+ XJi1AoGBAM7o7NRNSSeY8U1D/tgnaSR1lsSQh6F0gJc4hLSigVMsGaFnqD6pQHK/
+ Zxg5rNkPjZHHq5KRG80bKjyOwEhx3BQDwemv+XoCX8A6NzlgNWR8MlkEwlC6Twhz
+ 5eBy0x372FZpPSr1Tps6RHUZIqQbFFcUeNUH2I10HbVLEo+BuLso
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-etcd-pod17-jump
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEpAIBAAKCAQEA66FeENlqp50a5TJD5qhx+RotYhObEA5eGYtCEdt7ntEb8oJI
+ TROVq6vMy6UO0Cl7IJOBrIpR5mSmhl+QisSsecn8VH9hwC5NhCU0PIccGAvf0Z/2
+ 8YEXtWFitGanC5wgOtE+p53vCO5R8t1Lm3YGmKZaAKTYL4IylVCL0e2shrMsB0/o
+ KAMYP9WYxhm9zoSDOxOMGHyIRuZh+XEPeWrWcK+wVByVoWX+RxmBezIDvWi+nZ66
+ IFVYt5PDheVgMv9z7rvrNdMs57CT5YL4jkP8Jf5DD4JYNPb6k/n5dxqJz09VhvKP
+ N86kZBqAU6Oc6r+206jcsbmYxuarrqXVTspToQIDAQABAoIBAQDMumIupZlDlP8/
+ UNMqYATW+OWhp4M9Ch68dwCq31ajgPCVXplPTsrmY9kGv50FRGVUwpUSwwOx+JWv
+ fuzphUSOdO8mw569Cf4T6Pdf98xzIC4Rxrka0J023SyTrfVJ4xclw5R6soBz9A2D
+ xL7ijkPg8fiVQqULckZc8aTqe2VBilSTqPM+dpGQ5Wy2cqjjK70MCPdIMevZlmIH
+ bogNSUpsfKZ2lqboE3I2AaJJiGau1/1RF3cV4L+NK9wSUJNJ/MkPzgw9Ll+SKf9d
+ vPhGEsE8QUhT4jPyeWA5CSa4K7QfgLRH6P7VgjVanNKolPhSQCvmyIOj5ZYpU2TS
+ njrN0e6BAoGBAO03EPy6o8zand0eHJjjcvlHVX1gGfYxsNnffMZcKfaD7XUEEMk7
+ 90ez3gsaYPdclpCuV2zWYBlS8AKO9om96JiAejsqnt5wgi0NS79ms0P0Uv6zVYnT
+ RbpzH8/Ydbk3pPd7NdoaNEO7iYVwaYUC526G6td6+fDGumkxnd94dxcZAoGBAP5K
+ LJBPFuBA+iIgB5PUmH4u4VEQaE6cr0CzKy6CSTqtmMtKKRq1t4jvqqtVYE04Vnji
+ Q5+gw4I1yXxnHknH+4kzJlgQesnPWtlvTyQQhjGFryqxWaFNu+uflSvMeNzOfhpI
+ R+c278tAEKoCwxzGCw6tYdYmYy1lYmgQc+Xr/dnJAoGAChDlIqRU4ROB0Wk+s2or
+ bdKOGSTj1SOkqoomRFCS40gT4nxKrg9iXeOPD4+N/9Eo/ni3cwHh0BFJ6AHjClNJ
+ tHb3ON2FIlFJ5NmEllmoT8DlaLN5dMDHW7MY7Xv0+ugWkv3ieh/Uie9CVaxAfgly
+ gqks+/nW81WrgV0+osX837kCgYAZhfRnH6kaJSt2FWTtT59muuneqxjtGwj0I4eo
+ CWe0PgxiCzWI+shLNFMbE1yxI4B6bat/8DDvdtqcY/VETpBOuxWULUNF0kw6GtQE
+ uKvfeJ2WWWq3qAe+pKviU4mmEAvUM4EUEg2LhwilJ9XRo4ckl/6D8iJuQgjYjR40
+ 67T1EQKBgQDn86z6ryZs7L6lnZuPNaQ7TJiyv9EXeOQsQ2o5qBu/fVNDwYlJjab9
+ OJa49Sbv2ATAnp4ftkkleF/gFtqVFObiclkAhJXt4PqmY1JklLbaWKAxLv1QGRot
+ XHnidwjx1VXbKTbnfXY1EXPpAdsnGmgyTfrr4+LW4TeLaJBNfj/Kkg==
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-etcd-pod17-node1
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEowIBAAKCAQEA3uECyQsHrCTYCo7P/KuFNRXpqT5h/RN5c8CxBVKtr299NH0+
+ e4W6BkGbuFrj1I+mkYJjtSQ8BAL53D2Df7T29INHL8bSpKm7vs4Vhqjbd7txJXLt
+ yLVbQ1/mmoKfTu0aZJ1nlXZ2pL8tCdF2lRBS5YAVJlL/AL6277l2JWUdeS7ZsLiK
+ WdWeGQz2MXOpvQHlwB003Xq/kIcXSOyJnoO72U1GIvWHZ/lc3psVztWh+aztY3Tl
+ buf667ohCCaiJWD2EVl5Q6HhaaAx8+K3G4LbJkzK+YNK/p4/XrdMRzNN5U0Kac4+
+ f3aIwTR3+2/0Y8MAy5GbiIz6J4mpv0fAX+jJ9wIDAQABAoIBAFkg4lxDbO4KTdrr
+ AYGplbuE58wmhkkOYKNJi4D1bz+Y9hjnfPUopRubYQp4TmPSjmniGr11oAp6pjDM
+ 6KlJVPizBuS0PchbmBjVkQYowJtA+h5ft3dsDvMChtWDJvIJH2TdDW9X0FpRmVEz
+ 0pgJzxy3+703s4I4wi9bm0OZDBBJTPgbQ/MJmI59YxAszEByxOc2zsQCbICwvr/f
+ E2mZvJUBSzC7ySLZQ3LkYiClp50bRVYNyDA8xPQbJHMw268zWJUWgmHYwAxZ00Ke
+ +OVQte6qfaEP2rMcKQc6MCrZha1223NDQ1Nwg4KiJL4Aj9O0uADmDajjZ0HA5l5O
+ coPfiwECgYEA7X+gC/87W2I5Mr6VEnVqsvuH7O0iGUA75w8aCmGpxRoJBktoYxa1
+ a1DfRLH5aWIKF4W/xPMVgYuQZzVU2wDvDSkIwsWYT4zaKCadO50t9Tmvh44ImU4q
+ +O34l77Ybfb4Af0m/YU5Tz8mf8JBndPkApbr4GGoxNLPYUC9fJVUaTsCgYEA8D3U
+ s/oyXzxlQKjKTvH0SzUnChlwPoIFLUAYU2RrkGQD21QzfgpJgihh5vGmEI47CUWb
+ 00vzFm/KdnrHAUfujT2ATsqqhy9ahA3L7xrWqepsEZt7/F209DMi0E1++N5ss54N
+ juZaYfS3AFlTFkkvNfIWbcyz6fMfyoim24ZC9nUCgYBDEiPUv4O3zwlwNzpKODal
+ zTsZwe47S1SfcDhebi5Pp4ac7HbSZPtfDzu+XrSc+j73XaJGsI+GQi/Jtdn870qT
+ YN9EgiD9dj210RHeYAk2k8/qbEYpZVXlbu8hi5f7lh98EE4Okq0YoDDzK5z0QX7G
+ 7HA4sdvDmfVO9cWNhW6NOQKBgBv7B5gCrvU6ooxaXF2/fnV39lkNx23wVMwFaA/m
+ ZUTG8VANSYYHirI3I9fzEyVge23EBrcgZGqbkJgmCqGSkC0xGY2TuzLNiBxTQwpR
+ NOlLXVTbqCAnhdjfT9G1BPHVbhGpeejH2YUJLHtE7BFvaqk8zfHx4o5/+5bqPYzZ
+ 4Vi1AoGBAJtzPKVdiFlP4QHxU62Hbz5jVUIsBjvWENNOH5uMxqV0RabQxEr1me4q
+ 4N3RlJLsjwEmQ34bwZoztUK9ugDCts7E3BoaQ1CSST4IwTePxooZR74Ootxhco9u
+ ZrSLRT1UspjJhevPc4zg61grlm2Y7hx3LqWEHulumNwvnLC/4Qg0
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-etcd-pod17-node2
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEpAIBAAKCAQEAw5QMmK00nsuIs0S7+ePEV4SLSSeVTvQkKFfzbdtK0Ca3BbCW
+ wkbB9ywr2PVX6guY77T2HxaUyJOuuCWFQ2+wjIvwOFY0De4S7g4GHu+88oPwUKAp
+ yHLFYqtn2vGr0TXSUDW3UeCVlXZc7yKcG08z+B94ubBg6fdRO41CKSdwjS9wsBqC
+ N7PuEEogOoovU+OWOaPV4NL8E4OqJWKiF0Xz3BuEkZOrCBP8hX9Gu3oB2HdNxoTG
+ Ic+f5pOZbWFvxYZnNXeVLaDDcYt/yOXKWoAnc1baaeHkQfdSHpM5cDdX/F9JVDUE
+ vi/hRphaTn05zriLplDUv36qwC60SZX/y5dbGQIDAQABAoIBADqXthZffa49J90d
+ MHuy4vWdPeVSuIaI2fRENSeqVQV7M8W+m8vkSuP0FcbP6eCyTMUzn7C8oSJeLC/6
+ /auwYGIa4oLeQIYT1xP+m5LVG/RD1tEwypPE3qGq3FhZorHwv+tLzHn5IJdAeKMj
+ 6US9O8KQGyj2UHKHp4yBy1ps+GkzUSOQ5NAdfbTNk9xP6AtKaQsyuN5MDmmD7Tll
+ 6dfR9h3W6Tk+60a/t7goYVIwBB8m8L4uhojsQ3jPMrnHt+BIF5Tmpq+2JoKEgHY0
+ dDnomqJ4TgJ9vNbaAxpge/5QF+OCeG9bmlMx0oBUFRyORr9R6L08d/H1xNzZM/E7
+ eIc8mKECgYEA2zZa+xjDRZwqwGrZkGEb0K66Pr83bpXrP2XavGfrMRRqTwRtTukO
+ /AOAVxeXaYXbr3X3oly8HA5r4Assu08J7lMVr+P3rZeC5zAdgJWN0CprmCbyINcv
+ gmxgYzZXR46upDyTeRZ9NO0H+itT9n0W3SNMBtrtp3F18/ILID0usZ0CgYEA5GZY
+ pfUBAsFSCJxLdnX+tkQ4XmZp0G+3xzoNhth7GPEW5X4F8GaJT8i99V6opby6cWvP
+ wfYd94JGMDsVkr64c5qQDsWYNeRSJapSBbqpUVNCZxJ2W0h6ViUm/jEqEZS/vovA
+ m41A9FjaLm0FE65ahCXAO1wA+k2FcnhAPk/IZK0CgYAfcDk2H8QJnK8I74oKSdMK
+ Z7SwQQ47HuchLYNkV+cEH/BrKrBei9ApVns2glyltpveGyYLtA8KWwsfk5qztk8v
+ Td0jX6dqzvroGx9wDILNIvhRVuyMxy+6Hb7pG6cCzTTAuytPR2lniMMHHuWoySHZ
+ TzGdHhLNW9lVxhXQZtXmhQKBgQDEMcZkiJldrIKzMs7/60vpdaCWNpMeoVjUomGM
+ O9lCC5cHe8HOR8Yb6uyCIdXsyLm/REUq8Ce9vQJd2+MkMwBvDY5Boiql4INQJ4Zd
+ tYJMgaDAuXNB5nhwF2nvYHwqrgQnwhSpiiUJwGlrB+schODsMyF13Apa+MxxECrf
+ W9lf4QKBgQCSNYrSjf4eszLBtcLO++6KUf8NbH0t/zEO2jwGpvO3t8UHti+KeqhC
+ 8wjbghrf8q1Vpf0/drxRdv2cES1BlZWfan7861CTmyLLGjZ9h84Eqv5d7C7BH/zd
+ MkFOORTjA3VA1FZU7ZmCHuKDH9vtmgNaFEeszikJmK6nlLeISPazHA==
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-node
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEowIBAAKCAQEAv4vltDeQ39xsfPwmTL2vP9cFR5jKPO1ppxLhU3PPn7+E1ojJ
+ lKrM3bJFqBMlkf+box0FKYjcoiESge8dk0Q7ju2cv0n2xfxG3BXneZ9augeG4JDl
+ nUW6zCdHYj3KFo+9xdVCE8bGkKzN/roKbZLoly1nMoxSRGU9vZdX8oJaW4r0PF7u
+ SFCqlk5Um8ve4esp8FBciAuVlfEwtPPaz+MwN6oOyuHEGL3XvvRjBGJXDkdfguNH
+ yAwnRjU0n1915Y4nKWV8/zJ9xN1RDwlAjOTa8MqmNGimphhRPbdutA3sSoYry6S5
+ v0DIeCa5k4oWD4VeaSZdGLuplklpMAdpxwShBQIDAQABAoIBACW8OsmRNNJVS24o
+ AqeVquPJyXl8aUMthmXqu0dEhn+zLElTc1r9dxSp3T0qYHltwMyWmADBvK2YFFxS
+ riHoDE+xEfNBcAM7Gv6athpowWfqubCd+w5LwWwcxNxezeQ59yn1RGo++7lewcpP
+ /mPt0DKQOEdmC4L76vjhyuq0sXZdBoSXc1V8j6A36JSfcCMN6tmGKuzAPLCam8+4
+ 3nU8/D6bRG47TO9YsOPYg3T6ZZwKVluU9TpVrx+J6nIWlflLf4q2P/1voVhWu6p/
+ e/mFfYgYrTpNpds1kwiedGTuMEpPfD6KWcdwKwTjFfPqTlamd5hMIPmx7B/ConUp
+ gsR4iEECgYEA/fVcyt0qIvE1kLL2XLHCjbm+gQNhn44f1AM8QYj5Hu1ULYR3TmS5
+ hbnkpykZVUy5vcLP8EB2FLvLGrE8TYdguV6LPgDkqq6TwGfoLe/D8rZBUxBZzL/Y
+ fUNVY/w46yzROSbWPXXIkC/EzDpSJawcEs8vbQ40Sesj89vn3GKGmjECgYEAwRYX
+ 2f8cCeFDqEdLZB54jw7z9TJ5MfQ92lucO4INeIsLST5U0vYmnkSQDhLizSnUfUnB
+ W0+dBeLOoTydu8WhgWsCAdmR9UVv2llhYrL9WrlaPx1rB1QMbczeL19eF1VZSqPh
+ +Fr1gRcblJQLECdbIhshSPQgCJH4L8GI+r6f6xUCgYEAqr7wT5jZfrrMd+hLSdFe
+ bGmJEzbRyTQGZEZ0md9dF5UbtqrMiFGihq2QdW9lj/tRGqvDoNXGTnRgvyaQ09OE
+ jb1qQxrYo4VS49c4vMHq7eHqE833gnkuNjIyVFI9dqkgVputCY+KdJ8ZYvKHTrrj
+ +SWBzoHxWA2Xk5qzznIT69ECgYAiW9oWsqy8nVc6xKUHxdxSKKkEwtyKJRo0lwSw
+ Gi5neuahO/RALgklNLIlrvqo436qZMuBgiNA/uEiE/VFip94th//UEYGzTpgMnN/
+ 6rXmxQDoJkX7YdtsVn5bE69cm5VuEMePODBjrkb8I3PshfRTl1xO7RIeNEtjxB6p
+ 7+3pGQKBgGX+29mUiK1VJBbt6/yEHU1lMeOVQIMIdiJT+iYtYUKWiwu6K6YNW2gX
+ 06PbpNxRWWw9mErExz/HET2onW20wMe5HRJ6uIF8AvjDkofCh3JXg3SGy6uXjOsL
+ 331DfZUA+0vXMSnnK3ZOPlgPkUsS4qT/5dqcRpA43mfNu6O1Skz6
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-etcd-pod17-jump-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEogIBAAKCAQEAtFA10D9aUe/A2YfOhNnzlyogFXKKxH4O+XT/6RUMII+w/PTe
+ m3XJU07lctVPMY+h5SQPu1nhj6uNljp1TzSpXV+PeT0QhzClGpmEYLgVL4Ax5IWA
+ V4YYfKxbOj6r3FDdMtI5FHMva60qkcitPd4dQQz1Rf8YnI8NlyesE3rw2K1Dg88O
+ 99QrNm5pVYKjx++rjM561ymhGCJteCDFv2Akg+rOQU96GUJSoW3z2CB0siVAlUwn
+ 34SxdEYhG857KuoGkucpr1HX/55znmKrViUvDlfcvAfxzPwtn1iH5s1fGRyJ6M9L
+ DWtFzLRxs68lzeYNpB+gr+ohcqR8zq1/CelkbQIDAQABAoIBAEqWm4wniM84JEhX
+ 22AtYIx5iogUt76MftlGQs5CPKADkK0zBhq84Kkri9Ky1m2kAs5s2m0fwyTRTGKG
+ kBxRpnXPn+QBFKM3xjR4qL/xpiHeH8VuTCboe5ynF53CawlaEgaB28bP1x/tpBxm
+ LPPYu7U7DQMFgULSEkcizBXK13JplxomiIeJa8Tf64ecu1e1kznshqlM5qK9C7ci
+ 1SrMYT9FO2nZC5iK51rHavTAs4rWbK/w7d083Z2dhrgTkkRWETkIuZXZ+p/h3Vrb
+ OfdSrj6CM3sq2EK8kBfURAGO0dB6PdgD2UAeCQluQhe1VAEJb2AGS0ROaQsZjnP6
+ piii0ukCgYEAwFENTvJg6HLJq/UTIyNj3Pw9U8gfHwNRbDSQS7aTsyQjrp5LNpu2
+ +OmRmhNTj87qUppr/tyvsavp3a9yrx0j6B+oKF5nf741wNC/t9yr2+vOTzKCb+HH
+ voiZe432TKj3MqZMZAAEV9Pim/VdqUoc+nvnrSrlKlqS2D/J/qk6MDcCgYEA8AWf
+ aKw7r5BVSE6CoAIeIH87YripGDqEE/DDS84MaM2dSNrSDQvAWHmHkuW40MJs7OZo
+ JDGMlQP0MsAsB/YMxpT+9PC20bZ6kmNXLC8dEhSJ38EGQkbeqikedkLxhLSDQgxj
+ DHwZiut5Uhbchym+APTB3RiitReNpxMK6lDslnsCgYB3wkFiVycnuUuCzJOFPyWR
+ 2HWsNaPDoUJT+oucym5BkRCzTZmSwPb5HCHya3SOyhA7LjRwOicioeZ5iScGi0Pv
+ 6b7CnL8g2mcI0jWBHmbbBYWs5cw6NcQ4D0JcoXOuG04MeWh6oVQTCTxFWE9h+2f+
+ R6hmup6IeGyXQ2nbLrCwkwKBgAzlMHBOOJKxHXPaC/iOxJGYZFdkdmk/05LCr6tl
+ 8ZK74URlxT1AMWBPfzIsN2a322RK6LNxGg1zfe4wFu2CkaMlpCECwb+4nxM4VRmh
+ ml07T0D/PNfYuOPJe8J8zD8F97tXsQadsD2fcxAu/EAixPuGKtg3F57FGi4svrxi
+ BqP7AoGABlD3ZSAnEew3XcsfelU1I8XEDur8FZYJYdrKiuIgwYbeNQ4XS4PzMFBU
+ pkjM62EXAEIkCyDMk9uyAyUgun6wzm5hZJdLbMraRZp7Jvn0n50lLLLbQIswRlDc
+ iSb0ttXSpu8elbF6rmJAtBhmz0oqQVpliNWr4o/Tujmm512q4JI=
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-etcd-pod17-node1-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEpAIBAAKCAQEAwOpt4x9IxYen0zIPzL+U9wmOJlswJx/kYGgO1HICqTUqnxkV
+ rOybvdd4wWVJNNEr0whvrCiDlLbHfnygyXwkQC1PtV9HEUBw14AIPjSF6DhhvFol
+ UeK0Pek44p7nXj4K1t7crt1exP4Jigty4DAe972pcawHSqkg0oT/5mMKqjuh7dsR
+ uNdFaeNgDzjlvVbGQW7Wen+FjCds6VwsPYAbOmgOcbNsBptCX1iznwXLp1L0sRjR
+ xWxFPzmVI2f5eB7tsSt2mgsoOuZPTQbL7i13eGzlqsOqExWr19/LlVaLL/QOP/5B
+ mDGg6K2FB3BfjOmHiY4sY+EQ6W9bmgd0XudlcQIDAQABAoIBAFVe6OYbkA6p66DQ
+ hKFtHrT764YZ0INf36ayJe3pzjenKYdiiG8P/hPS6MNc2TqgXi5zi0e6XhBPmpTk
+ /hpr73bfFmkDEuYViFo1dHBiued8G/RISD+mfXDwZpYTD/xqpE1WLn7LxAaVDQ+j
+ 5WBEq0+jBPsiz89AbR/8b2o65htSp2XSH/Y0tOALYjEuxJEeS7ybumpgMT5+qrM7
+ VIqJMS+k2iqw7KcRmU1XsuX9KltiAEWSv0+NMNI+0+3j4ZXX43UrHdixqiFyRtMm
+ Gvua/b06UcapXBSApgDFbCNNsle1+duzb+DRxXN3Q2N+D1XlRDEVmowq2KvODvhM
+ iA3jv2ECgYEA6u1XL5yns+zEjkw01hJhTXuLZX5QgynaBkQwFlmhs9EW72YbxYnO
+ vzWK6WJMavn9JheXIBj5fnMhZIS95w69gtL6If8nH+DnkTiEU1RFH3tyDRLXvq77
+ F9fxwZ8izJ3v1rAKkGL9UQ4KxQE4r3KFMuV5vaiwZu/wIuVspWRhhf0CgYEA0jhg
+ YhAj0aL32uJFxXylGnmp09Qjm7PYxLTUvFm2FbOWM+8W2lZUJPicce9UIRCnNmQY
+ KyXZpJI6WUnEpVAIuutW/rzlhqNcgBEcpFUlSnsib14BriaSx4loAIcyDYGmAG6O
+ jnHm2A+gaYfoibTFO3+k09Zh7cKRrkKQh+HlvYUCgYEA4MzsOOs2rr1J+MCDbrV3
+ 1qT55szQTjKmJojpWvm5+k+CGuMigAw2glHB80HUzikZTHIWcuhzFcUllwJOleNN
+ BPrNz+pQjfiwng3u0a451r5RjKETQaw/KbnB5P1aV2JqNo2ODkwrCnzdYVah34E+
+ ZE2iCRJ6eoXuy/Wt2TYM/CECgYBKvqzWcTKrKSzDcMyqCUWTAks1/CmlBO9AEaPK
+ TIOHd9EiKhKQEz3b32GQyS26i/dISZKmVNDryOpiMO5wcOKJw3+tF3DszEzpZCww
+ 6e1WbC20N1KVnzV1KRAHkApl7wEdCjI5x5nynKvGmgI+ZD30h9ANWh57sUCnGxfU
+ mKddGQKBgQCtXb+6zdcuWS7Vri1lTE49831NZjC/DobwRhE5QJRnLmPFiCzOfnsr
+ +htnsJe/fGns445qhlaHH7VDRkTZlDZs6oJviECkMTk56Y3K72YUAQXknDswWUtM
+ HP+8NaFAWaxm8joIG2iD/etVlt2OEtflCk6M1ZXviNoKogM69cFlyQ==
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-etcd-pod17-node2-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEowIBAAKCAQEA7xv2/Y36/LeeUMFWWJ6ztNHw1BIEK8EVjQumZgl3fk7yXquv
+ 9NFbto9LXQo9Yib8741Q6BFtZ4ID4n3h/c65atA66V4zWnaVivs7UVsIoHGLz7lw
+ rb9plkHIN118o56ipWWcojiUfulAHC7wMIklEI9F9zOhRlzgvZbGpy5dSGQ6ZjqR
+ lWkOQNxVnvY8qqJnrrC6ucPGZqibhUo7UaLS4qlf0Yp/TjGsJjYsNwTACFUZOMpy
+ ZZuqoC8vLVWrNYMAZrMSoUalP5NNrKCQVGBj4saOIFDNcoWAF/Xdd21TTnYHyENr
+ EaLrfBEdiKL/Qjl0/l3YXVZ6IMNLcn8PVQQ3NQIDAQABAoIBAH0vnvjRRP7bA8Az
+ +Qkczel1oSjm5dgily3pU41Il49BthNqwAzlL6c9Dq//lHO3BeZFjn5x4V237GDA
+ l3lSqjEKJE3aS/io7VJ+hmfpyXJ3AEQZSq0s8hMBDdouz/q6K118/azRAq4PYMlg
+ qdA/fXBWEsOB/IXiSqf4MLmGxMAI9nZqJNnoPXZ4FCktIpWQfgOTYS8H865/uD5l
+ JdVxQzln4qw+MY5C6zL1vDvmivjhpgJRH9aXn06SdZ4AesaM2YxBpbT9Qq+i6YBK
+ QVEb1DHujr1qXmvT8X922NXQZSNN0Imn5/DUvZ9kiwpModbJIgUSrB2UqsTgDR3/
+ rqSLpQECgYEA74+HYaNg8/A0NUh9EK99o64Hik/8+Z3ZyH+2qIVitBZ1y0GtAcbg
+ 7onHpG3+4PCFHONZZdGNw1QkUD9zrTpZg+AuYkj8dph3UHRhOxE1t5A1E/f9dgZ1
+ gRaUxZwS4sMTD4pYgm8XDBHvBndwD8d0TFmH8QuC3T0XxkE/gqV/9lkCgYEA/4SB
+ cXPBI5OGcWJXa5Z8xzIDGk+Qs+f/xwnkt4vLbRZ9Q5hGUXInEV5ZhsIjXZNFhM9F
+ OO2mPerMWL+FDYHR7I0AG6xeD4Td2IwzJRHERPXaWcb3g2zhZmskoKBA3w7qfdOc
+ WRSxm1cEWPiM6dfrl2/6IAVcagYl+/w1ueWyJD0CgYEAqT4hSt19tVjRyYL4uD0C
+ 6gwcz55K/p6CKZ/wj4YMgWYMuhgf/c1fQ6abIJOFKa1CnXIQyloNaR2cugTZ2FwM
+ uZo7qrwdgDuer3xI5M33wUNj/EOLEULm6NfnKuRkg0eFw8jdVujcw244C719segb
+ RYVLAQQ848gxb6LRF5+Mk6ECgYBdIZ/IiUdZPzkedJimdzhNplXpLhzw5dudYWbC
+ 26ouvaa0j3j50KCavQfmjTY0siwBh0aUxFH2eXE3276UOMAZ9x6V95JlF6mAd0Fg
+ /oPKGs4WMOYgOfxBx0WXYjGi253udMWk1l0R4HqOLzG1PeT50m+ZYjrXzhvkJ34x
+ np36hQKBgDH1Jua/aapQZ39JltZ8dGoqGnXRxE37+fOnCiMphjNABP5dOvkbwmH4
+ X4s8t70KPzTNsCMPBk9ACxSoKDfT2vrzVIFc5Sy9eqO/Tufbis5EkVLx/AR8gPtT
+ PxcyBbm9ERRrR3Wv51myK0CReM28uuDAg0RpXvn8fH4PezKRoRxy
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: calico-node-peer
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+---
+data: |
+ -----BEGIN PUBLIC KEY-----
+ MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5VjcwV4weIFgFq25/aMn
+ gxvHW3elx7bXr7G1HI2EXsFVVUniJ4TfONkVpKMf9KLezrScLJL8LZJBo+kXtGDb
+ PWmL3VJtfEmshSk5EyESDAvg35sspToOaLbi0OE8uJa/9zE5phuMxVlMPwJgdKZ4
+ 7edqnL6JcZWJWLGtqknS98AfVvkKqzMkO4H2QTcZz9EjKhyHi62jwd1zj1WWUgbT
+ WZY5ynWT0d4I6jkAcs/R/ih3eAHUHY7ru370+1PkcFjBcNOeI65UiL4oXpbqFRKE
+ 16eVFULPpFYJ00thNGwgKFDuddrSV8ApXxliFgvmsRRdKhmNBU8fTcG7nzdl9mDf
+ wwIDAQAB
+ -----END PUBLIC KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: service-account
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/PublicKey/v1
+---
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEpQIBAAKCAQEA5VjcwV4weIFgFq25/aMngxvHW3elx7bXr7G1HI2EXsFVVUni
+ J4TfONkVpKMf9KLezrScLJL8LZJBo+kXtGDbPWmL3VJtfEmshSk5EyESDAvg35ss
+ pToOaLbi0OE8uJa/9zE5phuMxVlMPwJgdKZ47edqnL6JcZWJWLGtqknS98AfVvkK
+ qzMkO4H2QTcZz9EjKhyHi62jwd1zj1WWUgbTWZY5ynWT0d4I6jkAcs/R/ih3eAHU
+ HY7ru370+1PkcFjBcNOeI65UiL4oXpbqFRKE16eVFULPpFYJ00thNGwgKFDuddrS
+ V8ApXxliFgvmsRRdKhmNBU8fTcG7nzdl9mDfwwIDAQABAoIBAQC4blNn9LSJ05BP
+ 7Hiq7O8zUb1pYrgf+HtOQFvikDMod9SFd5q0KPfRIVF0SfHCqs797uPAPJsqknjS
+ tPlpBpKHuj7NRiHhVuWzV8kcBvYaVdsKNiEa5ar8rkWLr/VCg4fv4tf3KiRz9zGH
+ YgPrCowo1HY5gkfI3XXLq2Z6kE9lBsb2m/H9rJx4g17B6KDEaaOI/J2FNqy+SMSG
+ XLYx9Oqm6YUWUSbPXd8QUd/4axHgvecniz2KCg2YoGP7Oi2ercp4eXVrJ+FdoJSf
+ IUI1derpjMrd00VaFk3RfmKDzbrOlBp5lAkpGPydGbLmVAOaAsK9whb4BvR98ruv
+ Ph6xQsfhAoGBAPK+8YtQe5+LCn/9v8qsuP4DdRQ1lWpmxF/VbdOHupy4RhfRe2fd
+ MlZx+FjyU9UzYLBmq7VGTH1Z6v1obqqEpRbIuX1HYmbw3tXjnAVR8zD1bj5hvIFK
+ /puOmnTN85x27PYZG1rK4MfZE5O6KF0tHaxxD1HtV18SPjHpyY7ivpbpAoGBAPHe
+ oi1DsviS+QFdznCPtMBOZb7aEmylendMqfEPPVswQjsExSRJwFlh2tvurTFIflol
+ U/Ve+uRE96ZWvUYoTo6ZMxiv7nyXOz6L7u2M/95iIhQ1c9AMINyuJ/sRqtXNeN8p
+ wtgfIZcP/l1JMVXSZB3PXuc7sLFftLoM+M3ITm3LAoGBAKJI8Wb4CY3iAMUMubof
+ uxVm7lDyec/GoKaJI4F1jlbUA1hNHjmT8eFFFIkyiMVSMeP83/Ky6tQq1yVPOh0Z
+ zNzsmMWegbTcd717C4WrAfDLREbERKgToSASOES6o5EJGOZ2ZolOdPRmteXfYLja
+ PqpYc6uMBwtyQM5RxASYpl5xAoGALw0dRWrvDPYiZIaoGzOJeQOHPXpUrTf/u+d5
+ A8DwMaYQrESASU/jkD++AJzMqlKs6cJrM8d3TSKxfnVPOq+qoIji7MGExk3xI3i7
+ URDl0ZALixze27EQT329n1TPg+oFwnvwQHTF5wogdGtBoq1b9oSZtKfi9o5krPDL
+ EdUOlMMCgYEAh4cP2xvxy+hxI7pHb8/EmcSW5b1t+ib7OyDaLCi0jrPQlUTp+67y
+ 1GqNopNX2qjquaEs2G2WBMnyNi706ykmbO3OdtEGnXG3TVMnrAVxDytoZ5/haE6j
+ J5TG1WP0RMYgOOh1sLtsfUjKr0bbiciOenQxhtuCDfkkuHoftIWEZPU=
+ -----END RSA PRIVATE KEY-----
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: service-account
+ schema: metadata/Document/v1
+ storagePolicy: cleartext
+schema: deckhand/PrivateKey/v1
diff --git a/site/intel-pod17/secrets/certificates/ingress.yaml b/site/intel-pod17/secrets/certificates/ingress.yaml
new file mode 100644
index 0000000..b799fdb
--- /dev/null
+++ b/site/intel-pod17/secrets/certificates/ingress.yaml
@@ -0,0 +1,135 @@
+---
+# Example manifest for ingress cert.
+# NEWSITE-CHANGEME: must be replaced with proper/valid set,
+# self-signed certs are not supported.
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: ingress-crt
+ schema: metadata/Document/v1
+ labels:
+ name: ingress-crt-site
+ storagePolicy: cleartext
+schema: deckhand/Certificate/v1
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIIFKzCCA5OgAwIBAgIMW2h6FCcFdKeaw3vnMA0GCSqGSIb3DQEBCwUAMBIxEDAO
+ BgNVBAMTB0FpcnNoaXAwHhcNMTgwODA2MTY0MDUyWhcNMTkwODA2MTY0MDUyWjBJ
+ MTUwMwYDVQQDEyxpbmdyZXNzLmFpcnNoaXAtc2Vhd29ydGh5LmF0bGFudGFmb3Vu
+ ZHJ5LmNvbTEQMA4GA1UEChMHQWlyc2hpcDCCAaIwDQYJKoZIhvcNAQEBBQADggGP
+ ADCCAYoCggGBALvNHm/G/ylh6aPcvrhOcb4qz1BjcNtnxH8bzZng/rMeX3W2AzjC
+ r2JloJcDvOLBp/TkLOZPImnFW2/GCwktxPgXZuBTPzFV50g77KsPFw0fn3Si7+bs
+ F22tLhdOGk6MQj/WW4pKGHqdw1/VbPwOHBT+I4/scR1L2SZxYtSFIKGenHJH+PMV
+ bCdwnNOR80F8KRzK5iZs/r6S/QqVheieARSWWnk2+TtkM1BloGOhLSd+ZkWh9VO1
+ eOnZowkaDAJwD/G6zoSr5n+beaXzDnEcoVXFSwd4FLoV+om77o92XmZ4rVw0vTMO
+ k6jVwmkdT+dM2K2hLUG/TXWoV2/Qms70gzDOs85RtAkTPe4Ohtdpr51Q0hd35TKG
+ YLKzX/OPblD68iYJYSBvMPpAVTbFYVPW1AQx8wWfannYbMoeL8XTEOKfkqm90YP9
+ EhIdtmw4D7GZxlzG5FXXutmT9sqLfqlRu/RynAhBP8NQvw74WumhOe8r7GhCwgzC
+ gaPLGjeekoS6LQIDAQABo4IBSDCCAUQwDAYDVR0TAQH/BAIwADCBzQYDVR0RBIHF
+ MIHCgixpbmdyZXNzLmFpcnNoaXAtc2Vhd29ydGh5LmF0bGFudGFmb3VuZHJ5LmNv
+ bYIta2V5c3RvbmUuYWlyc2hpcC1zZWF3b3J0aHkuYXRsYW50YWZvdW5kcnkuY29t
+ gilub3ZhLmFpcnNoaXAtc2Vhd29ydGh5LmF0bGFudGFmb3VuZHJ5LmNvbYIsaG9y
+ aXpvbi5haXJzaGlwLXNlYXdvcnRoeS5hdGxhbnRhZm91bmRyeS5jb22HBAoXFQuH
+ BAoXFgswEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0PAQH/BAUDAwegADAdBgNV
+ HQ4EFgQUfTAjNgn/1U1Uh1MJDYT2m4dzhsYwHwYDVR0jBBgwFoAUJFuXPZo6RzfE
+ BlJjnnk5jhcP4wIwDQYJKoZIhvcNAQELBQADggGBAE2ISWmrxqrledJI3aLaS9Yw
+ WsZc8O8CnIyLoxrE85vUubFjuI9ixC/6dJxl2iB1n0H8JgmFREox32Q4+kDJI8V/
+ X9x0PFpRzL7QEPrLZhW94Yis3sOphLW0rf0t06ZepdHHeodYJu1pVMDmLq6bKXdX
+ vo+/WwKnZBXC1qPbXJByv/CN9MtViXOnBGORFRTJPb6U8379LNWclJ/LW12yTwNk
+ JGIbZU61Vxu+2nLIabmmRoODH2jomgMOMMzLgjT3Hvw3whe8GrUoxDiPYQVTDGNm
+ ly6m+5B1Nx06fkZazonozeaOhSQ7RblUSbo+w8TJmLRzD9ft7p4vpjBGxRADMcuF
+ DOjATgdZeisBUHTGEO0P6wJOBQuCFMX9AVl+u8ZpcuRaRaN+pBE6/BqcHBB6qV/N
+ w2DdNtP8BrJ3kJVNEDIo5oTbH5SToxgA4hWBV42M1rB+5vIMDKN3rwVDdNKWYhYc
+ VZpU3V9V6JzSW1O2w4Wu9PdbWJD9oSvC0qJgnjOXzg==
+ -----END CERTIFICATE-----
+...
+---
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: ingress-ca
+ schema: metadata/Document/v1
+ labels:
+ name: ingress-ca-site
+ storagePolicy: cleartext
+schema: deckhand/CertificateAuthority/v1
+data: |
+ -----BEGIN CERTIFICATE-----
+ MIID7TCCAlWgAwIBAgIMW2h3tgSwie0Ypx8eMA0GCSqGSIb3DQEBCwUAMBIxEDAO
+ BgNVBAMTB0FpcnNoaXAwHhcNMTgwODA2MTYzMDQ2WhcNMTkwODA2MTYzMDQ2WjAS
+ MRAwDgYDVQQDEwdBaXJzaGlwMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKC
+ AYEAny0Nqu9U2tXdCCTNzD2T62htMmBLg3CmzWajfbfFl7ALqzo3HgbbY3PxTHDE
+ OJ/lwdm0HkEaGfEDXhJd06WZsa8+fKGqhKXvZXwXx5mJ8LCGxz6xiaxwo9lnKe6V
+ o3YX7bJ5YIVxQ2jhvZo+dY8Z/buloi2Tp2HbqTejKULH9+qdiQTDXAnyR0NLqzJ0
+ YQ4v4yU3zix3nBi8z29lQekGO9quNEka3nw2n0Gxmq5z1bNALGCF5F759mVkB0uT
+ fPGF+zm9eqlqAgduYg7R+JYUumVHvIoRY454GtAdZHTJHJZP0gQSGJsLff8ROFpI
+ GVYsOZhJXU9Ihc5VBC5PMErbmCn0YkuxAWNOYBstZ8l+uY6YiPoFV5Ulc/8M0If+
+ T6jbqzWoFC+4ysgY95RKOw53S4o/T6AFwiIKIw0xp3UfHCf6kr5Y0+XdDn5CXpJB
+ d1KK3PoUWzPSsxcUMXvgKWT4x1vsCId21dn1SmVSOEBhM08VZfjd5bvL9Xjt/E0j
+ mUqDAgMBAAGjQzBBMA8GA1UdEwEB/wQFMAMBAf8wDwYDVR0PAQH/BAUDAwcEADAd
+ BgNVHQ4EFgQUJFuXPZo6RzfEBlJjnnk5jhcP4wIwDQYJKoZIhvcNAQELBQADggGB
+ AJaoEtnDoWUUs4nSSqIGcoCfpIO0oqVp8DvkBOcxz5Rz8vMVJSC24/UnuCD2Wknx
+ 2V/E3edXIeRo7duhPtNCT7c8OKY/pJsZQTgOczn4rphoD1pmAIPZmpG6ssPadPiM
+ EP8xWJHZt8NXG7D5kJX2COvBvgNeWXL6MF7Tv8+t5xzt59Vitdb/7lm9Z6jjpvN+
+ zoG0pKx3XYESsnLAVAf00F+kWwds/3x3gQywUAQUDER0jliYUE5id+sojp357Cl9
+ XtY+8zSnTduuP8CfMhwv5p6j9xbqacfT7AzpQ6cy4xcQ7MA6JBQcxbaq4NtvIf6+
+ d/5N9d8LGnfXdCd9iwNy9Qk23Ea0SNhnk9F/NqGBPakU4TbHh4iTYMC/+hDGInpO
+ TIRelTidNBFNaIBg3Z0vsh0lDwbt/xhpXip+ZVBqKMTtktEceiVGru9cYUQA2tKI
+ XNoc5s0uQGMpdFzgED4lXZf+n7yGVMKohvi7Yn96HqujGIrVH6qThsI6m7pUSz40
+ +g==
+ -----END CERTIFICATE-----
+...
+---
+metadata:
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: ingress-key
+ schema: metadata/Document/v1
+ labels:
+ name: ingress-key-site
+ storagePolicy: cleartext
+schema: deckhand/CertificateKey/v1
+data: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIG4wIBAAKCAYEAu80eb8b/KWHpo9y+uE5xvirPUGNw22fEfxvNmeD+sx5fdbYD
+ OMKvYmWglwO84sGn9OQs5k8iacVbb8YLCS3E+Bdm4FM/MVXnSDvsqw8XDR+fdKLv
+ 5uwXba0uF04aToxCP9ZbikoYep3DX9Vs/A4cFP4jj+xxHUvZJnFi1IUgoZ6cckf4
+ 8xVsJ3Cc05HzQXwpHMrmJmz+vpL9CpWF6J4BFJZaeTb5O2QzUGWgY6EtJ35mRaH1
+ U7V46dmjCRoMAnAP8brOhKvmf5t5pfMOcRyhVcVLB3gUuhX6ibvuj3ZeZnitXDS9
+ Mw6TqNXCaR1P50zYraEtQb9NdahXb9CazvSDMM6zzlG0CRM97g6G12mvnVDSF3fl
+ MoZgsrNf849uUPryJglhIG8w+kBVNsVhU9bUBDHzBZ9qedhsyh4vxdMQ4p+Sqb3R
+ g/0SEh22bDgPsZnGXMbkVde62ZP2yot+qVG79HKcCEE/w1C/Dvha6aE57yvsaELC
+ DMKBo8saN56ShLotAgMBAAECggGAYzZDhA1+sx/0zApL/xYB5NK83t0Ju/8fwX6w
+ qUBBjeLXz1mubgf7m2HQ6ragzLI9xpPcXHcl2PbYDT50ig7R5baHNK8FzUxyeKif
+ qOa56Mbx+C4zyqyi2+AHX2x1XVWfkhXuGip2sCA0HKalgqr5juWLZ/ci8rUlLLft
+ 3BPQX1FpmL4I+HIyxsspLmQGPGwZVAqkd1xRX+BLKZJAQdlm/LdJaIvwMr4Glcx6
+ ZOe68QhHgzXCYsyV6gR9qstF2OvVuLa2mUc7EzYInFIFhXUdAAwmDqkuuLRdRQhf
+ Ur8nqQW33T0cG0GBUzgBI5YmSPJvTSzcPmeSyNVx2/Yb0pkuXtCw67oDcAsN4nW8
+ uls49E2RaiLJYsy5vPsX5aJNcAxw/CWLdadQ3ukviD/MDJbpTl4F52GOVYL6K4XH
+ g5TJjj7xzjmK3ldR/Kscg7HpCitQLGUYdgIsAFdspXf4aSIa68IjDrc5NsJZuMzc
+ PbVHrw7QYNfHY7VNdUlOVqH5lS3BAoHBANRqKrQXtnJmM006TCEJXdcN/5M685jz
+ +L4Ox0Rhrq8ROgcN5q/hjKb6kP/MccQ9voGQOl9TKEyinGNdTtyc/fuH7RNlQwpS
+ HT+vEzVEcrSe8UFs8c6oJnHFO72ylFcibFf56LvbI3L8BZXp7gPSPQkp5f1NWEZk
+ X5bUL4UNiOm0diltba/ofxywF0M9WGD00eqi0Q29JRlvun+355j06CENxRoonNZC
+ wk1evIxhhckP9zLjI2Ykb1hV6yzwPWtmyQKBwQDiVgru/B396KhzDhLl5AL+pBWA
+ GsfiCbmPLh6W6V5VzldB4+GlMRrJ4zSjZQ3/nvX5KepqjMn1N6LQpZQUI/YShCKE
+ mW0XMiAfbp2d23MRMjLD8L/bIoBHQOPkCaMjbmyDOlCagWakEvHJO/TieVgTmYk6
+ mtEYVjJFWI9OCNMAHdl8ovWr3p+8YbVZ8LLv5ZO/V1cIjczoNQ6p8LG/pPMTDLXM
+ ScN9a8z3f8LQLBHBlu0155xvt95PQLAon/x21kUCgcAvPVk36hoiQQZhw3hQ1JNx
+ E2TmanLobkHAiurYE11VA+DC1t2Z+fBc5la+/MnEWfL3P4srzgOlX3imRIcYWzXE
+ 7crUyG1ray2kDxyXeRyFfN+srDzut8is/q81lfSVmEs+GY8f0DGHDfN0Dq1nXidC
+ 1XWXqs7aANKdaZ0T2xm61+57ciG1wGAckjDqPEdecLQKmaEijBEnIgj5BH5WLwk8
+ 6KIQGj4fDIPHzyzhj4LAX3ObdpZVzf6RR7JgsSEHtLkCgcBROW2dDC87MqZY++D+
+ TVBhz8LDgVjgHntQDc3+fGtVQcKAq+YLYU7qyrXWOWrHpGVDcK5mZHYJoVi1peY5
+ QBqL1I2KpoDGxT9P6GN6BgoKTsh3FsvTOVNtvrTJ3keEbJlWkrPgbrXGBeJtRC4C
+ pGdeSUg9FtgY8r4BsuFisLoAHbYyC008y5zpfusVBtNAUlQuY4qhUDoLzxafF/jB
+ /NEasgH/+SzFss0QuPHRwS7yGVaxdJfoY8TNDjrpqVhx0T0CgcEAvKG4UoWvT8gJ
+ pIeeAxxnv9yrMxgpntu4RXPDHgfX5tva6EaM3r3nLXjd9FVtlQ4cNBMhp9HNhS3a
+ dK+oEDcBysVxxfltlS2Bx0+gQf3WxgBCJwayKe3i/XCDza92EENgxTPmqB1LHiq5
+ 2b5aOl2Y5fP0eX6UryxRc443c/ejMHw4lGwnno0qpRk9M9Ucqv5J96QCfAlBSQQS
+ gOG9cypL0kBWzCejn9W4av8HkM8Noqd7Tqul1onv/46OBaX51kt3
+ -----END RSA PRIVATE KEY-----
+...
diff --git a/site/intel-pod17/secrets/passphrases/apiserver-encryption-key-key1.yaml b/site/intel-pod17/secrets/passphrases/apiserver-encryption-key-key1.yaml
new file mode 100644
index 0000000..e21876e
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/apiserver-encryption-key-key1.yaml
@@ -0,0 +1,13 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: apiserver-encryption-key-key1
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+# https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/
+# use head -c 32 /dev/urandom | base64
+data: n9VBwseT/JjV7r9vbUR/MvCobe01Bdh9XtWgsNF5zLY=
+...
diff --git a/site/intel-pod17/secrets/passphrases/ceph_fsid.yaml b/site/intel-pod17/secrets/passphrases/ceph_fsid.yaml
new file mode 100644
index 0000000..7201502
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ceph_fsid.yaml
@@ -0,0 +1,12 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ceph_fsid
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+# uuidgen
+data: 7b7576f4-3358-4668-9112-100440079807
+...
diff --git a/site/intel-pod17/secrets/passphrases/ceph_swift_keystone_password.yaml b/site/intel-pod17/secrets/passphrases/ceph_swift_keystone_password.yaml
new file mode 100644
index 0000000..9a9af1f
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ceph_swift_keystone_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ceph_swift_keystone_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ipmi_admin_password.yaml b/site/intel-pod17/secrets/passphrases/ipmi_admin_password.yaml
new file mode 100644
index 0000000..0b49b62
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ipmi_admin_password.yaml
@@ -0,0 +1,13 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ipmi_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ labels:
+ name: ipmi-admin-password-site
+ storagePolicy: cleartext
+data: root
+...
diff --git a/site/intel-pod17/secrets/passphrases/maas-region-key.yaml b/site/intel-pod17/secrets/passphrases/maas-region-key.yaml
new file mode 100644
index 0000000..73d4a69
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/maas-region-key.yaml
@@ -0,0 +1,12 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: maas-region-key
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+# openssl rand -hex 10
+data: 9026f6048d6a017dc913
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_barbican_oslo_db_password.yaml b/site/intel-pod17/secrets/passphrases/osh_barbican_oslo_db_password.yaml
new file mode 100644
index 0000000..c5f866c
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_barbican_oslo_db_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_barbican_oslo_db_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_barbican_oslo_messaging_admin_password.yaml b/site/intel-pod17/secrets/passphrases/osh_barbican_oslo_messaging_admin_password.yaml
new file mode 100644
index 0000000..bb19957
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_barbican_oslo_messaging_admin_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_barbican_oslo_messaging_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_barbican_oslo_messaging_password.yaml b/site/intel-pod17/secrets/passphrases/osh_barbican_oslo_messaging_password.yaml
new file mode 100644
index 0000000..9bf0217
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_barbican_oslo_messaging_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_barbican_oslo_messaging_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_barbican_password.yaml b/site/intel-pod17/secrets/passphrases/osh_barbican_password.yaml
new file mode 100644
index 0000000..5122192
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_barbican_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_barbican_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_barbican_rabbitmq_erlang_cookie.yaml b/site/intel-pod17/secrets/passphrases/osh_barbican_rabbitmq_erlang_cookie.yaml
new file mode 100644
index 0000000..32f8dae
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_barbican_rabbitmq_erlang_cookie.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_barbican_rabbitmq_erlang_cookie
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_cinder_oslo_db_password.yaml b/site/intel-pod17/secrets/passphrases/osh_cinder_oslo_db_password.yaml
new file mode 100644
index 0000000..b22f898
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_cinder_oslo_db_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_cinder_oslo_db_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_cinder_oslo_messaging_admin_password.yaml b/site/intel-pod17/secrets/passphrases/osh_cinder_oslo_messaging_admin_password.yaml
new file mode 100644
index 0000000..040e657
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_cinder_oslo_messaging_admin_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_cinder_oslo_messaging_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_cinder_oslo_messaging_password.yaml b/site/intel-pod17/secrets/passphrases/osh_cinder_oslo_messaging_password.yaml
new file mode 100644
index 0000000..5d76ba7
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_cinder_oslo_messaging_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_cinder_oslo_messaging_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_cinder_password.yaml b/site/intel-pod17/secrets/passphrases/osh_cinder_password.yaml
new file mode 100644
index 0000000..26565db
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_cinder_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_cinder_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_cinder_rabbitmq_erlang_cookie.yaml b/site/intel-pod17/secrets/passphrases/osh_cinder_rabbitmq_erlang_cookie.yaml
new file mode 100644
index 0000000..b1ac8ff
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_cinder_rabbitmq_erlang_cookie.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_cinder_rabbitmq_erlang_cookie
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_glance_oslo_db_password.yaml b/site/intel-pod17/secrets/passphrases/osh_glance_oslo_db_password.yaml
new file mode 100644
index 0000000..0739069
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_glance_oslo_db_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_glance_oslo_db_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_glance_oslo_messaging_admin_password.yaml b/site/intel-pod17/secrets/passphrases/osh_glance_oslo_messaging_admin_password.yaml
new file mode 100644
index 0000000..57db752
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_glance_oslo_messaging_admin_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_glance_oslo_messaging_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_glance_oslo_messaging_password.yaml b/site/intel-pod17/secrets/passphrases/osh_glance_oslo_messaging_password.yaml
new file mode 100644
index 0000000..d103c27
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_glance_oslo_messaging_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_glance_oslo_messaging_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_glance_password.yaml b/site/intel-pod17/secrets/passphrases/osh_glance_password.yaml
new file mode 100644
index 0000000..93ae0f2
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_glance_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_glance_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_glance_rabbitmq_erlang_cookie.yaml b/site/intel-pod17/secrets/passphrases/osh_glance_rabbitmq_erlang_cookie.yaml
new file mode 100644
index 0000000..496fae3
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_glance_rabbitmq_erlang_cookie.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_glance_rabbitmq_erlang_cookie
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_heat_oslo_db_password.yaml b/site/intel-pod17/secrets/passphrases/osh_heat_oslo_db_password.yaml
new file mode 100644
index 0000000..3352d4c
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_heat_oslo_db_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_heat_oslo_db_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_heat_oslo_messaging_admin_password.yaml b/site/intel-pod17/secrets/passphrases/osh_heat_oslo_messaging_admin_password.yaml
new file mode 100644
index 0000000..074e688
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_heat_oslo_messaging_admin_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_heat_oslo_messaging_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_heat_oslo_messaging_password.yaml b/site/intel-pod17/secrets/passphrases/osh_heat_oslo_messaging_password.yaml
new file mode 100644
index 0000000..39f1327
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_heat_oslo_messaging_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_heat_oslo_messaging_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_heat_password.yaml b/site/intel-pod17/secrets/passphrases/osh_heat_password.yaml
new file mode 100644
index 0000000..5777ebb
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_heat_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_heat_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_heat_rabbitmq_erlang_cookie.yaml b/site/intel-pod17/secrets/passphrases/osh_heat_rabbitmq_erlang_cookie.yaml
new file mode 100644
index 0000000..74e2a99
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_heat_rabbitmq_erlang_cookie.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_heat_rabbitmq_erlang_cookie
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_heat_stack_user_password.yaml b/site/intel-pod17/secrets/passphrases/osh_heat_stack_user_password.yaml
new file mode 100644
index 0000000..36db28b
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_heat_stack_user_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_heat_stack_user_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_heat_trustee_password.yaml b/site/intel-pod17/secrets/passphrases/osh_heat_trustee_password.yaml
new file mode 100644
index 0000000..58129ef
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_heat_trustee_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_heat_trustee_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_horizon_oslo_db_password.yaml b/site/intel-pod17/secrets/passphrases/osh_horizon_oslo_db_password.yaml
new file mode 100644
index 0000000..7c78d45
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_horizon_oslo_db_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_horizon_oslo_db_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_infra_elasticsearch_admin_password.yaml b/site/intel-pod17/secrets/passphrases/osh_infra_elasticsearch_admin_password.yaml
new file mode 100644
index 0000000..78c265e
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_infra_elasticsearch_admin_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_infra_elasticsearch_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_infra_grafana_admin_password.yaml b/site/intel-pod17/secrets/passphrases/osh_infra_grafana_admin_password.yaml
new file mode 100644
index 0000000..9232de7
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_infra_grafana_admin_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_infra_grafana_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_infra_grafana_oslo_db_password.yaml b/site/intel-pod17/secrets/passphrases/osh_infra_grafana_oslo_db_password.yaml
new file mode 100644
index 0000000..6d5f49e
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_infra_grafana_oslo_db_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_infra_grafana_oslo_db_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_infra_grafana_oslo_db_session_password.yaml b/site/intel-pod17/secrets/passphrases/osh_infra_grafana_oslo_db_session_password.yaml
new file mode 100644
index 0000000..bd4e573
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_infra_grafana_oslo_db_session_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_infra_grafana_oslo_db_session_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_infra_nagios_admin_password.yaml b/site/intel-pod17/secrets/passphrases/osh_infra_nagios_admin_password.yaml
new file mode 100644
index 0000000..52dbe16
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_infra_nagios_admin_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_infra_nagios_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_infra_openstack_exporter_password.yaml b/site/intel-pod17/secrets/passphrases/osh_infra_openstack_exporter_password.yaml
new file mode 100644
index 0000000..64f78e1
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_infra_openstack_exporter_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_infra_openstack_exporter_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_infra_oslo_db_admin_password.yaml b/site/intel-pod17/secrets/passphrases/osh_infra_oslo_db_admin_password.yaml
new file mode 100644
index 0000000..9c68e9d
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_infra_oslo_db_admin_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_infra_oslo_db_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_infra_oslo_db_exporter_password.yaml b/site/intel-pod17/secrets/passphrases/osh_infra_oslo_db_exporter_password.yaml
new file mode 100644
index 0000000..f134f46
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_infra_oslo_db_exporter_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_infra_oslo_db_exporter_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_infra_prometheus_admin_password.yaml b/site/intel-pod17/secrets/passphrases/osh_infra_prometheus_admin_password.yaml
new file mode 100644
index 0000000..b3df5f6
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_infra_prometheus_admin_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_infra_prometheus_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_infra_rgw_s3_admin_access_key.yaml b/site/intel-pod17/secrets/passphrases/osh_infra_rgw_s3_admin_access_key.yaml
new file mode 100644
index 0000000..9f64719
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_infra_rgw_s3_admin_access_key.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_infra_rgw_s3_admin_access_key
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: admin_access_key
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_infra_rgw_s3_admin_secret_key.yaml b/site/intel-pod17/secrets/passphrases/osh_infra_rgw_s3_admin_secret_key.yaml
new file mode 100644
index 0000000..3e06f91
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_infra_rgw_s3_admin_secret_key.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_infra_rgw_s3_admin_secret_key
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: admin_secret_key
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_infra_rgw_s3_elasticsearch_access_key.yaml b/site/intel-pod17/secrets/passphrases/osh_infra_rgw_s3_elasticsearch_access_key.yaml
new file mode 100644
index 0000000..97c7d23
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_infra_rgw_s3_elasticsearch_access_key.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_infra_rgw_s3_elasticsearch_access_key
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: elastic_access_key
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_infra_rgw_s3_elasticsearch_secret_key.yaml b/site/intel-pod17/secrets/passphrases/osh_infra_rgw_s3_elasticsearch_secret_key.yaml
new file mode 100644
index 0000000..60f0134
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_infra_rgw_s3_elasticsearch_secret_key.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_infra_rgw_s3_elasticsearch_secret_key
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: elastic_secret_key
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_keystone_admin_password.yaml b/site/intel-pod17/secrets/passphrases/osh_keystone_admin_password.yaml
new file mode 100644
index 0000000..6c3f446
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_keystone_admin_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_keystone_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_keystone_ldap_password.yaml b/site/intel-pod17/secrets/passphrases/osh_keystone_ldap_password.yaml
new file mode 100644
index 0000000..2edf0f2
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_keystone_ldap_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_keystone_ldap_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_keystone_oslo_db_password.yaml b/site/intel-pod17/secrets/passphrases/osh_keystone_oslo_db_password.yaml
new file mode 100644
index 0000000..07b2206
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_keystone_oslo_db_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_keystone_oslo_db_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_keystone_oslo_messaging_admin_password.yaml b/site/intel-pod17/secrets/passphrases/osh_keystone_oslo_messaging_admin_password.yaml
new file mode 100644
index 0000000..aec85c0
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_keystone_oslo_messaging_admin_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_keystone_oslo_messaging_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_keystone_oslo_messaging_password.yaml b/site/intel-pod17/secrets/passphrases/osh_keystone_oslo_messaging_password.yaml
new file mode 100644
index 0000000..be716f4
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_keystone_oslo_messaging_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_keystone_oslo_messaging_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_keystone_rabbitmq_erlang_cookie.yaml b/site/intel-pod17/secrets/passphrases/osh_keystone_rabbitmq_erlang_cookie.yaml
new file mode 100644
index 0000000..ee7e4bd
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_keystone_rabbitmq_erlang_cookie.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_keystone_rabbitmq_erlang_cookie
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_neutron_oslo_db_password.yaml b/site/intel-pod17/secrets/passphrases/osh_neutron_oslo_db_password.yaml
new file mode 100644
index 0000000..4d0b157
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_neutron_oslo_db_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_neutron_oslo_db_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_neutron_oslo_messaging_admin_password.yaml b/site/intel-pod17/secrets/passphrases/osh_neutron_oslo_messaging_admin_password.yaml
new file mode 100644
index 0000000..4ac42c9
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_neutron_oslo_messaging_admin_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_neutron_oslo_messaging_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_neutron_oslo_messaging_password.yaml b/site/intel-pod17/secrets/passphrases/osh_neutron_oslo_messaging_password.yaml
new file mode 100644
index 0000000..6be02b9
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_neutron_oslo_messaging_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_neutron_oslo_messaging_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_neutron_password.yaml b/site/intel-pod17/secrets/passphrases/osh_neutron_password.yaml
new file mode 100644
index 0000000..dd0b2b6
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_neutron_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_neutron_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_neutron_rabbitmq_erlang_cookie.yaml b/site/intel-pod17/secrets/passphrases/osh_neutron_rabbitmq_erlang_cookie.yaml
new file mode 100644
index 0000000..9e8ff8d
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_neutron_rabbitmq_erlang_cookie.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_neutron_rabbitmq_erlang_cookie
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_nova_metadata_proxy_shared_secret.yaml b/site/intel-pod17/secrets/passphrases/osh_nova_metadata_proxy_shared_secret.yaml
new file mode 100644
index 0000000..37d5c62
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_nova_metadata_proxy_shared_secret.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_nova_metadata_proxy_shared_secret
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_nova_oslo_db_password.yaml b/site/intel-pod17/secrets/passphrases/osh_nova_oslo_db_password.yaml
new file mode 100644
index 0000000..2cd60f5
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_nova_oslo_db_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_nova_oslo_db_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_nova_oslo_messaging_admin_password.yaml b/site/intel-pod17/secrets/passphrases/osh_nova_oslo_messaging_admin_password.yaml
new file mode 100644
index 0000000..487bcc5
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_nova_oslo_messaging_admin_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_nova_oslo_messaging_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_nova_oslo_messaging_password.yaml b/site/intel-pod17/secrets/passphrases/osh_nova_oslo_messaging_password.yaml
new file mode 100644
index 0000000..13569ba
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_nova_oslo_messaging_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_nova_oslo_messaging_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_nova_password.yaml b/site/intel-pod17/secrets/passphrases/osh_nova_password.yaml
new file mode 100644
index 0000000..4c2223d
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_nova_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_nova_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_nova_rabbitmq_erlang_cookie.yaml b/site/intel-pod17/secrets/passphrases/osh_nova_rabbitmq_erlang_cookie.yaml
new file mode 100644
index 0000000..7a885e6
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_nova_rabbitmq_erlang_cookie.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_nova_rabbitmq_erlang_cookie
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_oslo_cache_secret_key.yaml b/site/intel-pod17/secrets/passphrases/osh_oslo_cache_secret_key.yaml
new file mode 100644
index 0000000..11747a7
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_oslo_cache_secret_key.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_oslo_cache_secret_key
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_oslo_db_admin_password.yaml b/site/intel-pod17/secrets/passphrases/osh_oslo_db_admin_password.yaml
new file mode 100644
index 0000000..48df9ee
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_oslo_db_admin_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_oslo_db_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_oslo_db_exporter_password.yaml b/site/intel-pod17/secrets/passphrases/osh_oslo_db_exporter_password.yaml
new file mode 100644
index 0000000..61b4144
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_oslo_db_exporter_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_oslo_db_exporter_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_oslo_messaging_admin_password.yaml b/site/intel-pod17/secrets/passphrases/osh_oslo_messaging_admin_password.yaml
new file mode 100644
index 0000000..e7d97e2
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_oslo_messaging_admin_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_oslo_messaging_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_placement_password.yaml b/site/intel-pod17/secrets/passphrases/osh_placement_password.yaml
new file mode 100644
index 0000000..c72b59a
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_placement_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_placement_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_rabbitmq_erlang_cookie.yaml b/site/intel-pod17/secrets/passphrases/osh_rabbitmq_erlang_cookie.yaml
new file mode 100644
index 0000000..a3b5a2b
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_rabbitmq_erlang_cookie.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_rabbitmq_erlang_cookie
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/osh_tempest_password.yaml b/site/intel-pod17/secrets/passphrases/osh_tempest_password.yaml
new file mode 100644
index 0000000..af90ec0
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/osh_tempest_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_tempest_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/tenant_ceph_fsid.yaml b/site/intel-pod17/secrets/passphrases/tenant_ceph_fsid.yaml
new file mode 100644
index 0000000..18bd485
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/tenant_ceph_fsid.yaml
@@ -0,0 +1,12 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: tenant_ceph_fsid
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+# uuidgen
+data: 29d8953d-0bb6-4ba1-a48a-f9be1c0937a9
+...
diff --git a/site/intel-pod17/secrets/passphrases/ubuntu_crypt_password.yaml b/site/intel-pod17/secrets/passphrases/ubuntu_crypt_password.yaml
new file mode 100644
index 0000000..4d60468
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ubuntu_crypt_password.yaml
@@ -0,0 +1,12 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ubuntu_crypt_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+# Pass: password123
+data: $6$qgvZ3LC9.t59Akqy$HAJfJpdrN8Ld9ssGyjFPzyJ3WUGN.ucqhSyA25LFjBrSYboVFgX8wLomRwlf5YIn1siaXHSh4JaPJED3BO36J1
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_airflow_oslo_messaging_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_airflow_oslo_messaging_password.yaml
new file mode 100644
index 0000000..33c4125
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_airflow_oslo_messaging_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_airflow_oslo_messaging_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_airflow_postgres_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_airflow_postgres_password.yaml
new file mode 100644
index 0000000..8a1d648
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_airflow_postgres_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_airflow_postgres_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_armada_keystone_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_armada_keystone_password.yaml
new file mode 100644
index 0000000..866efcc
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_armada_keystone_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_armada_keystone_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_barbican_keystone_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_barbican_keystone_password.yaml
new file mode 100644
index 0000000..cb2da22
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_barbican_keystone_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_barbican_keystone_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_barbican_oslo_db_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_barbican_oslo_db_password.yaml
new file mode 100644
index 0000000..95a76ed
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_barbican_oslo_db_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_barbican_oslo_db_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_deckhand_keystone_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_deckhand_keystone_password.yaml
new file mode 100644
index 0000000..5ee27f2
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_deckhand_keystone_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_deckhand_keystone_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_deckhand_postgres_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_deckhand_postgres_password.yaml
new file mode 100644
index 0000000..e63319b
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_deckhand_postgres_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_deckhand_postgres_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_drydock_keystone_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_drydock_keystone_password.yaml
new file mode 100644
index 0000000..b8083b5
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_drydock_keystone_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_drydock_keystone_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_drydock_postgres_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_drydock_postgres_password.yaml
new file mode 100644
index 0000000..2eff525
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_drydock_postgres_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_drydock_postgres_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_keystone_admin_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_keystone_admin_password.yaml
new file mode 100644
index 0000000..91f74fd
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_keystone_admin_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_keystone_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_keystone_oslo_db_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_keystone_oslo_db_password.yaml
new file mode 100644
index 0000000..a9cb153
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_keystone_oslo_db_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_keystone_oslo_db_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_maas_admin_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_maas_admin_password.yaml
new file mode 100644
index 0000000..402c129
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_maas_admin_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_maas_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_maas_postgres_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_maas_postgres_password.yaml
new file mode 100644
index 0000000..96ec574
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_maas_postgres_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_maas_postgres_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_openstack_exporter_keystone_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_openstack_exporter_keystone_password.yaml
new file mode 100644
index 0000000..b513af4
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_openstack_exporter_keystone_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_openstack_exporter_keystone_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_oslo_db_admin_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_oslo_db_admin_password.yaml
new file mode 100644
index 0000000..b3c1325
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_oslo_db_admin_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_oslo_db_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_oslo_messaging_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_oslo_messaging_password.yaml
new file mode 100644
index 0000000..95d6c0e
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_oslo_messaging_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_oslo_messaging_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_postgres_admin_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_postgres_admin_password.yaml
new file mode 100644
index 0000000..546de05
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_postgres_admin_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_postgres_admin_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_postgres_exporter_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_postgres_exporter_password.yaml
new file mode 100644
index 0000000..abdaa5b
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_postgres_exporter_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_postgres_exporter_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_postgres_replication_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_postgres_replication_password.yaml
new file mode 100644
index 0000000..2176e71
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_postgres_replication_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_postgres_replication_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_promenade_keystone_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_promenade_keystone_password.yaml
new file mode 100644
index 0000000..ac40d1e
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_promenade_keystone_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_promenade_keystone_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_rabbitmq_erlang_cookie.yaml b/site/intel-pod17/secrets/passphrases/ucp_rabbitmq_erlang_cookie.yaml
new file mode 100644
index 0000000..6a2aef9
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_rabbitmq_erlang_cookie.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_rabbitmq_erlang_cookie
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_shipyard_keystone_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_shipyard_keystone_password.yaml
new file mode 100644
index 0000000..181a52a
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_shipyard_keystone_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_shipyard_keystone_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/passphrases/ucp_shipyard_postgres_password.yaml b/site/intel-pod17/secrets/passphrases/ucp_shipyard_postgres_password.yaml
new file mode 100644
index 0000000..de0eed7
--- /dev/null
+++ b/site/intel-pod17/secrets/passphrases/ucp_shipyard_postgres_password.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/Passphrase/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_shipyard_postgres_password
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: password123
+...
diff --git a/site/intel-pod17/secrets/publickey/grego_ssh_public_key.yaml b/site/intel-pod17/secrets/publickey/grego_ssh_public_key.yaml
new file mode 100644
index 0000000..2ca157f
--- /dev/null
+++ b/site/intel-pod17/secrets/publickey/grego_ssh_public_key.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/PublicKey/v1
+metadata:
+ schema: metadata/Document/v1
+ name: grego_ssh_public_key
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDOyMag93evkxOvIKFryNGuaIqzuWdji7wyqoYNzTP7JI3SvEAdv/6yEo5Ca7/OxHWvKOfD8BaBINljMdHk3cj47LA47s4BFUpYxaYd6x5JqjSVFcX0JzB8FO4i/RE9q2HmqJJ9XuOc9ZZZC8CANFajqG9uvY0ChHLMifEtzi7KCPnQfDSSB5dogz3kdaukuUC9dtpUX04v29C9Mk9JaW4gmECYqPnwRZq0E+XFI0ipKtB5LtGY191p04AYMWHq+vZXo7F5k2RKl3PRiIEBIGJjIK64NhzIhV4g/8nRABeNO7C7YbFHbNbXW2ztzZA4Avt/nPVn5goDuaY7kus1kWG+RRy1oQrFRL+MIbuJkFV4hkxa9SonUSTPNj8rk++E94ysVxundWRxhT9eKU/tDaVYg+KxoUApdk0UfwpbUNl/FtiEGu44hutYfON4EMYgHIc5lbfXQ2dSQq82jTdEeP2/LcRl+W6Au9chlzly7B39rCzi9hSjezb7r2uJ5ZhdXLfQfPaBg3hS+4Tt/QmBkj+1dZZVyJ77KAabd3ppr+KURwUEdwqP0Www9yExdhbO2ff92ZzkBe+9dUKaVv/yFapQYCgguwuRqG7a0tTvF/5aLx0IVghp6qBA9t4ysgpq5KqIB1aTuo546ftfSGnZZvbJhND1qMMqT8shTqaBkctGEw== greg.oberfield@att.com
+...
diff --git a/site/intel-pod17/secrets/publickey/kasparss_ssh_public_key.yaml b/site/intel-pod17/secrets/publickey/kasparss_ssh_public_key.yaml
new file mode 100644
index 0000000..3cf2601
--- /dev/null
+++ b/site/intel-pod17/secrets/publickey/kasparss_ssh_public_key.yaml
@@ -0,0 +1,11 @@
+---
+schema: deckhand/PublicKey/v1
+metadata:
+ schema: metadata/Document/v1
+ name: kasparss_ssh_public_key
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDhZBgcufBr6msHHnAxW96vYgFhDHqjYi3oWsg/E7BeoTT+962mSeU0roKJG9XN3WY++D83T5dUcv6PAje1Upzq9O0tX9daKET89ZeYEtZ5cwIQvf75caDIgfilNVFbIIc831ardHZVte68SRrtyToXdXJdiK0KHZyuMauZvU/T1Icth91fHYuY2Lo2G2+15A9VqKKW4v+Luvj8qJR98s0uMslkJozZH1xWbX2HbXzLLZuQZk93Z9V9QDCv5qKd9VBz6xDQ4d69Hf++qkHnKHznhq3mA1dIrSRNG963IM/sueoGCDDTLKPchZeZ4kWWH3vr0iM02NVcUV/R9kamoUzz kaspars.skels@att.com
+...
diff --git a/site/intel-pod17/site-definition.yaml b/site/intel-pod17/site-definition.yaml
new file mode 100644
index 0000000..1952cae
--- /dev/null
+++ b/site/intel-pod17/site-definition.yaml
@@ -0,0 +1,17 @@
+---
+schema: pegleg/SiteDefinition/v1
+metadata:
+ schema: metadata/Document/v1
+ layeringDefinition:
+ abstract: false
+ layer: site
+ name: intel-pod17
+ storagePolicy: cleartext
+data:
+ site_type: cntt
+
+ repositories:
+ global:
+ revision: v1.3
+ url: https://github.com/airshipit/treasuremap
+...
diff --git a/site/intel-pod17/software/charts/kubernetes/container-networking/etcd.yaml b/site/intel-pod17/software/charts/kubernetes/container-networking/etcd.yaml
new file mode 100644
index 0000000..00053a4
--- /dev/null
+++ b/site/intel-pod17/software/charts/kubernetes/container-networking/etcd.yaml
@@ -0,0 +1,127 @@
+---
+# The purpose of this file is to build the list of calico etcd nodes and the
+# calico etcd certs for those nodes in the environment.
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ name: kubernetes-calico-etcd
+ layeringDefinition:
+ abstract: false
+ layer: site
+ parentSelector:
+ name: kubernetes-calico-etcd-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+ substitutions:
+ # Generate a list of control plane nodes (i.e. genesis node + master node
+ # list) on which calico etcd will run and will need certs. It is assumed
+ # that Airship sites will have 4 control plane nodes, so this should not need to
+ # change for a new site.
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .genesis.hostname
+ dest:
+ path: .values.nodes[0].name
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .masters[0].hostname
+ dest:
+ path: .values.nodes[1].name
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .masters[1].hostname
+ dest:
+ path: .values.nodes[2].name
+
+ # Certificate substitutions for the node names assembled on the above list.
+ # NEWSITE-CHANGEME: Per above, the number of substitutions should not need
+ # to change with a standard Airship deployment. However, the names of each
+ # deckhand certficiate should be updated with the correct hostnames for your
+ # environment. The ordering is important (Genesis is index 0, then master
+ # nodes in the order they are specified in common-addresses).
+
+ # Genesis hostname - pod17-jump
+ - src:
+ schema: deckhand/Certificate/v1
+ name: calico-etcd-pod17-jump
+ path: .
+ dest:
+ path: .values.nodes[0].tls.client.cert
+ - src:
+ schema: deckhand/CertificateKey/v1
+ name: calico-etcd-pod17-jump
+ path: .
+ dest:
+ path: .values.nodes[0].tls.client.key
+ - src:
+ schema: deckhand/Certificate/v1
+ name: calico-etcd-pod17-jump-peer
+ path: .
+ dest:
+ path: .values.nodes[0].tls.peer.cert
+ - src:
+ schema: deckhand/CertificateKey/v1
+ name: calico-etcd-pod17-jump-peer
+ path: .
+ dest:
+ path: .values.nodes[0].tls.peer.key
+
+ # master node 1 hostname - pod17-node1
+ - src:
+ schema: deckhand/Certificate/v1
+ name: calico-etcd-pod17-node1
+ path: .
+ dest:
+ path: .values.nodes[1].tls.client.cert
+ - src:
+ schema: deckhand/CertificateKey/v1
+ name: calico-etcd-pod17-node1
+ path: .
+ dest:
+ path: .values.nodes[1].tls.client.key
+ - src:
+ schema: deckhand/Certificate/v1
+ name: calico-etcd-pod17-node1-peer
+ path: .
+ dest:
+ path: .values.nodes[1].tls.peer.cert
+ - src:
+ schema: deckhand/CertificateKey/v1
+ name: calico-etcd-pod17-node1-peer
+ path: .
+ dest:
+ path: .values.nodes[1].tls.peer.key
+
+ # master node 2 hostname - pod17-node2
+ - src:
+ schema: deckhand/Certificate/v1
+ name: calico-etcd-pod17-node2
+ path: .
+ dest:
+ path: .values.nodes[2].tls.client.cert
+ - src:
+ schema: deckhand/CertificateKey/v1
+ name: calico-etcd-pod17-node2
+ path: .
+ dest:
+ path: .values.nodes[2].tls.client.key
+ - src:
+ schema: deckhand/Certificate/v1
+ name: calico-etcd-pod17-node2-peer
+ path: .
+ dest:
+ path: .values.nodes[2].tls.peer.cert
+ - src:
+ schema: deckhand/CertificateKey/v1
+ name: calico-etcd-pod17-node2-peer
+ path: .
+ dest:
+ path: .values.nodes[2].tls.peer.key
+
+data: {}
+...
diff --git a/site/intel-pod17/software/charts/kubernetes/etcd/etcd.yaml b/site/intel-pod17/software/charts/kubernetes/etcd/etcd.yaml
new file mode 100644
index 0000000..365b3d0
--- /dev/null
+++ b/site/intel-pod17/software/charts/kubernetes/etcd/etcd.yaml
@@ -0,0 +1,131 @@
+---
+# The purpose of this file is to build the list of k8s etcd nodes and the
+# k8s etcd certs for those nodes in the environment.
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ name: kubernetes-etcd
+ layeringDefinition:
+ abstract: false
+ layer: site
+ parentSelector:
+ name: kubernetes-etcd-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+ substitutions:
+ # Generate a list of control plane nodes (i.e. genesis node + master node
+ # list) on which k8s etcd will run and will need certs. It is assumed
+ # that Airship sites will have 4 control plane nodes, so this should not need to
+ # change for a new site.
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .genesis.hostname
+ dest:
+ path: .values.nodes[0].name
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .masters[0].hostname
+ dest:
+ path: .values.nodes[1].name
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .masters[1].hostname
+ dest:
+ path: .values.nodes[2].name
+
+ # Certificate substitutions for the node names assembled on the above list.
+ # NEWSITE-CHANGEME: Per above, the number of substitutions should not need
+ # to change with a standard Airship deployment. However, the names of each
+ # deckhand certficiate should be updated with the correct hostnames for your
+ # environment. The ordering is important (Genesis is index 0, then master
+ # nodes in the order they are specified in common-addresses).
+
+ # Genesis Exception*
+ # *NOTE: This is an exception in that `genesis` is not the hostname of the
+ # genesis node, but `genesis` is reference here in the certificate names
+ # because of certain Promenade assumptions that may be addressed in the
+ # future. Therefore `genesis` is used instead of `pod17-jump` here.
+ - src:
+ schema: deckhand/Certificate/v1
+ name: kubernetes-etcd-genesis
+ path: .
+ dest:
+ path: .values.nodes[0].tls.client.cert
+ - src:
+ schema: deckhand/CertificateKey/v1
+ name: kubernetes-etcd-genesis
+ path: .
+ dest:
+ path: .values.nodes[0].tls.client.key
+ - src:
+ schema: deckhand/Certificate/v1
+ name: kubernetes-etcd-genesis-peer
+ path: .
+ dest:
+ path: .values.nodes[0].tls.peer.cert
+ - src:
+ schema: deckhand/CertificateKey/v1
+ name: kubernetes-etcd-genesis-peer
+ path: .
+ dest:
+ path: .values.nodes[0].tls.peer.key
+
+ # master node 1 hostname - pod17-node1
+ - src:
+ schema: deckhand/Certificate/v1
+ name: kubernetes-etcd-pod17-node1
+ path: .
+ dest:
+ path: .values.nodes[1].tls.client.cert
+ - src:
+ schema: deckhand/CertificateKey/v1
+ name: kubernetes-etcd-pod17-node1
+ path: .
+ dest:
+ path: .values.nodes[1].tls.client.key
+ - src:
+ schema: deckhand/Certificate/v1
+ name: kubernetes-etcd-pod17-node1-peer
+ path: .
+ dest:
+ path: .values.nodes[1].tls.peer.cert
+ - src:
+ schema: deckhand/CertificateKey/v1
+ name: kubernetes-etcd-pod17-node1-peer
+ path: .
+ dest:
+ path: .values.nodes[1].tls.peer.key
+
+ # master node 2 hostname - pod17-node2
+ - src:
+ schema: deckhand/Certificate/v1
+ name: kubernetes-etcd-pod17-node2
+ path: .
+ dest:
+ path: .values.nodes[2].tls.client.cert
+ - src:
+ schema: deckhand/CertificateKey/v1
+ name: kubernetes-etcd-pod17-node2
+ path: .
+ dest:
+ path: .values.nodes[2].tls.client.key
+ - src:
+ schema: deckhand/Certificate/v1
+ name: kubernetes-etcd-pod17-node2-peer
+ path: .
+ dest:
+ path: .values.nodes[2].tls.peer.cert
+ - src:
+ schema: deckhand/CertificateKey/v1
+ name: kubernetes-etcd-pod17-node2-peer
+ path: $
+ dest:
+ path: .values.nodes[2].tls.peer.key
+
+data: {}
+...
diff --git a/site/intel-pod17/software/charts/ucp/ceph/ceph-client-update.yaml b/site/intel-pod17/software/charts/ucp/ceph/ceph-client-update.yaml
new file mode 100644
index 0000000..eb921b8
--- /dev/null
+++ b/site/intel-pod17/software/charts/ucp/ceph/ceph-client-update.yaml
@@ -0,0 +1,26 @@
+---
+# The purpose of this file is to define environment-specific parameters for ceph
+# client update
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp-ceph-client-update
+ layeringDefinition:
+ abstract: false
+ layer: site
+ parentSelector:
+ name: ucp-ceph-client-update-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data:
+ values:
+ conf:
+ pool:
+ target:
+ # NEWSITE-CHANGEME: Total number of OSDs. Does not need to change if
+ # your HW matches this site's HW. Verify for your environment.
+ # 8 OSDs per node x 3 nodes = 24
+ osd: 3
+...
diff --git a/site/intel-pod17/software/charts/ucp/ceph/ceph-client.yaml b/site/intel-pod17/software/charts/ucp/ceph/ceph-client.yaml
new file mode 100644
index 0000000..e1e8ecf
--- /dev/null
+++ b/site/intel-pod17/software/charts/ucp/ceph/ceph-client.yaml
@@ -0,0 +1,100 @@
+---
+# The purpose of this file is to define envrionment-specific parameters for the
+# ceph client
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp-ceph-client
+ layeringDefinition:
+ abstract: false
+ layer: site
+ parentSelector:
+ name: ucp-ceph-client-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data:
+ values:
+ conf:
+ pool:
+ target:
+ # NEWSITE-CHANGEME: The number of OSDs per ceph node. Does not need to
+ # change if your deployment HW matches this site's HW.
+ osd: 1
+ spec:
+ # RBD pool
+ - name: rbd
+ application: rbd
+ replication: 1
+ percent_total_data: 40
+ - name: cephfs_metadata
+ application: cephfs
+ replication: 1
+ percent_total_data: 5
+ - name: cephfs_data
+ application: cephfs
+ replication: 1
+ percent_total_data: 10
+ # RadosGW pools
+ - name: .rgw.root
+ application: rgw
+ replication: 1
+ percent_total_data: 0.1
+ - name: default.rgw.control
+ application: rgw
+ replication: 1
+ percent_total_data: 0.1
+ - name: default.rgw.data.root
+ application: rgw
+ replication: 1
+ percent_total_data: 0.1
+ - name: default.rgw.gc
+ application: rgw
+ replication: 1
+ percent_total_data: 0.1
+ - name: default.rgw.log
+ application: rgw
+ replication: 1
+ percent_total_data: 0.1
+ - name: default.rgw.intent-log
+ application: rgw
+ replication: 1
+ percent_total_data: 0.1
+ - name: default.rgw.meta
+ application: rgw
+ replication: 1
+ percent_total_data: 0.1
+ - name: default.rgw.usage
+ application: rgw
+ replication: 1
+ percent_total_data: 0.1
+ - name: default.rgw.users.keys
+ application: rgw
+ replication: 1
+ percent_total_data: 0.1
+ - name: default.rgw.users.email
+ application: rgw
+ replication: 1
+ percent_total_data: 0.1
+ - name: default.rgw.users.swift
+ application: rgw
+ replication: 1
+ percent_total_data: 0.1
+ - name: default.rgw.users.uid
+ application: rgw
+ replication: 1
+ percent_total_data: 0.1
+ - name: default.rgw.buckets.extra
+ application: rgw
+ replication: 1
+ percent_total_data: 0.1
+ - name: default.rgw.buckets.index
+ application: rgw
+ replication: 1
+ percent_total_data: 3
+ - name: default.rgw.buckets.data
+ application: rgw
+ replication: 1
+ percent_total_data: 34.8
+...
diff --git a/site/intel-pod17/software/charts/ucp/ceph/ceph-osd.yaml b/site/intel-pod17/software/charts/ucp/ceph/ceph-osd.yaml
new file mode 100644
index 0000000..8cf291a
--- /dev/null
+++ b/site/intel-pod17/software/charts/ucp/ceph/ceph-osd.yaml
@@ -0,0 +1,30 @@
+---
+# The purpose of this file is to define environment-specific parameters for
+# ceph-osd
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp-ceph-osd
+ layeringDefinition:
+ abstract: false
+ layer: site
+ parentSelector:
+ name: ucp-ceph-osd-global
+ actions:
+ - method: replace
+ path: .values.conf.storage.osd
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data:
+ values:
+ conf:
+ storage:
+ osd:
+ - data:
+ type: block-logical
+ location: /dev/sdb
+ journal:
+ type: directory
+ location: /var/lib/openstack-helm/ceph/osd/osd-sdb
+...
diff --git a/site/intel-pod17/software/charts/ucp/divingbell/divingbell.yaml b/site/intel-pod17/software/charts/ucp/divingbell/divingbell.yaml
new file mode 100644
index 0000000..db6ef66
--- /dev/null
+++ b/site/intel-pod17/software/charts/ucp/divingbell/divingbell.yaml
@@ -0,0 +1,72 @@
+---
+# The purpose of this file is to define site-specific parameters to the
+# UAM-lite portion of the divingbell chart:
+# 1. User accounts to create on bare metal
+# 2. SSH public key for operationg system access to the bare metal
+# 3. Passwords for operating system access via iDrac/iLo console. SSH password-
+# based auth is disabled.
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp-divingbell
+ layeringDefinition:
+ abstract: false
+ layer: site
+ parentSelector:
+ name: ucp-divingbell-global
+ actions:
+ - method: merge
+ path: .
+ labels:
+ name: ucp-divingbell-site
+ storagePolicy: cleartext
+ substitutions:
+ - dest:
+ path: .values.conf.uamlite.users[0].user_sshkeys[0]
+ src:
+ schema: deckhand/PublicKey/v1
+ name: airship_ssh_public_key
+ path: .
+ - dest:
+ path: .values.conf.uamlite.users[0].user_crypt_passwd
+ src:
+ schema: deckhand/Passphrase/v1
+ name: ubuntu_crypt_password
+ path: .
+ - dest:
+ path: .values.conf.uamlite.users[1].user_sshkeys[0]
+ src:
+ schema: deckhand/PublicKey/v1
+ name: airship_ssh_public_key
+ path: .
+ - dest:
+ path: .values.conf.uamlite.users[2].user_sshkeys[0]
+ src:
+ schema: deckhand/PublicKey/v1
+ name: grego_ssh_public_key
+ path: .
+ - dest:
+ path: .values.conf.uamlite.users[3].user_sshkeys[0]
+ src:
+ schema: deckhand/PublicKey/v1
+ name: kasparss_ssh_public_key
+ path: .
+
+data:
+ values:
+ conf:
+ uamlite:
+ users:
+ - user_name: ubuntu
+ user_sudo: true
+ user_sshkeys: []
+ - user_name: airship
+ user_sudo: true
+ user_sshkeys: []
+ - user_name: grego
+ user_sudo: true
+ user_sshkeys: []
+ - user_name: kasparss
+ user_sudo: true
+ user_sshkeys: []
+...
diff --git a/site/intel-pod17/software/config/common-software-config.yaml b/site/intel-pod17/software/config/common-software-config.yaml
new file mode 100644
index 0000000..6122372
--- /dev/null
+++ b/site/intel-pod17/software/config/common-software-config.yaml
@@ -0,0 +1,16 @@
+---
+# The purpose of this file is to define site-specific common software config
+# paramters.
+schema: pegleg/CommonSoftwareConfig/v1
+metadata:
+ schema: metadata/Document/v1
+ name: common-software-config
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ osh:
+ # NEWSITE-CHANGEME: Replace with the site name
+ region_name: intel-pod17
+...
diff --git a/type/cntt/bootactions/promjoin.yaml b/type/cntt/bootactions/promjoin.yaml
new file mode 100644
index 0000000..1178c10
--- /dev/null
+++ b/type/cntt/bootactions/promjoin.yaml
@@ -0,0 +1,32 @@
+---
+# This file defines a boot action which is responsible for fetching the node's
+# promjoin script from the promenade API. This is the script responsible for
+# installing kubernetes on the node and joining the kubernetes cluster.
+# #GLOBAL-CANDIDATE#
+schema: 'drydock/BootAction/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ name: promjoin
+ storagePolicy: 'cleartext'
+ layeringDefinition:
+ abstract: false
+ layer: site
+ labels:
+ application: 'drydock'
+data:
+ signaling: false
+ # TODO(alanmeadows) move what is global about this document
+ assets:
+ - path: /opt/promjoin.sh
+ type: file
+ permissions: '555'
+ # The ip= parameter must match the MaaS network name of the network used
+ # to contact kubernetes. With a standard, reference Airship deployment where
+ # L2 networks are shared between all racks, the network name (i.e. calico)
+ # should be correct.
+ location: promenade+http://promenade-api.ucp.svc.cluster.local/api/v1.0/join-scripts?design_ref={{ action.design_ref | urlencode }}&hostname={{ node.hostname }}&ip={{ node.network.private.ip }}{% for k, v in node.labels.items() %}&labels.dynamic={{ k }}={{ v }}{% endfor %}
+ location_pipeline:
+ - template
+ data_pipeline:
+ - utf8_decode
+...
diff --git a/type/cntt/deployment/deployment-configuration.yaml b/type/cntt/deployment/deployment-configuration.yaml
new file mode 100644
index 0000000..bfc6c0c
--- /dev/null
+++ b/type/cntt/deployment/deployment-configuration.yaml
@@ -0,0 +1,41 @@
+---
+# The purpose of this file is to provide shipyard related deployment config
+# parameters. This should not require modification for a new site. However,
+# shipyard deployment strategies can be very useful in getting around certain
+# failures, like misbehaving nodes that hold up the deployment. See more at
+# https://opendev.org/airship/shipyard/src/branch/master/doc/source/site-definition-documents.rst#using-a-deployment-strategy
+schema: shipyard/DeploymentConfiguration/v1
+metadata:
+ schema: metadata/Document/v1
+ name: deployment-configuration
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ physical_provisioner:
+ deployment_strategy: deployment-strategy
+ deploy_interval: 30
+ deploy_timeout: 3600
+ destroy_interval: 30
+ destroy_timeout: 900
+ join_wait: 0
+ prepare_node_interval: 30
+ prepare_node_timeout: 1800
+ prepare_site_interval: 10
+ prepare_site_timeout: 300
+ verify_interval: 10
+ verify_timeout: 60
+ kubernetes_provisioner:
+ drain_timeout: 3600
+ drain_grace_period: 1800
+ clear_labels_timeout: 1800
+ remove_etcd_timeout: 1800
+ etcd_ready_timeout: 600
+ armada:
+ get_releases_timeout: 300
+ get_status_timeout: 300
+ manifest: 'full-site'
+ post_apply_timeout: 7200
+ validate_design_timeout: 600
+...
diff --git a/type/cntt/network/KubernetesNetwork.yaml b/type/cntt/network/KubernetesNetwork.yaml
new file mode 100644
index 0000000..1124d63
--- /dev/null
+++ b/type/cntt/network/KubernetesNetwork.yaml
@@ -0,0 +1,97 @@
+---
+schema: promenade/KubernetesNetwork/v1
+metadata:
+ schema: metadata/Document/v1
+ name: kubernetes-network
+ layeringDefinition:
+ abstract: false
+ layer: type
+ storagePolicy: cleartext
+ substitutions:
+ # DNS
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .dns.cluster_domain
+ dest:
+ path: .dns.cluster_domain
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .dns.service_ip
+ dest:
+ path: .dns.service_ip
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .dns.upstream_servers
+ dest:
+ path: .dns.upstream_servers
+
+ # Kubernetes IPs
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .kubernetes.api_service_ip
+ dest:
+ path: .kubernetes.service_ip
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .kubernetes.pod_cidr
+ dest:
+ path: .kubernetes.pod_cidr
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .kubernetes.service_cidr
+ dest:
+ path: .kubernetes.service_cidr
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .kubernetes.apiserver_port
+ dest:
+ path: .kubernetes.apiserver_port
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .kubernetes.haproxy_port
+ dest:
+ path: .kubernetes.haproxy_port
+
+ # etcd IPs
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .etcd.container_port
+ dest:
+ path: .etcd.container_port
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .etcd.haproxy_port
+ dest:
+ path: .etcd.haproxy_port
+
+ # proxy
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .proxy.http
+ dest:
+ path: .proxy.url
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .proxy.no_proxy
+ dest:
+ path: .proxy.additional_no_proxy
+
+data:
+ dns:
+ bootstrap_validation_checks:
+ - calico-etcd.kube-system.svc.cluster.local
+ - kubernetes-etcd.kube-system.svc.cluster.local
+ - kubernetes.default.svc.cluster.local
+...
diff --git a/type/cntt/profiles/genesis.yaml b/type/cntt/profiles/genesis.yaml
new file mode 100644
index 0000000..54c5276
--- /dev/null
+++ b/type/cntt/profiles/genesis.yaml
@@ -0,0 +1,49 @@
+---
+# The purpose of this file is to apply proper labels to Genesis node so the
+# proper services are installed and proper configuration applied. This should
+# not need to be changed for a new site.
+# #GLOBAL-CANDIDATE#
+schema: promenade/Genesis/v1
+metadata:
+ schema: metadata/Document/v1
+ name: genesis-site
+ layeringDefinition:
+ abstract: false
+ layer: site
+ parentSelector:
+ name: genesis-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data:
+ labels:
+ dynamic:
+ - beta.kubernetes.io/fluentd-ds-ready=true
+ - calico-etcd=enabled
+ - ceph-mds=enabled
+ - ceph-mon=enabled
+ - ceph-osd=enabled
+ - ceph-rgw=enabled
+ - ceph-mgr=enabled
+ - ceph-bootstrap=enabled
+ - tenant-ceph-control-plane=enabled
+ - tenant-ceph-mon=enabled
+ - tenant-ceph-rgw=enabled
+ - tenant-ceph-mgr=enabled
+ - kube-dns=enabled
+ - kube-ingress=enabled
+ - kubernetes-apiserver=enabled
+ - kubernetes-controller-manager=enabled
+ - kubernetes-etcd=enabled
+ - kubernetes-scheduler=enabled
+ - promenade-genesis=enabled
+ - ucp-control-plane=enabled
+ - maas-rack=enabled
+ - maas-region=enabled
+ - ceph-osd-bootstrap=enabled
+ - openstack-control-plane=enabled
+ - openvswitch=enabled
+ - openstack-l3-agent=enabled
+ - node-exporter=enabled
+...
diff --git a/type/cntt/profiles/hardware/intel-s2600wt.yaml b/type/cntt/profiles/hardware/intel-s2600wt.yaml
new file mode 100644
index 0000000..07836ef
--- /dev/null
+++ b/type/cntt/profiles/hardware/intel-s2600wt.yaml
@@ -0,0 +1,109 @@
+---
+schema: 'drydock/HardwareProfile/v1'
+metadata:
+ schema: 'metadata/Document/v1'
+ name: intel-s2600wt
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ # Vendor of the server chassis
+ vendor: Intel
+ # Generation of the chassis model
+ generation: '4'
+ # Version of the chassis model within its generation - not version of the hardware definition
+ hw_version: '3'
+ # The certified version of the chassis BIOS
+ bios_version: 'SE5C610.86B.01.01.0019.101220160604'
+ # Mode of the default boot of hardware - bios, uefi
+ boot_mode: bios
+ # Protocol of boot of the hardware - pxe, usb, hdd
+ bootstrap_protocol: pxe
+ # Which interface to use for network booting within the OOB manager, not OS device
+ pxe_interface: 0
+
+ # Map hardware addresses to aliases/roles to allow a mix of hardware configs
+ # in a site to result in a consistent configuration
+
+ device_aliases:
+ ## network
+ # $ sudo lspci |grep -i ethernet
+ # 03:00.0 Ethernet controller: Intel Corporation I350 Gigabit Network Connection (rev 01)
+ # 03:00.3 Ethernet controller: Intel Corporation I350 Gigabit Network Connection (rev 01)
+ # 05:00.0 Ethernet controller: Intel Corporation Ethernet Controller X710 for 10GbE SFP+ (rev 01)
+ # 05:00.1 Ethernet controller: Intel Corporation Ethernet Controller X710 for 10GbE SFP+ (rev 01)
+ # 05:00.2 Ethernet controller: Intel Corporation Ethernet Controller X710 for 10GbE SFP+ (rev 01)
+ # 05:00.3 Ethernet controller: Intel Corporation Ethernet Controller X710 for 10GbE SFP+ (rev 01)
+
+ # control networks
+ # eno1
+ ctrl_nic1:
+ address: '0000:03:00.0'
+ dev_type: 'I350 Gigabit Network Connection'
+ bus_type: 'pci'
+ # eno2
+ ctrl_nic2:
+ address: '0000:03:00.3'
+ dev_type: 'I350 Gigabit Network Connection'
+ bus_type: 'pci'
+
+ # data networks
+ # ens785f0
+ data_nic1:
+ address: '0000:05:00.0'
+ dev_type: 'Ethernet Controller X710 for 10GbE SFP+'
+ bus_type: 'pci'
+ # ens785f1
+ data_nic2:
+ address: '0000:05:00.1'
+ dev_type: 'Ethernet Controller X710 for 10GbE SFP+'
+ bus_type: 'pci'
+ # ens785f2
+ data_nic3:
+ address: '0000:05:00.2'
+ dev_type: 'Ethernet Controller X710 for 10GbE SFP+'
+ bus_type: 'pci'
+ # ens785f3
+ data_nic4:
+ address: '0000:05:00.3'
+ dev_type: 'Ethernet Controller X710 for 10GbE SFP+'
+ bus_type: 'pci'
+
+ ## storage
+ # $ sudo lshw -c disk
+ # *-disk
+ # description: ATA Disk
+ # product: INTEL SSDSC2BB48
+ # physical id: 0.0.0
+ # bus info: scsi@4:0.0.0
+ # logical name: /dev/sda
+ # version: 0101
+ # serial: PHDV637602LL480BGN
+ # size: 447GiB (480GB)
+ # capabilities: gpt-1.00 partitioned partitioned:gpt
+ # configuration: ansiversion=5 guid=ea7d0b6a-c105-4409-8d4c-dc104cb38737 logicalsectorsize=512 sectorsize=4096
+ # *-disk
+ # description: ATA Disk
+ # product: ST91000640NS
+ # vendor: Seagate
+ # physical id: 0.0.0
+ # bus info: scsi@5:0.0.0
+ # logical name: /dev/sdb
+ # version: SN03
+ # serial: 9XG6LX48
+ # size: 931GiB (1TB)
+ # capabilities: gpt-1.00 partitioned partitioned:gpt
+ # configuration: ansiversion=5 guid=27f17348-e081-4b00-8d4c-5960513a40cd logicalsectorsize=512 sectorsize=512
+
+ # /dev/sda
+ bootdisk:
+ address: '4:0.0.0'
+ dev_type: 'INTEL SSDSC2BB48'
+ bus_type: 'scsi'
+ # /dev/sdb
+ datadisk:
+ address: '5:0.0.0'
+ dev_type: 'ST91000640NS'
+ bus_type: 'scsi'
+...
diff --git a/type/cntt/profiles/host/cp-intel-s2600wt.yaml b/type/cntt/profiles/host/cp-intel-s2600wt.yaml
new file mode 100644
index 0000000..1eca33e
--- /dev/null
+++ b/type/cntt/profiles/host/cp-intel-s2600wt.yaml
@@ -0,0 +1,96 @@
+---
+# The primary control plane host profile for Airship for DELL R720s, and
+# should not need to be altered if you are using matching HW. The active
+# participants in the Ceph cluster run on this profile. Other control plane
+# services are not affected by primary vs secondary designation.
+schema: drydock/HostProfile/v1
+metadata:
+ schema: metadata/Document/v1
+ name: cp-intel-s2600wt
+ storagePolicy: cleartext
+ layeringDefinition:
+ abstract: false
+ layer: site
+ parentSelector:
+ hosttype: cp-global
+ actions:
+ - method: replace
+ path: .interfaces
+ - method: replace
+ path: .storage
+ - method: merge
+ path: .
+data:
+ hardware_profile: intel-s2600wt
+
+ primary_network: dmz
+ interfaces:
+ dmz:
+ device_link: dmz
+ slaves:
+ - ctrl_nic1
+ networks:
+ - dmz
+ admin:
+ device_link: admin
+ slaves:
+ - ctrl_nic2
+ networks:
+ - admin
+ data1:
+ device_link: data1
+ slaves:
+ - data_nic1
+ networks:
+ - private
+ - management
+ data2:
+ device_link: data2
+ slaves:
+ - data_nic2
+ networks:
+ - storage
+ - public
+
+ storage:
+ physical_devices:
+ bootdisk:
+ labels:
+ bootdrive: 'true'
+ partitions:
+ - name: 'root'
+ size: '30g'
+ bootable: true
+ filesystem:
+ mountpoint: '/'
+ fstype: 'ext4'
+ mount_options: 'defaults'
+ - name: 'boot'
+ size: '1g'
+ filesystem:
+ mountpoint: '/boot'
+ fstype: 'ext4'
+ mount_options: 'defaults'
+ - name: 'var_log'
+ size: '100g'
+ filesystem:
+ mountpoint: '/var/log'
+ fstype: 'ext4'
+ mount_options: 'defaults'
+ - name: 'var'
+ size: '>100g'
+ filesystem:
+ mountpoint: '/var'
+ fstype: 'ext4'
+ mount_options: 'defaults'
+
+ platform:
+ image: 'xenial'
+ kernel: 'hwe-16.04'
+ kernel_params:
+ kernel_package: 'linux-image-4.15.0-46-generic'
+
+ metadata:
+ owner_data:
+ openstack-l3-agent: enabled
+...
diff --git a/type/cntt/profiles/host/dp-intel-s2600wt.yaml b/type/cntt/profiles/host/dp-intel-s2600wt.yaml
new file mode 100644
index 0000000..e05a2c7
--- /dev/null
+++ b/type/cntt/profiles/host/dp-intel-s2600wt.yaml
@@ -0,0 +1,103 @@
+---
+# The data plane host profile for Airship for DELL R720s, and should
+# not need to be altered if you are using matching HW. The host profile is setup
+# for cpu isolation (for nova pinning), hugepages, and sr-iov.
+schema: drydock/HostProfile/v1
+metadata:
+ schema: metadata/Document/v1
+ name: dp-intel-s2600wt
+ storagePolicy: cleartext
+ layeringDefinition:
+ abstract: false
+ layer: site
+ parentSelector:
+ hosttype: dp-global
+ actions:
+ - method: replace
+ path: .interfaces
+ - method: replace
+ path: .storage
+ - method: merge
+ path: .
+data:
+ hardware_profile: intel-s2600wt
+
+ primary_network: dmz
+ interfaces:
+ dmz:
+ device_link: dmz
+ slaves:
+ - ctrl_nic1
+ networks:
+ - dmz
+ admin:
+ device_link: admin
+ slaves:
+ - ctrl_nic2
+ networks:
+ - admin
+ data1:
+ device_link: data1
+ slaves:
+ - data_nic1
+ networks:
+ - private
+ - management
+ data2:
+ device_link: data2
+ slaves:
+ - data_nic2
+ networks:
+ - storage
+ - public
+
+ storage:
+ physical_devices:
+ bootdisk:
+ labels:
+ bootdrive: 'true'
+ partitions:
+ - name: 'root'
+ size: '30g'
+ bootable: true
+ filesystem:
+ mountpoint: '/'
+ fstype: 'ext4'
+ mount_options: 'defaults'
+ - name: 'boot'
+ size: '1g'
+ filesystem:
+ mountpoint: '/boot'
+ fstype: 'ext4'
+ mount_options: 'defaults'
+ - name: 'log'
+ size: '100g'
+ filesystem:
+ mountpoint: '/var/log'
+ fstype: 'ext4'
+ mount_options: 'defaults'
+ # - name: 'cephjournal'
+ # size: '10g'
+ - name: 'var'
+ size: '>100g'
+ filesystem:
+ mountpoint: '/var'
+ fstype: 'ext4'
+ mount_options: 'defaults'
+ # datadisk:
+ # partitions:
+ # - name: 'nova'
+ # size: '450g'
+ # filesystem:
+ # mountpoint: '/var/lib/nova'
+ # fstype: 'ext4'
+ # mount_options: 'defaults'
+ # - name: 'cephosd'
+ # size: '>100g'
+
+ platform:
+ image: 'xenial'
+ kernel: 'hwe-16.04'
+ kernel_params:
+ kernel_package: 'linux-image-4.15.0-46-generic'
+...
diff --git a/type/cntt/software/charts/kubernetes/ingress/ingress.yaml b/type/cntt/software/charts/kubernetes/ingress/ingress.yaml
new file mode 100644
index 0000000..be61953
--- /dev/null
+++ b/type/cntt/software/charts/kubernetes/ingress/ingress.yaml
@@ -0,0 +1,31 @@
+---
+# The purpose of this file is to define the environment-specific public-facing
+# VIP for the ingress controller
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ingress-kube-system
+ layeringDefinition:
+ abstract: false
+ layer: site
+ parentSelector:
+ ingress: kube-system
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+ substitutions:
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .vip.ingress_vip
+ dest:
+ path: .values.network.vip.addr
+data:
+ values:
+ network:
+ ingress:
+ disable-ipv6: "true"
+ vip:
+ manage: true
+...
diff --git a/type/cntt/software/charts/osh-infra/elasticsearch.yaml b/type/cntt/software/charts/osh-infra/elasticsearch.yaml
new file mode 100644
index 0000000..3621e75
--- /dev/null
+++ b/type/cntt/software/charts/osh-infra/elasticsearch.yaml
@@ -0,0 +1,34 @@
+---
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ name: elasticsearch
+ labels:
+ name: elasticsearch-type
+ layeringDefinition:
+ abstract: false
+ layer: type
+ parentSelector:
+ hosttype: elasticsearch-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data:
+ values:
+ pod:
+ replicas:
+ master: 2
+ data: 1
+ client: 2
+ storage:
+ requests:
+ storage: 40Gi
+ conf:
+ elasticsearch:
+ env:
+ java_opts:
+ client: "-Xms2048m -Xmx2048m"
+ data: "-Xms2048m -Xmx2048m"
+ master: "-Xms2048m -Xmx2048m"
+...
diff --git a/type/cntt/software/charts/osh-infra/fluentbit.yaml b/type/cntt/software/charts/osh-infra/fluentbit.yaml
new file mode 100644
index 0000000..1d176cd
--- /dev/null
+++ b/type/cntt/software/charts/osh-infra/fluentbit.yaml
@@ -0,0 +1,22 @@
+---
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ name: fluentbit
+ labels:
+ name: fluentbit-type
+ layeringDefinition:
+ abstract: false
+ layer: type
+ parentSelector:
+ hosttype: fluentbit-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data:
+ values:
+ pod:
+ replicas:
+ fluentd: 1
+...
diff --git a/type/cntt/software/charts/osh-infra/fluentd.yaml b/type/cntt/software/charts/osh-infra/fluentd.yaml
new file mode 100644
index 0000000..906b26d
--- /dev/null
+++ b/type/cntt/software/charts/osh-infra/fluentd.yaml
@@ -0,0 +1,22 @@
+---
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ name: fluentd
+ labels:
+ name: fluentd-type
+ layeringDefinition:
+ abstract: false
+ layer: type
+ parentSelector:
+ hosttype: fluentd-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data:
+ values:
+ pod:
+ replicas:
+ fluentd: 1
+...
diff --git a/type/cntt/software/charts/osh-infra/grafana.yaml b/type/cntt/software/charts/osh-infra/grafana.yaml
new file mode 100644
index 0000000..d12f7d2
--- /dev/null
+++ b/type/cntt/software/charts/osh-infra/grafana.yaml
@@ -0,0 +1,23 @@
+---
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ replacement: true
+ name: grafana
+ labels:
+ name: grafana-type
+ layeringDefinition:
+ abstract: false
+ layer: type
+ parentSelector:
+ name: grafana-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data:
+ values:
+ pod:
+ replicas:
+ grafana: 1
+...
diff --git a/type/cntt/software/charts/osh-infra/ingress.yaml b/type/cntt/software/charts/osh-infra/ingress.yaml
new file mode 100644
index 0000000..96753c9
--- /dev/null
+++ b/type/cntt/software/charts/osh-infra/ingress.yaml
@@ -0,0 +1,24 @@
+---
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ replacement: true
+ name: osh-infra-ingress-controller
+ labels:
+ name: osh-infra-ingress-controller-type
+ layeringDefinition:
+ abstract: false
+ layer: type
+ parentSelector:
+ name: osh-infra-ingress-controller-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data:
+ values:
+ pod:
+ replicas:
+ ingress: 1
+ error_page: 1
+...
diff --git a/type/cntt/software/charts/osh-infra/mariadb.yaml b/type/cntt/software/charts/osh-infra/mariadb.yaml
new file mode 100644
index 0000000..ddb4424
--- /dev/null
+++ b/type/cntt/software/charts/osh-infra/mariadb.yaml
@@ -0,0 +1,24 @@
+---
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ replacement: true
+ name: osh-infra-mariadb
+ labels:
+ name: osh-infra-mariadb-type
+ layeringDefinition:
+ abstract: false
+ layer: type
+ parentSelector:
+ name: osh-infra-mariadb-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data:
+ values:
+ pod:
+ replicas:
+ server: 1
+ ingress: 1
+...
diff --git a/type/cntt/software/charts/osh-infra/prometheus.yaml b/type/cntt/software/charts/osh-infra/prometheus.yaml
new file mode 100644
index 0000000..4b02c04
--- /dev/null
+++ b/type/cntt/software/charts/osh-infra/prometheus.yaml
@@ -0,0 +1,35 @@
+---
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ replacement: true
+ name: prometheus
+ labels:
+ name: prometheus-type
+ layeringDefinition:
+ abstract: false
+ layer: type
+ parentSelector:
+ name: prometheus-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data:
+ values:
+ pod:
+ replicas:
+ prometheus: 1
+ resources:
+ enabled: true
+ prometheus:
+ limits:
+ memory: "4Gi"
+ cpu: "2000m"
+ requests:
+ memory: "2Gi"
+ cpu: "1000m"
+ storage:
+ requests:
+ storage: 50Gi
+...
diff --git a/type/cntt/software/charts/osh/openstack-compute-kit/neutron.yaml b/type/cntt/software/charts/osh/openstack-compute-kit/neutron.yaml
new file mode 100644
index 0000000..8d47efd
--- /dev/null
+++ b/type/cntt/software/charts/osh/openstack-compute-kit/neutron.yaml
@@ -0,0 +1,28 @@
+---
+# This file defines hardware-specific settings for neutron. If you use the same
+# hardware profile as this environment, you should not need to change this file.
+# Otherwise, you should review the settings here and adjust for your hardware.
+# In particular:
+# 1. logical network interface names
+# 2. physical device mappigns
+# TODO: Should move to global layer and become tied to the hardware profile
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ replacement: true
+ name: neutron
+ layeringDefinition:
+ abstract: false
+ layer: site
+ parentSelector:
+ name: neutron-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data:
+ wait:
+ timeout: 1800
+ test:
+ timeout: 900
+...
diff --git a/type/cntt/software/charts/osh/openstack-compute-kit/nova.yaml b/type/cntt/software/charts/osh/openstack-compute-kit/nova.yaml
new file mode 100644
index 0000000..32f94b8
--- /dev/null
+++ b/type/cntt/software/charts/osh/openstack-compute-kit/nova.yaml
@@ -0,0 +1,25 @@
+---
+# This file defines hardware-specific settings for nova. If you use the same
+# hardware profile as this environment, you should not need to change this file.
+# Otherwise, you should review the settings here and adjust for your hardware.
+# In particular:
+# 1. vcpu_pin_set will change if the number of logical CPUs on the hardware
+# changes.
+# 2. pci alias / passthrough_whitelist could change if the NIC type or NIC
+# slotting changes.
+# TODO: Should move to global layer and become tied to the hardware profile
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ name: nova
+ layeringDefinition:
+ abstract: false
+ layer: site
+ parentSelector:
+ name: nova-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data: {}
+...
diff --git a/type/cntt/software/charts/osh/openstack-heat/heat.yaml b/type/cntt/software/charts/osh/openstack-heat/heat.yaml
new file mode 100644
index 0000000..de5bd51
--- /dev/null
+++ b/type/cntt/software/charts/osh/openstack-heat/heat.yaml
@@ -0,0 +1,21 @@
+---
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ replacement: true
+ name: heat
+ labels:
+ name: heat-type
+ layeringDefinition:
+ abstract: false
+ layer: type
+ parentSelector:
+ name: heat-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data:
+ test:
+ timeout: 600
+...
diff --git a/type/cntt/software/charts/osh/openstack-tenant-ceph/ceph-client.yaml b/type/cntt/software/charts/osh/openstack-tenant-ceph/ceph-client.yaml
new file mode 100644
index 0000000..3f5bfba
--- /dev/null
+++ b/type/cntt/software/charts/osh/openstack-tenant-ceph/ceph-client.yaml
@@ -0,0 +1,23 @@
+---
+# The purpose of this file is to define envrionment-specific parameters for the
+# ceph client
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ name: tenant-ceph-client
+ layeringDefinition:
+ abstract: false
+ layer: site
+ parentSelector:
+ name: tenant-ceph-client-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data:
+ values:
+ conf:
+ pool:
+ target:
+ osd: 3
+...
diff --git a/type/cntt/software/charts/osh/openstack-tenant-ceph/ceph-osd.yaml b/type/cntt/software/charts/osh/openstack-tenant-ceph/ceph-osd.yaml
new file mode 100644
index 0000000..8937fdc
--- /dev/null
+++ b/type/cntt/software/charts/osh/openstack-tenant-ceph/ceph-osd.yaml
@@ -0,0 +1,34 @@
+---
+# The purpose of this file is to define environment-specific parameters for
+# ceph-osd
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ name: tenant-ceph-osd
+ layeringDefinition:
+ abstract: false
+ layer: site
+ parentSelector:
+ name: tenant-ceph-osd-global
+ actions:
+ - method: replace
+ path: .values.conf.storage.osd
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data:
+ values:
+ labels:
+ osd:
+ node_selector_key: tenant-ceph-osd
+ node_selector_value: enabled
+ conf:
+ storage:
+ osd:
+ - data:
+ type: block-logical
+ location: /dev/sdb
+ journal:
+ type: directory
+ location: /var/lib/openstack-helm/tenant-ceph/osd/osd-sdb
+...
diff --git a/type/cntt/software/charts/ucp/comps/chart-group.yaml b/type/cntt/software/charts/ucp/comps/chart-group.yaml
new file mode 100644
index 0000000..02236b5
--- /dev/null
+++ b/type/cntt/software/charts/ucp/comps/chart-group.yaml
@@ -0,0 +1,14 @@
+---
+schema: armada/ChartGroup/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp-drydock-scaled
+ layeringDefinition:
+ abstract: false
+ layer: type
+ storagePolicy: cleartext
+data:
+ description: Drydock
+ chart_group:
+ - ucp-maas-scaled
+ - ucp-drydock
diff --git a/type/cntt/software/charts/ucp/comps/drydock.yaml b/type/cntt/software/charts/ucp/comps/drydock.yaml
new file mode 100644
index 0000000..1343340
--- /dev/null
+++ b/type/cntt/software/charts/ucp/comps/drydock.yaml
@@ -0,0 +1,25 @@
+---
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ replacement: true
+ name: ucp-drydock
+ labels:
+ name: ucp-drydock-type
+ layeringDefinition:
+ abstract: false
+ layer: type
+ parentSelector:
+ name: ucp-drydock-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data:
+ values:
+ network:
+ api:
+ ingress:
+ classes:
+ cluster: maas-ingress
+...
diff --git a/type/cntt/software/charts/ucp/comps/maas-scaled.yaml b/type/cntt/software/charts/ucp/comps/maas-scaled.yaml
new file mode 100644
index 0000000..531a9f3
--- /dev/null
+++ b/type/cntt/software/charts/ucp/comps/maas-scaled.yaml
@@ -0,0 +1,32 @@
+---
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp-maas-scaled
+ layeringDefinition:
+ abstract: false
+ layer: type
+ parentSelector:
+ name: ucp-maas-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+ substitutions:
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .vip.maas_vip
+ dest:
+ path: .values.network.maas_ingress.addr
+data:
+ values:
+ network:
+ region_api:
+ node_port:
+ enabled: true
+ pod:
+ replicas:
+ region: 2
+ rack: 2
+...
diff --git a/type/cntt/software/charts/ucp/comps/maas.yaml b/type/cntt/software/charts/ucp/comps/maas.yaml
new file mode 100644
index 0000000..d22cf55
--- /dev/null
+++ b/type/cntt/software/charts/ucp/comps/maas.yaml
@@ -0,0 +1,29 @@
+---
+# This file defines site-specific deviations for MaaS.
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp-maas
+ layeringDefinition:
+ abstract: false
+ layer: type
+ parentSelector:
+ name: ucp-maas-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+ substitutions:
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .vip.maas_vip
+ dest:
+ path: .values.network.maas_ingress.addr
+data:
+ values:
+ network:
+ region_api:
+ node_port:
+ enabled: true
+...
diff --git a/type/cntt/software/charts/ucp/promenade/promenade.yaml b/type/cntt/software/charts/ucp/promenade/promenade.yaml
new file mode 100644
index 0000000..e245bd9
--- /dev/null
+++ b/type/cntt/software/charts/ucp/promenade/promenade.yaml
@@ -0,0 +1,50 @@
+---
+# The purpose of this file is to provide site-specific parameters for the ucp-
+# promenade chart.
+schema: armada/Chart/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp-promenade
+ layeringDefinition:
+ abstract: false
+ layer: site
+ parentSelector:
+ name: ucp-promenade-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data:
+ values:
+ pod:
+ env:
+ promenade_api: []
+ # NEWSITE-CHANGEME: If your site uses an http proxy, enter it here.
+ # Otherwise comment out these lines.
+ # - name: http_proxy
+ # value: 'http://proxy.example.com:8080'
+ # NEWSITE-CHANGEME: If your site uses an https proxy, enter it here.
+ # Otherwise comment out these lines.
+ # - name: https_proxy
+ # value: 'http://proxy.example.com:8080'
+ # NEWSITE-CHANGEME: If your site uses an http/https proxy, enter the
+ # IPs / domain names which the proxy should not be used for (i.e. the
+ # cluster domain and kubernetes service_cidr defined in common-addresses)
+ # Otherwise comment out these lines.
+ # - name: no_proxy
+ # value: '10.96.0.1,.cluster.local'
+ # NEWSITE-CHANGEME: If your site uses an http proxy, enter it here.
+ # Otherwise comment out these lines.
+ # - name: HTTP_PROXY
+ # value: 'http://proxy.example.com:8080'
+ # NEWSITE-CHANGEME: If your site uses an https proxy, enter it here.
+ # Otherwise comment out these lines.
+ # - name: HTTPS_PROXY
+ # value: 'http://proxy.example.com:8080'
+ # NEWSITE-CHANGEME: If your site uses an http/https proxy, enter the
+ # IPs / domain names which the proxy should not be used for (i.e. the
+ # cluster domain and kubernetes service_cidr defined in common-addresses)
+ # Otherwise comment out these lines.
+ # - name: NO_PROXY
+ # value: '10.96.0.1,.cluster.local'
+...
diff --git a/type/cntt/software/config/endpoints.yaml b/type/cntt/software/config/endpoints.yaml
new file mode 100644
index 0000000..12bc7da
--- /dev/null
+++ b/type/cntt/software/config/endpoints.yaml
@@ -0,0 +1,1088 @@
+---
+# The purpose of this file is to define the site's endpoint catalog. This should
+# not need to be modified for a new site.
+# #GLOBAL-CANDIDATE#
+schema: pegleg/EndpointCatalogue/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_endpoints
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+ substitutions:
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .dns.ingress_domain
+ dest:
+ - path: .ucp.identity.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .ucp.identity.host_fqdn_override.admin.host
+ pattern: DOMAIN
+ - path: .ucp.shipyard.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .ucp.physicalprovisioner.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .ucp.maas_region.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .ceph.object_store.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .ceph.ceph_object_store.host_fqdn_override.public.host
+ pattern: DOMAIN
+data:
+ ucp:
+ identity:
+ namespace: ucp
+ name: keystone
+ hosts:
+ default: keystone
+ internal: keystone-api
+ host_fqdn_override:
+ default: null
+ public:
+ host: iam-airship.DOMAIN
+ admin:
+ host: iam-airship.DOMAIN
+ path:
+ default: /v3
+ scheme:
+ default: "http"
+ internal: "http"
+ port:
+ api:
+ default: 80
+ internal: 5000
+ armada:
+ name: armada
+ hosts:
+ default: armada-api
+ public: armada
+ port:
+ api:
+ default: 8000
+ path:
+ default: /api/v1.0
+ scheme:
+ default: "http"
+ host_fqdn_override:
+ default: null
+ deckhand:
+ name: deckhand
+ hosts:
+ default: deckhand-int
+ public: deckhand-api
+ port:
+ api:
+ default: 9000
+ path:
+ default: /api/v1.0
+ scheme:
+ default: "http"
+ host_fqdn_override:
+ default: null
+ postgresql:
+ name: postgresql
+ hosts:
+ default: postgresql
+ path: /DB_NAME
+ scheme: postgresql+psycopg2
+ port:
+ postgresql:
+ default: 5432
+ host_fqdn_override:
+ default: null
+ postgresql_airflow_celery:
+ name: postgresql_airflow_celery_db
+ hosts:
+ default: postgresql
+ path: /DB_NAME
+ scheme: db+postgresql
+ port:
+ postgresql:
+ default: 5432
+ host_fqdn_override:
+ default: null
+ oslo_db:
+ hosts:
+ default: mariadb
+ discovery: mariadb-discovery
+ host_fqdn_override:
+ default: null
+ path: /DB_NAME
+ scheme: mysql+pymysql
+ port:
+ mysql:
+ default: 3306
+ wsrep:
+ default: 4567
+ key_manager:
+ name: barbican
+ hosts:
+ default: barbican-api
+ public: barbican
+ host_fqdn_override:
+ default: null
+ path:
+ default: /v1
+ scheme:
+ default: "http"
+ port:
+ api:
+ default: 9311
+ public: 80
+ airflow_oslo_messaging:
+ namespace: null
+ hosts:
+ default: rabbitmq
+ host_fqdn_override:
+ default: null
+ path: /airflow
+ scheme: amqp
+ port:
+ amqp:
+ default: 5672
+ http:
+ default: 15672
+ oslo_messaging:
+ namespace: null
+ statefulset:
+ name: airship-ucp-rabbitmq-rabbitmq
+ hosts:
+ default: rabbitmq
+ host_fqdn_override:
+ default: null
+ path: /keystone
+ scheme: rabbit
+ port:
+ amqp:
+ default: 5672
+ oslo_cache:
+ hosts:
+ default: memcached
+ host_fqdn_override:
+ default: null
+ port:
+ memcache:
+ default: 11211
+ physicalprovisioner:
+ name: drydock
+ hosts:
+ default: drydock-api
+ port:
+ api:
+ default: 9000
+ nodeport: 31900
+ public: 80
+ path:
+ default: /api/v1.0
+ scheme:
+ default: "http"
+ public: "http"
+ host_fqdn_override:
+ default: null
+ public:
+ host: drydock-airship.DOMAIN
+ maas_region:
+ name: maas-region
+ hosts:
+ default: maas-region
+ public: maas
+ path:
+ default: /MAAS
+ scheme:
+ default: "http"
+ port:
+ region_api:
+ default: 80
+ nodeport: 31900
+ podport: 80
+ public: 80
+ region_proxy:
+ default: 8000
+ host_fqdn_override:
+ default: null
+ public:
+ host: maas-airship.DOMAIN
+ maas_ingress:
+ hosts:
+ default: maas-ingress
+ error_pages: maas-ingress-error
+ host_fqdn_override:
+ public: null
+ port:
+ http:
+ default: 80
+ https:
+ default: 443
+ ingress_default_server:
+ default: 8383
+ error_pages:
+ default: 8080
+ podport: 8080
+ healthz:
+ podport: 10259
+ status:
+ podport: 18089
+ kubernetesprovisioner:
+ name: promenade
+ hosts:
+ default: promenade-api
+ port:
+ api:
+ default: 80
+ path:
+ default: /api/v1.0
+ scheme:
+ default: "http"
+ host_fqdn_override:
+ default: null
+ shipyard:
+ name: shipyard
+ hosts:
+ default: shipyard-int
+ public: shipyard-api
+ port:
+ api:
+ default: 9000
+ public: 80
+ path:
+ default: /api/v1.0
+ scheme:
+ default: "http"
+ public: "http"
+ host_fqdn_override:
+ default: null
+ public:
+ host: shipyard-airship.DOMAIN
+ prometheus_openstack_exporter:
+ namespace: ucp
+ hosts:
+ default: openstack-metrics
+ host_fqdn_override:
+ default: null
+ path:
+ default: null
+ scheme:
+ default: "http"
+ port:
+ exporter:
+ default: 9103
+ ceph:
+ object_store:
+ name: swift
+ namespace: ceph
+ hosts:
+ default: ceph-rgw
+ public: radosgw
+ host_fqdn_override:
+ default: null
+ public:
+ host: object-store-airship.DOMAIN
+ path:
+ default: /swift/v1
+ scheme:
+ default: "http"
+ public: "http"
+ port:
+ api:
+ default: 8088
+ public: 80
+ ceph_object_store:
+ name: radosgw
+ namespace: ceph
+ hosts:
+ default: ceph-rgw
+ public: radosgw
+ host_fqdn_override:
+ default: null
+ public:
+ host: object-store-airship.DOMAIN
+ path:
+ default: /auth/v1.0
+ scheme:
+ default: "http"
+ public: "http"
+ port:
+ api:
+ default: 8088
+ public: 80
+ ceph_mon:
+ namespace: ceph
+ hosts:
+ default: ceph-mon
+ discovery: ceph-mon-discovery
+ host_fqdn_override:
+ default: null
+ port:
+ mon:
+ default: 6789
+ ceph_mgr:
+ namespace: ceph
+ hosts:
+ default: ceph-mgr
+ host_fqdn_override:
+ default: null
+ port:
+ mgr:
+ default: 7000
+ scheme:
+ default: "http"
+ tenant_ceph_mon:
+ namespace: tenant-ceph
+ hosts:
+ default: ceph-mon
+ discovery: ceph-mon-discovery
+ host_fqdn_override:
+ default: null
+ port:
+ mon:
+ default: 6790
+ tenant_ceph_mgr:
+ namespace: tenant-ceph
+ hosts:
+ default: ceph-mgr
+ host_fqdn_override:
+ default: null
+ port:
+ mgr:
+ default: 7001
+ metrics:
+ default: 9284
+ scheme:
+ default: http
+...
+---
+schema: pegleg/EndpointCatalogue/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_endpoints
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+ substitutions:
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .dns.ingress_domain
+ dest:
+ - path: .osh.object_store.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .osh.ceph_object_store.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .osh.image.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .osh.cloudformation.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .osh.orchestration.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .osh.compute.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .osh.compute_novnc_proxy.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .osh.placement.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .osh.network.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .osh.identity.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .osh.identity.host_fqdn_override.admin.host
+ pattern: DOMAIN
+ - path: .osh.dashboard.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .osh.volume.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .osh.volumev2.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .osh.volumev3.host_fqdn_override.public.host
+ pattern: DOMAIN
+data:
+ osh:
+ object_store:
+ name: swift
+ namespace: openstack
+ hosts:
+ default: ceph-rgw
+ public: radosgw
+ host_fqdn_override:
+ default: null
+ public:
+ host: object-store-airship.DOMAIN
+ path:
+ default: /swift/v1/KEY_$(tenant_id)s
+ scheme:
+ default: "http"
+ public: "http"
+ port:
+ api:
+ default: 8088
+ public: 80
+ ceph_object_store:
+ name: radosgw
+ namespace: openstack
+ hosts:
+ default: ceph-rgw
+ public: radosgw
+ host_fqdn_override:
+ default: null
+ public:
+ host: object-store-airship.DOMAIN
+ path:
+ default: /auth/v1.0
+ scheme:
+ default: "http"
+ public: "http"
+ port:
+ api:
+ default: 8088
+ public: 80
+ oslo_db:
+ hosts:
+ default: mariadb
+ discovery: mariadb-discovery
+ host_fqdn_override:
+ default: null
+ path: /DB_NAME
+ scheme: mysql+pymysql
+ port:
+ mysql:
+ default: 3306
+ wsrep:
+ default: 4567
+ prometheus_mysql_exporter:
+ namespace: openstack
+ hosts:
+ default: mysql-exporter
+ host_fqdn_override:
+ default: null
+ path:
+ default: /metrics
+ scheme:
+ default: 'http'
+ port:
+ metrics:
+ default: 9104
+ oslo_messaging:
+ statefulset:
+ name: airship-openstack-rabbitmq-rabbitmq
+ namespace: openstack
+ hosts:
+ default: openstack-rabbitmq
+ host_fqdn_override:
+ default: null
+ path: /VHOST_NAME
+ scheme: rabbit
+ port:
+ amqp:
+ default: 5672
+ http:
+ default: 15672
+ openstack_rabbitmq_exporter:
+ namespace: openstack
+ hosts:
+ default: openstack-rabbitmq-exporter
+ host_fqdn_override:
+ default: null
+ path:
+ default: /metrics
+ scheme:
+ default: "http"
+ port:
+ metrics:
+ default: 9095
+ oslo_cache:
+ namespace: openstack
+ hosts:
+ default: memcached
+ host_fqdn_override:
+ default: null
+ port:
+ memcache:
+ default: 11211
+ identity:
+ namespace: openstack
+ name: keystone
+ hosts:
+ default: keystone
+ internal: keystone-api
+ host_fqdn_override:
+ default: null
+ public:
+ host: identity-airship.DOMAIN
+ admin:
+ host: identity-airship.DOMAIN
+ path:
+ default: /v3
+ scheme:
+ default: "http"
+ internal: "http"
+ port:
+ api:
+ default: 80
+ internal: 5000
+ image:
+ name: glance
+ hosts:
+ default: glance-api
+ public: glance
+ host_fqdn_override:
+ default: null
+ public:
+ host: image-airship.DOMAIN
+ path:
+ default: null
+ scheme:
+ default: "http"
+ public: "http"
+ port:
+ api:
+ default: 9292
+ public: 80
+ image_registry:
+ name: glance-registry
+ hosts:
+ default: glance-registry
+ public: glance-reg
+ host_fqdn_override:
+ default: null
+ path:
+ default: null
+ scheme:
+ default: "http"
+ port:
+ api:
+ default: 9191
+ public: 80
+ volume:
+ name: cinder
+ hosts:
+ default: cinder-api
+ public: cinder
+ host_fqdn_override:
+ default: null
+ public:
+ host: volume-airship.DOMAIN
+ path:
+ default: "/v1/%(tenant_id)s"
+ scheme:
+ default: "http"
+ public: "http"
+ port:
+ api:
+ default: 8776
+ public: 80
+ volumev2:
+ name: cinderv2
+ hosts:
+ default: cinder-api
+ public: cinder
+ host_fqdn_override:
+ default: null
+ public:
+ host: volume-airship.DOMAIN
+ path:
+ default: "/v2/%(tenant_id)s"
+ scheme:
+ default: "http"
+ public: "http"
+ port:
+ api:
+ default: 8776
+ public: 80
+ volumev3:
+ name: cinderv3
+ hosts:
+ default: cinder-api
+ public: cinder
+ host_fqdn_override:
+ default: null
+ public:
+ host: volume-airship.DOMAIN
+ path:
+ default: "/v3/%(tenant_id)s"
+ scheme:
+ default: "http"
+ public: "http"
+ port:
+ api:
+ default: 8776
+ public: 80
+ orchestration:
+ name: heat
+ hosts:
+ default: heat-api
+ public: heat
+ host_fqdn_override:
+ default: null
+ public:
+ host: orchestration-airship.DOMAIN
+ path:
+ default: "/v1/%(project_id)s"
+ scheme:
+ default: "http"
+ public: "http"
+ port:
+ api:
+ default: 8004
+ public: 80
+ cloudformation:
+ name: heat-cfn
+ hosts:
+ default: heat-cfn
+ public: cloudformation
+ host_fqdn_override:
+ default: null
+ public:
+ host: cloudformation-airship.DOMAIN
+ path:
+ default: /v1
+ scheme:
+ default: "http"
+ public: "http"
+ port:
+ api:
+ default: 8000
+ public: 80
+ cloudwatch:
+ name: heat-cloudwatch
+ hosts:
+ default: heat-cloudwatch
+ public: cloudwatch
+ host_fqdn_override:
+ default: null
+ path:
+ default: null
+ type: null
+ scheme:
+ default: "http"
+ port:
+ api:
+ default: 8003
+ public: 80
+ network:
+ name: neutron
+ hosts:
+ default: neutron-server
+ public: neutron
+ host_fqdn_override:
+ default: null
+ public:
+ host: network-airship.DOMAIN
+ path:
+ default: null
+ scheme:
+ default: "http"
+ public: "http"
+ port:
+ api:
+ default: 9696
+ public: 80
+ compute:
+ name: nova
+ hosts:
+ default: nova-api
+ public: nova
+ host_fqdn_override:
+ default: null
+ public:
+ host: compute-airship.DOMAIN
+ path:
+ default: "/v2/%(tenant_id)s"
+ scheme:
+ default: "http"
+ public: "http"
+ port:
+ api:
+ default: 8774
+ public: 80
+ novncproxy:
+ default: 80
+ compute_metadata:
+ name: nova
+ hosts:
+ default: nova-metadata
+ public: metadata
+ host_fqdn_override:
+ default: null
+ path:
+ default: /
+ scheme:
+ default: "http"
+ port:
+ metadata:
+ default: 8775
+ public: 80
+ compute_novnc_proxy:
+ name: nova
+ hosts:
+ default: nova-novncproxy
+ public: novncproxy
+ host_fqdn_override:
+ default: null
+ public:
+ host: nova-novncproxy-airship.DOMAIN
+ path:
+ default: /vnc_auto.html
+ scheme:
+ default: "http"
+ public: "http"
+ port:
+ novnc_proxy:
+ default: 6080
+ public: 80
+ compute_spice_proxy:
+ name: nova
+ hosts:
+ default: nova-spiceproxy
+ host_fqdn_override:
+ default: null
+ path:
+ default: /spice_auto.html
+ scheme:
+ default: "http"
+ port:
+ spice_proxy:
+ default: 6082
+ placement:
+ name: placement
+ hosts:
+ default: placement-api
+ public: placement
+ host_fqdn_override:
+ default: null
+ public:
+ host: placement-airship.DOMAIN
+ path:
+ default: /
+ scheme:
+ default: "http"
+ public: "http"
+ port:
+ api:
+ default: 8778
+ public: 80
+ dashboard:
+ name: horizon
+ hosts:
+ default: horizon-int
+ public: horizon
+ host_fqdn_override:
+ default: null
+ public:
+ host: dashboard-airship.DOMAIN
+ path:
+ default: null
+ scheme:
+ default: "http"
+ public: "http"
+ port:
+ web:
+ default: 80
+ public: 80
+...
+---
+schema: pegleg/EndpointCatalogue/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_infra_endpoints
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+ substitutions:
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .dns.ingress_domain
+ dest:
+ - path: .osh_infra.kibana.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .osh_infra.grafana.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - path: .osh_infra.nagios.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .ldap.base_url
+ dest:
+ path: .osh_infra.ldap.host_fqdn_override.public.host
+ pattern: DOMAIN
+ - src:
+ schema: pegleg/CommonAddresses/v1
+ name: common-addresses
+ path: .ldap.auth_path
+ dest:
+ path: .osh_infra.ldap.path.default
+ pattern: AUTH_PATH
+data:
+ osh_infra:
+ ceph_object_store:
+ name: radosgw
+ namespace: osh-infra
+ hosts:
+ default: ceph-rgw
+ public: radosgw
+ host_fqdn_override:
+ default: null
+ path:
+ default: null
+ scheme:
+ default: "http"
+ port:
+ api:
+ default: 8088
+ public: 80
+ elasticsearch:
+ name: elasticsearch
+ namespace: osh-infra
+ hosts:
+ data: elasticsearch-data
+ default: elasticsearch-logging
+ discovery: elasticsearch-discovery
+ public: elasticsearch
+ host_fqdn_override:
+ default: null
+ path:
+ default: null
+ scheme:
+ default: "http"
+ prometheus_elasticsearch_exporter:
+ namespace: null
+ hosts:
+ default: elasticsearch-exporter
+ host_fqdn_override:
+ default: null
+ path:
+ default: /metrics
+ scheme:
+ default: "http"
+ port:
+ metrics:
+ default: 9108
+ fluentd:
+ namespace: osh-infra
+ name: fluentd
+ hosts:
+ default: fluentd-logging
+ host_fqdn_override:
+ default: null
+ path:
+ default: null
+ scheme:
+ default: "http"
+ port:
+ service:
+ default: 24224
+ metrics:
+ default: 24220
+ prometheus_fluentd_exporter:
+ namespace: osh-infra
+ hosts:
+ default: fluentd-exporter
+ host_fqdn_override:
+ default: null
+ path:
+ default: /metrics
+ scheme:
+ default: "http"
+ port:
+ metrics:
+ default: 9309
+ oslo_db:
+ namespace: osh-infra
+ hosts:
+ default: mariadb
+ host_fqdn_override:
+ default: null
+ path: /DB_NAME
+ scheme: mysql+pymysql
+ port:
+ mysql:
+ default: 3306
+ prometheus_mysql_exporter:
+ namespace: osh-infra
+ hosts:
+ default: mysql-exporter
+ host_fqdn_override:
+ default: null
+ path:
+ default: /metrics
+ scheme:
+ default: 'http'
+ port:
+ metrics:
+ default: 9104
+ grafana:
+ name: grafana
+ namespace: osh-infra
+ hosts:
+ default: grafana-dashboard
+ public: grafana
+ host_fqdn_override:
+ default: null
+ public:
+ host: grafana-airship.DOMAIN
+ path:
+ default: null
+ scheme:
+ default: "http"
+ public: "http"
+ port:
+ grafana:
+ default: 3000
+ public: 80
+ monitoring:
+ name: prometheus
+ namespace: osh-infra
+ hosts:
+ default: prom-metrics
+ public: prometheus
+ host_fqdn_override:
+ default: null
+ path:
+ default: null
+ scheme:
+ default: "http"
+ port:
+ api:
+ default: 9090
+ http:
+ default: 80
+ kibana:
+ name: kibana
+ namespace: osh-infra
+ hosts:
+ default: kibana-dash
+ public: kibana
+ host_fqdn_override:
+ default: null
+ public:
+ host: kibana-airship.DOMAIN
+ path:
+ default: null
+ scheme:
+ default: "http"
+ public: "http"
+ port:
+ kibana:
+ default: 5601
+ public: 80
+ alerts:
+ name: alertmanager
+ namespace: osh-infra
+ hosts:
+ default: alerts-engine
+ public: alertmanager
+ discovery: alertmanager-discovery
+ host_fqdn_override:
+ default: null
+ path:
+ default: null
+ scheme:
+ default: "http"
+ port:
+ api:
+ default: 9093
+ public: 80
+ mesh:
+ default: 6783
+ kube_state_metrics:
+ namespace: kube-system
+ hosts:
+ default: kube-state-metrics
+ host_fqdn_override:
+ default: null
+ path:
+ default: null
+ scheme:
+ default: "http"
+ port:
+ http:
+ default: 8080
+ kube_scheduler:
+ scheme:
+ default: "http"
+ path:
+ default: /metrics
+ kube_controller_manager:
+ scheme:
+ default: "http"
+ path:
+ default: /metrics
+ node_metrics:
+ namespace: kube-system
+ hosts:
+ default: node-exporter
+ host_fqdn_override:
+ default: null
+ path:
+ default: null
+ scheme:
+ default: "http"
+ port:
+ metrics:
+ default: 9100
+ prometheus_port:
+ default: 9100
+ process_exporter_metrics:
+ namespace: kube-system
+ hosts:
+ default: process-exporter
+ host_fqdn_override:
+ default: null
+ path:
+ default: null
+ scheme:
+ default: "http"
+ port:
+ metrics:
+ default: 9256
+ prometheus_openstack_exporter:
+ namespace: openstack
+ hosts:
+ default: openstack-metrics
+ host_fqdn_override:
+ default: null
+ path:
+ default: null
+ scheme:
+ default: "http"
+ port:
+ exporter:
+ default: 9103
+ nagios:
+ name: nagios
+ namespace: osh-infra
+ hosts:
+ default: nagios-metrics
+ public: nagios
+ host_fqdn_override:
+ default: null
+ public:
+ host: nagios-airship.DOMAIN
+ path:
+ default: null
+ scheme:
+ default: "http"
+ public: "http"
+ port:
+ http:
+ default: 80
+ public: 80
+ ldap:
+ hosts:
+ default: ldap
+ host_fqdn_override:
+ default: null
+ public:
+ host: DOMAIN
+ path:
+ default: /AUTH_PATH
+ scheme:
+ default: "ldap"
+ port:
+ ldap:
+ default: 389
+...
diff --git a/type/cntt/software/config/service_accounts.yaml b/type/cntt/software/config/service_accounts.yaml
new file mode 100644
index 0000000..751f1b1
--- /dev/null
+++ b/type/cntt/software/config/service_accounts.yaml
@@ -0,0 +1,435 @@
+---
+# The purpose of this file is to define the account catalog for the site. This
+# mostly contains service usernames, but also contain some information which
+# should be changed like the region (site) name.
+schema: pegleg/AccountCatalogue/v1
+metadata:
+ schema: metadata/Document/v1
+ name: ucp_service_accounts
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+data:
+ ucp:
+ postgres:
+ admin:
+ username: postgres
+ replica:
+ username: standby
+ exporter:
+ username: psql_exporter
+ oslo_db:
+ admin:
+ username: root
+ oslo_messaging:
+ admin:
+ username: rabbitmq
+ keystone:
+ admin:
+ # NEWSITE-CHANGEME: Replace with the site name
+ region_name: RegionOne
+ username: admin
+ project_name: admin
+ user_domain_name: default
+ project_domain_name: default
+ oslo_messaging:
+ admin:
+ username: rabbitmq
+ keystone:
+ username: keystone
+ oslo_db:
+ username: keystone
+ database: keystone
+ promenade:
+ keystone:
+ # NEWSITE-CHANGEME: Replace with the site name
+ region_name: RegionOne
+ role: admin
+ project_name: service
+ project_domain_name: default
+ user_domain_name: default
+ username: promenade
+ drydock:
+ keystone:
+ # NEWSITE-CHANGEME: Replace with the site name
+ region_name: RegionOne
+ role: admin
+ project_name: service
+ project_domain_name: default
+ user_domain_name: default
+ username: drydock
+ postgres:
+ username: drydock
+ database: drydock
+ shipyard:
+ keystone:
+ # NEWSITE-CHANGEME: Replace with the site name
+ region_name: RegionOne
+ role: admin
+ project_name: service
+ project_domain_name: default
+ user_domain_name: default
+ username: shipyard
+ postgres:
+ username: shipyard
+ database: shipyard
+ airflow:
+ postgres:
+ username: airflow
+ database: airflow
+ oslo_messaging:
+ admin:
+ username: rabbitmq
+ user:
+ username: airflow
+ maas:
+ admin:
+ username: admin
+ email: none@none
+ postgres:
+ username: maas
+ database: maasdb
+ barbican:
+ keystone:
+ # NEWSITE-CHANGEME: Replace with the site name
+ region_name: RegionOne
+ role: admin
+ project_name: service
+ project_domain_name: default
+ user_domain_name: default
+ username: barbican
+ oslo_db:
+ username: barbican
+ database: barbican
+ oslo_messaging:
+ admin:
+ username: rabbitmq
+ keystone:
+ username: keystone
+ armada:
+ keystone:
+ project_domain_name: default
+ user_domain_name: default
+ project_name: service
+ # NEWSITE-CHANGEME: Replace with the site name
+ region_name: RegionOne
+ role: admin
+ username: armada
+ deckhand:
+ keystone:
+ # NEWSITE-CHANGEME: Replace with the site name
+ region_name: RegionOne
+ role: admin
+ project_name: service
+ project_domain_name: default
+ user_domain_name: default
+ username: deckhand
+ postgres:
+ username: deckhand
+ database: deckhand
+ prometheus_openstack_exporter:
+ user:
+ region_name: RegionOne
+ role: admin
+ username: prometheus-openstack-exporter
+ project_name: service
+ user_domain_name: default
+ project_domain_name: default
+ ceph:
+ swift:
+ keystone:
+ role: admin
+ # NEWSITE-CHANGEME: Replace with the site name
+ region_name: RegionOne
+ username: swift
+ project_name: service
+ user_domain_name: default
+ project_domain_name: default
+...
+---
+schema: pegleg/AccountCatalogue/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_service_accounts
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+ substitutions:
+ - src:
+ schema: pegleg/CommonSoftwareConfig/v1
+ name: common-software-config
+ path: .osh.region_name
+ dest:
+ path: .osh.keystone.admin.region_name
+ - src:
+ schema: pegleg/CommonSoftwareConfig/v1
+ name: common-software-config
+ path: .osh.region_name
+ dest:
+ path: .osh.cinder.cinder.region_name
+ - src:
+ schema: pegleg/CommonSoftwareConfig/v1
+ name: common-software-config
+ path: .osh.region_name
+ dest:
+ path: .osh.glance.glance.region_name
+ - src:
+ schema: pegleg/CommonSoftwareConfig/v1
+ name: common-software-config
+ path: .osh.region_name
+ dest:
+ path: .osh.heat.heat.region_name
+ - src:
+ schema: pegleg/CommonSoftwareConfig/v1
+ name: common-software-config
+ path: .osh.region_name
+ dest:
+ path: .osh.heat.heat_trustee.region_name
+ - src:
+ schema: pegleg/CommonSoftwareConfig/v1
+ name: common-software-config
+ path: .osh.region_name
+ dest:
+ path: .osh.heat.heat_stack_user.region_name
+ - src:
+ schema: pegleg/CommonSoftwareConfig/v1
+ name: common-software-config
+ path: .osh.region_name
+ dest:
+ path: .osh.swift.keystone.region_name
+ - src:
+ schema: pegleg/CommonSoftwareConfig/v1
+ name: common-software-config
+ path: .osh.region_name
+ dest:
+ path: .osh.neutron.neutron.region_name
+ - src:
+ schema: pegleg/CommonSoftwareConfig/v1
+ name: common-software-config
+ path: .osh.region_name
+ dest:
+ path: .osh.nova.nova.region_name
+ - src:
+ schema: pegleg/CommonSoftwareConfig/v1
+ name: common-software-config
+ path: .osh.region_name
+ dest:
+ path: .osh.nova.placement.region_name
+ - src:
+ schema: pegleg/CommonSoftwareConfig/v1
+ name: common-software-config
+ path: .osh.region_name
+ dest:
+ path: .osh.barbican.barbican.region_name
+data:
+ osh:
+ keystone:
+ admin:
+ username: admin
+ project_name: admin
+ user_domain_name: default
+ project_domain_name: default
+ oslo_db:
+ username: keystone
+ database: keystone
+ oslo_messaging:
+ keystone:
+ username: keystone-rabbitmq-user
+ ldap:
+ # NEWSITE-CHANGEME: Replace with the site's LDAP account used to
+ # authenticate to the active directory backend to validate keystone
+ # users.
+ username: "test@ldap.example.com"
+ cinder:
+ cinder:
+ role: admin
+ username: cinder
+ project_name: service
+ user_domain_name: default
+ project_domain_name: default
+ oslo_db:
+ username: cinder
+ database: cinder
+ oslo_messaging:
+ cinder:
+ username: cinder-rabbitmq-user
+ glance:
+ glance:
+ role: admin
+ username: glance
+ project_name: service
+ user_domain_name: default
+ project_domain_name: default
+ oslo_db:
+ username: glance
+ database: glance
+ oslo_messaging:
+ glance:
+ username: glance-rabbitmq-user
+ ceph_object_store:
+ username: glance
+ heat:
+ heat:
+ role: admin
+ username: heat
+ project_name: service
+ user_domain_name: default
+ project_domain_name: default
+ heat_trustee:
+ role: admin
+ username: heat-trust
+ project_name: service
+ user_domain_name: default
+ project_domain_name: default
+ heat_stack_user:
+ role: admin
+ username: heat-domain
+ domain_name: heat
+ oslo_db:
+ username: heat
+ database: heat
+ oslo_messaging:
+ heat:
+ username: heat-rabbitmq-user
+ swift:
+ keystone:
+ role: admin
+ username: swift
+ project_name: service
+ user_domain_name: default
+ project_domain_name: default
+ oslo_db:
+ admin:
+ username: root
+ prometheus_mysql_exporter:
+ user:
+ username: osh-oslodb-exporter
+ neutron:
+ neutron:
+ role: admin
+ username: neutron
+ project_name: service
+ user_domain_name: default
+ project_domain_name: default
+ oslo_db:
+ username: neutron
+ database: neutron
+ oslo_messaging:
+ neutron:
+ username: neutron-rabbitmq-user
+ nova:
+ nova:
+ role: admin
+ username: nova
+ project_name: service
+ user_domain_name: default
+ project_domain_name: default
+ placement:
+ role: admin
+ username: placement
+ project_name: service
+ user_domain_name: default
+ project_domain_name: default
+ oslo_db:
+ username: nova
+ database: nova
+ oslo_db_api:
+ username: nova
+ database: nova_api
+ oslo_db_cell0:
+ username: nova
+ database: "nova_cell0"
+ oslo_messaging:
+ nova:
+ username: nova-rabbitmq-user
+ horizon:
+ oslo_db:
+ username: horizon
+ database: horizon
+ barbican:
+ barbican:
+ role: admin
+ username: barbican
+ project_name: service
+ user_domain_name: default
+ project_domain_name: default
+ oslo_db:
+ username: barbican
+ database: barbican
+ oslo_messaging:
+ barbican:
+ username: barbican-rabbitmq-user
+ oslo_messaging:
+ admin:
+ username: admin
+ tempest:
+ tempest:
+ role: admin
+ username: tempest
+ project_name: service
+ user_domain_name: default
+ project_domain_name: default
+...
+---
+schema: pegleg/AccountCatalogue/v1
+metadata:
+ schema: metadata/Document/v1
+ name: osh_infra_service_accounts
+ layeringDefinition:
+ abstract: false
+ layer: site
+ storagePolicy: cleartext
+ substitutions:
+ - src:
+ schema: pegleg/CommonSoftwareConfig/v1
+ name: common-software-config
+ path: .osh.region_name
+ dest:
+ path: .osh_infra.prometheus_openstack_exporter.user.region_name
+data:
+ osh_infra:
+ ceph_object_store:
+ admin:
+ username: s3_admin
+ elasticsearch:
+ username: elasticsearch
+ grafana:
+ admin:
+ username: grafana
+ oslo_db:
+ username: grafana
+ database: grafana
+ oslo_db_session:
+ username: grafana_session
+ database: grafana_session
+ elasticsearch:
+ admin:
+ username: elasticsearch
+ oslo_db:
+ admin:
+ username: root
+ prometheus_mysql_exporter:
+ user:
+ username: osh-infra-oslodb-exporter
+ prometheus_openstack_exporter:
+ user:
+ role: admin
+ username: prometheus-openstack-exporter
+ project_name: service
+ user_domain_name: default
+ project_domain_name: default
+ nagios:
+ admin:
+ username: nagios
+ prometheus:
+ admin:
+ username: prometheus
+ ldap:
+ admin:
+ # NEWSITE-CHANGEME: Replace with the site's LDAP account used to
+ # authenticate to the active directory backend to validate keystone
+ # users.
+ bind: "test@ldap.example.com"
+...
diff --git a/type/cntt/software/manifests/bootstrap.yaml b/type/cntt/software/manifests/bootstrap.yaml
new file mode 100644
index 0000000..e015410
--- /dev/null
+++ b/type/cntt/software/manifests/bootstrap.yaml
@@ -0,0 +1,39 @@
+---
+schema: armada/Manifest/v1
+metadata:
+ schema: metadata/Document/v1
+ replacement: true
+ name: cluster-bootstrap
+ labels:
+ name: cluster-bootstrap-type
+ layeringDefinition:
+ abstract: false
+ layer: type
+ parentSelector:
+ name: cluster-bootstrap-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data:
+ release_prefix: airship
+ chart_groups:
+ - podsecuritypolicy
+ - kubernetes-proxy
+ - kubernetes-container-networking
+ - kubernetes-dns
+ - kubernetes-etcd
+ - kubernetes-haproxy
+ - kubernetes-core
+ - ingress-kube-system
+ - ucp-ceph
+ - ucp-ceph-config
+ - ucp-core
+ - ucp-keystone
+ - ucp-divingbell
+ - ucp-armada
+ - ucp-deckhand
+ - ucp-drydock
+ - ucp-promenade
+ - ucp-shipyard
+...
diff --git a/type/cntt/software/manifests/full-site.yaml b/type/cntt/software/manifests/full-site.yaml
new file mode 100644
index 0000000..2cb0c84
--- /dev/null
+++ b/type/cntt/software/manifests/full-site.yaml
@@ -0,0 +1,61 @@
+---
+schema: armada/Manifest/v1
+metadata:
+ schema: metadata/Document/v1
+ replacement: true
+ name: full-site
+ labels:
+ name: full-site-type
+ layeringDefinition:
+ abstract: false
+ layer: type
+ parentSelector:
+ name: full-site-global
+ actions:
+ - method: merge
+ path: .
+ storagePolicy: cleartext
+data:
+ release_prefix: airship
+ chart_groups:
+ - podsecuritypolicy
+ - kubernetes-proxy
+ - kubernetes-container-networking
+ - kubernetes-dns
+ - kubernetes-etcd
+ - kubernetes-haproxy
+ - kubernetes-core
+ - ingress-kube-system
+ - ucp-ceph-update
+ - ucp-ceph-config
+ - ucp-core
+ - ucp-keystone
+ - ucp-divingbell
+ - ucp-armada
+ - ucp-deckhand
+ - ucp-drydock-scaled
+ - ucp-promenade
+ - ucp-shipyard
+ - ucp-prometheus-openstack-exporter
+ - osh-infra-ingress-controller
+ - osh-infra-ceph-config
+ - osh-infra-radosgw
+ - osh-infra-logging
+ - osh-infra-monitoring
+ - osh-infra-mariadb
+ - osh-infra-dashboards
+ - openstack-ingress-controller
+ - openstack-ceph-config
+ - openstack-tenant-ceph
+ - openstack-mariadb
+ - openstack-rabbitmq
+ - openstack-memcached
+ - openstack-keystone
+ - openstack-radosgw
+ - openstack-glance
+ - openstack-cinder
+ - openstack-compute-kit
+ - openstack-heat
+ - osh-infra-prometheus-openstack-exporter
+ - openstack-horizon
+...