Backport: pass on properties of Terraform typed application to Configuration (#2872)

Pass on properties like writeConnectionSecretRef, Region and providerRef
to Configuration.

Backport #2847

Signed-off-by: Zheng Xi Zhou <zzxwill@gmail.com>

.github/pr-title-checker-config.json

@@ -0,0 +1,10 @@
+{
+  "LABEL": {
+    "name": "title-needs-formatting",
+    "color": "EEEEEE"
+  },
+  "CHECKS": {
+    "prefixes": ["Fix: ", "Feat: ", "Docs: ", "Test: ", "Chore: ", "CI: ", "Perf: ", "Refactor: ", "Revert: ", "Style: ", "Test: ", "Backport: ", "Backport",
+      "Fix(", "Feat(", "Docs(", "Test(", "Chore(", "CI(", "Perf(", "Refactor(", "Revert(", "Style(", "Test(", "Backport("]
+  }
+} 

.github/workflows/commit-lint.yml

@@ -1,13 +1,19 @@
-name: Lint Commit Messages
-on: [push, pull_request]
+name: PR Title Checker
+on:
+  pull_request:
+    types:
+      - opened
+      - edited
+      - synchronize
+      - labeled
+      - unlabeled
 
 jobs:
-  commitlint:
+  check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: thehanimo/pr-title-checker@v1.3.1
         with:
-          fetch-depth: 0
-      - uses: wagoid/commitlint-github-action@v4
-        with:
-          helpURL: https://github.com/oam-dev/kubevela/blob/master/contribute/create-pull-request.md#commit-message-format
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          pass_on_octokit_error: true
+          configuration_path: ".github/pr-title-checker-config.json"

.github/workflows/e2e-test.yml

@@ -83,6 +83,9 @@ jobs:
       - name: Run api e2e tests
         run: make e2e-api-test
 
+      - name: Run addons e2e tests
+        run: make e2e-addon-test
+
       - name: Run e2e tests
         run: make e2e-test
 

Dockerfile

@@ -5,6 +5,10 @@ WORKDIR /workspace
 # Copy the Go Modules manifests
 COPY go.mod go.mod
 COPY go.sum go.sum
+
+# It's a proxy for CN developer, please unblock it if you have network issue
+# RUN go env -w GOPROXY=https://goproxy.cn,direct
+
 # cache deps before building and copying source so that we don't need to re-download as much
 # and so that source changes don't invalidate our downloaded layer
 RUN go mod download

Makefile

@@ -155,7 +155,7 @@ e2e-setup:
 	helm upgrade --install --create-namespace --namespace vela-system --set image.pullPolicy=IfNotPresent --set image.repository=vela-core-test --set applicationRevisionLimit=5 --set dependCheckWait=10s --set image.tag=$(GIT_COMMIT) --wait kubevela ./charts/vela-core
 	helm upgrade --install --create-namespace --namespace oam-runtime-system --set image.pullPolicy=IfNotPresent --set image.repository=vela-core-test --set dependCheckWait=10s --set image.tag=$(GIT_COMMIT) --wait oam-runtime ./charts/oam-runtime
 	bin/vela addon enable fluxcd
-	bin/vela addon enable terraform
+	bin/vela addon enable terraform-alibaba ALICLOUD_ACCESS_KEY=xxx ALICLOUD_SECRET_KEY=yyy ALICLOUD_REGION=cn-beijing
 	ginkgo version
 	ginkgo -v -r e2e/setup
 
@@ -174,6 +174,11 @@ e2e-test:
 	ginkgo -v  --skip="rollout related e2e-test." ./test/e2e-test
 	@$(OK) tests pass
 
+e2e-addon-test:
+	cp bin/vela /tmp/
+	ginkgo -v ./test/e2e-addon-test
+	@$(OK) tests pass
+
 e2e-rollout-test:
 	ginkgo -v  --focus="rollout related e2e-test." ./test/e2e-test
 	@$(OK) tests pass
@@ -199,10 +204,12 @@ e2e-cleanup:
 	rm -rf ~/.vela
 
 image-cleanup:
+ifneq (, $(shell which docker))
 # Delete Docker image
 ifneq ($(shell docker images -q $(VELA_CORE_TEST_IMAGE)),)
 	docker rmi -f $(VELA_CORE_TEST_IMAGE)
 endif
+endif
 
 end-e2e-core:
 	sh ./hack/e2e/end_e2e_core.sh
@@ -252,7 +259,7 @@ core-uninstall: manifests
 	kubectl delete -f charts/vela-core/crds/
 
 # Generate manifests e.g. CRD, RBAC etc.
-manifests: installcue kustomize
+manifests: installcue kustomize addon
 	go generate $(foreach t,pkg apis,./$(t)/...)
 	# TODO(yangsoon): kustomize will merge all CRD into a whole file, it may not work if we want patch more than one CRD in this way
 	$(KUSTOMIZE) build config/crd -o config/crd/base/core.oam.dev_applications.yaml
@@ -260,7 +267,6 @@ manifests: installcue kustomize
 	go run ./hack/crd/dispatch/dispatch.go config/crd/base charts/vela-core/crds charts/oam-runtime/crds runtime/ charts/vela-minimal/crds
 	rm -f config/crd/base/*
 	./vela-templates/gen_definitions.sh
-	go run ./vela-templates/gen_addons.go
 
 GOLANGCILINT_VERSION ?= v1.38.0
 HOSTOS := $(shell uname -s | tr '[:upper:]' '[:lower:]')
@@ -270,16 +276,20 @@ HOSTARCH := amd64
 endif
 
 golangci:
-ifeq (, $(shell which golangci-lint))
+ifneq ($(shell which golangci-lint),)
+	@$(OK) golangci-lint is already installed
+GOLANGCILINT=$(shell which golangci-lint)
+else ifeq (, $(shell which $(GOBIN)/golangci-lint))
 	@{ \
 	set -e ;\
 	echo 'installing golangci-lint-$(GOLANGCILINT_VERSION)' ;\
 	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOBIN) $(GOLANGCILINT_VERSION) ;\
-	echo 'Install succeed' ;\
+	echo 'Successfully installed' ;\
 	}
 GOLANGCILINT=$(GOBIN)/golangci-lint
 else
-GOLANGCILINT=$(shell which golangci-lint)
+	@$(OK) golangci-lint is already installed
+GOLANGCILINT=$(GOBIN)/golangci-lint
 endif
 
 .PHONY: staticchecktool
@@ -340,3 +350,7 @@ check-license-header:
 
 def-install:
 	./hack/utils/installdefinition.sh
+
+# generate addons to auto-gen and charts
+addon:
+	go run ./vela-templates/gen_addons.go

apis/core.oam.dev/common/types.go

@@ -19,13 +19,11 @@ package common
 import (
 	"encoding/json"
 
+	"github.com/oam-dev/terraform-controller/api/v1beta1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 
-	types "github.com/oam-dev/terraform-controller/api/types/crossplane-runtime"
-
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/condition"
-
 	"github.com/oam-dev/kubevela/apis/standard.oam.dev/v1alpha1"
 )
 
@@ -117,8 +115,7 @@ type Terraform struct {
 	// Path is the sub-directory of remote git repository. It's valid when remote is set
 	Path string `json:"path,omitempty"`
 
-	// ProviderReference specifies the reference to Provider
-	ProviderReference *types.Reference `json:"providerRef,omitempty"`
+	v1beta1.BaseConfigurationSpec `json:",inline"`
 }
 
 // A WorkloadTypeDescriptor refer to a Workload Type

apis/core.oam.dev/common/zz_generated.deepcopy.go

@@ -21,7 +21,6 @@ limitations under the License.
 package common
 
 import (
-	crossplane_runtime "github.com/oam-dev/terraform-controller/api/types/crossplane-runtime"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 )
@@ -559,11 +558,7 @@ func (in *SubStepsStatus) DeepCopy() *SubStepsStatus {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Terraform) DeepCopyInto(out *Terraform) {
 	*out = *in
-	if in.ProviderReference != nil {
-		in, out := &in.ProviderReference, &out.ProviderReference
-		*out = new(crossplane_runtime.Reference)
-		**out = **in
-	}
+	in.BaseConfigurationSpec.DeepCopyInto(&out.BaseConfigurationSpec)
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Terraform.

charts/oam-runtime/crds/core.oam.dev_traitdefinitions.yaml

@@ -188,6 +188,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -201,11 +206,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -215,6 +224,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -472,6 +497,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -485,11 +515,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -499,6 +533,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/oam-runtime/crds/core.oam.dev_workloaddefinitions.yaml

@@ -193,6 +193,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -206,11 +211,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -220,6 +229,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -458,6 +483,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -471,11 +501,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -485,6 +519,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/oam-runtime/templates/admission-webhooks/job-patch/job-createSecret.yaml

@@ -24,7 +24,7 @@ spec:
     spec:
       containers:
         - name: create
-          image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
           imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
           args:
             - create

charts/oam-runtime/templates/admission-webhooks/job-patch/job-patchWebhook.yaml

@@ -24,7 +24,7 @@ spec:
     spec:
       containers:
         - name: patch
-          image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
           imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
           args:
             - patch

charts/oam-runtime/templates/oam-runtime-controller.yaml

@@ -126,7 +126,7 @@ spec:
             {{ end }}
             - "--system-definition-namespace={{ .Values.systemDefinitionNamespace }}"
             - "--oam-spec-ver={{ .Values.OAMSpecVer }}"
-          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.image.repository }}:{{ .Values.image.tag }}
           imagePullPolicy: {{ quote .Values.image.pullPolicy }}
           resources:
           {{- toYaml .Values.resources | nindent 12 }}

charts/oam-runtime/templates/test/test-application.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Pod
 metadata:
-  name: "{{ include "oam-runtime.fullname" . }}-test-connection"
+  name: {{ include "oam-runtime.fullname" . }}-test-connection
   labels:
   {{- include "oam-runtime.labels" . | nindent 4 }}
   annotations:
@@ -9,7 +9,7 @@ metadata:
 spec:
   containers:
     - name: wget
-      image: busybox
+      image: {{ .Values.imageRegistry }}{{ .Values.test.app.repository }}:{{ .Values.test.app.tag }}
       command: ['wget']
       args: ['{{ include "oam-runtime.fullname" . }}:{{ .Values.healthCheck.port }}']
   restartPolicy: Never

charts/oam-runtime/values.yaml

@@ -7,6 +7,8 @@ replicaCount: 1
 applyOnceOnly: "off"
 
 disableCaps: "all"
+
+imageRegistry: ""
 image:
   repository: oamdev/vela-core
   tag: latest
@@ -98,4 +100,9 @@ concurrentReconciles: 4
 dependCheckWait: 30s
 
 # OAMSpecVer is the oam spec version controller want to setup
-OAMSpecVer: "v0.2"
+OAMSpecVer: "v0.2"
+
+test:
+  app:
+    repository: oamdev/busybox
+    tag: v1

charts/vela-core/crds/core.oam.dev_applicationrevisions.yaml

@@ -1232,6 +1232,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -1245,11 +1251,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -1259,6 +1270,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -1639,6 +1667,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -1652,11 +1686,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -1666,6 +1705,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -1944,6 +2000,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -1957,11 +2019,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -1971,6 +2038,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -3372,6 +3456,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -3385,11 +3475,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -3399,6 +3494,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -3672,6 +3784,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -3685,11 +3803,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -3699,6 +3822,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -4061,6 +4201,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -4074,11 +4220,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -4088,6 +4239,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -4329,6 +4497,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -4342,11 +4516,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -4356,6 +4535,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -4617,6 +4813,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -4630,11 +4832,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -4644,6 +4851,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object

charts/vela-core/crds/core.oam.dev_componentdefinitions.yaml

@@ -179,6 +179,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -192,11 +197,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -206,6 +215,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -467,6 +492,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -480,11 +510,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -494,6 +528,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/vela-core/crds/core.oam.dev_definitionrevisions.yaml

@@ -222,6 +222,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -235,11 +241,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -249,6 +260,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object
@@ -510,6 +538,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -523,11 +557,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -537,6 +576,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object
@@ -791,6 +847,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -804,11 +866,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -818,6 +885,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object
@@ -1053,6 +1137,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -1066,11 +1156,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -1080,6 +1175,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object

charts/vela-core/crds/core.oam.dev_policydefinitions.yaml

@@ -151,6 +151,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -164,11 +169,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -178,6 +187,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/vela-core/crds/core.oam.dev_traitdefinitions.yaml

@@ -188,6 +188,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -201,11 +206,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -215,6 +224,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -472,6 +497,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -485,11 +515,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -499,6 +533,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/vela-core/crds/core.oam.dev_workflowstepdefinitions.yaml

@@ -148,6 +148,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -161,11 +166,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -175,6 +184,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/vela-core/crds/core.oam.dev_workloaddefinitions.yaml

@@ -193,6 +193,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -206,11 +211,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -220,6 +229,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -458,6 +483,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -471,11 +501,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -485,6 +519,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/vela-core/templates/addons/istio.yaml

@@ -8,7 +8,7 @@ data:
         addons.oam.dev/description: istio Controller is a Kubernetes Controller for manage
           traffic.
       name: istio
-      namespace: istio-system
+      namespace: vela-system
     spec:
       components:
       - name: ns-istio-system

charts/vela-core/templates/addons/observability.yaml

@@ -10,106 +10,13 @@ data:
       namespace: vela-system
     spec:
       components:
-      - name: ns-observability
-        properties:
-          apiVersion: v1
-          kind: Namespace
-          metadata:
-            name: observability
-        type: raw
-      - name: import-grafana-dashboard-traitdef
-        properties:
-          apiVersion: core.oam.dev/v1beta1
-          kind: TraitDefinition
-          metadata:
-            annotations:
-              definition.oam.dev/description: Import dashboards to Grafana
-            name: import-grafana-dashboard
-            namespace: vela-system
-          spec:
-            schematic:
-              cue:
-                template: "outputs: registerdatasource: {\n\tapiVersion: \"grafana.extension.oam.dev/v1alpha1\"\n\tkind:
-                  \      \"ImportDashboard\"\n\tspec: {\n\t\tgrafana: {\n\t\t\tservice:
-                  \                  parameter.grafanaServiceName\n\t\t\tnamespace:                 parameter.grafanaServiceNamespace\n\t\t\tcredentialSecret:
-                  \         parameter.credentialSecret\n\t\t\tcredentialSecretNamespace:
-                  parameter.credentialSecretNamespace\n\t\t}\n\t\turls: parameter.urls\n\t}\n}\nparameter:
-                  {\n\tgrafanaServiceName:        string\n\tgrafanaServiceNamespace:   *\"default\"
-                  | string\n\tcredentialSecret:          string\n\tcredentialSecretNamespace:
-                  *\"default\" | string\n\turls: [...string]\n}\n"
-        type: raw
-      - name: pure-ingress-traitdef
-        properties:
-          apiVersion: core.oam.dev/v1beta1
-          kind: TraitDefinition
-          metadata:
-            annotations:
-              definition.oam.dev/description: Enable public web traffic for the component
-                without creating a Service.
-            name: pure-ingress
-            namespace: vela-system
-          spec:
-            schematic:
-              cue:
-                template: "\noutputs: ingress: {\n\tapiVersion: \"networking.k8s.io/v1beta1\"\n\tkind:
-                  \      \"Ingress\"\n\tmetadata:\n\t\tname: context.name\n\tspec: {\n\t\trules:
-                  [{\n\t\t\thost: parameter.domain\n\t\t\thttp: {\n\t\t\t\tpaths: [\n\t\t\t\t\tfor
-                  k, v in parameter.http {\n\t\t\t\t\t\tpath: k\n\t\t\t\t\t\tbackend:
-                  {\n\t\t\t\t\t\t\tserviceName: context.name\n\t\t\t\t\t\t\tservicePort:
-                  v\n\t\t\t\t\t\t}\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t}\n\t\t}]\n\t}\n}\n\nparameter:
-                  {\n\t// +usage=Specify the domain you want to expose\n\tdomain: string\n\n\t//
-                  +usage=Specify the mapping relationship between the http path and the
-                  workload port\n\thttp: [string]: int\n}\n"
-            status:
-              customStatus: |-
-                let igs = context.outputs.ingress.status.loadBalancer.ingress
-                if igs == _|_ {
-                  message: "No loadBalancer found, visiting by using 'vela port-forward " + context.appName + " --route'\n"
-                }
-                if len(igs) > 0 {
-                  if igs[0].ip != _|_ {
-                    message: "Visiting URL: " + context.outputs.ingress.spec.rules[0].host + ", IP: " + igs[0].ip
-                  }
-                  if igs[0].ip == _|_ {
-                    message: "Visiting URL: " + context.outputs.ingress.spec.rules[0].host
-                  }
-                }
-              healthPolicy: |
-                isHealth: len(context.outputs.ingress.status.loadBalancer.ingress) > 0
-        type: raw
-      - name: register-grafana-datasource-traitdef
-        properties:
-          apiVersion: core.oam.dev/v1beta1
-          kind: TraitDefinition
-          metadata:
-            annotations:
-              definition.oam.dev/description: Add a datasource to Grafana
-            name: register-grafana-datasource
-            namespace: vela-system
-          spec:
-            schematic:
-              cue:
-                template: "outputs: registerdatasource: {\n\tapiVersion: \"grafana.extension.oam.dev/v1alpha1\"\n\tkind:
-                  \      \"DatasourceRegistration\"\n\tspec: {\n\t\tgrafana: {\n\t\t\tservice:
-                  \                  parameter.grafanaServiceName\n\t\t\tnamespace:                 parameter.grafanaServiceNamespace\n\t\t\tcredentialSecret:
-                  \         parameter.credentialSecret\n\t\t\tcredentialSecretNamespace:
-                  parameter.credentialSecretNamespace\n\t\t}\n\t\tdatasource: {\n\t\t\tname:
-                  \     parameter.name\n\t\t\ttype:      parameter.type\n\t\t\taccess:
-                  \   parameter.access\n\t\t\tservice:   parameter.service\n\t\t\tnamespace:
-                  parameter.namespace\n\t\t}\n\t}\n}\n\nparameter: {\n\tgrafanaServiceName:
-                  \       string\n\tgrafanaServiceNamespace:   *\"default\" | string\n\tcredentialSecret:
-                  \         string\n\tcredentialSecretNamespace: string\n\tname:                      string\n\ttype:
-                  \                     string\n\taccess:                    *\"proxy\"
-                  | string\n\tservice:                   string\n\tnamespace:                 *\"default\"
-                  | string\n}\n"
-        type: raw
       - name: grafana-registration
         properties:
           chart: ./chart
           git:
             branch: master
           repoType: git
-          targetNamespace: observability
+          targetNamespace: vela-system
           url: https://github.com/oam-dev/grafana-registration
           values:
             replicaCount: 1
@@ -119,7 +26,7 @@ data:
           chart: grafana
           releaseName: grafana
           repoType: helm
-          targetNamespace: observability
+          targetNamespace: vela-system
           url: https://charts.kubevela.net/addons
           version: 6.14.1
         traits:
@@ -130,9 +37,9 @@ data:
           type: pure-ingress
         - properties:
             credentialSecret: grafana
-            credentialSecretNamespace: observability
+            credentialSecretNamespace: vela-system
             grafanaServiceName: grafana
-            grafanaServiceNamespace: observability
+            grafanaServiceNamespace: vela-system
             urls:
             - https://charts.kubevela.net/addons/dashboards/kubevela_core_logging.json
             - https://charts.kubevela.net/addons/dashboards/kubevela_core_monitoring.json
@@ -145,18 +52,18 @@ data:
           chart: loki-stack
           releaseName: loki
           repoType: helm
-          targetNamespace: observability
+          targetNamespace: vela-system
           url: https://charts.kubevela.net/addons
           version: 2.4.1
         traits:
         - properties:
             access: proxy
             credentialSecret: grafana
-            credentialSecretNamespace: observability
+            credentialSecretNamespace: vela-system
             grafanaServiceName: grafana
-            grafanaServiceNamespace: observability
+            grafanaServiceNamespace: vela-system
             name: loki
-            namespace: observability
+            namespace: vela-system
             service: loki
             type: loki
           type: register-grafana-datasource
@@ -166,7 +73,7 @@ data:
           chart: prometheus
           releaseName: prometheus
           repoType: helm
-          targetNamespace: observability
+          targetNamespace: vela-system
           url: https://charts.kubevela.net/addons
           values:
             alertmanager:
@@ -184,11 +91,11 @@ data:
         - properties:
             access: proxy
             credentialSecret: grafana
-            credentialSecretNamespace: observability
+            credentialSecretNamespace: vela-system
             grafanaServiceName: grafana
-            grafanaServiceNamespace: observability
+            grafanaServiceNamespace: vela-system
             name: prometheus
-            namespace: observability
+            namespace: vela-system
             service: prometheus-server
             type: prometheus
           type: register-grafana-datasource
@@ -197,7 +104,7 @@ data:
         properties:
           chart: kube-state-metrics
           repoType: helm
-          targetNamespace: observability
+          targetNamespace: vela-system
           url: https://charts.kubevela.net/addons
           values:
             image:
@@ -212,22 +119,6 @@ data:
             name: fluxcd
             namespace: vela-system
           type: depends-on-app
-        - name: apply-ns
-          properties:
-            component: ns-observability
-          type: apply-component
-        - name: apply-trait-1
-          properties:
-            component: import-grafana-dashboard-traitdef
-          type: apply-component
-        - name: apply-trait-2
-          properties:
-            component: pure-ingress-traitdef
-          type: apply-component
-        - name: apply-trait-3
-          properties:
-            component: register-grafana-datasource-traitdef
-          type: apply-component
         - name: apply-resources
           type: apply-remaining
     status:

charts/vela-core/templates/addons/terraform-alibaba.yaml

@@ -0,0 +1,70 @@
+apiVersion: v1
+data:
+  application: |
+    apiVersion: core.oam.dev/v1beta1
+    kind: Application
+    metadata:
+      annotations:
+        addons.oam.dev/description: Kubernetes Terraform Controller for Alibaba Cloud
+        addons.oam.dev/name: terraform-alibaba
+      name: terraform-alibaba
+      namespace: vela-system
+    spec:
+      components:
+      - name: alibaba-account-creds-[[ index .Args "providerName" ]]
+        properties:
+          apiVersion: v1
+          kind: Secret
+          metadata:
+            name: alibaba-account-creds-[[ index .Args "providerName" ]]
+            namespace: vela-system
+          stringData:
+            credentials: |
+              accessKeyID: [[ index .Args "ALICLOUD_ACCESS_KEY" ]]
+              accessKeySecret: [[ index .Args "ALICLOUD_SECRET_KEY" ]]
+              securityToken: [[ index .Args "ALICLOUD_SECURITY_TOKEN" ]]
+          type: Opaque
+        type: raw
+      - name: alibaba-[[ index .Args "providerName" ]]
+        properties:
+          apiVersion: terraform.core.oam.dev/v1beta1
+          kind: Provider
+          metadata:
+            name: '[[ index .Args "providerName" ]]'
+            namespace: default
+          spec:
+            credentials:
+              secretRef:
+                key: credentials
+                name: alibaba-account-creds-[[ index .Args "providerName" ]]
+                namespace: vela-system
+              source: Secret
+            provider: alibaba
+            region: '[[ index .Args "ALICLOUD_REGION" ]]'
+        type: raw
+      workflow:
+        steps:
+        - name: ""
+          properties:
+            name: terraform
+            namespace: vela-system
+          type: depends-on-app
+        - name: ""
+          type: apply-application
+    status:
+      rollout:
+        batchRollingState: ""
+        currentBatch: 0
+        lastTargetAppRevision: ""
+        rollingState: ""
+        upgradedReadyReplicas: 0
+        upgradedReplicas: 0
+kind: ConfigMap
+metadata:
+  annotations:
+    addons.oam.dev/description: Kubernetes Terraform Controller for Alibaba Cloud
+    addons.oam.dev/name: terraform-alibaba
+  labels:
+    addons.oam.dev/type: terraform-alibaba
+  name: terraform-alibaba
+  namespace: {{.Values.systemDefinitionNamespace}}

charts/vela-core/templates/addons/terraform-aws.yaml

@@ -0,0 +1,70 @@
+apiVersion: v1
+data:
+  application: |
+    apiVersion: core.oam.dev/v1beta1
+    kind: Application
+    metadata:
+      annotations:
+        addons.oam.dev/description: Kubernetes Terraform Controller for AWS
+        addons.oam.dev/name: terraform-aws
+      name: terraform-aws
+      namespace: vela-system
+    spec:
+      components:
+      - name: aws-account-creds
+        properties:
+          apiVersion: v1
+          kind: Secret
+          metadata:
+            name: aws-account-creds
+            namespace: vela-system
+          stringData:
+            credentials: |
+              awsAccessKeyID: [[ index .Args "AWS_ACCESS_KEY_ID" ]]
+              awsSecretAccessKey: [[ index .Args "AWS_SECRET_ACCESS_KEY" ]]
+              awsSessionToken: [[ index .Args "AWS_SESSION_TOKEN" ]]
+          type: Opaque
+        type: raw
+      - name: aws
+        properties:
+          apiVersion: terraform.core.oam.dev/v1beta1
+          kind: Provider
+          metadata:
+            name: aws
+            namespace: default
+          spec:
+            credentials:
+              secretRef:
+                key: credentials
+                name: aws-account-creds
+                namespace: vela-system
+              source: Secret
+            provider: aws
+            region: '[[ index .Args "AWS_DEFAULT_REGION" ]]'
+        type: raw
+      workflow:
+        steps:
+        - name: ""
+          properties:
+            name: terraform
+            namespace: vela-system
+          type: depends-on-app
+        - name: ""
+          type: apply-application
+    status:
+      rollout:
+        batchRollingState: ""
+        currentBatch: 0
+        lastTargetAppRevision: ""
+        rollingState: ""
+        upgradedReadyReplicas: 0
+        upgradedReplicas: 0
+kind: ConfigMap
+metadata:
+  annotations:
+    addons.oam.dev/description: Kubernetes Terraform Controller for AWS
+    addons.oam.dev/name: terraform-aws
+  labels:
+    addons.oam.dev/type: terraform-aws
+  name: terraform-aws
+  namespace: {{.Values.systemDefinitionNamespace}}

charts/vela-core/templates/addons/terraform-azure.yaml

@@ -0,0 +1,70 @@
+apiVersion: v1
+data:
+  application: |
+    apiVersion: core.oam.dev/v1beta1
+    kind: Application
+    metadata:
+      annotations:
+        addons.oam.dev/description: Kubernetes Terraform Controller for Azure
+        addons.oam.dev/name: terraform-azure
+      name: terraform-azure
+      namespace: vela-system
+    spec:
+      components:
+      - name: azure-account-creds
+        properties:
+          apiVersion: v1
+          kind: Secret
+          metadata:
+            name: azure-account-creds
+            namespace: vela-system
+          stringData:
+            credentials: |
+              armClientID: [[ index .Args "ARM_CLIENT_ID" ]]
+              armClientSecret: [[ index .Args "ARM_CLIENT_SECRET" ]]
+              armSubscriptionID: [[ index .Args "ARM_SUBSCRIPTION_ID" ]]
+              armTenantID: [[ index .Args "ARM_TENANT_ID" ]]
+          type: Opaque
+        type: raw
+      - name: azure
+        properties:
+          apiVersion: terraform.core.oam.dev/v1beta1
+          kind: Provider
+          metadata:
+            name: azure
+            namespace: default
+          spec:
+            credentials:
+              secretRef:
+                key: credentials
+                name: azure-account-creds
+                namespace: vela-system
+              source: Secret
+            provider: azure
+        type: raw
+      workflow:
+        steps:
+        - name: ""
+          properties:
+            name: terraform
+            namespace: vela-system
+          type: depends-on-app
+        - name: ""
+          type: apply-application
+    status:
+      rollout:
+        batchRollingState: ""
+        currentBatch: 0
+        lastTargetAppRevision: ""
+        rollingState: ""
+        upgradedReadyReplicas: 0
+        upgradedReplicas: 0
+kind: ConfigMap
+metadata:
+  annotations:
+    addons.oam.dev/description: Kubernetes Terraform Controller for Azure
+    addons.oam.dev/name: terraform-azure
+  labels:
+    addons.oam.dev/type: terraform-azure
+  name: terraform-azure
+  namespace: {{.Values.systemDefinitionNamespace}}

charts/vela-core/templates/addons/terraform.yaml

@@ -11,20 +11,35 @@ data:
       namespace: vela-system
     spec:
       components:
-      - name: ns-terraform-system
-        properties:
-          apiVersion: v1
-          kind: Namespace
-          metadata:
-            name: terraform-system
-        type: raw
       - name: terraform-controller
         properties:
           chart: terraform-controller
           repoType: helm
           url: https://charts.kubevela.net/addons
-          version: 0.2.6
+          version: 0.2.10
         type: helm
+      - name: alibaba-redis
+        properties:
+          apiVersion: core.oam.dev/v1beta1
+          kind: ComponentDefinition
+          metadata:
+            annotations:
+              definition.oam.dev/description: Terraform configuration for Alibaba Cloud
+                Redis
+            labels:
+              type: terraform
+            name: alibaba-redis
+            namespace: vela-system
+          spec:
+            schematic:
+              terraform:
+                configuration: https://github.com/kubevela-contrib/terraform-modules/alibaba/redis
+                type: remote
+            workload:
+              definition:
+                apiVersion: terraform.core.oam.dev/v1beta1
+                kind: Configuration
+        type: raw
       - name: alibaba-ack
         properties:
           apiVersion: core.oam.dev/v1beta1
@@ -48,6 +63,29 @@ data:
                 apiVersion: terraform.core.oam.dev/v1beta1
                 kind: Configuration
         type: raw
+      - name: alibaba-ask
+        properties:
+          apiVersion: core.oam.dev/v1beta1
+          kind: ComponentDefinition
+          metadata:
+            annotations:
+              definition.oam.dev/description: Terraform configuration for Alibaba Cloud
+                Serverless Kubernetes (ASK)
+            labels:
+              type: terraform
+            name: alibaba-ask
+            namespace: vela-system
+          spec:
+            schematic:
+              terraform:
+                configuration: https://github.com/kubevela-contrib/terraform-modules.git
+                path: alibaba/cs/serverless-kubernetes
+                type: remote
+            workload:
+              definition:
+                apiVersion: terraform.core.oam.dev/v1beta1
+                kind: Configuration
+        type: raw
       - name: alibaba-eip
         properties:
           apiVersion: core.oam.dev/v1alpha2
@@ -76,6 +114,8 @@ data:
           kind: ComponentDefinition
           metadata:
             annotations:
+              cloud-resource/console-url: https://oss.console.aliyun.com/bucket/oss-{ALICLOUD_REGION}/{BUCKET_NAME}/overview
+              cloud-resource/identifier: BUCKET_NAME
               definition.oam.dev/description: Terraform configuration for Alibaba Cloud
                 OSS object
             labels:
@@ -103,6 +143,9 @@ data:
           kind: ComponentDefinition
           metadata:
             annotations:
+              cloud-resource/console-url: https://rdsnext.console.aliyun.com/detail/{DB_ID}/basicInfo?&region={ALICLOUD_REGION}
+              cloud-resource/identifier: DB_ID
+              cloud-resource/sensitive-outputs: DB_PASSWORD
               definition.oam.dev/description: Terraform configuration for Alibaba Cloud
                 RDS object
             labels:
@@ -126,6 +169,10 @@ data:
                     security_ips = ["0.0.0.0/0",]
                   }
 
+                  output "DB_ID" {
+                    value = module.rds.db_instance_id
+                  }
+
                   output "DB_NAME" {
                     value = module.rds.this_db_instance_name
                   }
@@ -173,6 +220,98 @@ data:
                 apiVersion: terraform.core.oam.dev/v1beta1
                 kind: Configuration
         type: raw
+      - name: alibaba-sls-project
+        properties:
+          apiVersion: core.oam.dev/v1beta1
+          kind: ComponentDefinition
+          metadata:
+            annotations:
+              definition.oam.dev/description: Terraform configuration for Alibaba Cloud
+                SLS Project
+            labels:
+              type: terraform
+            name: alibaba-sls-project
+            namespace: vela-system
+          spec:
+            schematic:
+              terraform:
+                configuration: https://github.com/kubevela-contrib/terraform-modules.git
+                path: alibaba/sls/project
+                type: remote
+            workload:
+              definition:
+                apiVersion: terraform.core.oam.dev/v1beta1
+                kind: Configuration
+        type: raw
+      - name: alibaba-sls-store
+        properties:
+          apiVersion: core.oam.dev/v1beta1
+          kind: ComponentDefinition
+          metadata:
+            annotations:
+              definition.oam.dev/description: Terraform configuration for Alibaba Cloud
+                SLS Store
+            labels:
+              type: terraform
+            name: alibaba-sls-store
+            namespace: vela-system
+          spec:
+            schematic:
+              terraform:
+                configuration: https://github.com/kubevela-contrib/terraform-modules.git
+                path: alibaba/sls/store
+                type: remote
+            workload:
+              definition:
+                apiVersion: terraform.core.oam.dev/v1beta1
+                kind: Configuration
+        type: raw
+      - name: alibaba-vpc
+        properties:
+          apiVersion: core.oam.dev/v1beta1
+          kind: ComponentDefinition
+          metadata:
+            annotations:
+              definition.oam.dev/description: Terraform configuration for Alibaba Cloud
+                VPC
+            labels:
+              type: terraform
+            name: alibaba-vpc
+            namespace: vela-system
+          spec:
+            schematic:
+              terraform:
+                configuration: https://github.com/kubevela-contrib/terraform-modules.git
+                path: alibaba/vpc
+                type: remote
+            workload:
+              definition:
+                apiVersion: terraform.core.oam.dev/v1beta1
+                kind: Configuration
+        type: raw
+      - name: alibaba-vswitch
+        properties:
+          apiVersion: core.oam.dev/v1beta1
+          kind: ComponentDefinition
+          metadata:
+            annotations:
+              definition.oam.dev/description: Terraform configuration for Alibaba Cloud
+                VSwitch
+            labels:
+              type: terraform
+            name: alibaba-vswitch
+            namespace: vela-system
+          spec:
+            schematic:
+              terraform:
+                configuration: https://github.com/kubevela-contrib/terraform-modules.git
+                path: alibaba/vswitch
+                type: remote
+            workload:
+              definition:
+                apiVersion: terraform.core.oam.dev/v1beta1
+                kind: Configuration
+        type: raw
       - name: aws-s3
         properties:
           apiVersion: core.oam.dev/v1alpha2
@@ -329,19 +468,119 @@ data:
                 apiVersion: terraform.core.oam.dev/v1beta1
                 kind: Configuration
         type: raw
+      - name: azure-storage-account
+        properties:
+          apiVersion: core.oam.dev/v1alpha2
+          kind: ComponentDefinition
+          metadata:
+            annotations:
+              definition.oam.dev/description: Terraform configuration for Azure Blob Storage
+                Account
+              provider: azure
+            labels:
+              type: terraform
+            name: azure-storage-account
+            namespace: vela-system
+          spec:
+            schematic:
+              terraform:
+                configuration: |
+                  # Configure the Microsoft Azure Provider
+                  provider "azurerm" {
+                    features {}
+                  }
+
+                  resource "azurerm_resource_group" "rsg" {
+                    count    = var.create_rsg ? 1 : 0
+                    name     = var.resource_group_name
+                    location = var.location
+                  }
+
+                  resource "azurerm_storage_account" "sa" {
+                    name                      = var.name
+                    resource_group_name       = var.create_rsg ? azurerm_resource_group.rsg[0].name : var.resource_group_name
+                    location                  = var.location
+                    account_tier              = "Standard"
+                    account_replication_type  = "GRS"
+                    enable_https_traffic_only = true
+
+                    dynamic "static_website" {
+                      for_each = var.static_website
+                      content {
+                        index_document     = static_website.value["index_document"]
+                        error_404_document = static_website.value["error_404_document"]
+                      }
+                    }
+
+                    tags = var.tags
+                  }
+
+                  variable "create_rsg" {
+                    description = "Conditional if resource group should be created. Defaults to 'true'."
+                    type        = bool
+                    default     = true
+                  }
+
+                  variable "resource_group_name" {
+                    description = "Name of resource group. Defaults to 'rsg'."
+                    type        = string
+                    default     = "rsg"
+                  }
+
+                  variable "name" {
+                    description = "Name of storage account. Defaults to 'storageaccount'."
+                    type        = string
+                    default     = "storageaccount"
+                  }
+
+                  variable "location" {
+                    description = "Location of storage account. Defaults to 'West Europe'."
+                    type        = string
+                    default     = "West Europe"
+                  }
+
+                  variable "tags" {
+                    description = "Tags for storage account. Defaults to '{}'."
+                    type        = map(string)
+                    default     = {}
+                  }
+
+                  variable "static_website" {
+                    description = "Static website configuration. Defaults to disabled."
+                    type        = list(map(string))
+                    default     = [{
+                      index_document = null
+                      error_404_document = null
+                    }]
+                  }
+
+                  output "BLOB_CONNECTION_STRING" {
+                    description = "Blob storage connection string"
+                    sensitive   = true
+                    value       = azurerm_storage_account.sa.primary_connection_string
+                  }
+
+                  output "BLOB_WEB_ENDPOINT" {
+                    description = "Blob storage static web endpoint"
+                    value       = azurerm_storage_account.sa.primary_web_endpoint
+                  }
+                providerRef:
+                  name: azure
+                  namespace: default
+            workload:
+              definition:
+                apiVersion: terraform.core.oam.dev/v1beta1
+                kind: Configuration
+        type: raw
       workflow:
         steps:
-        - name: checking-depends-on
+        - name: ""
           properties:
             name: fluxcd
             namespace: vela-system
           type: depends-on-app
-        - name: apply-ns
-          properties:
-            component: ns-terraform-system
-          type: apply-component
-        - name: apply-resources
-          type: apply-remaining
+        - name: ""
+          type: apply-application
     status:
       rollout:
         batchRollingState: ""

charts/vela-core/templates/admission-webhooks/job-patch/job-createSecret.yaml

@@ -24,7 +24,7 @@ spec:
     spec:
       containers:
         - name: create
-          image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
           imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
           args:
             - create

charts/vela-core/templates/admission-webhooks/job-patch/job-patchWebhook.yaml

@@ -24,7 +24,7 @@ spec:
     spec:
       containers:
         - name: patch
-          image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
           imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
           args:
             - patch

charts/vela-core/templates/cluster-gateway.yaml

@@ -35,7 +35,7 @@ spec:
             {{ if .Values.multicluster.clusterGateway.secureTLS.enabled }}
             - "--cert-dir={{ .Values.multicluster.clusterGateway.secureTLS.certPath }}"
             {{ end }}
-          image: {{ .Values.multicluster.clusterGateway.image.repository }}:{{ .Values.multicluster.clusterGateway.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.multicluster.clusterGateway.image.repository }}:{{ .Values.multicluster.clusterGateway.image.tag }}
           imagePullPolicy: {{ .Values.multicluster.clusterGateway.image.pullPolicy }}
           resources:
           {{- toYaml .Values.multicluster.clusterGateway.resources | nindent 12 }}
@@ -132,7 +132,7 @@ spec:
     spec:
       containers:
       - name: create
-        image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
+        image: {{ .Values.imageRegistry }}{{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
         imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
         args:
           - create
@@ -175,7 +175,7 @@ spec:
     spec:
       containers:
       - name: patch
-        image: {{ .Values.multicluster.clusterGateway.image.repository }}:{{ .Values.multicluster.clusterGateway.image.tag }}
+        image: {{ .Values.imageRegistry }}{{ .Values.multicluster.clusterGateway.image.repository }}:{{ .Values.multicluster.clusterGateway.image.tag }}
         imagePullPolicy: {{ .Values.multicluster.clusterGateway.image.pullPolicy }}
         command:
           - /patch

charts/vela-core/templates/defwithtemplate/depends-on-app.yaml

@@ -27,7 +27,7 @@ spec:
         	}
         }
         load: op.#Steps & {
-        	if dependsOn.err != _|_ && dependsOn.value == _|_ {
+        	if dependsOn.err != _|_ {
         		configMap: op.#Read & {
         			value: {
         				apiVersion: "v1"
@@ -37,18 +37,17 @@ spec:
         					namespace: parameter.namespace
         				}
         			}
-        		}
-        		apply: op.#Apply & {
-        			value: {
-        				yaml.Unmarshal(configMap.value.data[parameter.name])
-        			}
-        		}
+        		}         @step(1)
+        		template: configMap.value.data["application"]
+        		apply:    op.#Apply & {
+        			value: yaml.Unmarshal(template)
+        		}     @step(2)
         		wait: op.#ConditionalWait & {
-        			continue: load.apply.value.status.status == "running"
-        		}
+        			continue: apply.value.status.status == "running"
+        		} @step(3)
         	}
 
-        	if dependsOn.value != _|_ {
+        	if dependsOn.err == _|_ {
         		wait: op.#ConditionalWait & {
         			continue: dependsOn.value.status.status == "running"
         		}

charts/vela-core/templates/defwithtemplate/import-grafana-dashboard.yaml

@@ -0,0 +1,39 @@
+# Code generated by KubeVela templates. DO NOT EDIT. Please edit the original cue file.
+# Definition source cue file: vela-templates/definitions/internal/import-grafana-dashboard.cue
+apiVersion: core.oam.dev/v1beta1
+kind: TraitDefinition
+metadata:
+  annotations:
+    definition.oam.dev/description: Import dashboards to Grafana
+  name: import-grafana-dashboard
+  namespace: {{.Values.systemDefinitionNamespace}}
+spec:
+  appliesToWorkloads: []
+  conflictsWith: []
+  podDisruptive: false
+  schematic:
+    cue:
+      template: |
+        outputs: registerdatasource: {
+        	apiVersion: "grafana.extension.oam.dev/v1alpha1"
+        	kind:       "ImportDashboard"
+        	spec: {
+        		grafana: {
+        			service:                   parameter.grafanaServiceName
+        			namespace:                 parameter.grafanaServiceNamespace
+        			credentialSecret:          parameter.credentialSecret
+        			credentialSecretNamespace: parameter.credentialSecretNamespace
+        		}
+        		urls: parameter.urls
+        	}
+        }
+        parameter: {
+        	grafanaServiceName:        string
+        	grafanaServiceNamespace:   *"default" | string
+        	credentialSecret:          string
+        	credentialSecretNamespace: *"default" | string
+        	urls: [...string]
+
+        }
+  workloadRefPath: ""
+

charts/vela-core/templates/defwithtemplate/pure-ingress.yaml

@@ -0,0 +1,56 @@
+# Code generated by KubeVela templates. DO NOT EDIT. Please edit the original cue file.
+# Definition source cue file: vela-templates/definitions/internal/pure-ingress.cue
+apiVersion: core.oam.dev/v1beta1
+kind: TraitDefinition
+metadata:
+  annotations:
+    definition.oam.dev/description: Enable public web traffic for the component without creating a Service.
+  name: pure-ingress
+  namespace: {{.Values.systemDefinitionNamespace}}
+spec:
+  appliesToWorkloads: []
+  conflictsWith: []
+  podDisruptive: false
+  schematic:
+    cue:
+      template: |
+        outputs: ingress: {
+        	apiVersion: "networking.k8s.io/v1beta1"
+        	kind:       "Ingress"
+        	metadata: name: context.name
+        	spec: rules: [{
+        		host: parameter.domain
+        		http: paths: [
+        			for k, v in parameter.http {
+        				path: k
+        				backend: {
+        					serviceName: context.name
+        					servicePort: v
+        				}
+        			},
+        		]
+        	}]
+        }
+        parameter: {
+        	// +usage=Specify the domain you want to expose
+        	domain: string
+
+        	// +usage=Specify the mapping relationship between the http path and the workload port
+        	http: [string]: int
+        }
+  status:
+    customStatus: |-
+      let igs = context.outputs.ingress.status.loadBalancer.ingress
+      if igs == _|_ {
+      	message: "No loadBalancer found, visiting by using 'vela port-forward " + context.appName + " --route'\n"
+      }
+      if len(igs) > 0 {
+      	if igs[0].ip != _|_ {
+      		message: "Visiting URL: " + context.outputs.ingress.spec.rules[0].host + ", IP: " + igs[0].ip
+      	}
+      	if igs[0].ip == _|_ {
+      		message: "Visiting URL: " + context.outputs.ingress.spec.rules[0].host
+      	}
+      }
+  workloadRefPath: ""
+

charts/vela-core/templates/defwithtemplate/register-grafana-datasource.yaml

@@ -0,0 +1,48 @@
+# Code generated by KubeVela templates. DO NOT EDIT. Please edit the original cue file.
+# Definition source cue file: vela-templates/definitions/internal/register-grafana-datasource.cue
+apiVersion: core.oam.dev/v1beta1
+kind: TraitDefinition
+metadata:
+  annotations:
+    definition.oam.dev/description: Add a datasource to Grafana
+  name: register-grafana-datasource
+  namespace: {{.Values.systemDefinitionNamespace}}
+spec:
+  appliesToWorkloads: []
+  conflictsWith: []
+  podDisruptive: false
+  schematic:
+    cue:
+      template: |
+        outputs: registerdatasource: {
+        	apiVersion: "grafana.extension.oam.dev/v1alpha1"
+        	kind:       "DatasourceRegistration"
+        	spec: {
+        		grafana: {
+        			service:                   parameter.grafanaServiceName
+        			namespace:                 parameter.grafanaServiceNamespace
+        			credentialSecret:          parameter.credentialSecret
+        			credentialSecretNamespace: parameter.credentialSecretNamespace
+        		}
+        		datasource: {
+        			name:      parameter.name
+        			type:      parameter.type
+        			access:    parameter.access
+        			service:   parameter.service
+        			namespace: parameter.namespace
+        		}
+        	}
+        }
+        parameter: {
+        	grafanaServiceName:        string
+        	grafanaServiceNamespace:   *"default" | string
+        	credentialSecret:          string
+        	credentialSecretNamespace: string
+        	name:                      string
+        	type:                      string
+        	access:                    *"proxy" | string
+        	service:                   string
+        	namespace:                 *"default" | string
+        }
+  workloadRefPath: ""
+

charts/vela-core/templates/kubevela-apiserver.yaml

@@ -30,7 +30,7 @@ spec:
           args:
             - "apiserver"
             - "--port={{ .Values.apiServer.port }}"
-          image: {{ .Values.apiserverImage.repository }}:{{ .Values.apiserverImage.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.apiserverImage.repository }}:{{ .Values.apiserverImage.tag }}
           imagePullPolicy: {{ quote .Values.apiserverImage.pullPolicy }}
           resources:
           {{- toYaml .Values.resources | nindent 12 }}

charts/vela-core/templates/kubevela-controller.yaml

@@ -130,7 +130,7 @@ spec:
             {{ if .Values.multicluster.enabled }}
             - "--enable-cluster-gateway"
             {{ end }}
-          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.image.repository }}:{{ .Values.image.tag }}
           imagePullPolicy: {{ quote .Values.image.pullPolicy }}
           resources:
           {{- toYaml .Values.resources | nindent 12 }}

charts/vela-core/templates/test/test-application.yaml

@@ -10,7 +10,7 @@ spec:
     - name: helm-test-express-server
       type: webservice
       properties:
-        image: crccheck/hello-world
+        image: {{ .Values.imageRegistry }}{{ .Values.test.app.repository }}:{{ .Values.test.app.tag }}
         port: 8000
       traits:
         - type: ingress
@@ -30,7 +30,7 @@ spec:
   serviceAccountName: kubevela-vela-core
   containers:
     - name: {{ .Release.Name }}-application-test
-      image: alpine/k8s:1.18.2
+      image: {{ .Values.imageRegistry }}{{ .Values.test.k8s.repository }}:{{ .Values.test.k8s.tag }}
       imagePullPolicy: IfNotPresent
       command:
         - /bin/bash

charts/vela-core/values.yaml

@@ -7,6 +7,8 @@ replicaCount: 1
 applyOnceOnly: "off"
 
 disableCaps: ""
+
+imageRegistry: ""
 image:
   repository: oamdev/vela-core
   tag: latest
@@ -130,4 +132,12 @@ multicluster:
         memory: 200Mi
     secureTLS:
       enabled: true
-      certPath: /etc/k8s-cluster-gateway-certs
+      certPath: /etc/k8s-cluster-gateway-certs
+
+test:
+  app:
+    repository: oamdev/hello-world
+    tag: v1
+  k8s:
+    repository: oamdev/alpine-k8s
+    tag: 1.18.2

charts/vela-minimal/crds/core.oam.dev_applicationrevisions.yaml

@@ -1232,6 +1232,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -1245,11 +1251,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -1259,6 +1270,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -1639,6 +1667,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -1652,11 +1686,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -1666,6 +1705,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -1944,6 +2000,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -1957,11 +2019,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -1971,6 +2038,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -3372,6 +3456,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -3385,11 +3475,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -3399,6 +3494,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -3672,6 +3784,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -3685,11 +3803,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -3699,6 +3822,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -4061,6 +4201,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -4074,11 +4220,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -4088,6 +4239,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -4329,6 +4497,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -4342,11 +4516,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -4356,6 +4535,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -4617,6 +4813,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -4630,11 +4832,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -4644,6 +4851,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object

charts/vela-minimal/crds/core.oam.dev_definitionrevisions.yaml

@@ -222,6 +222,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -235,11 +241,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -249,6 +260,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object
@@ -510,6 +538,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -523,11 +557,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -537,6 +576,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object
@@ -791,6 +847,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -804,11 +866,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -818,6 +885,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object
@@ -1053,6 +1137,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -1066,11 +1156,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -1080,6 +1175,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object

charts/vela-minimal/crds/core.oam.dev_policydefinitions.yaml

@@ -151,6 +151,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -164,11 +169,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -178,6 +187,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/vela-minimal/crds/core.oam.dev_traitdefinitions.yaml

@@ -188,6 +188,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -201,11 +206,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -215,6 +224,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -472,6 +497,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -485,11 +515,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -499,6 +533,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/vela-minimal/crds/core.oam.dev_workflowstepdefinitions.yaml

@@ -148,6 +148,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -161,11 +166,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -175,6 +184,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/vela-minimal/crds/core.oam.dev_workloaddefinitions.yaml

@@ -193,6 +193,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -206,11 +211,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -220,6 +229,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -458,6 +483,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -471,11 +501,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -485,6 +519,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/vela-minimal/templates/admission-webhooks/job-patch/job-createSecret.yaml

@@ -24,7 +24,7 @@ spec:
     spec:
       containers:
         - name: create
-          image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
           imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
           args:
             - create

charts/vela-minimal/templates/admission-webhooks/job-patch/job-patchWebhook.yaml

@@ -24,7 +24,7 @@ spec:
     spec:
       containers:
         - name: patch
-          image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
           imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
           args:
             - patch

charts/vela-minimal/templates/cluster-gateway.yaml

@@ -35,7 +35,7 @@ spec:
             {{ if .Values.multicluster.clusterGateway.secureTLS.enabled }}
             - "--cert-dir={{ .Values.multicluster.clusterGateway.secureTLS.certPath }}"
             {{ end }}
-          image: {{ .Values.multicluster.clusterGateway.image.repository }}:{{ .Values.multicluster.clusterGateway.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.multicluster.clusterGateway.image.repository }}:{{ .Values.multicluster.clusterGateway.image.tag }}
           imagePullPolicy: {{ .Values.multicluster.clusterGateway.image.pullPolicy }}
           resources:
           {{- toYaml .Values.multicluster.clusterGateway.resources | nindent 12 }}
@@ -132,7 +132,7 @@ spec:
     spec:
       containers:
         - name: create
-          image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
           imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
           args:
             - create
@@ -175,7 +175,7 @@ spec:
     spec:
       containers:
         - name: patch
-          image: {{ .Values.multicluster.clusterGateway.image.repository }}:{{ .Values.multicluster.clusterGateway.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.multicluster.clusterGateway.image.repository }}:{{ .Values.multicluster.clusterGateway.image.tag }}
           imagePullPolicy: {{ .Values.multicluster.clusterGateway.image.pullPolicy }}
           command:
             - /patch

charts/vela-minimal/templates/defwithtemplate/depends-on-app.yaml

@@ -27,7 +27,7 @@ spec:
         	}
         }
         load: op.#Steps & {
-        	if dependsOn.err != _|_ && dependsOn.value == _|_ {
+        	if dependsOn.err != _|_ {
         		configMap: op.#Read & {
         			value: {
         				apiVersion: "v1"
@@ -37,18 +37,17 @@ spec:
         					namespace: parameter.namespace
         				}
         			}
-        		}
-        		apply: op.#Apply & {
-        			value: {
-        				yaml.Unmarshal(configMap.value.data[parameter.name])
-        			}
-        		}
+        		}         @step(1)
+        		template: configMap.value.data["application"]
+        		apply:    op.#Apply & {
+        			value: yaml.Unmarshal(template)
+        		}     @step(2)
         		wait: op.#ConditionalWait & {
-        			continue: load.apply.value.status.status == "running"
-        		}
+        			continue: apply.value.status.status == "running"
+        		} @step(3)
         	}
 
-        	if dependsOn.value != _|_ {
+        	if dependsOn.err == _|_ {
         		wait: op.#ConditionalWait & {
         			continue: dependsOn.value.status.status == "running"
         		}

charts/vela-minimal/templates/defwithtemplate/import-grafana-dashboard.yaml

@@ -0,0 +1,39 @@
+# Code generated by KubeVela templates. DO NOT EDIT. Please edit the original cue file.
+# Definition source cue file: vela-templates/definitions/internal/import-grafana-dashboard.cue
+apiVersion: core.oam.dev/v1beta1
+kind: TraitDefinition
+metadata:
+  annotations:
+    definition.oam.dev/description: Import dashboards to Grafana
+  name: import-grafana-dashboard
+  namespace: {{.Values.systemDefinitionNamespace}}
+spec:
+  appliesToWorkloads: []
+  conflictsWith: []
+  podDisruptive: false
+  schematic:
+    cue:
+      template: |
+        outputs: registerdatasource: {
+        	apiVersion: "grafana.extension.oam.dev/v1alpha1"
+        	kind:       "ImportDashboard"
+        	spec: {
+        		grafana: {
+        			service:                   parameter.grafanaServiceName
+        			namespace:                 parameter.grafanaServiceNamespace
+        			credentialSecret:          parameter.credentialSecret
+        			credentialSecretNamespace: parameter.credentialSecretNamespace
+        		}
+        		urls: parameter.urls
+        	}
+        }
+        parameter: {
+        	grafanaServiceName:        string
+        	grafanaServiceNamespace:   *"default" | string
+        	credentialSecret:          string
+        	credentialSecretNamespace: *"default" | string
+        	urls: [...string]
+
+        }
+  workloadRefPath: ""
+

charts/vela-minimal/templates/defwithtemplate/pure-ingress.yaml

@@ -0,0 +1,56 @@
+# Code generated by KubeVela templates. DO NOT EDIT. Please edit the original cue file.
+# Definition source cue file: vela-templates/definitions/internal/pure-ingress.cue
+apiVersion: core.oam.dev/v1beta1
+kind: TraitDefinition
+metadata:
+  annotations:
+    definition.oam.dev/description: Enable public web traffic for the component without creating a Service.
+  name: pure-ingress
+  namespace: {{.Values.systemDefinitionNamespace}}
+spec:
+  appliesToWorkloads: []
+  conflictsWith: []
+  podDisruptive: false
+  schematic:
+    cue:
+      template: |
+        outputs: ingress: {
+        	apiVersion: "networking.k8s.io/v1beta1"
+        	kind:       "Ingress"
+        	metadata: name: context.name
+        	spec: rules: [{
+        		host: parameter.domain
+        		http: paths: [
+        			for k, v in parameter.http {
+        				path: k
+        				backend: {
+        					serviceName: context.name
+        					servicePort: v
+        				}
+        			},
+        		]
+        	}]
+        }
+        parameter: {
+        	// +usage=Specify the domain you want to expose
+        	domain: string
+
+        	// +usage=Specify the mapping relationship between the http path and the workload port
+        	http: [string]: int
+        }
+  status:
+    customStatus: |-
+      let igs = context.outputs.ingress.status.loadBalancer.ingress
+      if igs == _|_ {
+      	message: "No loadBalancer found, visiting by using 'vela port-forward " + context.appName + " --route'\n"
+      }
+      if len(igs) > 0 {
+      	if igs[0].ip != _|_ {
+      		message: "Visiting URL: " + context.outputs.ingress.spec.rules[0].host + ", IP: " + igs[0].ip
+      	}
+      	if igs[0].ip == _|_ {
+      		message: "Visiting URL: " + context.outputs.ingress.spec.rules[0].host
+      	}
+      }
+  workloadRefPath: ""
+

charts/vela-minimal/templates/defwithtemplate/register-grafana-datasource.yaml

@@ -0,0 +1,48 @@
+# Code generated by KubeVela templates. DO NOT EDIT. Please edit the original cue file.
+# Definition source cue file: vela-templates/definitions/internal/register-grafana-datasource.cue
+apiVersion: core.oam.dev/v1beta1
+kind: TraitDefinition
+metadata:
+  annotations:
+    definition.oam.dev/description: Add a datasource to Grafana
+  name: register-grafana-datasource
+  namespace: {{.Values.systemDefinitionNamespace}}
+spec:
+  appliesToWorkloads: []
+  conflictsWith: []
+  podDisruptive: false
+  schematic:
+    cue:
+      template: |
+        outputs: registerdatasource: {
+        	apiVersion: "grafana.extension.oam.dev/v1alpha1"
+        	kind:       "DatasourceRegistration"
+        	spec: {
+        		grafana: {
+        			service:                   parameter.grafanaServiceName
+        			namespace:                 parameter.grafanaServiceNamespace
+        			credentialSecret:          parameter.credentialSecret
+        			credentialSecretNamespace: parameter.credentialSecretNamespace
+        		}
+        		datasource: {
+        			name:      parameter.name
+        			type:      parameter.type
+        			access:    parameter.access
+        			service:   parameter.service
+        			namespace: parameter.namespace
+        		}
+        	}
+        }
+        parameter: {
+        	grafanaServiceName:        string
+        	grafanaServiceNamespace:   *"default" | string
+        	credentialSecret:          string
+        	credentialSecretNamespace: string
+        	name:                      string
+        	type:                      string
+        	access:                    *"proxy" | string
+        	service:                   string
+        	namespace:                 *"default" | string
+        }
+  workloadRefPath: ""
+

charts/vela-minimal/templates/kubevela-apiserver.yaml

@@ -30,7 +30,7 @@ spec:
           args:
             - "apiserver"
             - "--bind-addr=0.0.0.0:{{ .Values.apiServer.port }}"
-          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.image.repository }}:{{ .Values.image.tag }}
           imagePullPolicy: {{ quote .Values.image.pullPolicy }}
           resources:
           {{- toYaml .Values.resources | nindent 12 }}

charts/vela-minimal/templates/kubevela-controller.yaml

@@ -132,7 +132,7 @@ spec:
             {{ if .Values.multicluster.enabled }}
             - "--enable-cluster-gateway"
             {{ end }}
-          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.image.repository }}:{{ .Values.image.tag }}
           imagePullPolicy: {{ quote .Values.image.pullPolicy }}
           resources:
           {{- toYaml .Values.resources | nindent 12 }}

charts/vela-minimal/templates/test/test-application.yaml

@@ -10,53 +10,5 @@ spec:
     - name: helm-test-express-server
       type: webservice
       properties:
-        image: crccheck/hello-world
+        image: {{ .Values.imageRegistry }}{{ .Values.test.app.repository }}:{{ .Values.test.app.tag }}
         port: 8000
-      # traits:
-      #   - type: ingress
-      #     properties:
-      #       domain: testsvc.example.com
-      #       http:
-      #         "/": 8000
-# ---
-# apiVersion: v1
-# kind: Pod
-# metadata:
-#   name: "{{ .Release.Name }}-application-test"
-#   annotations:
-#     "helm.sh/hook": test
-#     helm.sh/hook-delete-policy: hook-succeeded
-# spec:
-#   serviceAccountName: kubevela-vela-core
-#   containers:
-#     - name: {{ .Release.Name }}-application-test
-#       image: alpine/k8s:1.18.2
-#       imagePullPolicy: IfNotPresent
-#       command:
-#         - /bin/bash
-#         - -ec
-#         - |
-
-#           set -e
-
-#           echo "Waiting application is ready..."
-
-#           echo "waiting for application being Ready"
-#           kubectl -n vela-system wait --for=condition=Ready applications.core.oam.dev helm-test-vela-app --timeout=3m
-#           echo "application is Ready"
-
-#           # wait for deploy being created
-#           echo "waiting for deployment being available"
-#           kubectl -n vela-system wait --for=condition=available deployments helm-test-express-server --timeout 3m
-#           echo "deployment being available"
-
-#           # wait for ingress being created
-#           while ! [ `kubectl -n vela-system get ing helm-test-express-server | grep -v NAME | wc -l` = 1 ]; do
-#             echo "waiting for ingress being created"
-#             sleep 1
-#           done
-
-
-
-#           echo "Application and its components are created"
-#   restartPolicy: Never

charts/vela-minimal/values.yaml

@@ -7,6 +7,8 @@ replicaCount: 1
 applyOnceOnly: "off"
 
 disableCaps: "manualscalertrait,containerizedwokrload,envbinding"
+
+imageRegistry: ""
 image:
   repository: oamdev/vela-core
   tag: latest
@@ -125,4 +127,9 @@ multicluster:
         memory: 200Mi
     secureTLS:
       enabled: true
-      certPath: /etc/k8s-cluster-gateway-certs
+      certPath: /etc/k8s-cluster-gateway-certs
+
+test:
+  app:
+    repository: oamdev/hello-world
+    tag: v1

cmd/core/main.go

@@ -44,6 +44,7 @@ import (
 	oamv1alpha2 "github.com/oam-dev/kubevela/pkg/controller/core.oam.dev/v1alpha2"
 	"github.com/oam-dev/kubevela/pkg/controller/utils"
 	"github.com/oam-dev/kubevela/pkg/cue/packages"
+	_ "github.com/oam-dev/kubevela/pkg/monitor/metrics"
 	"github.com/oam-dev/kubevela/pkg/multicluster"
 	"github.com/oam-dev/kubevela/pkg/oam"
 	"github.com/oam-dev/kubevela/pkg/oam/discoverymapper"
@@ -112,6 +113,8 @@ func main() {
 	flag.StringVar(&storageDriver, "storage-driver", "Local", "Application file save to the storage driver")
 	flag.DurationVar(&syncPeriod, "informer-re-sync-interval", 60*time.Minute,
 		"controller shared informer lister full re-sync period")
+	flag.DurationVar(&commonconfig.ReconcileTimeout, "reconcile-timeout", time.Minute*3,
+		"the timeout for controller reconcile")
 	flag.StringVar(&oam.SystemDefinitonNamespace, "system-definition-namespace", "vela-system", "define the namespace of the system-level definition")
 	flag.IntVar(&controllerArgs.ConcurrentReconciles, "concurrent-reconciles", 4, "concurrent-reconciles is the concurrent reconcile number of the controller. The default value is 4")
 	flag.Float64Var(&qps, "kube-api-qps", 50, "the qps for reconcile clients. Low qps may lead to low throughput. High qps may give stress to api-server. Raise this value if concurrent-reconciles is set to be high.")

commitlint.config.js

@@ -1,32 +0,0 @@
-const Configuration = {
-  /*
-   * Resolve and load @commitlint/config-conventional from node_modules.
-   * Referenced packages must be installed
-   */
-  extends: ['@commitlint/config-conventional'],
-  /*
-   * Any rules defined here will override rules from @commitlint/config-conventional
-   */
-  rules: {
-    'type-enum': [
-			2,
-			'always',
-			[
-				'Build',
-				'Chore',
-				'CI',
-				'Docs',
-				'Feat',
-				'Fix',
-				'Perf',
-				'Refactor',
-				'Revert',
-				'Style',
-				'Test',
-			],
-		],
-    'type-case': [2, 'never', 'lower-case'],
-  },
-};
-
-module.exports = Configuration;

design/api/vela-controller-params-reference.md

@@ -22,6 +22,7 @@
 |        disable-caps         | string |                ""                 |           To be disabled builtin capability list.            |
 |       storage-driver        | string |               Local               |         Application file save to the storage driver          |
 |  informer-re-sync-interval  |  time  |                1h                 | Controller shared informer lister full re-sync period, the interval between two routinely reconciles for one CR (like Application) if no changes made to it. |
+|      reconcile-timeout      |  time  |                3m                 |           The timeout for controller reconcile.              |
 | system-definition-namespace | string |            vela-system            |     define the namespace of the system-level definition      |
 |    concurrent-reconciles    |  int   |                 4                 | The concurrent reconcile number of the controller. You can increase the degree of concurrency if a large number of CPU cores are provided to the controller. |
 |        kube-api-qps         |  int   |                50                 | The qps for reconcile k8s clients. Increase it if you have high concurrency. A small number might restrict the requests to the api-server which may cause a long waiting queue when there are a large number of inflight requests. Try to avoid setting it too high since it will cause large burden on apiserver. |
@@ -39,4 +40,4 @@
 | Medium | < 500   |   < 5,000     | < 30,000 |              4        |      500     |      800       |     1 |   2Gi  |
 | Large | < 1,000  |   < 12,000    | < 72,000 |              4        |      800     |     1,000      |     2 |   4Gi  |
 
-> For details, read KubeVela Performance Test Report
+> For details, read KubeVela Performance Test Report

docs/examples/obervability/README.md

@@ -1,4 +1,4 @@
 This repo is the source artifacts for addon `observability`.
 
-- All .cue files are source artifacts from definition of [observability-asset](../../../vela-templates/addons/observability-asset).
-- `initializer-observability.yaml` will help developer  [observability](../../../vela-templates/addons/observability).
+- All files in definitions are source artifacts which is now built-in in `vela-core` helm chart.
+- `application-observability.yaml` will help developer  [observability](../../../vela-templates/addons/observability).

docs/examples/obervability/trait-import-grafana-dashboard.cue

@@ -1,21 +0,0 @@
-outputs: registerdatasource: {
-	apiVersion: "grafana.extension.oam.dev/v1alpha1"
-	kind:       "ImportDashboard"
-	spec: {
-		grafana: {
-			service:                   parameter.grafanaServiceName
-			namespace:                 parameter.grafanaServiceNamespace
-			credentialSecret:          parameter.credentialSecret
-			credentialSecretNamespace: parameter.credentialSecretNamespace
-		}
-		urls: parameter.urls
-	}
-}
-
-parameter: {
-	grafanaServiceName:        string
-	grafanaServiceNamespace:   *"default" | string
-	credentialSecret:          string
-	credentialSecretNamespace: *"default" | string
-	urls: [...string]
-}

docs/examples/obervability/trait-register-grafana-datasource.cue

@@ -1,31 +0,0 @@
-outputs: registerdatasource: {
-	apiVersion: "grafana.extension.oam.dev/v1alpha1"
-	kind:       "DatasourceRegistration"
-	spec: {
-		grafana: {
-			service:                   parameter.grafanaServiceName
-			namespace:                 parameter.grafanaServiceNamespace
-			credentialSecret:          parameter.credentialSecret
-			credentialSecretNamespace: parameter.credentialSecretNamespace
-		}
-		datasource: {
-			name:      parameter.name
-			type:      parameter.type
-			access:    parameter.access
-			service:   parameter.service
-			namespace: parameter.namespace
-		}
-	}
-}
-
-parameter: {
-	grafanaServiceName:        string
-	grafanaServiceNamespace:   *"default" | string
-	credentialSecret:          string
-	credentialSecretNamespace: string
-	name:                      string
-	type:                      string
-	access:                    *"proxy" | string
-	service:                   string
-	namespace:                 *"default" | string
-}

docs/examples/terraform/cloud-resource-provision-and-consume/application-ask.yaml

@@ -0,0 +1,13 @@
+apiVersion: core.oam.dev/v1beta1
+kind: Application
+metadata:
+  name: app-ask-sample
+spec:
+  components:
+    - name: sample-ask
+      type: alibaba-ask
+      properties:
+        name: kubevela
+
+        writeConnectionSecretToRef:
+          name: ask-conn

docs/examples/terraform/cloud-resource-provision-and-consume/application-rds.yaml

@@ -0,0 +1,14 @@
+apiVersion: core.oam.dev/v1beta1
+kind: Application
+metadata:
+  name: app-rds-sample
+spec:
+  components:
+    - name: sample-db
+      type: alibaba-rds
+      properties:
+        instance_name: sample-db
+        account_name: oamtest
+        password: U34rfwefwefffaked
+        writeConnectionSecretToRef:
+          name: db-conn

docs/examples/terraform/cloud-resource-provision-and-consume/application-sls-project.yaml

@@ -0,0 +1,14 @@
+apiVersion: core.oam.dev/v1beta1
+kind: Application
+metadata:
+  name: app-sls-project-sample
+spec:
+  components:
+    - name: sample-sls-project
+      type: alibaba-sls-project
+      properties:
+        name: kubevela-1112
+        description: "Managed by KubeVela"
+
+        writeConnectionSecretToRef:
+          name: sls-project-conn

docs/examples/terraform/cloud-resource-provision-and-consume/application-sls-store.yaml

@@ -0,0 +1,16 @@
+apiVersion: core.oam.dev/v1beta1
+kind: Application
+metadata:
+  name: app-sls-store-sample
+spec:
+  components:
+    - name: sample-sls-store
+      type: alibaba-sls-store
+      properties:
+        store_name: kubevela-1111
+        store_retention_period: 30
+        store_shard_count: 2
+        store_max_split_shard_count: 2
+
+        writeConnectionSecretToRef:
+          name: sls-store-conn

docs/examples/terraform/cloud-resource-provision-and-consume/application-vpc.yaml

@@ -0,0 +1,13 @@
+apiVersion: core.oam.dev/v1beta1
+kind: Application
+metadata:
+  name: app-vpc-sample
+spec:
+  components:
+    - name: sample-vpc
+      type: alibaba-vpc
+      properties:
+        vpc_cidr: "172.16.0.0/12"
+
+        writeConnectionSecretToRef:
+          name: vpc-conn

docs/examples/terraform/cloud-resource-provision-and-consume/application-vswitch.yaml

@@ -0,0 +1,15 @@
+apiVersion: core.oam.dev/v1beta1
+kind: Application
+metadata:
+  name: app-vpc-sample
+spec:
+  components:
+    - name: sample-vswitch
+      type: alibaba-vswitch
+      properties:
+        vpc_cidr: "172.16.0.0/12"
+        vswitch_cidr: "172.16.0.0/18"
+        zone_id: cn-beijing-a
+
+        writeConnectionSecretToRef:
+          name: vswitch-conn

e2e/application/application_test.go

@@ -49,11 +49,11 @@ var _ = ginkgo.Describe("Test Vela Application", func() {
 	e2e.EnvInitContext("env init", envName)
 	e2e.EnvSetContext("env set", envName)
 	e2e.JsonAppFileContext("deploy app-basic", appbasicJsonAppFile)
+	ApplicationExecContext("exec -- COMMAND", applicationName)
 	e2e.JsonAppFileContext("update app-basic, add scaler trait with replicas 2", appbasicAddTraitJsonAppFile)
 	e2e.ComponentListContext("ls", applicationName, workloadType, traitAlias)
 	ApplicationStatusContext("status", applicationName, workloadType)
 	ApplicationStatusDeeplyContext("status", applicationName, workloadType, envName)
-	ApplicationExecContext("exec -- COMMAND", applicationName)
 	// ApplicationPortForwardContext("port-forward", applicationName)
 	e2e.WorkloadDeleteContext("delete", applicationName)
 
@@ -88,9 +88,8 @@ var ApplicationStatusDeeplyContext = func(context string, applicationName, workl
 			}, 180*time.Second, 1*time.Second).Should(gomega.BeTrue())
 
 			cli := fmt.Sprintf("vela status %s", applicationName)
-			output, err := e2e.LongTimeExec(cli, 120*time.Second)
+			_, err = e2e.LongTimeExec(cli, 120*time.Second)
 			gomega.Expect(err).NotTo(gomega.HaveOccurred())
-			gomega.Expect(output).To(gomega.ContainSubstring("Checking health status"))
 			// TODO(zzxwill) need to check workloadType after app status is refined
 		})
 	})

e2e/application/vela.yaml

@@ -0,0 +1,12 @@
+createTime: "0001-01-01T00:00:00Z"
+name: initmyapp
+services:
+  mysvc:
+    addRevisionLabel: false
+    cpu: "0.5"
+    image: nginx:latest
+    imagePullPolicy: Always
+    memory: 200M
+    port: 80
+    type: webservice
+updateTime: "0001-01-01T00:00:00Z"

e2e/commonContext.go

@@ -127,7 +127,7 @@ var (
 				cli := fmt.Sprintf("vela delete %s", applicationName)
 				output, err := Exec(cli)
 				gomega.Expect(err).NotTo(gomega.HaveOccurred())
-				gomega.Expect(output).To(gomega.ContainSubstring("deleted from env"))
+				gomega.Expect(output).To(gomega.ContainSubstring("already deleted"))
 			})
 		})
 	}

go.mod

@@ -10,7 +10,7 @@ require (
 	github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b
 	github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869
 	github.com/briandowns/spinner v1.11.1
-	github.com/containerd/containerd v1.4.11
+	github.com/containerd/containerd v1.4.12
 	github.com/coreos/prometheus-operator v0.41.1
 	github.com/crossplane/crossplane-runtime v0.14.1-0.20210722005935-0b469fcc77cd
 	github.com/davecgh/go-spew v1.1.1
@@ -29,18 +29,21 @@ require (
 	github.com/gosuri/uitable v0.0.4
 	github.com/hashicorp/hcl/v2 v2.9.1
 	github.com/hinshun/vt10x v0.0.0-20180616224451-1954e6464174
+	github.com/huandu/xstrings v1.3.2 // indirect
 	github.com/imdario/mergo v0.3.12
 	github.com/kyokomi/emoji v2.2.4+incompatible
+	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/hashstructure/v2 v2.0.1
-	github.com/oam-dev/cluster-gateway v1.1.2
+	github.com/oam-dev/cluster-gateway v1.1.6
 	github.com/oam-dev/terraform-config-inspect v0.0.0-20210418082552-fc72d929aa28
-	github.com/oam-dev/terraform-controller v0.2.6
+	github.com/oam-dev/terraform-controller v0.2.12
 	github.com/olekukonko/tablewriter v0.0.5
 	github.com/onsi/ginkgo v1.16.4
 	github.com/onsi/gomega v1.16.0
 	github.com/opencontainers/runc v1.0.0-rc95 // indirect
 	github.com/openkruise/kruise-api v0.9.0
 	github.com/pkg/errors v0.9.1
+	github.com/prometheus/client_golang v1.11.0
 	github.com/sirupsen/logrus v1.8.1
 	github.com/spf13/cobra v1.2.1
 	github.com/spf13/pflag v1.0.5
@@ -51,6 +54,7 @@ require (
 	go.mongodb.org/mongo-driver v1.5.1
 	go.uber.org/zap v1.18.1
 	golang.org/x/oauth2 v0.0.0-20210402161424-2e8d93401602
+	golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b // indirect
 	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
 	gotest.tools v2.2.0+incompatible
 	helm.sh/helm/v3 v3.6.1
@@ -77,5 +81,6 @@ require (
 
 replace (
 	github.com/docker/docker => github.com/moby/moby v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible
-	github.com/wercker/stern => github.com/oam-dev/stern v1.13.0-alpha
+	github.com/wercker/stern => github.com/oam-dev/stern v1.13.1
+	sigs.k8s.io/apiserver-network-proxy/konnectivity-client => sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.24
 )

go.sum

@@ -77,6 +77,7 @@ github.com/Azure/go-autorest/autorest v0.9.0/go.mod h1:xyHB1BMZT0cuDHU7I0+g046+B
 github.com/Azure/go-autorest/autorest v0.9.3-0.20191028180845-3492b2aff503/go.mod h1:xyHB1BMZT0cuDHU7I0+g046+BFDTQ8rEZB0s4Yfa6bI=
 github.com/Azure/go-autorest/autorest v0.10.0/go.mod h1:/FALq9T/kS7b5J5qsQ+RSTUdAmGFqi0vUdVNNx8q630=
 github.com/Azure/go-autorest/autorest v0.10.2/go.mod h1:/FALq9T/kS7b5J5qsQ+RSTUdAmGFqi0vUdVNNx8q630=
+github.com/Azure/go-autorest/autorest v0.11.1/go.mod h1:JFgpikqFJ/MleTTxwepExTKnFUKKszPS8UavbQYUMuw=
 github.com/Azure/go-autorest/autorest v0.11.12/go.mod h1:eipySxLmqSyC5s5k1CLupqet0PSENBEDP93LQ9a8QYw=
 github.com/Azure/go-autorest/autorest v0.11.18 h1:90Y4srNYrwOtAgVo3ndrQkTYn6kf1Eg/AjTFJ8Is2aM=
 github.com/Azure/go-autorest/autorest v0.11.18/go.mod h1:dSiJPy22c3u0OtOKDNttNgqpNFY/GeWa7GH/Pz56QRA=
@@ -84,6 +85,7 @@ github.com/Azure/go-autorest/autorest/adal v0.5.0/go.mod h1:8Z9fGy2MpX0PvDjB1pEg
 github.com/Azure/go-autorest/autorest/adal v0.8.1-0.20191028180845-3492b2aff503/go.mod h1:Z6vX6WXXuyieHAXwMj0S6HY6e6wcHn37qQMBQlvY3lc=
 github.com/Azure/go-autorest/autorest/adal v0.8.2/go.mod h1:ZjhuQClTqx435SRJ2iMlOxPYt3d2C/T/7TiQCVZSn3Q=
 github.com/Azure/go-autorest/autorest/adal v0.8.3/go.mod h1:ZjhuQClTqx435SRJ2iMlOxPYt3d2C/T/7TiQCVZSn3Q=
+github.com/Azure/go-autorest/autorest/adal v0.9.0/go.mod h1:/c022QCutn2P7uY+/oQWWNcK9YU+MH96NgK+jErpbcg=
 github.com/Azure/go-autorest/autorest/adal v0.9.5/go.mod h1:B7KF7jKIeC9Mct5spmyCB/A8CG/sEz1vwIRGv/bbw7A=
 github.com/Azure/go-autorest/autorest/adal v0.9.13 h1:Mp5hbtOePIzM8pJVRa3YLrWWmZtoxRXqUEzCfJt3+/Q=
 github.com/Azure/go-autorest/autorest/adal v0.9.13/go.mod h1:W/MM4U6nLxnIskrw4UwWzlHfGjwUS50aOsc/I3yuU8M=
@@ -94,6 +96,7 @@ github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSY
 github.com/Azure/go-autorest/autorest/mocks v0.1.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
 github.com/Azure/go-autorest/autorest/mocks v0.2.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
 github.com/Azure/go-autorest/autorest/mocks v0.3.0/go.mod h1:a8FDP3DYzQ4RYfVAxAN3SVSiiO77gL2j2ronKKP0syM=
+github.com/Azure/go-autorest/autorest/mocks v0.4.0/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
 github.com/Azure/go-autorest/autorest/mocks v0.4.1 h1:K0laFcLE6VLTOwNgSxaGbUcLPuGXlNkbVvq4cW4nIHk=
 github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
 github.com/Azure/go-autorest/autorest/to v0.3.0/go.mod h1:MgwOyqaIuKdG4TL/2ywSsIWKAfJfgHDo8ObuUk3t5sA=
@@ -178,6 +181,7 @@ github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk5
 github.com/alessio/shellescape v1.2.2 h1:8LnL+ncxhWT2TR00dfJRT25JWWrhkMZXneHVWnetDZg=
 github.com/alessio/shellescape v1.2.2/go.mod h1:PZAiSCk0LJaZkiCSkPv8qIobYglO3FPpyFjDCtHLS30=
 github.com/alexkohler/prealloc v1.0.0/go.mod h1:VetnK3dIgFBBKmg0YnD9F9x6Icjd+9cvfHR56wJVlKE=
+github.com/aliyun/alibaba-cloud-sdk-go v1.61.1318/go.mod h1:9CMdKNL3ynIGPpfTcdwTvIm8SGuAZYYC4jFVSSvE1YQ=
 github.com/aliyun/aliyun-oss-go-sdk v2.0.4+incompatible/go.mod h1:T/Aws4fEfogEE9v+HPhhw+CntffsBHJ8nXQCwKr0/g8=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.0/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
@@ -307,8 +311,8 @@ github.com/containerd/console v0.0.0-20180822173158-c12b1e7919c1/go.mod h1:Tj/on
 github.com/containerd/console v1.0.2/go.mod h1:ytZPjGgY2oeTkAONYafi2kSj0aYggsf8acV1PGKCbzQ=
 github.com/containerd/containerd v1.3.2/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
 github.com/containerd/containerd v1.4.4/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.4.11 h1:QCGOUN+i70jEEL/A6JVIbhy4f4fanzAzSR4kNG7SlcE=
-github.com/containerd/containerd v1.4.11/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
+github.com/containerd/containerd v1.4.12 h1:V+SHzYmhng/iju6M5nFrpTTusrhidoxKTwdwLw+u4c4=
+github.com/containerd/containerd v1.4.12/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
 github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20201208142359-180525291bb7 h1:6ejg6Lkk8dskcM7wQ28gONkukbQkM4qpj4RnYbpFzrI=
 github.com/containerd/continuity v0.0.0-20201208142359-180525291bb7/go.mod h1:kR3BEg7bDFaEddKm54WSmrol1fKWDU1nKYkgrcgZT7Y=
@@ -670,6 +674,7 @@ github.com/gogo/protobuf v1.3.0/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXP
 github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/goji/httpauth v0.0.0-20160601135302-2da839ab0f4d/go.mod h1:nnjvkQ9ptGaCkuDUx6wNykzzlUixGxvkme+H/lnzb+A=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
 github.com/golang/geo v0.0.0-20190916061304-5b978397cfec/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
@@ -905,8 +910,9 @@ github.com/hinshun/vt10x v0.0.0-20180616224451-1954e6464174/go.mod h1:DqJ97dSdRW
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/huandu/xstrings v1.0.0/go.mod h1:4qWG/gcEcfX4z/mBDHJ++3ReCw9ibxbsNJbcucJdbSo=
 github.com/huandu/xstrings v1.2.0/go.mod h1:DvyZB1rfVYsBIigL8HwpZgxHwXozlTgGqn63UyNX5k4=
-github.com/huandu/xstrings v1.3.1 h1:4jgBlKK6tLKFvO8u5pmYjG91cqytmDCDvGh7ECVFfFs=
 github.com/huandu/xstrings v1.3.1/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/huandu/xstrings v1.3.2 h1:L18LIDzqlW6xN2rEkpdV8+oL/IXWJ1APd+vsdYy4Wdw=
+github.com/huandu/xstrings v1.3.2/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/hudl/fargo v1.3.0/go.mod h1:y3CKSmjA+wD2gak7sUSXTAoopbhU08POFhmITJgmKTg=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
@@ -960,6 +966,7 @@ github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFF
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v0.0.0-20180612202835-f2b4162afba3/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v0.0.0-20180701071628-ab8a2e0c74be/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.5/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.8/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
@@ -1121,8 +1128,9 @@ github.com/minio/minio-go/v6 v6.0.49/go.mod h1:qD0lajrGW49lKZLtXKtCB4X/qkMf0a5tB
 github.com/minio/sha256-simd v0.1.1/go.mod h1:B5e1o+1/KgNmWrSQK08Y6Z1Vb5pwIktudl0J58iy0KM=
 github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
 github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
-github.com/mitchellh/copystructure v1.1.1 h1:Bp6x9R1Wn16SIz3OfeDr0b7RnCG2OB66Y7PQyC/cvq4=
 github.com/mitchellh/copystructure v1.1.1/go.mod h1:EBArHfARyrSWO/+Wyr9zwEkc6XMFB9XyNgFNmRkZZU4=
+github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
+github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/go-homedir v0.0.0-20161203194507-b8bc1bf76747/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
@@ -1143,13 +1151,15 @@ github.com/mitchellh/mapstructure v1.2.2/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RR
 github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f/go.mod h1:OkQIRizQZAeMln+1tSwduZz7+Af5oFlKirV/MSYes2A=
 github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/mitchellh/reflectwalk v1.0.1 h1:FVzMWA5RllMAKIdUSC8mdWo3XtwoecrH79BY70sEEpE=
 github.com/mitchellh/reflectwalk v1.0.1/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
+github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/moby/moby v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible h1:NT0cwArZg/wGdvY8pzej4tPr+9WGmDdkF8Suj+mkz2g=
 github.com/moby/moby v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible/go.mod h1:fDXVQ6+S340veQPv35CzDahGBmHsiclFwfEygB/TWMc=
 github.com/moby/spdystream v0.2.0 h1:cjW1zVyyoiM0T7b6UoySUFqzXMoqRckQtXwGPiBhOM8=
 github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
 github.com/moby/sys/mountinfo v0.4.1/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
+github.com/moby/term v0.0.0-20200312100748-672ec06f55cd/go.mod h1:DdlQx2hp0Ss5/fLikoLlEeIYiATotOjgB//nb973jeo=
 github.com/moby/term v0.0.0-20201216013528-df9cb8a40635/go.mod h1:FBS0z0QWA44HXygs7VXDUOGoN/1TV3RuWkLO04am3wc=
 github.com/moby/term v0.0.0-20210610120745-9d4ed1856297 h1:yH0SvLzcbZxcJXho2yh7CqdENGMQe73Cw3woZBpPli0=
 github.com/moby/term v0.0.0-20210610120745-9d4ed1856297/go.mod h1:vgPCkQMyxTZ7IDy8SXRufE172gr8+K/JE/7hHFxHW3A=
@@ -1182,6 +1192,7 @@ github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRW
 github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mwitkow/go-proto-validators v0.0.0-20180403085117-0950a7990007/go.mod h1:m2XC9Qq0AlmmVksL6FktJCdTYyLk7V3fKyp0sl1yWQo=
 github.com/mwitkow/go-proto-validators v0.2.0/go.mod h1:ZfA1hW+UH/2ZHOWvQ3HnQaU0DtnpXu850MZiy+YUgcc=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
 github.com/nakabonne/nestif v0.3.0/go.mod h1:dI314BppzXjJ4HsCnbo7XzrJHPszZsjnk5wEBSYHI2c=
 github.com/nats-io/jwt v0.3.0/go.mod h1:fRYCDE99xlTsqUzISS1Bi75UBJ6ljOJQOAAu5VglpSg=
@@ -1200,14 +1211,14 @@ github.com/nishanths/predeclared v0.2.1/go.mod h1:HvkGJcA3naj4lOwnFXFDkFxVtSqQMB
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
-github.com/oam-dev/cluster-gateway v1.1.2 h1:sxC8Uyx/d3Yu8nIFSz31i+4JKhJfDAS9XVIPEWa1y+Q=
-github.com/oam-dev/cluster-gateway v1.1.2/go.mod h1:EjPUZwTYBe+gFtPV/yGohLE19fDr3CUg4tfSRY72fkM=
-github.com/oam-dev/stern v1.13.0-alpha h1:EVjM8Qvh6LssB6t4RZrjf9DtCq1cz+/cy6OF7fpy9wk=
-github.com/oam-dev/stern v1.13.0-alpha/go.mod h1:AOkvfFUv0Arz7GBi0jz7S0Jsu4K/kdvSjNsnRt1+BIg=
+github.com/oam-dev/cluster-gateway v1.1.6 h1:CY6m2Qcs6XJ/l/NY48CdHD7GAel9zZ/erUOz2zYzxkI=
+github.com/oam-dev/cluster-gateway v1.1.6/go.mod h1:SF7S4Ss+VUs2OVxmvSrrFGcaNFoXy6JWxHAnUxC1QcY=
+github.com/oam-dev/stern v1.13.1 h1:Gt7xMBmQjRueHVFjRo5CHDTVhiYrssjlmvPwRiZtq7c=
+github.com/oam-dev/stern v1.13.1/go.mod h1:0pLjZt0amXE/ErF16Rdrgd98H2owN8Hmn3/7CX5+AeA=
 github.com/oam-dev/terraform-config-inspect v0.0.0-20210418082552-fc72d929aa28 h1:tD8HiFKnt0jnwdTWjeqUnfnUYLD/+Nsmj8ZGIxqDWiU=
 github.com/oam-dev/terraform-config-inspect v0.0.0-20210418082552-fc72d929aa28/go.mod h1:Mu8i0/DdplvnjwRbAYPsc8+LRR27n/mp8VWdkN10GzE=
-github.com/oam-dev/terraform-controller v0.2.6 h1:aoEj4sfxDMBdTkM5uKYmjVFOgjhYeYBm0xzdRb4+Xu0=
-github.com/oam-dev/terraform-controller v0.2.6/go.mod h1:xFSCd3Nwuh6P1HEpx5jDnLzN35T9hoH53zdojDYE6LI=
+github.com/oam-dev/terraform-controller v0.2.12 h1:WIcpV4JWVOiN52DOjwiOTvy4+snSWzX2ltFAnXP1QqE=
+github.com/oam-dev/terraform-controller v0.2.12/go.mod h1:DbdquoYxiWoZnYpRsHH/HKdR1REYdwRQycYJuC1CUdQ=
 github.com/oklog/oklog v0.3.2/go.mod h1:FCV+B7mhrz4o+ueLpx+KqkyXRGMWOYEvfiXtdGtbWGs=
 github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
 github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DVU=
@@ -1296,7 +1307,6 @@ github.com/philhofer/fwd v1.0.0/go.mod h1:gk3iGcWd9+svBvR0sR+KPcfE+RNWozjowpeBVG
 github.com/pierrec/lz4 v1.0.2-0.20190131084431-473cd7ce01a1/go.mod h1:3/3N9NVKO0jef7pBehbT1qWhCMrIgbYNnFAZCqQ5LRc=
 github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
-github.com/pkg/errors v0.0.0-20180311214515-816c9085562c/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -1955,6 +1965,7 @@ golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200923182605-d9f96fdee20d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201112073958-5cba982894dd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1982,8 +1993,9 @@ golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069 h1:siQdpVirKtzPhKl3lZWozZraC
 golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d h1:SZxvLBoTP5yHO3Frd4z4vrF+DBX9vMVanchswa69toE=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b h1:9zKuko04nR4gjZ4+DNjHqRlAJqbJETHwiNKDqTfOjfE=
+golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -2002,6 +2014,7 @@ golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxb
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20210611083556-38a9dc6acbc6/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac h1:7zkz7BUtwNFFqcowJ+RIgu2MaV/MapERkDIy+mwPyjs=
@@ -2367,6 +2380,7 @@ k8s.io/api v0.18.2/go.mod h1:SJCWI7OLzhZSvbY7U8zwNl9UA4o1fizoug34OV/2r78=
 k8s.io/api v0.18.3/go.mod h1:UOaMwERbqJMfeeeHc8XJKawj4P9TgDRnViIqqBeH2QA=
 k8s.io/api v0.18.6/go.mod h1:eeyxr+cwCjMdLAmr2W3RyDI0VvTawSg/3RFFBEnmZGI=
 k8s.io/api v0.18.8/go.mod h1:d/CXqwWv+Z2XEG1LgceeDmHQwpUJhROPx16SlxJgERY=
+k8s.io/api v0.20.10/go.mod h1:0kei3F6biGjtRQBo5dUeujq6Ji3UCh9aOSfp/THYd7I=
 k8s.io/api v0.21.0/go.mod h1:+YbrhBBGgsxbF6o6Kj4KJPJnBmAKuXDeS3E18bgHNVU=
 k8s.io/api v0.21.1/go.mod h1:FstGROTmsSHBarKc8bylzXih8BLNYTiS3TZcsoEDg2s=
 k8s.io/api v0.21.2/go.mod h1:Lv6UGJZ1rlMI1qusN8ruAp9PUBFyBwpEHAdG24vIsiU=
@@ -2394,6 +2408,7 @@ k8s.io/apimachinery v0.18.2/go.mod h1:9SnR/e11v5IbyPCGbvJViimtJ0SwHG4nfZFjU77ftc
 k8s.io/apimachinery v0.18.3/go.mod h1:OaXp26zu/5J7p0f92ASynJa1pZo06YlV9fG7BoWbCko=
 k8s.io/apimachinery v0.18.6/go.mod h1:OaXp26zu/5J7p0f92ASynJa1pZo06YlV9fG7BoWbCko=
 k8s.io/apimachinery v0.18.8/go.mod h1:6sQd+iHEqmOtALqOFjSWp2KZ9F0wlU/nWm0ZgsYWMig=
+k8s.io/apimachinery v0.20.10/go.mod h1:kQa//VOAwyVwJ2+L9kOREbsnryfsGSkSM1przND4+mw=
 k8s.io/apimachinery v0.21.0/go.mod h1:jbreFvJo3ov9rj7eWT7+sYiRx+qZuCYXwWT1bcDswPY=
 k8s.io/apimachinery v0.21.1/go.mod h1:jbreFvJo3ov9rj7eWT7+sYiRx+qZuCYXwWT1bcDswPY=
 k8s.io/apimachinery v0.21.2/go.mod h1:CdTY8fU/BlvAbJ2z/8kBwimGki5Zp8/fbVuLY8gJumM=
@@ -2423,6 +2438,7 @@ k8s.io/client-go v0.18.2/go.mod h1:Xcm5wVGXX9HAA2JJ2sSBUn3tCJ+4SVlCbl2MNNv+CIU=
 k8s.io/client-go v0.18.3/go.mod h1:4a/dpQEvzAhT1BbuWW09qvIaGw6Gbu1gZYiQZIi1DMw=
 k8s.io/client-go v0.18.6/go.mod h1:/fwtGLjYMS1MaM5oi+eXhKwG+1UHidUEXRh6cNsdO0Q=
 k8s.io/client-go v0.18.8/go.mod h1:HqFqMllQ5NnQJNwjro9k5zMyfhZlOwpuTLVrxjkYSxU=
+k8s.io/client-go v0.20.10/go.mod h1:fFg+aLoasv/R+xiVaWjxeqGFYltzgQcOQzkFaSRfnJ0=
 k8s.io/client-go v0.21.0/go.mod h1:nNBytTF9qPFDEhoqgEPaarobC8QPae13bElIVHzIglA=
 k8s.io/client-go v0.21.1/go.mod h1:/kEw4RgW+3xnBGzvp9IWxKSNA+lXn3A7AuH3gdOAzLs=
 k8s.io/client-go v0.21.2/go.mod h1:HdJ9iknWpbl3vMGtib6T2PyI/VYxiZfq936WNVHBRrA=
@@ -2444,6 +2460,7 @@ k8s.io/component-base v0.0.0-20191122220729-2684fb322cb9/go.mod h1:NFuUusy/X4Tk2
 k8s.io/component-base v0.17.0/go.mod h1:rKuRAokNMY2nn2A6LP/MiwpoaMRHpfRnrPaUJJj1Yoc=
 k8s.io/component-base v0.18.2/go.mod h1:kqLlMuhJNHQ9lz8Z7V5bxUUtjFZnrypArGl58gmDfUM=
 k8s.io/component-base v0.18.6/go.mod h1:knSVsibPR5K6EW2XOjEHik6sdU5nCvKMrzMt2D4In14=
+k8s.io/component-base v0.20.10/go.mod h1:ZKOEin1xu68aJzxgzl5DZSp5J1IrjAOPlPN90/t6OI8=
 k8s.io/component-base v0.21.0/go.mod h1:qvtjz6X0USWXbgmbfXR+Agik4RZ3jv2Bgr5QnZzdPYw=
 k8s.io/component-base v0.21.2/go.mod h1:9lvmIThzdlrJj5Hp8Z/TOgIkdfsNARQ1pT+3PByuiuc=
 k8s.io/component-base v0.21.3/go.mod h1:kkuhtfEHeZM6LkX0saqSK8PbdO7A0HigUngmhhrwfGQ=
@@ -2509,6 +2526,7 @@ mvdan.cc/gofumpt v0.1.1/go.mod h1:yXG1r1WqZVKWbVRtBWKWX9+CxGYfA51nSomhM0woR48=
 mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed/go.mod h1:Xkxe497xwlCKkIaQYRfC7CSLworTXY9RMqwhhCm+8Nc=
 mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b/go.mod h1:2odslEg/xrtNQqCYg2/jCoyKnw3vv5biOc3JnIcYfL4=
 mvdan.cc/unparam v0.0.0-20210104141923-aac4ce9116a7/go.mod h1:hBpJkZE8H/sb+VRFvw2+rBpHNsTBcvSpk61hr8mzXZE=
+open-cluster-management.io/api v0.0.0-20210610125115-f57c747b84aa/go.mod h1:9qiA5h/8kvPQnJEOlAPHVjRO9a1jCmDhGzvgMBvXEaE=
 open-cluster-management.io/api v0.0.0-20210804091127-340467ff6239 h1:ToDTkftv88UVZSCqTCzYZTkYoba28z+An08Yrm9aOAA=
 open-cluster-management.io/api v0.0.0-20210804091127-340467ff6239/go.mod h1:9qiA5h/8kvPQnJEOlAPHVjRO9a1jCmDhGzvgMBvXEaE=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
@@ -2517,11 +2535,10 @@ rsc.io/letsencrypt v0.0.3/go.mod h1:buyQKZ6IXrRnB7TdkHP0RyEybLx18HHyOSoTyoOLqNY=
 rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.7/go.mod h1:PHgbrJT7lCHcxMU+mDHEm+nx46H4zuuHZkDP6icnhu0=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.15/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.19/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.22 h1:fmRfl9WJ4ApJn7LxNuED4m0t18qivVQOxP6aAYG9J6c=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.22/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
+sigs.k8s.io/apiserver-network-proxy v0.0.24 h1:yaswrAqidc2XdLK2GRacVEBb55g4dg91f/B7b0SYliY=
+sigs.k8s.io/apiserver-network-proxy v0.0.24/go.mod h1:z/U9KltvRVSMttVl3cdQo8cPuXEjr+Qn3A5sUJR55XI=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.24 h1:bCO6TN9VG1bK3nCG5ghQ5httx1HpsG5MD8XtRDySHDM=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.24/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
 sigs.k8s.io/apiserver-runtime v1.0.3-0.20210913073608-0663f60bfee2 h1:c6RYHA1wUg9IEsfjnxg0WsPwvDC2Qw2eryXKXgSEF1c=
 sigs.k8s.io/apiserver-runtime v1.0.3-0.20210913073608-0663f60bfee2/go.mod h1:gvPfh5FX3Wi3kIRpkh7qvY0i/DQl3SDpRtvqMGZE3Vo=
 sigs.k8s.io/controller-runtime v0.6.0/go.mod h1:CpYf5pdNY/B352A1TFLAS2JVSlnGQ5O2cftPHndTroo=

legacy/charts/vela-core-legacy/crds/core.oam.dev_applicationrevisions.yaml

@@ -1232,6 +1232,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -1245,11 +1251,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -1259,6 +1270,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -1639,6 +1667,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -1652,11 +1686,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -1666,6 +1705,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -1944,6 +2000,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -1957,11 +2019,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -1971,6 +2038,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -3372,6 +3456,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -3385,11 +3475,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -3399,6 +3494,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -3672,6 +3784,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -3685,11 +3803,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -3699,6 +3822,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -4061,6 +4201,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -4074,11 +4220,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -4088,6 +4239,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -4329,6 +4497,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -4342,11 +4516,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -4356,6 +4535,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -4617,6 +4813,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -4630,11 +4832,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -4644,6 +4851,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object

legacy/charts/vela-core-legacy/crds/core.oam.dev_componentdefinitions.yaml

@@ -179,6 +179,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -192,11 +197,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -206,6 +215,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -467,6 +492,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -480,11 +510,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -494,6 +528,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

legacy/charts/vela-core-legacy/crds/core.oam.dev_definitionrevisions.yaml

@@ -222,6 +222,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -235,11 +241,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -249,6 +260,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object
@@ -510,6 +538,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -523,11 +557,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -537,6 +576,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object
@@ -791,6 +847,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -804,11 +866,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -818,6 +885,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object
@@ -1053,6 +1137,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -1066,11 +1156,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -1080,6 +1175,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object

legacy/charts/vela-core-legacy/crds/core.oam.dev_policydefinitions.yaml

@@ -151,6 +151,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -164,11 +169,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -178,6 +187,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

legacy/charts/vela-core-legacy/crds/core.oam.dev_traitdefinitions.yaml

@@ -188,6 +188,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -201,11 +206,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -215,6 +224,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -472,6 +497,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -485,11 +515,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -499,6 +533,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

legacy/charts/vela-core-legacy/crds/core.oam.dev_workflowstepdefinitions.yaml

@@ -148,6 +148,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -161,11 +166,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -175,6 +184,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

legacy/charts/vela-core-legacy/crds/core.oam.dev_workloaddefinitions.yaml

@@ -193,6 +193,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -206,11 +211,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -220,6 +229,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -458,6 +483,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -471,11 +501,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -485,6 +519,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

pkg/appfile/appfile.go

@@ -50,14 +50,20 @@ import (
 
 // constant error information
 const (
-	errInvalidValueType                                = "require %q type parameter value"
-	errTerraformConfigurationIsNotSet                  = "terraform configuration is not set"
-	errFailToConvertTerraformComponentProperties       = "failed to convert Terraform component properties"
-	errTerraformNameOfWriteConnectionSecretToRefNotSet = "the name of writeConnectionSecretToRef of terraform component is not set"
+	errInvalidValueType                          = "require %q type parameter value"
+	errTerraformConfigurationIsNotSet            = "terraform configuration is not set"
+	errFailToConvertTerraformComponentProperties = "failed to convert Terraform component properties"
+	errConvertTerraformBaseConfigurationSpec     = "failed to convert properties to Terraform Configuration spec"
 )
 
-// WriteConnectionSecretToRefKey is used to create a secret for cloud resource connection
-const WriteConnectionSecretToRefKey = "writeConnectionSecretToRef"
+const (
+	// WriteConnectionSecretToRefKey is used to create a secret for cloud resource connection
+	WriteConnectionSecretToRefKey = "writeConnectionSecretToRef"
+	// RegionKey is the region of a Cloud Provider
+	RegionKey = "region"
+	// ProviderRefKey is the reference of a Provider
+	ProviderRefKey = "providerRef"
+)
 
 // Workload is component
 type Workload struct {
@@ -658,8 +664,14 @@ func generateTerraformConfigurationWorkload(wl *Workload, ns string) (*unstructu
 	}
 
 	configuration := terraformapi.Configuration{
-		TypeMeta:   metav1.TypeMeta{APIVersion: "terraform.core.oam.dev/v1beta1", Kind: "Configuration"},
-		ObjectMeta: metav1.ObjectMeta{Name: wl.Name, Namespace: ns},
+		TypeMeta: metav1.TypeMeta{APIVersion: "terraform.core.oam.dev/v1beta1", Kind: "Configuration"},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      wl.Name,
+			Namespace: ns,
+		},
+	}
+	if wl.FullTemplate.ComponentDefinition != nil {
+		configuration.ObjectMeta.Annotations = wl.FullTemplate.ComponentDefinition.Annotations
 	}
 
 	switch wl.FullTemplate.Terraform.Type {
@@ -672,19 +684,24 @@ func generateTerraformConfigurationWorkload(wl *Workload, ns string) (*unstructu
 		configuration.Spec.Path = wl.FullTemplate.Terraform.Path
 	}
 
-	if wl.FullTemplate.Terraform.ProviderReference != nil {
-		configuration.Spec.ProviderReference = wl.FullTemplate.Terraform.ProviderReference
-	}
-
 	// 1. parse writeConnectionSecretToRef
-	if err := json.Unmarshal(params, &configuration.Spec); err != nil {
+	if err := json.Unmarshal(params, &configuration); err != nil {
 		return nil, errors.Wrap(err, errFailToConvertTerraformComponentProperties)
 	}
 
-	if configuration.Spec.WriteConnectionSecretToReference != nil {
-		if configuration.Spec.WriteConnectionSecretToReference.Name == "" {
-			return nil, errors.New(errTerraformNameOfWriteConnectionSecretToRefNotSet)
-		}
+	var spec terraformapi.BaseConfigurationSpec
+	if err := json.Unmarshal(params, &spec); err != nil {
+		return nil, errors.Wrap(err, errConvertTerraformBaseConfigurationSpec)
+	}
+	if spec.ProviderReference != nil && !reflect.DeepEqual(configuration.Spec.ProviderReference, spec.ProviderReference) {
+		configuration.Spec.ProviderReference = spec.ProviderReference
+	}
+	if spec.Region != "" && configuration.Spec.Region != spec.Region {
+		configuration.Spec.Region = spec.Region
+	}
+	if spec.WriteConnectionSecretToReference != nil && spec.WriteConnectionSecretToReference.Name != "" &&
+		!reflect.DeepEqual(configuration.Spec.WriteConnectionSecretToReference, spec.WriteConnectionSecretToReference) {
+		configuration.Spec.WriteConnectionSecretToReference = spec.WriteConnectionSecretToReference
 		// set namespace for writeConnectionSecretToRef, developer needn't manually set it
 		if configuration.Spec.WriteConnectionSecretToReference.Namespace == "" {
 			configuration.Spec.WriteConnectionSecretToReference.Namespace = ns
@@ -702,11 +719,14 @@ func generateTerraformConfigurationWorkload(wl *Workload, ns string) (*unstructu
 		return nil, errors.Wrap(err, errFailToConvertTerraformComponentProperties)
 	}
 	delete(variableMap, WriteConnectionSecretToRefKey)
+	delete(variableMap, RegionKey)
+	delete(variableMap, ProviderRefKey)
 
 	data, err := json.Marshal(variableMap)
 	if err != nil {
 		return nil, errors.Wrap(err, errFailToConvertTerraformComponentProperties)
 	}
+
 	configuration.Spec.Variable = &runtime.RawExtension{Raw: data}
 	raw := util.Object2RawExtension(&configuration)
 	return util.RawExtension2Unstructured(raw)

pkg/appfile/appfile_test.go

@@ -608,12 +608,12 @@ variable "password" {
 			},
 
 			Spec: terraformapi.ConfigurationSpec{
-				HCL:                              configuration,
-				Variable:                         raw,
-				WriteConnectionSecretToReference: &terraformtypes.SecretReference{Name: "db", Namespace: "default"},
+				HCL:      configuration,
+				Variable: raw,
 			},
 			Status: terraformapi.ConfigurationStatus{},
 		}
+		workload.Spec.WriteConnectionSecretToReference = &terraformtypes.SecretReference{Name: "db", Namespace: "default"}
 
 		expectCompManifest := &oamtypes.ComponentManifest{
 			Name: compName,
@@ -920,13 +920,6 @@ func TestGenerateTerraformConfigurationWorkload(t *testing.T) {
 		args args
 		want want
 	}{
-		"json workload with invalid secret": {
-			args: args{
-				json:   "abc",
-				params: map[string]interface{}{"acl": "private", "writeConnectionSecretToRef": map[string]interface{}{"name": "", "namespace": ""}},
-			},
-			want: want{err: errors.New(errTerraformNameOfWriteConnectionSecretToRefNotSet)}},
-
 		"json workload with secret": {
 			args: args{
 
@@ -998,10 +991,10 @@ func TestGenerateTerraformConfigurationWorkload(t *testing.T) {
 				},
 			}
 			configSpec = terraformapi.ConfigurationSpec{
-				HCL:                              tc.args.hcl,
-				Variable:                         raw,
-				WriteConnectionSecretToReference: tc.args.writeConnectionSecretToRef,
+				HCL:      tc.args.hcl,
+				Variable: raw,
 			}
+			configSpec.WriteConnectionSecretToReference = tc.args.writeConnectionSecretToRef
 		}
 		if tc.args.json != "" {
 			template = &Template{
@@ -1011,10 +1004,10 @@ func TestGenerateTerraformConfigurationWorkload(t *testing.T) {
 				},
 			}
 			configSpec = terraformapi.ConfigurationSpec{
-				JSON:                             tc.args.json,
-				Variable:                         raw,
-				WriteConnectionSecretToReference: tc.args.writeConnectionSecretToRef,
+				JSON:     tc.args.json,
+				Variable: raw,
 			}
+			configSpec.WriteConnectionSecretToReference = tc.args.writeConnectionSecretToRef
 		}
 		if tc.args.remote != "" {
 			template = &Template{
@@ -1024,10 +1017,10 @@ func TestGenerateTerraformConfigurationWorkload(t *testing.T) {
 				},
 			}
 			configSpec = terraformapi.ConfigurationSpec{
-				Remote:                           tc.args.remote,
-				Variable:                         raw,
-				WriteConnectionSecretToReference: tc.args.writeConnectionSecretToRef,
+				Remote:   tc.args.remote,
+				Variable: raw,
 			}
+			configSpec.WriteConnectionSecretToReference = tc.args.writeConnectionSecretToRef
 		}
 		if tc.args.hcl == "" && tc.args.json == "" && tc.args.remote == "" {
 			template = &Template{
@@ -1035,9 +1028,9 @@ func TestGenerateTerraformConfigurationWorkload(t *testing.T) {
 			}
 
 			configSpec = terraformapi.ConfigurationSpec{
-				Variable:                         raw,
-				WriteConnectionSecretToReference: tc.args.writeConnectionSecretToRef,
+				Variable: raw,
 			}
+			configSpec.WriteConnectionSecretToReference = tc.args.writeConnectionSecretToRef
 		}
 		if tc.args.providerRef != nil {
 			template.Terraform.ProviderReference = tc.args.providerRef

pkg/appfile/parser.go

@@ -78,6 +78,9 @@ func (p *Parser) GenerateAppFile(ctx context.Context, app *v1beta1.Application)
 	appName := app.Name
 
 	appfile := p.newAppfile(appName, ns, app)
+	if app.Status.LatestRevision != nil {
+		appfile.AppRevisionName = app.Status.LatestRevision.Name
+	}
 
 	var wds []*Workload
 	for _, comp := range app.Spec.Components {

pkg/controller/common/context.go

@@ -26,11 +26,12 @@ var (
 	PerfEnabled = false
 )
 
-const (
-	reconcileTimeout = time.Minute
+var (
+	// ReconcileTimeout timeout for controller to reconcile
+	ReconcileTimeout = time.Minute * 3
 )
 
 // NewReconcileContext create context with default timeout (60s)
 func NewReconcileContext(ctx context.Context) (context.Context, context.CancelFunc) {
-	return context.WithTimeout(ctx, reconcileTimeout)
+	return context.WithTimeout(ctx, ReconcileTimeout)
 }

pkg/controller/core.oam.dev/v1alpha2/application/application_controller.go

@@ -40,11 +40,11 @@ import (
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/v1beta1"
 	velatypes "github.com/oam-dev/kubevela/apis/types"
 	"github.com/oam-dev/kubevela/pkg/appfile"
-	common2 "github.com/oam-dev/kubevela/pkg/controller/common"
 	core "github.com/oam-dev/kubevela/pkg/controller/core.oam.dev"
 	"github.com/oam-dev/kubevela/pkg/controller/core.oam.dev/v1alpha1/envbinding"
 	"github.com/oam-dev/kubevela/pkg/controller/core.oam.dev/v1alpha2/application/assemble"
 	"github.com/oam-dev/kubevela/pkg/cue/packages"
+	monitorContext "github.com/oam-dev/kubevela/pkg/monitor/context"
 	"github.com/oam-dev/kubevela/pkg/oam"
 	"github.com/oam-dev/kubevela/pkg/oam/discoverymapper"
 	oamutil "github.com/oam-dev/kubevela/pkg/oam/util"
@@ -87,19 +87,24 @@ type Reconciler struct {
 // Reconcile process app event
 // nolint:gocyclo
 func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
-	ctx, cancel := common2.NewReconcileContext(ctx)
+	ctx, cancel := context.WithTimeout(ctx, time.Minute)
 	defer cancel()
 
-	klog.InfoS("Reconcile application", "application", klog.KRef(req.Namespace, req.Name))
-
+	logCtx := monitorContext.NewTraceContext(ctx, "").AddTag("application", req.String(), "controller", "application")
+	logCtx.Info("Reconcile application")
+	defer logCtx.Commit("Reconcile application")
 	app := new(v1beta1.Application)
 	if err := r.Get(ctx, client.ObjectKey{
 		Name:      req.Name,
 		Namespace: req.Namespace,
 	}, app); err != nil {
+		logCtx.Error(err, "get application")
 		return ctrl.Result{}, client.IgnoreNotFound(err)
 	}
+
+	logCtx.AddTag("resource_version", app.ResourceVersion)
 	ctx = oamutil.SetNamespaceInCtx(ctx, app.Namespace)
+	logCtx.SetContext(ctx)
 	if len(app.GetAnnotations()[oam.AnnotationKubeVelaVersion]) == 0 {
 		oamutil.AddAnnotations(app, map[string]string{
 			oam.AnnotationKubeVelaVersion: version.VelaVersion,
@@ -111,76 +116,76 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 		app:    app,
 		parser: appParser,
 	}
-	endReconcile, err := r.handleFinalizers(ctx, app)
+	endReconcile, err := r.handleFinalizers(logCtx, app)
 	if err != nil {
-		return r.endWithNegativeCondition(ctx, app, condition.ReconcileError(err), common.ApplicationStarting)
+		return r.endWithNegativeCondition(logCtx, app, condition.ReconcileError(err), common.ApplicationStarting)
 	}
 	if endReconcile {
 		return ctrl.Result{}, nil
 	}
 
-	appFile, err := appParser.GenerateAppFile(ctx, app)
+	appFile, err := appParser.GenerateAppFile(logCtx, app)
 	if err != nil {
-		klog.ErrorS(err, "Failed to parse application", "application", klog.KObj(app))
+		logCtx.Error(err, "Failed to parse application")
 		r.Recorder.Event(app, event.Warning(velatypes.ReasonFailedParse, err))
-		return r.endWithNegativeCondition(ctx, app, condition.ErrorCondition("Parsed", err), common.ApplicationRendering)
+		return r.endWithNegativeCondition(logCtx, app, condition.ErrorCondition("Parsed", err), common.ApplicationRendering)
 	}
 	app.Status.SetConditions(condition.ReadyCondition("Parsed"))
 	r.Recorder.Event(app, event.Normal(velatypes.ReasonParsed, velatypes.MessageParsed))
 
-	if err := handler.PrepareCurrentAppRevision(ctx, appFile); err != nil {
-		klog.ErrorS(err, "Failed to prepare app revision", "application", klog.KObj(app))
+	if err := handler.PrepareCurrentAppRevision(logCtx, appFile); err != nil {
+		logCtx.Error(err, "Failed to prepare app revision")
 		r.Recorder.Event(app, event.Warning(velatypes.ReasonFailedRevision, err))
-		return r.endWithNegativeCondition(ctx, app, condition.ErrorCondition("Revision", err), common.ApplicationRendering)
+		return r.endWithNegativeCondition(logCtx, app, condition.ErrorCondition("Revision", err), common.ApplicationRendering)
 	}
-	if err := handler.FinalizeAndApplyAppRevision(ctx); err != nil {
-		klog.ErrorS(err, "Failed to apply app revision", "application", klog.KObj(app))
+	if err := handler.FinalizeAndApplyAppRevision(logCtx); err != nil {
+		logCtx.Error(err, "Failed to apply app revision")
 		r.Recorder.Event(app, event.Warning(velatypes.ReasonFailedRevision, err))
-		return r.endWithNegativeCondition(ctx, app, condition.ErrorCondition("Revision", err), common.ApplicationRendering)
+		return r.endWithNegativeCondition(logCtx, app, condition.ErrorCondition("Revision", err), common.ApplicationRendering)
 	}
-	klog.InfoS("Successfully prepare current app revision", "revisionName", handler.currentAppRev.Name,
+	logCtx.Info("Successfully prepare current app revision", "revisionName", handler.currentAppRev.Name,
 		"revisionHash", handler.currentRevHash, "isNewRevision", handler.isNewRevision)
 	app.Status.SetConditions(condition.ReadyCondition("Revision"))
 	r.Recorder.Event(app, event.Normal(velatypes.ReasonRevisoned, velatypes.MessageRevisioned))
 
-	if err := handler.UpdateAppLatestRevisionStatus(ctx); err != nil {
-		klog.ErrorS(err, "Failed to update application status", "application", klog.KObj(app))
-		return r.endWithNegativeCondition(ctx, app, condition.ReconcileError(err), common.ApplicationRendering)
+	if err := handler.UpdateAppLatestRevisionStatus(logCtx); err != nil {
+		logCtx.Error(err, "Failed to update application status")
+		return r.endWithNegativeCondition(logCtx, app, condition.ReconcileError(err), common.ApplicationRendering)
 	}
-	klog.InfoS("Successfully apply application revision", "application", klog.KObj(app))
+	logCtx.Info("Successfully apply application revision")
 
 	policies, err := appFile.PrepareWorkflowAndPolicy()
 	if err != nil {
-		klog.Error(err, "[Handle PrepareWorkflowAndPolicy]")
+		logCtx.Error(err, "[Handle PrepareWorkflowAndPolicy]")
 		r.Recorder.Event(app, event.Warning(velatypes.ReasonFailedRender, err))
-		return r.endWithNegativeCondition(ctx, app, condition.ErrorCondition("PrepareWorkflowAndPolicy", err), common.ApplicationPolicyGenerating)
+		return r.endWithNegativeCondition(logCtx, app, condition.ErrorCondition("PrepareWorkflowAndPolicy", err), common.ApplicationPolicyGenerating)
 	}
 
 	if len(policies) > 0 {
 		if err := handler.Dispatch(ctx, "", common.PolicyResourceCreator, policies...); err != nil {
-			klog.Error(err, "[Handle ApplyPolicyResources]")
+			logCtx.Error(err, "[Handle ApplyPolicyResources]")
 			r.Recorder.Event(app, event.Warning(velatypes.ReasonFailedApply, err))
-			return r.endWithNegativeCondition(ctx, app, condition.ErrorCondition("ApplyPolices", err), common.ApplicationPolicyGenerating)
+			return r.endWithNegativeCondition(logCtx, app, condition.ErrorCondition("ApplyPolices", err), common.ApplicationPolicyGenerating)
 		}
-		klog.InfoS("Successfully generated application policies", "application", klog.KObj(app))
+		logCtx.Info("Successfully generated application policies")
 	}
 
 	app.Status.SetConditions(condition.ReadyCondition("Render"))
 	r.Recorder.Event(app, event.Normal(velatypes.ReasonRendered, velatypes.MessageRendered))
 
 	if !appWillRollout(app) {
-		steps, err := handler.GenerateApplicationSteps(ctx, app, appParser, appFile, handler.currentAppRev, r.Client, r.dm, r.pd)
+		steps, err := handler.GenerateApplicationSteps(logCtx, app, appParser, appFile, handler.currentAppRev, r.Client, r.dm, r.pd)
 		if err != nil {
-			klog.Error(err, "[handle workflow]")
+			logCtx.Error(err, "[handle workflow]")
 			r.Recorder.Event(app, event.Warning(velatypes.ReasonFailedWorkflow, err))
-			return r.endWithNegativeCondition(ctx, app, condition.ErrorCondition("Workflow", err), common.ApplicationRunningWorkflow)
+			return r.endWithNegativeCondition(logCtx, app, condition.ErrorCondition("Workflow", err), common.ApplicationRunningWorkflow)
 		}
 
-		workflowState, err := workflow.NewWorkflow(app, r.Client, appFile.WorkflowMode).ExecuteSteps(ctx, handler.currentAppRev, steps)
+		workflowState, err := workflow.NewWorkflow(app, r.Client, appFile.WorkflowMode).ExecuteSteps(logCtx.Fork("workflow"), handler.currentAppRev, steps)
 		if err != nil {
-			klog.Error(err, "[handle workflow]")
+			logCtx.Error(err, "[handle workflow]")
 			r.Recorder.Event(app, event.Warning(velatypes.ReasonFailedWorkflow, err))
-			return r.endWithNegativeCondition(ctx, app, condition.ErrorCondition("Workflow", err), common.ApplicationRunningWorkflow)
+			return r.endWithNegativeCondition(logCtx, app, condition.ErrorCondition("Workflow", err), common.ApplicationRunningWorkflow)
 		}
 
 		handler.addServiceStatus(false, app.Status.Services...)
@@ -188,9 +193,10 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 		app.Status.AppliedResources = handler.appliedResources
 		switch workflowState {
 		case common.WorkflowStateSuspended:
-			return ctrl.Result{}, r.patchStatus(ctx, app, common.ApplicationWorkflowSuspending)
+			logCtx.Info("Workflow return state=Suspend")
+			return ctrl.Result{}, r.patchStatus(logCtx, app, common.ApplicationWorkflowSuspending)
 		case common.WorkflowStateTerminated:
-			return ctrl.Result{}, r.patchStatus(ctx, app, common.ApplicationWorkflowTerminated)
+			return ctrl.Result{}, r.patchStatus(logCtx, app, common.ApplicationWorkflowTerminated)
 		case common.WorkflowStateExecuting:
 			return reconcile.Result{RequeueAfter: baseWorkflowBackoffWaitTime}, r.patchStatus(ctx, app, common.ApplicationRunningWorkflow)
 		case common.WorkflowStateFinished:
@@ -204,10 +210,9 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 					})
 				}
 				if err != nil {
-					klog.ErrorS(err, "Failed to gc after workflow",
-						"application", klog.KObj(app))
+					logCtx.Error(err, "Failed to gc after workflow")
 					r.Recorder.Event(app, event.Warning(velatypes.ReasonFailedGC, err))
-					return r.endWithNegativeCondition(ctx, app, condition.ErrorCondition("GCAfterWorkflow", err), common.ApplicationRunningWorkflow)
+					return r.endWithNegativeCondition(logCtx, app, condition.ErrorCondition("GCAfterWorkflow", err), common.ApplicationRunningWorkflow)
 				}
 				app.Status.ResourceTracker = ref
 			}
@@ -219,33 +224,33 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 		var comps []*velatypes.ComponentManifest
 		comps, err = appFile.GenerateComponentManifests()
 		if err != nil {
-			klog.ErrorS(err, "Failed to render components", "application", klog.KObj(app))
+			logCtx.Error(err, "Failed to render components")
 			r.Recorder.Event(app, event.Warning(velatypes.ReasonFailedRender, err))
-			return r.endWithNegativeCondition(ctx, app, condition.ErrorCondition("Render", err), common.ApplicationRendering)
+			return r.endWithNegativeCondition(logCtx, app, condition.ErrorCondition("Render", err), common.ApplicationRendering)
 		}
 
 		assemble.HandleCheckManageWorkloadTrait(*handler.currentAppRev, comps)
 
-		if err := handler.HandleComponentsRevision(ctx, comps); err != nil {
-			klog.ErrorS(err, "Failed to handle compoents revision", "application", klog.KObj(app))
+		if err := handler.HandleComponentsRevision(logCtx, comps); err != nil {
+			logCtx.Error(err, "Failed to handle components revision")
 			r.Recorder.Event(app, event.Warning(velatypes.ReasonFailedRevision, err))
-			return r.endWithNegativeCondition(ctx, app, condition.ErrorCondition("Render", err), common.ApplicationRendering)
+			return r.endWithNegativeCondition(logCtx, app, condition.ErrorCondition("Render", err), common.ApplicationRendering)
 		}
 		klog.Info("Application manifests has prepared and ready for appRollout to handle", "application", klog.KObj(app))
 	}
 	// if inplace is false and rolloutPlan is nil, it means the user will use an outer AppRollout object to rollout the application
 	if handler.app.Spec.RolloutPlan != nil {
-		res, err := handler.handleRollout(ctx)
+		res, err := handler.handleRollout(logCtx)
 		if err != nil {
-			klog.ErrorS(err, "Failed to handle rollout", "application", klog.KObj(app))
+			logCtx.Error(err, "Failed to handle rollout")
 			r.Recorder.Event(app, event.Warning(velatypes.ReasonFailedRollout, err))
-			return r.endWithNegativeCondition(ctx, app, condition.ErrorCondition("Rollout", err), common.ApplicationRollingOut)
+			return r.endWithNegativeCondition(logCtx, app, condition.ErrorCondition("Rollout", err), common.ApplicationRollingOut)
 		}
 		// skip health check and garbage collection if rollout have not finished
 		// start next reconcile immediately
 		if res.Requeue || res.RequeueAfter > 0 {
-			if err := r.patchStatus(ctx, app, common.ApplicationRollingOut); err != nil {
-				return r.endWithNegativeCondition(ctx, app, condition.ReconcileError(err), common.ApplicationRollingOut)
+			if err := r.patchStatus(logCtx, app, common.ApplicationRollingOut); err != nil {
+				return r.endWithNegativeCondition(logCtx, app, condition.ReconcileError(err), common.ApplicationRollingOut)
 			}
 			return res, nil
 		}
@@ -253,7 +258,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 		// there is no need reconcile immediately, that means the rollout operation have finished
 		r.Recorder.Event(app, event.Normal(velatypes.ReasonRollout, velatypes.MessageRollout))
 		app.Status.SetConditions(condition.ReadyCondition("Rollout"))
-		klog.InfoS("Finished rollout ", "application", klog.KObj(app))
+		logCtx.Info("Finished rollout ")
 	}
 	var phase = common.ApplicationRunning
 	if !hasHealthCheckPolicy(appFile.Policies) {
@@ -264,11 +269,11 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 	}
 
 	if err := garbageCollection(ctx, handler); err != nil {
-		klog.ErrorS(err, "Failed to run garbage collection")
+		logCtx.Error(err, "Failed to run garbage collection")
 		r.Recorder.Event(app, event.Warning(velatypes.ReasonFailedGC, err))
-		return r.endWithNegativeCondition(ctx, app, condition.ReconcileError(err), phase)
+		return r.endWithNegativeCondition(logCtx, app, condition.ReconcileError(err), phase)
 	}
-	klog.Info("Successfully garbage collect", "application", klog.KObj(app))
+	logCtx.Info("Successfully garbage collect")
 	app.Status.SetConditions(condition.Condition{
 		Type:               condition.TypeReady,
 		Status:             corev1.ConditionTrue,
@@ -276,17 +281,17 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 		Reason:             condition.ReasonReconcileSuccess,
 	})
 	r.Recorder.Event(app, event.Normal(velatypes.ReasonDeployed, velatypes.MessageDeployed))
-	return ctrl.Result{}, r.patchStatus(ctx, app, phase)
+	return ctrl.Result{}, r.patchStatus(logCtx, app, phase)
 }
 
 // NOTE Because resource tracker is cluster-scoped resources, we cannot garbage collect them
 // by setting application(namespace-scoped) as their owners.
 // We must delete all resource trackers related to an application through finalizer logic.
-func (r *Reconciler) handleFinalizers(ctx context.Context, app *v1beta1.Application) (bool, error) {
+func (r *Reconciler) handleFinalizers(ctx monitorContext.Context, app *v1beta1.Application) (bool, error) {
 	if app.ObjectMeta.DeletionTimestamp.IsZero() {
 		if !meta.FinalizerExists(app, resourceTrackerFinalizer) {
 			meta.AddFinalizer(app, resourceTrackerFinalizer)
-			klog.InfoS("Register new finalizer for application", "application", klog.KObj(app), "finalizer", resourceTrackerFinalizer)
+			ctx.Info("Register new finalizer for application", "finalizer", resourceTrackerFinalizer)
 			return true, errors.Wrap(r.Client.Update(ctx, app), errUpdateApplicationFinalizer)
 		}
 	} else {
@@ -296,7 +301,7 @@ func (r *Reconciler) handleFinalizers(ctx context.Context, app *v1beta1.Applicat
 			rt := &v1beta1.ResourceTracker{}
 			rt.SetName(fmt.Sprintf("%s-%s", app.Namespace, app.Name))
 			if err := r.Client.Delete(ctx, rt); err != nil && !kerrors.IsNotFound(err) {
-				klog.ErrorS(err, "Failed to delete legacy resource tracker", "name", rt.Name)
+				ctx.Error(err, "Failed to delete legacy resource tracker", "name", rt.Name)
 				return true, errors.WithMessage(err, "cannot remove finalizer")
 			}
 			meta.RemoveFinalizer(app, legacyResourceTrackerFinalizer)
@@ -310,12 +315,12 @@ func (r *Reconciler) handleFinalizers(ctx context.Context, app *v1beta1.Applicat
 				}}
 			rtList := &v1beta1.ResourceTrackerList{}
 			if err := r.Client.List(ctx, rtList, listOpts...); err != nil {
-				klog.ErrorS(err, "Failed to list resource tracker of app", "name", app.Name)
+				ctx.Error(err, "Failed to list resource tracker of app", "name", app.Name)
 				return true, errors.WithMessage(err, "cannot remove finalizer")
 			}
 			for _, rt := range rtList.Items {
 				if err := r.Client.Delete(ctx, rt.DeepCopy()); err != nil && !kerrors.IsNotFound(err) {
-					klog.ErrorS(err, "Failed to delete resource tracker", "name", rt.Name)
+					ctx.Error(err, "Failed to delete resource tracker", "name", rt.Name)
 					return true, errors.WithMessage(err, "cannot remove finalizer")
 				}
 			}

pkg/controller/core.oam.dev/v1alpha2/application/apply.go

@@ -36,7 +36,6 @@ import (
 	"github.com/oam-dev/kubevela/pkg/controller/core.oam.dev/v1alpha2/application/dispatch"
 	"github.com/oam-dev/kubevela/pkg/controller/core.oam.dev/v1alpha2/applicationrollout"
 	"github.com/oam-dev/kubevela/pkg/controller/utils"
-	"github.com/oam-dev/kubevela/pkg/cue/process"
 	oamutil "github.com/oam-dev/kubevela/pkg/oam/util"
 )
 
@@ -174,24 +173,36 @@ func (h *AppHandler) collectHealthStatus(wl *appfile.Workload, appRev *v1beta1.A
 		}
 		appName  = appRev.Spec.Application.Name
 		isHealth = true
+		err      error
 	)
 
 	if wl.CapabilityCategory == types.TerraformCategory {
-		return nil, true, nil
+		ctx := context.Background()
+		var configuration terraformapi.Configuration
+		if err := h.r.Client.Get(ctx, client.ObjectKey{Name: wl.Name, Namespace: h.app.Namespace}, &configuration); err != nil {
+			return nil, false, errors.WithMessagef(err, "app=%s, comp=%s, check health error", appName, wl.Name)
+		}
+		if configuration.Status.Apply.State != terraformtypes.Available {
+			status.Healthy = false
+			isHealth = false
+		} else {
+			status.Healthy = true
+			isHealth = true
+		}
+		status.Message = configuration.Status.Apply.Message
+	} else {
+		if ok, err := wl.EvalHealth(wl.Ctx, h.r.Client, h.app.Namespace); !ok || err != nil {
+			isHealth = false
+			status.Healthy = false
+		}
+
+		status.Message, err = wl.EvalStatus(wl.Ctx, h.r.Client, h.app.Namespace)
+		if err != nil {
+			return nil, false, errors.WithMessagef(err, "app=%s, comp=%s, evaluate workload status message error", appName, wl.Name)
+		}
 	}
 
-	if ok, err := wl.EvalHealth(wl.Ctx, h.r.Client, h.app.Namespace); !ok || err != nil {
-		isHealth = false
-		status.Healthy = false
-	}
 	var traitStatusList []common.ApplicationTraitStatus
-
-	var err error
-	status.Message, err = wl.EvalStatus(wl.Ctx, h.r.Client, h.app.Namespace)
-	if err != nil {
-		return nil, false, errors.WithMessagef(err, "app=%s, comp=%s, evaluate workload status message error", appName, wl.Name)
-	}
-
 	for _, tr := range wl.Traits {
 		var traitStatus = common.ApplicationTraitStatus{
 			Type:    tr.Name,
@@ -214,95 +225,6 @@ func (h *AppHandler) collectHealthStatus(wl *appfile.Workload, appRev *v1beta1.A
 	return &status, isHealth, nil
 }
 
-func (h *AppHandler) aggregateHealthStatus(appFile *appfile.Appfile) ([]common.ApplicationComponentStatus, bool, error) {
-	var appStatus []common.ApplicationComponentStatus
-	var healthy = true
-	for _, wl := range appFile.Workloads {
-		var status = common.ApplicationComponentStatus{
-			Name:               wl.Name,
-			WorkloadDefinition: wl.FullTemplate.Reference.Definition,
-			Healthy:            true,
-		}
-
-		var pCtx process.Context
-
-		switch wl.CapabilityCategory {
-		case types.TerraformCategory:
-			pCtx = appfile.NewBasicContext(wl, appFile.Name, appFile.AppRevisionName, appFile.Namespace)
-			ctx := context.Background()
-			var configuration terraformapi.Configuration
-			if err := h.r.Client.Get(ctx, client.ObjectKey{Name: wl.Name, Namespace: h.app.Namespace}, &configuration); err != nil {
-				return nil, false, errors.WithMessagef(err, "app=%s, comp=%s, check health error", appFile.Name, wl.Name)
-			}
-			if configuration.Status.Apply.State != terraformtypes.Available {
-				healthy = false
-				status.Healthy = false
-			} else {
-				status.Healthy = true
-			}
-			status.Message = configuration.Status.Apply.Message
-		default:
-			pCtx = process.NewContext(h.app.Namespace, wl.Name, appFile.Name, appFile.AppRevisionName)
-			if !h.isNewRevision && wl.CapabilityCategory != types.CUECategory {
-				templateStr, err := appfile.GenerateCUETemplate(wl)
-				if err != nil {
-					return nil, false, err
-				}
-				wl.FullTemplate.TemplateStr = templateStr
-			}
-
-			if err := wl.EvalContext(pCtx); err != nil {
-				return nil, false, errors.WithMessagef(err, "app=%s, comp=%s, evaluate context error", appFile.Name, wl.Name)
-			}
-			workloadHealth, err := wl.EvalHealth(pCtx, h.r.Client, h.app.Namespace)
-			if err != nil {
-				return nil, false, errors.WithMessagef(err, "app=%s, comp=%s, check health error", appFile.Name, wl.Name)
-			}
-			if !workloadHealth {
-				// TODO(wonderflow): we should add a custom way to let the template say why it's unhealthy, only a bool flag is not enough
-				status.Healthy = false
-				healthy = false
-			}
-
-			status.Message, err = wl.EvalStatus(pCtx, h.r.Client, h.app.Namespace)
-			if err != nil {
-				return nil, false, errors.WithMessagef(err, "app=%s, comp=%s, evaluate workload status message error", appFile.Name, wl.Name)
-			}
-		}
-
-		var traitStatusList []common.ApplicationTraitStatus
-		for _, tr := range wl.Traits {
-			if err := tr.EvalContext(pCtx); err != nil {
-				return nil, false, errors.WithMessagef(err, "app=%s, comp=%s, trait=%s, evaluate context error", appFile.Name, wl.Name, tr.Name)
-			}
-
-			var traitStatus = common.ApplicationTraitStatus{
-				Type:    tr.Name,
-				Healthy: true,
-			}
-			traitHealth, err := tr.EvalHealth(pCtx, h.r.Client, h.app.Namespace)
-			if err != nil {
-				return nil, false, errors.WithMessagef(err, "app=%s, comp=%s, trait=%s, check health error", appFile.Name, wl.Name, tr.Name)
-			}
-			if !traitHealth {
-				// TODO(wonderflow): we should add a custom way to let the template say why it's unhealthy, only a bool flag is not enough
-				traitStatus.Healthy = false
-				healthy = false
-			}
-			traitStatus.Message, err = tr.EvalStatus(pCtx, h.r.Client, h.app.Namespace)
-			if err != nil {
-				return nil, false, errors.WithMessagef(err, "app=%s, comp=%s, trait=%s, evaluate status message error", appFile.Name, wl.Name, tr.Name)
-			}
-			traitStatusList = append(traitStatusList, traitStatus)
-		}
-
-		status.Traits = traitStatusList
-		status.Scopes = generateScopeReference(wl.Scopes)
-		appStatus = append(appStatus, status)
-	}
-	return appStatus, healthy, nil
-}
-
 func generateScopeReference(scopes []appfile.Scope) []corev1.ObjectReference {
 	var references []corev1.ObjectReference
 	for _, scope := range scopes {

pkg/controller/core.oam.dev/v1alpha2/application/apply_test.go

@@ -24,22 +24,17 @@ import (
 
 	"github.com/oam-dev/kubevela/pkg/oam/testutil"
 
-	terraformtypes "github.com/oam-dev/terraform-controller/api/types"
-	terraformapi "github.com/oam-dev/terraform-controller/api/v1beta1"
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
-	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/yaml"
 
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/v1beta1"
-	velatypes "github.com/oam-dev/kubevela/apis/types"
-	"github.com/oam-dev/kubevela/pkg/appfile"
 )
 
 const workloadDefinition = `
@@ -157,61 +152,3 @@ var _ = Describe("Test Application apply", func() {
 		Expect(strings.Compare(applabel, app.Name) == 0).Should(BeTrue())
 	})
 })
-
-var _ = Describe("Test statusAggregate", func() {
-	It("the component is Terraform type", func() {
-		var (
-			ctx           = context.TODO()
-			componentName = "sample-oss"
-			ns            = "default"
-			h             = &AppHandler{r: reconciler, app: &v1beta1.Application{
-				TypeMeta:   metav1.TypeMeta{},
-				ObjectMeta: metav1.ObjectMeta{Namespace: ns},
-			}}
-			appFile = &appfile.Appfile{
-				Workloads: []*appfile.Workload{
-					{
-						Name: componentName,
-						FullTemplate: &appfile.Template{
-							Reference: common.WorkloadTypeDescriptor{
-								Definition: common.WorkloadGVK{APIVersion: "v1", Kind: "A1"},
-							},
-						},
-						CapabilityCategory: velatypes.TerraformCategory,
-					},
-				},
-			}
-		)
-
-		By("aggregate status")
-		statuses, healthy, err := h.aggregateHealthStatus(appFile)
-		Expect(statuses).Should(BeNil())
-		Expect(healthy).Should(Equal(false))
-		Expect(err).Should(HaveOccurred())
-
-		By("create Terraform configuration")
-		configuration := terraformapi.Configuration{
-			TypeMeta:   metav1.TypeMeta{APIVersion: "terraform.core.oam.dev/v1beta1", Kind: "Configuration"},
-			ObjectMeta: metav1.ObjectMeta{Name: componentName, Namespace: ns},
-		}
-		k8sClient.Create(ctx, &configuration)
-
-		By("aggregate status again")
-		statuses, healthy, err = h.aggregateHealthStatus(appFile)
-		Expect(len(statuses)).Should(Equal(1))
-		Expect(healthy).Should(Equal(false))
-		Expect(err).Should(BeNil())
-
-		By("set status for Terraform configuration")
-		var gotConfiguration terraformapi.Configuration
-		k8sClient.Get(ctx, client.ObjectKey{Namespace: ns, Name: componentName}, &gotConfiguration)
-		gotConfiguration.Status.Apply.State = terraformtypes.Available
-		k8sClient.Status().Update(ctx, &gotConfiguration)
-
-		By("aggregate status one more time")
-		statuses, healthy, err = h.aggregateHealthStatus(appFile)
-		Expect(len(statuses)).Should(Equal(1))
-		Expect(healthy).Should(Equal(true))
-		Expect(err).Should(BeNil())
-	})
-})

pkg/controller/core.oam.dev/v1alpha2/application/dispatch/dispatch.go

@@ -43,7 +43,7 @@ func NewAppManifestsDispatcher(c client.Client, appRev *v1beta1.ApplicationRevis
 		c:          c,
 		applicator: apply.NewAPIApplicator(c),
 		appRev:     appRev,
-		gcHandler:  NewGCHandler(c, appRev.Namespace),
+		gcHandler:  NewGCHandler(c, appRev.Namespace, *appRev),
 	}
 }
 

pkg/controller/core.oam.dev/v1alpha2/application/dispatch/dispatch_suite_test.go

@@ -26,6 +26,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
+
 	"github.com/crossplane/crossplane-runtime/pkg/test"
 
 	. "github.com/onsi/ginkgo"
@@ -419,7 +421,9 @@ var _ = Describe("Test handleSkipGC func", func() {
 	})
 
 	It("Test GC skip func ", func() {
-		handler := GCHandler{c: k8sClient}
+		handler := GCHandler{c: k8sClient, appRev: v1beta1.ApplicationRevision{Spec: v1beta1.ApplicationRevisionSpec{
+			Application: v1beta1.Application{Spec: v1beta1.ApplicationSpec{Components: []common.ApplicationComponent{{Name: "mywebservice"}}}},
+		}}}
 		wlName := "test-workload"
 		resourceTracker := v1beta1.ResourceTracker{
 			ObjectMeta: metav1.ObjectMeta{
@@ -430,6 +434,7 @@ var _ = Describe("Test handleSkipGC func", func() {
 		skipWorkload := &appsv1.Deployment{TypeMeta: metav1.TypeMeta{APIVersion: "apps/v1", Kind: "Deployment"}}
 		skipWorkload.SetNamespace(namespaceName)
 		skipWorkload.SetName(wlName)
+		skipWorkload.SetLabels(map[string]string{oam.LabelAppComponent: "mywebservice"})
 		skipWorkload.SetOwnerReferences([]metav1.OwnerReference{*metav1.NewControllerRef(
 			&resourceTracker, v1beta1.ResourceTrackerKindVersionKind),
 			metav1.OwnerReference{UID: "app-uid", Name: "test-app", APIVersion: v1beta1.SchemeGroupVersion.String(), Kind: v1beta1.ApplicationKind}})

pkg/controller/core.oam.dev/v1alpha2/application/dispatch/dispatch_test.go

@@ -22,6 +22,9 @@ import (
 	"github.com/stretchr/testify/assert"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+
+	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
+	"github.com/oam-dev/kubevela/pkg/oam"
 )
 
 func TestSetOAMOwner(t *testing.T) {
@@ -107,3 +110,31 @@ func TestSetOAMOwner(t *testing.T) {
 		assert.Equal(t, ti.ExpOwner, ti.OO.GetOwnerReferences(), name)
 	}
 }
+
+func TestCheckComponentDeleted(t *testing.T) {
+	wl_1 := unstructured.Unstructured{}
+	wl_1.SetLabels(map[string]string{oam.LabelAppComponent: "comp-1"})
+
+	wl_2 := unstructured.Unstructured{}
+
+	wl_3 := unstructured.Unstructured{}
+	wl_3.SetLabels(map[string]string{oam.LabelAppComponent: "comp-3"})
+
+	components := []common.ApplicationComponent{{Name: "comp-1"}}
+
+	testCase := map[string]struct {
+		u   unstructured.Unstructured
+		res bool
+	}{
+		"exsit comp":       {wl_1, false},
+		"no label deleted": {wl_2, true},
+		"not exsit comp":   {wl_3, true},
+	}
+
+	for caseName, s := range testCase {
+		b := checkResourceRelatedCompDeleted(s.u, components)
+		if b != s.res {
+			t.Errorf("check comp deleted func meet error: %s want %v got %v", caseName, s.res, b)
+		}
+	}
+}

pkg/controller/core.oam.dev/v1alpha2/application/dispatch/gc.go

@@ -28,6 +28,7 @@ import (
 	"k8s.io/klog/v2"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
+	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/v1beta1"
 	"github.com/oam-dev/kubevela/pkg/oam"
 )
@@ -38,8 +39,8 @@ type GarbageCollector interface {
 }
 
 // NewGCHandler create a GCHandler
-func NewGCHandler(c client.Client, ns string) *GCHandler {
-	return &GCHandler{c, ns, nil, nil}
+func NewGCHandler(c client.Client, ns string, appRev v1beta1.ApplicationRevision) *GCHandler {
+	return &GCHandler{c, ns, nil, nil, appRev}
 }
 
 // GCHandler implement GarbageCollector interface
@@ -49,6 +50,8 @@ type GCHandler struct {
 
 	oldRT *v1beta1.ResourceTracker
 	newRT *v1beta1.ResourceTracker
+
+	appRev v1beta1.ApplicationRevision
 }
 
 // GarbageCollect delete the old resources that are no longer in the new resource tracker
@@ -137,6 +140,10 @@ func (h *GCHandler) handleResourceSkipGC(ctx context.Context, u *unstructured.Un
 	if _, exist := res.GetAnnotations()[oam.AnnotationSkipGC]; !exist {
 		return false, nil
 	}
+	// if the component have been deleted don't skipGC
+	if checkResourceRelatedCompDeleted(*res, h.appRev.Spec.Application.Spec.Components) {
+		return false, nil
+	}
 	var owners []metav1.OwnerReference
 	for _, ownerReference := range res.GetOwnerReferences() {
 		if ownerReference.UID == oldRt.GetUID() {
@@ -152,3 +159,14 @@ func (h *GCHandler) handleResourceSkipGC(ctx context.Context, u *unstructured.Un
 	klog.InfoS("succeed to handle a skipGC res kind ", res.GetKind(), "namespace", res.GetNamespace(), "name", res.GetName())
 	return true, nil
 }
+
+func checkResourceRelatedCompDeleted(res unstructured.Unstructured, comps []common.ApplicationComponent) bool {
+	compName := res.GetLabels()[oam.LabelAppComponent]
+	deleted := true
+	for _, comp := range comps {
+		if compName == comp.Name {
+			deleted = false
+		}
+	}
+	return deleted
+}

pkg/controller/core.oam.dev/v1alpha2/core/components/componentdefinition/componentdefinition_controller_test.go

@@ -173,7 +173,7 @@ spec:
 
 			By("Check whether ConfigMap is created")
 			var cm corev1.ConfigMap
-			name := fmt.Sprintf("%s%s", types.CapabilityConfigMapNamePrefix, componentDefinitionName)
+			name := fmt.Sprintf("component-%s%s", types.CapabilityConfigMapNamePrefix, componentDefinitionName)
 			Eventually(func() bool {
 				err := k8sClient.Get(ctx, client.ObjectKey{Namespace: namespace, Name: name}, &cm)
 				return err == nil
@@ -264,7 +264,7 @@ spec:
 
 			By("Check whether ConfigMap is created")
 			var cm corev1.ConfigMap
-			name := fmt.Sprintf("%s%s", types.CapabilityConfigMapNamePrefix, componentDefinitionName)
+			name := fmt.Sprintf("component-%s%s", types.CapabilityConfigMapNamePrefix, componentDefinitionName)
 			Eventually(func() bool {
 				err := k8sClient.Get(ctx, client.ObjectKey{Namespace: namespace, Name: name}, &cm)
 				return err == nil
@@ -306,8 +306,9 @@ spec:
 			cd.SetNamespace(namespace)
 			Expect(k8sClient.Create(ctx, &cd)).Should(Succeed())
 			req := reconcile.Request{NamespacedName: client.ObjectKey{Name: cd.Name, Namespace: cd.Namespace}}
+			By("Check whether ConfigMap is created")
 			var cm corev1.ConfigMap
-			name := fmt.Sprintf("%s%s", types.CapabilityConfigMapNamePrefix, cd.Name)
+			name := fmt.Sprintf("component-%s%s", types.CapabilityConfigMapNamePrefix, cd.Name)
 			Eventually(func() bool {
 				testutil.ReconcileRetry(&r, req)
 				err := k8sClient.Get(ctx, client.ObjectKey{Namespace: cd.Namespace, Name: name}, &cm)
@@ -347,7 +348,7 @@ spec:
 
 			By("Check whether ConfigMap is created")
 			var cm corev1.ConfigMap
-			name := fmt.Sprintf("%s%s", types.CapabilityConfigMapNamePrefix, componentDefinitionName)
+			name := fmt.Sprintf("component-%s%s", types.CapabilityConfigMapNamePrefix, componentDefinitionName)
 			Eventually(func() bool {
 				err := k8sClient.Get(ctx, client.ObjectKey{Namespace: namespace, Name: name}, &cm)
 				return err == nil
@@ -392,7 +393,7 @@ spec:
 
 			By("Check whether ConfigMap is created")
 			var cm corev1.ConfigMap
-			name := fmt.Sprintf("%s%s", types.CapabilityConfigMapNamePrefix, componentDefinitionName)
+			name := fmt.Sprintf("component-%s%s", types.CapabilityConfigMapNamePrefix, componentDefinitionName)
 			Eventually(func() bool {
 				err := k8sClient.Get(ctx, client.ObjectKey{Namespace: namespace, Name: name}, &cm)
 				return err == nil
@@ -501,7 +502,7 @@ spec:
 
 			By("Check whether ConfigMap is created")
 			var cm corev1.ConfigMap
-			name := fmt.Sprintf("%s%s", types.CapabilityConfigMapNamePrefix, componentDefinitionName)
+			name := fmt.Sprintf("component-%s%s", types.CapabilityConfigMapNamePrefix, componentDefinitionName)
 			Eventually(func() bool {
 				err := k8sClient.Get(ctx, client.ObjectKey{Namespace: namespace, Name: name}, &cm)
 				return err == nil
@@ -725,7 +726,7 @@ spec:
 
 			By("Check whether ConfigMap is created")
 			var cm corev1.ConfigMap
-			name := fmt.Sprintf("%s%s", types.CapabilityConfigMapNamePrefix, componentDefinitionName)
+			name := fmt.Sprintf("component-%s%s", types.CapabilityConfigMapNamePrefix, componentDefinitionName)
 			Eventually(func() bool {
 				testutil.ReconcileRetry(&r, req)
 				err := k8sClient.Get(ctx, client.ObjectKey{Namespace: namespace, Name: name}, &cm)

pkg/controller/core.oam.dev/v1alpha2/core/traits/traitdefinition/traitdefinition_controller_test.go

@@ -137,7 +137,7 @@ spec:
 
 			By("Check whether ConfigMap is created")
 			var cm corev1.ConfigMap
-			name := fmt.Sprintf("%s%s", types.CapabilityConfigMapNamePrefix, traitDefinitionName)
+			name := fmt.Sprintf("trait-%s%s", types.CapabilityConfigMapNamePrefix, traitDefinitionName)
 			Eventually(func() bool {
 				err := k8sClient.Get(ctx, client.ObjectKey{Namespace: namespace, Name: name}, &cm)
 				return err == nil
@@ -288,7 +288,7 @@ spec:
 
 			By("Check whether ConfigMap is created")
 			var cm corev1.ConfigMap
-			name := fmt.Sprintf("%s%s", types.CapabilityConfigMapNamePrefix, traitDefinitionName)
+			name := fmt.Sprintf("trait-%s%s", types.CapabilityConfigMapNamePrefix, traitDefinitionName)
 			Eventually(func() bool {
 				testutil.ReconcileRetry(&r, req)
 				err := k8sClient.Get(ctx, client.ObjectKey{Namespace: namespace, Name: name}, &cm)

pkg/controller/core.oam.dev/v1alpha2/core/workflow/workflowstepdefinition/workflowstepdefinition_controller_test.go

@@ -0,0 +1,197 @@
+/*
+
+ Copyright 2021 The KubeVela Authors.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/
+
+package workflowstepdefinition
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+	"sigs.k8s.io/yaml"
+
+	"github.com/oam-dev/kubevela/apis/core.oam.dev/v1beta1"
+	"github.com/oam-dev/kubevela/apis/types"
+	"github.com/oam-dev/kubevela/pkg/oam/testutil"
+	"github.com/oam-dev/kubevela/pkg/oam/util"
+)
+
+var _ = Describe("Apply WorkflowStepDefinition to store its schema to ConfigMap Test", func() {
+	ctx := context.Background()
+	var ns corev1.Namespace
+
+	Context("When the WorkflowStepDefinition is valid, but the namespace doesn't exist, should occur errors", func() {
+		It("Apply WorkflowStepDefinition", func() {
+			By("Apply WorkflowStepDefinition")
+			var validWorkflowStepDefinition = `
+apiVersion: core.oam.dev/v1beta1
+apiVersion: core.oam.dev/v1beta1
+kind: WorkflowStepDefinition
+metadata:
+  annotations:
+    definition.oam.dev/description: Apply raw kubernetes objects for your workflow steps
+  name: apply-object
+  namespace: not-exist
+spec:
+  schematic:
+    cue:
+      template: |
+        import (
+        	"vela/op"
+        )
+
+        apply: op.#Apply & {
+        	value:   parameter.value
+        	cluster: parameter.cluster
+        }
+        parameter: {
+        	// +usage=Specify the value of the object
+        	value: {...}
+        	// +usage=Specify the cluster of the object
+        	cluster: *"" | string
+        }
+`
+
+			var def v1beta1.WorkflowStepDefinition
+			Expect(yaml.Unmarshal([]byte(validWorkflowStepDefinition), &def)).Should(BeNil())
+			Expect(k8sClient.Create(ctx, &def)).Should(Not(Succeed()))
+		})
+	})
+
+	Context("When the WorkflowStepDefinition is valid, should create a ConfigMap", func() {
+		var WorkflowStepDefinitionName = "apply-object"
+		var namespace = "ns-wfs-def-1"
+		req := reconcile.Request{NamespacedName: client.ObjectKey{Name: WorkflowStepDefinitionName, Namespace: namespace}}
+
+		It("Apply WorkflowStepDefinition", func() {
+			ns = corev1.Namespace{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: namespace,
+				},
+			}
+			By("Create a namespace")
+			Expect(k8sClient.Create(ctx, &ns)).Should(SatisfyAny(Succeed(), &util.AlreadyExistMatcher{}))
+
+			By("Apply WorkflowStepDefinition")
+			var validWorkflowStepDefinition = `
+apiVersion: core.oam.dev/v1beta1
+kind: WorkflowStepDefinition
+metadata:
+  annotations:
+    definition.oam.dev/description: Apply raw kubernetes objects for your workflow steps
+  name: apply-object
+  namespace: ns-wfs-def-1
+spec:
+  schematic:
+    cue:
+      template: |
+        import (
+        	"vela/op"
+        )
+
+        apply: op.#Apply & {
+        	value:   parameter.value
+        	cluster: parameter.cluster
+        }
+        parameter: {
+        	// +usage=Specify the value of the object
+        	value: {...}
+        	// +usage=Specify the cluster of the object
+        	cluster: *"" | string
+        }
+`
+
+			var def v1beta1.WorkflowStepDefinition
+			Expect(yaml.Unmarshal([]byte(validWorkflowStepDefinition), &def)).Should(BeNil())
+			Expect(k8sClient.Create(ctx, &def)).Should(Succeed())
+			testutil.ReconcileRetry(&r, req)
+
+			By("Check whether ConfigMap is created")
+			var cm corev1.ConfigMap
+			name := fmt.Sprintf("workflowstep-%s%s", types.CapabilityConfigMapNamePrefix, WorkflowStepDefinitionName)
+			Eventually(func() bool {
+				err := k8sClient.Get(ctx, client.ObjectKey{Namespace: namespace, Name: name}, &cm)
+				return err == nil
+			}, 30*time.Second, time.Second).Should(BeTrue())
+			Expect(cm.Data[types.OpenapiV3JSONSchema]).Should(Not(Equal("")))
+			Expect(cm.Labels["definition.oam.dev/name"]).Should(Equal(WorkflowStepDefinitionName))
+
+			By("Check whether ConfigMapRef refer to right")
+			Eventually(func() string {
+				_ = k8sClient.Get(ctx, client.ObjectKey{Namespace: def.Namespace, Name: def.Name}, &def)
+				return def.Status.ConfigMapRef
+			}, 30*time.Second, time.Second).Should(Equal(name))
+
+			By("Delete the workflowstep")
+			Expect(k8sClient.Delete(ctx, &def)).Should(Succeed())
+			testutil.ReconcileRetry(&r, req)
+		})
+	})
+
+	Context("When the WorkflowStepDefinition is invalid, should report issues", func() {
+		var invalidWorkflowStepDefinitionName = "invalid-wf1"
+		var namespace = "ns-wfs-def2"
+		BeforeEach(func() {
+			ns = corev1.Namespace{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: namespace,
+				},
+			}
+			By("Create a namespace")
+			Expect(k8sClient.Create(ctx, &ns)).Should(SatisfyAny(Succeed(), &util.AlreadyExistMatcher{}))
+		})
+
+		It("Applying invalid WorkflowStepDefinition", func() {
+			By("Apply the WorkflowStepDefinition")
+			var invalidWorkflowStepDefinition = `
+apiVersion: core.oam.dev/v1beta1
+kind: WorkflowStepDefinition
+metadata:
+  annotations:
+    definition.oam.dev/description: Apply raw kubernetes objects for your workflow steps
+  name: invalid-wf1
+  namespace: ns-wfs-def2
+spec:
+  schematic:
+    cue:
+      template: |
+        import (
+        	"vela/op"
+        )
+
+        apply: op.#Apply & {
+        	value:   parameter.value
+        	cluster: parameter.cluster
+        }
+`
+
+			var invalidDef v1beta1.WorkflowStepDefinition
+			Expect(yaml.Unmarshal([]byte(invalidWorkflowStepDefinition), &invalidDef)).Should(BeNil())
+			Expect(k8sClient.Create(ctx, &invalidDef)).Should(Succeed())
+			gotWorkflowStepDefinition := &v1beta1.WorkflowStepDefinition{}
+			Expect(k8sClient.Get(ctx, client.ObjectKey{Name: invalidWorkflowStepDefinitionName, Namespace: namespace}, gotWorkflowStepDefinition)).Should(BeNil())
+		})
+	})
+})

pkg/controller/standard.oam.dev/v1alpha1/rollout/handler.go

@@ -221,13 +221,24 @@ func (h *handler) setWorkloadBaseInfo() {
 		h.sourceWorkload.SetNamespace(h.rollout.Namespace)
 	}
 
+	var appRev string
+	if len(h.rollout.GetLabels()) > 0 {
+		appRev = h.rollout.GetLabels()[oam.LabelAppRevision]
+	}
+
 	h.targetWorkload.SetName(h.compName)
-	util.AddLabels(h.targetWorkload, map[string]string{oam.LabelAppComponentRevision: h.targetRevName})
+	util.AddLabels(h.targetWorkload, map[string]string{
+		oam.LabelAppComponentRevision: h.targetRevName,
+		oam.LabelAppRevision:          appRev,
+	})
 	util.AddAnnotations(h.targetWorkload, map[string]string{oam.AnnotationSkipGC: "true"})
 
 	if h.sourceWorkload != nil {
 		h.sourceWorkload.SetName(h.compName)
-		util.AddLabels(h.sourceWorkload, map[string]string{oam.LabelAppComponentRevision: h.sourceRevName})
+		util.AddLabels(h.sourceWorkload, map[string]string{
+			oam.LabelAppComponentRevision: h.sourceRevName,
+			oam.LabelAppRevision:          appRev,
+		})
 	}
 }
 

pkg/controller/standard.oam.dev/v1alpha1/rollout/handler_suit_test.go

@@ -60,6 +60,7 @@ var _ = Describe("Test rollout related handler func", func() {
 		srcWorkload.SetAPIVersion("apps/v1")
 		srcWorkload.SetKind("Deployment")
 		compName := "comp-test"
+		appRevName := "app-revision-v2"
 		h := handler{
 			reconciler: &reconciler{
 				Client: k8sClient,
@@ -67,6 +68,9 @@ var _ = Describe("Test rollout related handler func", func() {
 			rollout: &v1alpha1.Rollout{
 				ObjectMeta: metav1.ObjectMeta{
 					Namespace: namespace,
+					Labels: map[string]string{
+						oam.LabelAppRevision: appRevName,
+					},
 				}},
 			targetWorkload: tarWorkload,
 			sourceWorkload: srcWorkload,
@@ -82,10 +86,10 @@ var _ = Describe("Test rollout related handler func", func() {
 		Expect(h.targetWorkload.GetNamespace()).Should(BeEquivalentTo(namespace))
 		Expect(h.sourceWorkload.GetNamespace()).Should(BeEquivalentTo(namespace))
 		tarLabel := h.targetWorkload.GetLabels()
-		Expect(len(tarLabel)).Should(BeEquivalentTo(2))
+		Expect(tarLabel[oam.LabelAppRevision]).Should(BeEquivalentTo(appRevName))
 		Expect(tarLabel[oam.LabelAppComponentRevision]).Should(BeEquivalentTo("comp-test-v2"))
 		srcLabel := h.sourceWorkload.GetLabels()
-		Expect(len(srcLabel)).Should(BeEquivalentTo(2))
+		Expect(srcLabel[oam.LabelAppRevision]).Should(BeEquivalentTo(appRevName))
 		Expect(srcLabel[oam.LabelAppComponentRevision]).Should(BeEquivalentTo("comp-test-v1"))
 
 		Expect(h.assembleWorkload(ctx)).Should(BeNil())

pkg/controller/utils/capability.go

@@ -61,6 +61,10 @@ const (
 	TerraformTupleTypePrefix  string = "tuple("
 	TerraformMapTypePrefix    string = "map("
 	TerraformObjectTypePrefix string = "object("
+
+	typeTraitDefinition        = "trait"
+	typeComponentDefinition    = "component"
+	typeWorkflowStepDefinition = "workflowstep"
 )
 
 // ErrNoSectionParameterInCue means there is not parameter section in Cue template of a workload
@@ -245,7 +249,7 @@ func (def *CapabilityComponentDefinition) StoreOpenAPISchema(ctx context.Context
 		Controller:         pointer.BoolPtr(true),
 		BlockOwnerDeletion: pointer.BoolPtr(true),
 	}}
-	cmName, err := def.CreateOrUpdateConfigMap(ctx, k8sClient, namespace, componentDefinition.Name, jsonSchema, ownerReference)
+	cmName, err := def.CreateOrUpdateConfigMap(ctx, k8sClient, namespace, componentDefinition.Name, typeComponentDefinition, jsonSchema, ownerReference)
 	if err != nil {
 		return cmName, err
 	}
@@ -263,7 +267,7 @@ func (def *CapabilityComponentDefinition) StoreOpenAPISchema(ctx context.Context
 		Controller:         pointer.BoolPtr(true),
 		BlockOwnerDeletion: pointer.BoolPtr(true),
 	}}
-	_, err = def.CreateOrUpdateConfigMap(ctx, k8sClient, namespace, revName, jsonSchema, ownerReference)
+	_, err = def.CreateOrUpdateConfigMap(ctx, k8sClient, namespace, revName, typeComponentDefinition, jsonSchema, ownerReference)
 	if err != nil {
 		return cmName, err
 	}
@@ -326,7 +330,7 @@ func (def *CapabilityTraitDefinition) StoreOpenAPISchema(ctx context.Context, k8
 		Controller:         pointer.BoolPtr(true),
 		BlockOwnerDeletion: pointer.BoolPtr(true),
 	}}
-	cmName, err := def.CreateOrUpdateConfigMap(ctx, k8sClient, namespace, traitDefinition.Name, jsonSchema, ownerReference)
+	cmName, err := def.CreateOrUpdateConfigMap(ctx, k8sClient, namespace, traitDefinition.Name, typeTraitDefinition, jsonSchema, ownerReference)
 	if err != nil {
 		return cmName, err
 	}
@@ -344,7 +348,7 @@ func (def *CapabilityTraitDefinition) StoreOpenAPISchema(ctx context.Context, k8
 		Controller:         pointer.BoolPtr(true),
 		BlockOwnerDeletion: pointer.BoolPtr(true),
 	}}
-	_, err = def.CreateOrUpdateConfigMap(ctx, k8sClient, namespace, revName, jsonSchema, ownerReference)
+	_, err = def.CreateOrUpdateConfigMap(ctx, k8sClient, namespace, revName, typeTraitDefinition, jsonSchema, ownerReference)
 	if err != nil {
 		return cmName, err
 	}
@@ -395,7 +399,7 @@ func (def *CapabilityStepDefinition) StoreOpenAPISchema(ctx context.Context, k8s
 		Controller:         pointer.BoolPtr(true),
 		BlockOwnerDeletion: pointer.BoolPtr(true),
 	}}
-	cmName, err := def.CreateOrUpdateConfigMap(ctx, k8sClient, namespace, stepDefinition.Name, jsonSchema, ownerReference)
+	cmName, err := def.CreateOrUpdateConfigMap(ctx, k8sClient, namespace, stepDefinition.Name, typeWorkflowStepDefinition, jsonSchema, ownerReference)
 	if err != nil {
 		return cmName, err
 	}
@@ -413,7 +417,7 @@ func (def *CapabilityStepDefinition) StoreOpenAPISchema(ctx context.Context, k8s
 		Controller:         pointer.BoolPtr(true),
 		BlockOwnerDeletion: pointer.BoolPtr(true),
 	}}
-	_, err = def.CreateOrUpdateConfigMap(ctx, k8sClient, namespace, revName, jsonSchema, ownerReference)
+	_, err = def.CreateOrUpdateConfigMap(ctx, k8sClient, namespace, revName, typeWorkflowStepDefinition, jsonSchema, ownerReference)
 	if err != nil {
 		return cmName, err
 	}
@@ -426,8 +430,8 @@ type CapabilityBaseDefinition struct {
 
 // CreateOrUpdateConfigMap creates ConfigMap to store OpenAPI v3 schema or or updates data in ConfigMap
 func (def *CapabilityBaseDefinition) CreateOrUpdateConfigMap(ctx context.Context, k8sClient client.Client, namespace,
-	definitionName string, jsonSchema []byte, ownerReferences []metav1.OwnerReference) (string, error) {
-	cmName := fmt.Sprintf("%s%s", types.CapabilityConfigMapNamePrefix, definitionName)
+	definitionName, definitionType string, jsonSchema []byte, ownerReferences []metav1.OwnerReference) (string, error) {
+	cmName := fmt.Sprintf("%s-%s%s", definitionType, types.CapabilityConfigMapNamePrefix, definitionName)
 	var cm v1.ConfigMap
 	var data = map[string]string{
 		types.OpenapiV3JSONSchema: string(jsonSchema),

pkg/controller/utils/capability_integrate_test.go

@@ -181,7 +181,7 @@ spec:
 				Controller:         pointer.BoolPtr(true),
 				BlockOwnerDeletion: pointer.BoolPtr(true),
 			}}
-			_, err := def.CreateOrUpdateConfigMap(ctx, k8sClient, namespace, definitionName, []byte(""), ownerReference)
+			_, err := def.CreateOrUpdateConfigMap(ctx, k8sClient, namespace, definitionName, typeTraitDefinition, []byte(""), ownerReference)
 			Expect(err).Should(BeNil())
 		})
 	})

pkg/monitor/README.md

@@ -0,0 +1,46 @@
+# Package Usage
+
+## Context
+First, this context is compatible with built-in context interface.
+Also it supports fork and commit like trace span.
+
+### Fork
+`Fork` will generate a sub context that inherit the parent's tags. When new tags are added to the `sub-context`, the `parent-context` will not be affected.
+
+### Commit
+`Commit` will log the context duration, and export metrics or other execution information.
+
+### usage
+```
+tracerCtx:=context.NewTraceContext(stdCtx,"$id") 
+defer tracerCtx.Commit("success")
+
+// Execute sub-code logic
+subCtx:=tracerCtx.Fork("sub-id")
+...
+subCtx.Commit("step is executed")
+
+```
+
+## Metrics
+First, you need register `metricVec` in package `pkg/monitor/metrics`, like below:
+```
+StepDurationSummary = prometheus.NewSummaryVec(prometheus.SummaryOpts{
+		Name:        "step_duration_ms",
+		Help:        "step latency distributions.",
+		Objectives:  map[float64]float64{0.5: 0.05, 0.9: 0.01, 0.99: 0.001},
+		ConstLabels: prometheus.Labels{},
+	}, []string{"application", "workflow_revision", "step_name", "step_type"})
+```
+
+Now, you can export metrics by context,for example
+```
+subCtx:=tracerCtx.Fork("sub-id",DurationMetric(func(v float64) {
+					metrics.StepDurationSummary.WithLabelValues(e.app.Name, e.status.AppRevision, stepStatus.Name, stepStatus.Type).Observe(v)
+				})
+subCtx.Commit("export") // At this time, it will export the StepDurationSummary metrics. 			
+
+```
+
+Context only support `DurationMetric` exporter. you can submit pr to support more exporters.
+If metrics have nothing to do with context, there is no need to extend it through context exporter

pkg/monitor/context/context.go

@@ -0,0 +1,170 @@
+/*
+ Copyright 2021. The KubeVela Authors.
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+     http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
+
+package context
+
+import (
+	stdctx "context"
+	"fmt"
+	"time"
+
+	"github.com/oam-dev/kubevela/pkg/utils"
+
+	"k8s.io/klog/v2"
+)
+
+const (
+	// spanTagID is the tag name of span ID.
+	spanTagID = "spanID"
+)
+
+// Context keep the trace info
+type Context interface {
+	stdctx.Context
+	Logger
+	GetContext() stdctx.Context
+	SetContext(ctx stdctx.Context)
+	AddTag(keysAndValues ...interface{}) Context
+	Fork(name string, exporters ...Exporter) Context
+	Commit(msg string)
+}
+
+// Logger represents the ability to log messages, both errors and not.
+type Logger interface {
+	InfoDepth(depth int, msg string, keysAndValues ...interface{})
+	Info(msg string, keysAndValues ...interface{})
+	Error(err error, msg string, keysAndValues ...interface{})
+	ErrorDepth(depth int, err error, msg string, keysAndValues ...interface{})
+	Printf(format string, args ...interface{})
+	V(level int)
+}
+
+type traceContext struct {
+	stdctx.Context
+
+	id             string
+	beginTimestamp time.Time
+	logLevel       int
+
+	tags      []interface{}
+	exporters []Exporter
+	parent    *traceContext
+}
+
+// Fork a child Context extends parent Context
+func (t *traceContext) Fork(id string, exporters ...Exporter) Context {
+	if id == "" {
+		id = t.id
+	} else {
+		id = t.id + "." + id
+	}
+
+	return &traceContext{
+		Context:        t.Context,
+		id:             id,
+		tags:           copySlice(t.tags),
+		logLevel:       t.logLevel,
+		parent:         t,
+		beginTimestamp: time.Now(),
+		exporters:      exporters,
+	}
+}
+
+// Commit finish the span record
+func (t *traceContext) Commit(msg string) {
+	msg = fmt.Sprintf("[Finished]: %s(%s)", t.id, msg)
+	duration := time.Since(t.beginTimestamp)
+	for _, export := range t.exporters {
+		export(t, duration.Microseconds())
+	}
+	klog.InfoSDepth(1, msg, t.getTagsWith("duration", duration.String())...)
+}
+
+func (t *traceContext) getTagsWith(keysAndValues ...interface{}) []interface{} {
+	tags := append(t.tags, keysAndValues...)
+	return append(tags, spanTagID, t.id)
+}
+
+// Info logs a non-error message with the given key/value pairs as context.
+func (t *traceContext) Info(msg string, keysAndValues ...interface{}) {
+	klog.InfoSDepth(1, msg, t.getTagsWith(keysAndValues...)...)
+}
+
+// GetContext get raw context.
+func (t *traceContext) GetContext() stdctx.Context {
+	return t.Context
+}
+
+// SetContext set raw context.
+func (t *traceContext) SetContext(ctx stdctx.Context) {
+	t.Context = ctx
+}
+
+// InfoDepth acts as Info but uses depth to determine which call frame to log.
+func (t *traceContext) InfoDepth(depth int, msg string, keysAndValues ...interface{}) {
+	klog.InfoSDepth(depth+1, msg, t.getTagsWith(keysAndValues...)...)
+}
+
+// Error logs an error, with the given message and key/value pairs as context.
+func (t *traceContext) Error(err error, msg string, keysAndValues ...interface{}) {
+	klog.ErrorSDepth(1, err, msg, t.getTagsWith(keysAndValues...)...)
+}
+
+// ErrorDepth acts as Error but uses depth to determine which call frame to log.
+func (t *traceContext) ErrorDepth(depth int, err error, msg string, keysAndValues ...interface{}) {
+	klog.ErrorSDepth(depth+1, err, msg, t.getTagsWith(keysAndValues...)...)
+}
+
+// Printf formats according to a format specifier and logs.
+func (t *traceContext) Printf(format string, args ...interface{}) {
+	klog.InfoSDepth(1, fmt.Sprintf(format, args...), t.getTagsWith()...)
+}
+
+// V reports whether verbosity at the call site is at least the requested level.
+func (t *traceContext) V(level int) {
+	t.logLevel = level
+}
+
+// AddTag adds some key-value pairs of context to a logger.
+func (t *traceContext) AddTag(keysAndValues ...interface{}) Context {
+	t.tags = append(t.tags, keysAndValues...)
+	return t
+}
+
+// NewTraceContext new a TraceContext
+func NewTraceContext(ctx stdctx.Context, id string) Context {
+	if id == "" {
+		id = "i-" + utils.RandomString(8)
+	}
+	return &traceContext{
+		Context:        ctx,
+		id:             id,
+		beginTimestamp: time.Now(),
+	}
+}
+
+func copySlice(in []interface{}) []interface{} {
+	out := make([]interface{}, len(in))
+	copy(out, in)
+	return out
+}
+
+// Exporter export context info.
+type Exporter func(t *traceContext, duration int64)
+
+// DurationMetric export context duration metric.
+func DurationMetric(h func(v float64)) Exporter {
+	return func(t *traceContext, duration int64) {
+		h(float64(duration / 1000))
+	}
+}

pkg/monitor/context/context_test.go

@@ -0,0 +1,45 @@
+/*
+ Copyright 2021. The KubeVela Authors.
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+     http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
+
+package context
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/pkg/errors"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+func TestLog(t *testing.T) {
+	ctx := NewTraceContext(context.Background(), types.NamespacedName{
+		Namespace: "default",
+		Name:      "test-app",
+	}.String())
+
+	ctx.AddTag("controller", "application")
+	ctx.Info("init")
+	ctx.InfoDepth(1, "init")
+	defer ctx.Commit("close")
+	spanCtx := ctx.Fork("child1", DurationMetric(func(v float64) {
+		fmt.Println(v)
+	}))
+	time.Sleep(time.Millisecond * 30)
+	err := errors.New("mock error")
+	ctx.Error(err, "test case", "generated", "test_log")
+	ctx.ErrorDepth(1, err, "test case", "generated", "test_log")
+	spanCtx.Commit("finished")
+
+}