Fix: add volume bottom check in resource topology rule (#5835)

Signed-off-by: FogDong <dongtianxin.tx@alibaba-inc.com>

.github/CODEOWNERS

@@ -1,36 +1,37 @@
 # This file is a github code protect rule follow the codeowners https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/creating-a-repository-on-github/about-code-owners#example-of-a-codeowners-file
 
-*                                  @barnettZQG @wonderflow @leejanee
-design/                            @barnettZQG @leejanee @wonderflow
+*                                  @barnettZQG @wonderflow @leejanee @Somefive @jefree-cat @FogDong
+design/                            @barnettZQG @leejanee @wonderflow @Somefive @jefree-cat @FogDong
+
+# Owner of Core Controllers
+pkg/controller/core.oam.dev       @Somefive @FogDong @barnettZQG @wonderflow
+
+# Owner of Standard Controllers
+pkg/controller/standard.oam.dev   @wangyikewxgm @barnettZQG @wonderflow
 
 # Owner of CUE
-pkg/cue                            @leejanee @FogDong
-pkg/stdlib                         @leejanee @FogDong
+pkg/cue                            @leejanee @FogDong @Somefive
+pkg/stdlib                         @leejanee @FogDong @Somefive
 
 # Owner of Workflow
-pkg/workflow                       @leejanee @FogDong
+pkg/workflow                       @leejanee @FogDong @Somefive
 
 # Owner of rollout
-pkg/controller/common/rollout/                              @wangyikewxgm @wonderflow
-pkg/controller/core.oam.dev/v1alpha2/applicationrollout     @wangyikewxgm @wonderflow
-pkg/controller/standard.oam.dev/v1alpha1/rollout            @wangyikewxgm @wonderflow
-runtime/rollout                                             @wangyikewxgm @wonderflow
-
-# Owner of definition controller
-pkg/controller/core.oam.dev/v1alpha2/core/workflow/workflowstepdefinition  @yangsoon @Somefive
-pkg/controller/core.oam.dev/v1alpha2/core/policies/policydefinition        @yangsoon @Somefive
-pkg/controller/core.oam.dev/v1alpha2/core/components/componentdefinition   @yangsoon @zzxwill
-pkg/controller/core.oam.dev/v1alpha2/core/traits/traitdefinition           @yangsoon @zzxwill
-
-# Owner of health scope controller
-pkg/controller/core.oam.dev/v1alpha2/core/scopes/healthscope     @captainroy-hy @zzxwill
+pkg/controller/common/rollout/     @wangyikewxgm @wonderflow
+runtime/rollout                    @wangyikewxgm @wonderflow
 
 # Owner of vela templates
-vela-templates/                     @Somefive @barnettZQG @wonderflow
+vela-templates/                     @Somefive @barnettZQG @wonderflow @FogDong
 
 # Owner of vela CLI
-references/cli/                     @Somefive @zzxwill 
+references/cli/                     @Somefive @zzxwill @StevenLeiZhang @charlie0129 @chivalryq
 
 # Owner of vela APIServer
-pkg/apiserver/                     @barnettZQG @yangsoon
+pkg/apiserver/                     @barnettZQG @yangsoon @FogDong
 
+# Owner of vela addon framework
+pkg/addon/                         @wangyikewxgm @wonderflow @charlie0129
+
+# Owner of resource keeper and tracker
+pkg/resourcekeeper                 @Somefive @FogDong
+pkg/resourcetracker                @Somefive @FogDong

.github/PULL_REQUEST_TEMPLATE.md

@@ -13,8 +13,8 @@ Fixes #
 
 I have:
 
-- [ ] Read and followed KubeVela's [contribution process](https://github.com/oam-dev/kubevela/blob/master/contribute/create-pull-request.md).
-- [ ] [Related Docs](https://github.com/oam-dev/kubevela.io) updated properly. In a new feature or configuration option, an update to the documentation is necessary. 
+- [ ] Read and followed KubeVela's [contribution process](https://github.com/kubevela/kubevela/blob/master/contribute/create-pull-request.md).
+- [ ] [Related Docs](https://github.com/kubevela/kubevela.io) updated properly. In a new feature or configuration option, an update to the documentation is necessary. 
 - [ ] Run `make reviewable` to ensure this PR is ready for review.
 - [ ] Added `backport release-x.y` labels to auto-backport this PR if necessary.
 

.github/bot.md

@@ -1,9 +1,9 @@
 ### GitHub & kubevela automation
 
-The bot is configured via [issue-commands.json](https://github.com/oam-dev/kubevela/blob/master/.github/workflows/issue-commands.json) 
-and some other GitHub [workflows](https://github.com/oam-dev/kubevela/blob/master/.github/workflows).
+The bot is configured via [issue-commands.json](https://github.com/kubevela/kubevela/blob/master/.github/issue-commands.json) 
+and some other GitHub [workflows](https://github.com/kubevela/kubevela/blob/master/.github/workflows).
 By default, users with write access to the repo is allowed to use the comments, 
-the [userlist](https://github.com/oam-dev/kubevela/blob/master/.github/comment.userlist) 
+the [userlist](https://github.com/kubevela/kubevela/blob/master/.github/comment.userlist) 
 file is for adding additional members who do not have access and want to contribute to the issue triage.
 
 Comment commands:
@@ -14,7 +14,7 @@ Comment commands:
 * Write the word `/area/*` in a comment, and the bot will add the corresponding label `/area/*`.
 * Write the word `/priority/*` in a comment, and the bot will add the corresponding label `/priority/*`.
 
-The `*` mention above represent a specific word. Please read the details about label category in [ISSUE_TRIAGE.md](https://github.com/oam-dev/kubevela/blob/master/ISSUE_TRIAGE.md)  
+The `*` mention above represent a specific word. Please read the details about label category in [ISSUE_TRIAGE.md](https://github.com/kubevela/kubevela/blob/master/ISSUE_TRIAGE.md)  
 
 Label commands:
 

.github/workflows/apiserver-test.yaml

@@ -1,121 +0,0 @@
-name: APIServer Unit Test & E2E Test
-
-on:
-  push:
-    branches:
-      - master
-      - release-*
-      - apiserver
-  workflow_dispatch: {}
-  pull_request:
-    branches:
-      - master
-      - release-*
-      - apiserver
-
-env:
-  # Common versions
-  GO_VERSION: '1.17'
-  GOLANGCI_VERSION: 'v1.38'
-  KIND_VERSION: 'v0.7.0'
-
-jobs:
-
-  detect-noop:
-    runs-on: ubuntu-20.04
-    outputs:
-      noop: ${{ steps.noop.outputs.should_skip }}
-    steps:
-      - name: Detect No-op Changes
-        id: noop
-        uses: fkirc/skip-duplicate-actions@v3.3.0
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          paths_ignore: '["**.md", "**.mdx", "**.png", "**.jpg"]'
-          do_not_skip: '["workflow_dispatch", "schedule", "push"]'
-          concurrent_skipping: false
-
-  apiserver-unit-tests:
-    runs-on: aliyun
-    needs: detect-noop
-    if: needs.detect-noop.outputs.noop != 'true'
-
-    steps:
-      - name: Set up Go
-        uses: actions/setup-go@v1
-        with:
-          go-version: ${{ env.GO_VERSION }}
-        id: go
-
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v2
-        with:
-          submodules: true
-
-      - name: Get dependencies
-        run: |
-          go get -v -t -d ./...
-
-      - name: Setup Kind
-        uses: engineerd/setup-kind@v0.5.0
-        with:
-          version: ${{ env.KIND_VERSION }}
-          skipClusterCreation: true
-
-      - name: Setup Kind Cluster (Worker)
-        run: |
-          kind delete cluster --name worker
-          kind create cluster --image kindest/node:v1.20.7@sha256:688fba5ce6b825be62a7c7fe1415b35da2bdfbb5a69227c499ea4cc0008661ca --name worker
-          kubectl version
-          kubectl cluster-info
-          kind get kubeconfig --name worker --internal > /tmp/worker.kubeconfig
-          kind get kubeconfig --name worker > /tmp/worker.client.kubeconfig
-
-      - name: Setup Kind Cluster (Hub)
-        run: |
-          kind delete cluster
-          kind create cluster --image kindest/node:v1.20.7@sha256:688fba5ce6b825be62a7c7fe1415b35da2bdfbb5a69227c499ea4cc0008661ca
-          kubectl version
-          kubectl cluster-info
-
-      - name: Load Image to kind cluster
-        run: make kind-load
-
-      - name: Cleanup for e2e tests
-        run: |
-          make e2e-cleanup
-          make vela-cli
-          make e2e-setup-core
-          bin/vela addon enable fluxcd
-          timeout 600s bash -c -- 'while true; do kubectl get ns flux-system; if [ $? -eq 0 ] ; then break; else sleep 5; fi;done'
-          kubectl wait --for=condition=Ready pod -l app.kubernetes.io/name=vela-core,app.kubernetes.io/instance=kubevela -n vela-system --timeout=600s
-          kubectl wait --for=condition=Ready pod -l app=source-controller -n flux-system --timeout=600s
-          kubectl wait --for=condition=Ready pod -l app=helm-controller -n flux-system --timeout=600s
-
-      - name: Run api server unit test
-        run: make unit-test-apiserver
-
-      - name: Run api server e2e test
-        run: |
-          export ALIYUN_ACCESS_KEY_ID=${{ secrets.ALIYUN_ACCESS_KEY_ID }}
-          export ALIYUN_ACCESS_KEY_SECRET=${{ secrets.ALIYUN_ACCESS_KEY_SECRET }}
-          export GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
-          make e2e-apiserver-test
-
-      - name: Stop kubevela, get profile
-        run: make end-e2e-core
-
-      - name: Upload coverage report
-        uses: codecov/codecov-action@v1
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: ./coverage.txt,/tmp/e2e_apiserver_test.out
-          flags: apiserver-unittests
-          name: codecov-umbrella
-
-      - name: Clean e2e profile
-        run: rm /tmp/e2e-profile.out
-
-      - name: Cleanup image
-        if: ${{ always() }}
-        run: make image-cleanup

.github/workflows/apiserver-test.yml

@@ -0,0 +1,198 @@
+name: VelaUX APIServer Test
+
+on:
+  push:
+    branches:
+      - master
+      - release-*
+      - apiserver
+    tags:
+      - v*
+  workflow_dispatch: { }
+  pull_request:
+    branches:
+      - master
+      - release-*
+      - apiserver
+
+env:
+  # Common versions
+  GO_VERSION: '1.19'
+
+permissions:
+  contents: read
+
+jobs:
+
+  detect-noop:
+    runs-on: ubuntu-20.04
+    outputs:
+      noop: ${{ steps.noop.outputs.should_skip }}
+    steps:
+      - name: Detect No-op Changes
+        id: noop
+        uses: fkirc/skip-duplicate-actions@12aca0a884f6137d619d6a8a09fcc3406ced5281
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          paths_ignore: '["**.md", "**.mdx", "**.png", "**.jpg"]'
+          do_not_skip: '["workflow_dispatch", "schedule", "push"]'
+        continue-on-error: true
+
+  apiserver-unit-tests:
+    runs-on: ubuntu-20.04
+    needs: detect-noop
+    if: needs.detect-noop.outputs.noop != 'true'
+
+    steps:
+      - name: Set up Go
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568
+        with:
+          go-version: ${{ env.GO_VERSION }}
+        id: go
+
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
+        with:
+          submodules: true
+
+      - name: Cache Go Dependencies
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
+        with:
+          path: .work/pkg
+          key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }}
+          restore-keys: ${{ runner.os }}-pkg-
+
+      - name: Install ginkgo
+        run: |
+          sudo sed -i 's/azure\.//' /etc/apt/sources.list
+          sudo apt-get update
+          sudo apt-get install -y golang-ginkgo-dev
+
+      - name: Start MongoDB
+        uses: supercharge/mongodb-github-action@538a4d2a1041920c47630172445cb688592d6e51 # 1.8.0
+        with:
+          mongodb-version: '5.0'
+
+        # TODO need update action version to resolve node 12 deprecated.
+      - name: install Kubebuilder
+        uses: RyanSiu1995/kubebuilder-action@ff52bff1bae252239223476e5ab0d71d6ba02343
+        with:
+          version: 3.1.0
+          kubebuilderOnly: false
+          kubernetesVersion: v1.21.2
+
+      - name: Run api server unit test
+        run: make unit-test-apiserver
+
+      - name: Upload coverage report
+        uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          file: ./coverage.txt
+          flags: apiserver-unittests
+          name: codecov-umbrella
+
+  apiserver-e2e-tests:
+    runs-on: aliyun
+    needs: [ detect-noop ]
+    if: needs.detect-noop.outputs.noop != 'true'
+    strategy:
+      matrix:
+        k8s-version: ["v1.20","v1.24"]
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.k8s-version }}
+      cancel-in-progress: true
+
+    steps:
+      - name: Set up Go
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568
+        with:
+          go-version: ${{ env.GO_VERSION }}
+        id: go
+
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
+        with:
+          submodules: true
+
+      - name: Get dependencies
+        run: |
+          go get -v -t -d ./...
+
+      - name: Tear down K3d if exist
+        run: |
+          k3d cluster delete || true
+          k3d cluster delete worker || true
+
+      - name: Calculate K3d args
+        run: |
+          EGRESS_ARG=""
+          if [[ "${{ matrix.k8s-version }}" == v1.24 ]]; then
+            EGRESS_ARG="--k3s-arg --egress-selector-mode=disabled@server:0"
+          fi
+          echo "EGRESS_ARG=${EGRESS_ARG}" >> $GITHUB_ENV 
+
+      - name: Setup K3d (Hub)
+        uses: nolar/setup-k3d-k3s@293b8e5822a20bc0d5bcdd4826f1a665e72aba96
+        with:
+          version: ${{ matrix.k8s-version }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          k3d-args: ${{ env.EGRESS_ARG }}
+
+
+      - name: Setup K3d (Worker)
+        uses: nolar/setup-k3d-k3s@293b8e5822a20bc0d5bcdd4826f1a665e72aba96
+        with:
+          version: ${{ matrix.k8s-version }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          k3d-name: worker
+          k3d-args: --kubeconfig-update-default=false --network=k3d-k3s-default ${{ env.EGRESS_ARG }}
+
+
+      - name: Kind Cluster (Worker)
+        run: |
+          internal_ip=$(docker network inspect k3d-k3s-default|jq ".[0].Containers"| jq -r '.[]| select(.Name=="k3d-worker-server-0")|.IPv4Address' | cut -d/ -f1)
+          k3d kubeconfig get worker > /tmp/worker.client.kubeconfig
+          cp /tmp/worker.client.kubeconfig /tmp/worker.kubeconfig
+          sed -i "s/0.0.0.0:[0-9]\+/$internal_ip:6443/"  /tmp/worker.kubeconfig
+
+      - name: Load image to k3d cluster
+        run: make image-load
+
+      - name: Cleanup for e2e tests
+        run: |
+          make vela-cli
+          make e2e-cleanup
+          make e2e-setup-core
+          bin/vela addon enable fluxcd
+          bin/vela addon enable vela-workflow --override-definitions
+          timeout 600s bash -c -- 'while true; do kubectl get ns flux-system; if [ $? -eq 0 ] ; then break; else sleep 5; fi;done'
+          kubectl wait --for=condition=Ready pod -l app.kubernetes.io/name=vela-core,app.kubernetes.io/instance=kubevela -n vela-system --timeout=600s
+          kubectl wait --for=condition=Ready pod -l app=source-controller -n flux-system --timeout=600s
+          kubectl wait --for=condition=Ready pod -l app=helm-controller -n flux-system --timeout=600s
+          kubectl wait --for=condition=Ready pod -l app.kubernetes.io/name=vela-workflow -n vela-system --timeout=600s
+
+      - name: Run api server e2e test
+        run: |
+          export ALIYUN_ACCESS_KEY_ID=${{ secrets.ALIYUN_ACCESS_KEY_ID }}
+          export ALIYUN_ACCESS_KEY_SECRET=${{ secrets.ALIYUN_ACCESS_KEY_SECRET }}
+          export GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
+          make e2e-apiserver-test
+
+      - name: Stop kubevela, get profile
+        run: make end-e2e-core
+
+      - name: Upload coverage report
+        uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: /tmp/e2e-profile.out, /tmp/e2e_apiserver_test.out
+          flags: apiserver-e2etests
+          name: codecov-umbrella
+
+      - name: Clean e2e profile
+        run: rm /tmp/e2e-profile.out
+
+      - name: Cleanup image
+        if: ${{ always() }}
+        run: make image-cleanup

.github/workflows/back-port.yml

@@ -4,19 +4,25 @@ on:
     types:
       - closed
 
+permissions:
+  contents: read
+
 jobs:
   # align with crossplane's choice https://github.com/crossplane/crossplane/blob/master/.github/workflows/backport.yml
   open-pr:
     runs-on: ubuntu-20.04
     if: github.event.pull_request.merged
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
         with:
           fetch-depth: 0
 
       - name: Open Backport PR
-        uses: zeebe-io/backport-action@v0.0.6
+        uses: zeebe-io/backport-action@2ee900dc92632adf994f8e437b6d16840fd61f58
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           github_workspace: ${{ github.workspace }}

.github/workflows/chart.yml

@@ -0,0 +1,103 @@
+name: Publish Chart
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch: { }
+
+permissions:
+  contents: read
+
+env:
+  BUCKET: ${{ secrets.OSS_BUCKET }}
+  ENDPOINT: ${{ secrets.OSS_ENDPOINT }}
+  ACCESS_KEY: ${{ secrets.OSS_ACCESS_KEY }}
+  ACCESS_KEY_SECRET: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
+  ARTIFACT_HUB_REPOSITORY_ID: ${{ secrets.ARTIFACT_HUB_REPOSITORY_ID }}
+
+jobs:  
+  publish-charts:
+    env:
+      HELM_CHARTS_DIR: charts
+      HELM_CHART: charts/vela-core
+      MINIMAL_HELM_CHART: charts/vela-minimal
+      LEGACY_HELM_CHART: legacy/charts/vela-core-legacy
+      VELA_ROLLOUT_HELM_CHART: runtime/rollout/charts
+      LOCAL_OSS_DIRECTORY: .oss
+      HELM_CHART_NAME: vela-core
+      MINIMAL_HELM_CHART_NAME: vela-minimal
+      LEGACY_HELM_CHART_NAME: vela-core-legacy
+      VELA_ROLLOUT_HELM_CHART_NAME: vela-rollout
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
+      - name: Get git revision
+        id: vars
+        shell: bash
+        run: |
+          echo "git_revision=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+      - name: Install Helm
+        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78
+        with:
+          version: v3.4.0
+      - name: Setup node
+        uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516
+        with:
+          node-version: '14'
+      - name: Generate helm doc
+        run: |
+          make helm-doc-gen
+      - name: Prepare legacy chart
+        run: |
+          rsync -r $LEGACY_HELM_CHART $HELM_CHARTS_DIR
+          rsync -r $HELM_CHART/* $LEGACY_HELM_CHART --exclude=Chart.yaml --exclude=crds
+      - name: Prepare vela chart
+        run: |
+          rsync -r $VELA_ROLLOUT_HELM_CHART $HELM_CHARTS_DIR
+      - name: Get the version
+        id: get_version
+        run: |
+          VERSION=${GITHUB_REF#refs/tags/}
+          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
+      - name: Tag helm chart image
+        run: |
+          image_tag=${{ steps.get_version.outputs.VERSION }}
+          chart_version=${{ steps.get_version.outputs.VERSION }}
+          sed -i "s/latest/${image_tag}/g" $HELM_CHART/values.yaml
+          sed -i "s/latest/${image_tag}/g" $MINIMAL_HELM_CHART/values.yaml
+          sed -i "s/latest/${image_tag}/g" $LEGACY_HELM_CHART/values.yaml
+          sed -i "s/latest/${image_tag}/g" $VELA_ROLLOUT_HELM_CHART/values.yaml
+          chart_smever=${chart_version#"v"}
+          sed -i "s/0.1.0/$chart_smever/g" $HELM_CHART/Chart.yaml
+          sed -i "s/0.1.0/$chart_smever/g" $MINIMAL_HELM_CHART/Chart.yaml
+          sed -i "s/0.1.0/$chart_smever/g" $LEGACY_HELM_CHART/Chart.yaml
+          sed -i "s/0.1.0/$chart_smever/g" $VELA_ROLLOUT_HELM_CHART/Chart.yaml
+      - name: Install ossutil
+        run: wget http://gosspublic.alicdn.com/ossutil/1.7.0/ossutil64 && chmod +x ossutil64 && mv ossutil64 ossutil
+      - name: Configure Alibaba Cloud OSSUTIL
+        run: ./ossutil --config-file .ossutilconfig config -i ${ACCESS_KEY} -k ${ACCESS_KEY_SECRET} -e ${ENDPOINT} -c .ossutilconfig
+      - name: sync cloud to local
+        run: ./ossutil --config-file .ossutilconfig sync oss://$BUCKET/core $LOCAL_OSS_DIRECTORY
+      - name: add artifacthub stuff to the repo
+        run: |
+          rsync $HELM_CHART/README.md $LEGACY_HELM_CHART/README.md
+          rsync $HELM_CHART/README.md $VELA_ROLLOUT_HELM_CHART/README.md
+          sed -i "s/ARTIFACT_HUB_REPOSITORY_ID/$ARTIFACT_HUB_REPOSITORY_ID/g" hack/artifacthub/artifacthub-repo.yml
+          rsync hack/artifacthub/artifacthub-repo.yml $LOCAL_OSS_DIRECTORY
+      - name: Package helm charts
+        run: |
+          helm package $HELM_CHART --destination $LOCAL_OSS_DIRECTORY
+          helm package $MINIMAL_HELM_CHART --destination $LOCAL_OSS_DIRECTORY
+          helm package $LEGACY_HELM_CHART --destination $LOCAL_OSS_DIRECTORY
+          helm package $VELA_ROLLOUT_HELM_CHART --destination $LOCAL_OSS_DIRECTORY
+          helm repo index --url https://$BUCKET.$ENDPOINT/core $LOCAL_OSS_DIRECTORY
+      - name: sync local to cloud
+        run: |
+          image_tag=${{ steps.get_version.outputs.VERSION }}
+          chart_semver=${image_tag#"v"}
+          ./ossutil --config-file .ossutilconfig cp -f $LOCAL_OSS_DIRECTORY/index.yaml oss://$BUCKET/core/index.yaml
+          ./ossutil --config-file .ossutilconfig cp -f $LOCAL_OSS_DIRECTORY/$HELM_CHART_NAME-${chart_semver}.tgz oss://$BUCKET/core/$HELM_CHART_NAME-${chart_semver}.tgz 
+          ./ossutil --config-file .ossutilconfig cp -f $LOCAL_OSS_DIRECTORY/$MINIMAL_HELM_CHART_NAME-${chart_semver}.tgz oss://$BUCKET/core/$MINIMAL_HELM_CHART_NAME-${chart_semver}.tgz
+          ./ossutil --config-file .ossutilconfig cp -f $LOCAL_OSS_DIRECTORY/$LEGACY_HELM_CHART_NAME-${chart_semver}.tgz oss://$BUCKET/core/$LEGACY_HELM_CHART_NAME-${chart_semver}.tgz
+          ./ossutil --config-file .ossutilconfig cp -f $LOCAL_OSS_DIRECTORY/$VELA_ROLLOUT_HELM_CHART_NAME-${chart_semver}.tgz oss://$BUCKET/core/$VELA_ROLLOUT_HELM_CHART_NAME-${chart_semver}.tgz

.github/workflows/codeql-analysis.yml

@@ -4,51 +4,34 @@ on:
   push:
     branches: [ master, release-* ]
 
+permissions:
+  contents: read
+
 jobs:
-  images:
-    name: Image Scan
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v2
-
-      - name: Build Vela Core image from Dockerfile
-        run: |
-          docker build --build-arg GOPROXY=https://proxy.golang.org -t docker.io/oamdev/vela-core:${{ github.sha }} .
-
-      - name: Run Trivy vulnerability scanner for vela core
-        uses: aquasecurity/trivy-action@master
-        with:
-          image-ref: 'docker.io/oamdev/vela-core:${{ github.sha }}'
-          format: 'sarif'
-          output: 'trivy-results.sarif'
-
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v1
-        if: always()
-        with:
-          sarif_file: 'trivy-results.sarif'
-
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
 
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      security-events: write  # for github/codeql-action/autobuild to send a status report
+
     strategy:
       fail-fast: false
       matrix:
         language: [ 'go' ]
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
+      - name: Checkout repository
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
 
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
-      with:
-        languages: ${{ matrix.language }}
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # v2.1.37
+        with:
+          languages: ${{ matrix.language }}
 
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # v2.1.37
 
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # v2.1.37

.github/workflows/commit-lint.yml

@@ -8,11 +8,14 @@ on:
       - labeled
       - unlabeled
 
+permissions:
+  pull-requests: read
+
 jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: thehanimo/pr-title-checker@v1.3.1
+      - uses: thehanimo/pr-title-checker@v1.3.5
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           pass_on_octokit_error: true

.github/workflows/core-api-test.yml

@@ -0,0 +1,40 @@
+name: core-api-test
+on:
+  pull_request:
+    paths:
+      - 'apis/**'
+      - 'pkg/oam/**'
+      - "hack/apis/**"
+    branches:
+      - master
+      - release-*
+
+permissions:
+  contents: read
+
+jobs:
+  core-api-test:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Set up Go 1.19
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568
+        env:
+          GO_VERSION: '1.19'
+        with:
+          go-version: ${{ env.GO_VERSION }}
+        id: go
+
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
+
+      - name: Get the version
+        id: get_version
+        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
+
+      - name: Test build kubevela-core-api
+        env:
+          VERSION: ${{ steps.get_version.outputs.VERSION }}
+          COMMIT_ID: ${{ github.sha }}
+        run: |
+          bash ./hack/apis/clientgen.sh
+          bash ./hack/apis/sync.sh test

.github/workflows/definition-lint.yml

@@ -0,0 +1,47 @@
+name: Definition-Lint
+
+on:
+  push:
+    branches:
+      - master
+      - release-*
+  workflow_dispatch: {}
+  pull_request:
+    branches:
+      - master
+      - release-*
+
+permissions:
+  contents: read
+
+env:
+  # Common versions
+  GO_VERSION: '1.19'
+
+jobs:
+  definition-doc:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Setup Go
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: Checkout
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
+        with:
+          submodules: true
+
+      - name: Setup K3d
+        uses: nolar/setup-k3d-k3s@293b8e5822a20bc0d5bcdd4826f1a665e72aba96
+        with:
+          version: v1.20
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Definition Doc generate check
+        run: |
+          go build -o docgen hack/docgen/def/gen.go
+          ./docgen --type=comp --force-example-doc --path=./comp-def-check.md
+          ./docgen --type=trait --force-example-doc --path=./trait-def-check.md
+          ./docgen --type=wf --force-example-doc --path=./wf-def-check.md
+          ./docgen --type=policy --force-example-doc --path=./policy-def-check.md

.github/workflows/e2e-multicluster-test.yml

@@ -5,45 +5,57 @@ on:
     branches:
       - master
       - release-*
+    tags:
+      - v*
   workflow_dispatch: {}
   pull_request:
     branches:
       - master
       - release-*
 
+permissions:
+  contents: read
+
 env:
   # Common versions
-  GO_VERSION: '1.17'
-  GOLANGCI_VERSION: 'v1.38'
-  KIND_VERSION: 'v0.7.0'
+  GO_VERSION: '1.19'
 
 jobs:
 
   detect-noop:
+    permissions:
+      actions: write
     runs-on: ubuntu-20.04
     outputs:
       noop: ${{ steps.noop.outputs.should_skip }}
     steps:
       - name: Detect No-op Changes
         id: noop
-        uses: fkirc/skip-duplicate-actions@v3.3.0
+        uses: fkirc/skip-duplicate-actions@12aca0a884f6137d619d6a8a09fcc3406ced5281
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           paths_ignore: '["**.md", "**.mdx", "**.png", "**.jpg"]'
           do_not_skip: '["workflow_dispatch", "schedule", "push"]'
-          concurrent_skipping: false
+        continue-on-error: true
 
   e2e-multi-cluster-tests:
     runs-on: aliyun
-    needs: detect-noop
+    needs: [ detect-noop ]
     if: needs.detect-noop.outputs.noop != 'true'
+    strategy:
+      matrix:
+        k8s-version: ["v1.20","v1.24"]
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.k8s-version }}
+      cancel-in-progress: true
+
 
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v2
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
 
       - name: Setup Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568
         with:
           go-version: ${{ env.GO_VERSION }}
 
@@ -51,37 +63,49 @@ jobs:
         run: |
           go get -v -t -d ./...
 
-      - name: Setup Kind
-        uses: engineerd/setup-kind@v0.5.0
+      - name: Tear down K3d if exist
+        run: |
+          k3d cluster delete || true
+          k3d cluster delete worker || true
+
+      - name: Calculate K3d args
+        run: |
+          EGRESS_ARG=""
+          if [[ "${{ matrix.k8s-version }}" == v1.24 ]]; then
+            EGRESS_ARG="--k3s-arg --egress-selector-mode=disabled@server:0"
+          fi
+          echo "EGRESS_ARG=${EGRESS_ARG}" >> $GITHUB_ENV 
+
+      - name: Setup K3d (Hub)
+        uses: nolar/setup-k3d-k3s@293b8e5822a20bc0d5bcdd4826f1a665e72aba96
         with:
-          version: ${{ env.KIND_VERSION }}
-          skipClusterCreation: true
+          version: ${{ matrix.k8s-version }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          k3d-args: ${{ env.EGRESS_ARG }}
 
-      - name: Setup Kind Cluster (Worker)
+      - name: Setup K3d (Worker)
+        uses: nolar/setup-k3d-k3s@293b8e5822a20bc0d5bcdd4826f1a665e72aba96
+        with:
+          version: ${{ matrix.k8s-version }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          k3d-name: worker
+          k3d-args: --kubeconfig-update-default=false --network=k3d-k3s-default ${{ env.EGRESS_ARG }}
+
+      - name: Generating internal worker kubeconfig
         run: |
-          kind delete cluster --name worker
-          kind create cluster --image kindest/node:v1.20.7@sha256:688fba5ce6b825be62a7c7fe1415b35da2bdfbb5a69227c499ea4cc0008661ca --name worker
-          kubectl version
-          kubectl cluster-info
-          kind get kubeconfig --name worker --internal > /tmp/worker.kubeconfig
-          kind get kubeconfig --name worker > /tmp/worker.client.kubeconfig
+          internal_ip=$(docker network inspect k3d-k3s-default|jq ".[0].Containers"| jq -r '.[]| select(.Name=="k3d-worker-server-0")|.IPv4Address' | cut -d/ -f1)
+          k3d kubeconfig get worker > /tmp/worker.client.kubeconfig
+          cp /tmp/worker.client.kubeconfig /tmp/worker.kubeconfig
+          sed -i "s/0.0.0.0:[0-9]\+/$internal_ip:6443/"  /tmp/worker.kubeconfig
 
-      - name: Setup Kind Cluster (Hub)
-        run: |
-          kind delete cluster
-          kind create cluster --image kindest/node:v1.20.7@sha256:688fba5ce6b825be62a7c7fe1415b35da2bdfbb5a69227c499ea4cc0008661ca
-          kubectl version
-          kubectl cluster-info
-
-      - name: Load Image to kind cluster (Hub)
-        run: make kind-load
+      - name: Load image to k3d cluster (hub and worker)
+        run: make image-load image-load-runtime-cluster
 
       - name: Cleanup for e2e tests
         run: |
-          make e2e-cleanup
           make vela-cli
-          make e2e-setup-core
-          make
+          make e2e-cleanup
+          make e2e-setup-core-auth
           make setup-runtime-e2e-cluster
 
       - name: Run e2e multicluster tests
@@ -93,7 +117,7 @@ jobs:
         run: make end-e2e-core
 
       - name: Upload coverage report
-        uses: codecov/codecov-action@v1
+        uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: /tmp/e2e-profile.out,/tmp/e2e_multicluster_test.out

.github/workflows/e2e-rollout-test.yml

@@ -5,45 +5,57 @@ on:
     branches:
       - master
       - release-*
+    tags:
+      - v*
   workflow_dispatch: {}
   pull_request:
     branches:
       - master
       - release-*
 
+permissions:
+  contents: read
+
 env:
   # Common versions
-  GO_VERSION: '1.17'
-  GOLANGCI_VERSION: 'v1.38'
-  KIND_VERSION: 'v0.7.0'
+  GO_VERSION: '1.19'
 
 jobs:
 
   detect-noop:
+    permissions:
+      actions: write
     runs-on: ubuntu-20.04
     outputs:
       noop: ${{ steps.noop.outputs.should_skip }}
     steps:
       - name: Detect No-op Changes
         id: noop
-        uses: fkirc/skip-duplicate-actions@v3.3.0
+        uses: fkirc/skip-duplicate-actions@12aca0a884f6137d619d6a8a09fcc3406ced5281
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           paths_ignore: '["**.md", "**.mdx", "**.png", "**.jpg"]'
           do_not_skip: '["workflow_dispatch", "schedule", "push"]'
-          concurrent_skipping: false
+        continue-on-error: true
 
   e2e-rollout-tests:
     runs-on: aliyun
-    needs: detect-noop
+    needs: [ detect-noop ]
     if: needs.detect-noop.outputs.noop != 'true'
+    strategy:
+      matrix:
+        k8s-version: ["v1.20","v1.24"]
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.k8s-version }}
+      cancel-in-progress: true
+
 
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v2
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
 
       - name: Setup Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568
         with:
           go-version: ${{ env.GO_VERSION }}
 
@@ -51,33 +63,35 @@ jobs:
         run: |
           go get -v -t -d ./...
 
-      - name: Setup Kind
-        uses: engineerd/setup-kind@v0.5.0
-        with:
-          version: ${{ env.KIND_VERSION }}
-          skipClusterCreation: true
-
-      - name: Setup Kind Cluster
+      - name: Tear down K3d if exist
         run: |
-          kind delete cluster
-          kind create cluster --image kindest/node:v1.20.7@sha256:688fba5ce6b825be62a7c7fe1415b35da2bdfbb5a69227c499ea4cc0008661ca
-          kubectl version
-          kubectl cluster-info
+          k3d cluster delete || true
+          k3d cluster delete worker || true
 
-      - name: Load Image to kind cluster
-        run: make kind-load
+      - name: Calculate K3d args
+        run: |
+          EGRESS_ARG=""
+          if [[ "${{ matrix.k8s-version }}" == v1.24 ]]; then
+            EGRESS_ARG="--k3s-arg --egress-selector-mode=disabled@server:0"
+          fi
+          echo "EGRESS_ARG=${EGRESS_ARG}" >> $GITHUB_ENV 
 
-      - name: Run Make
-        run: make
+      - name: Setup K3d
+        uses: nolar/setup-k3d-k3s@293b8e5822a20bc0d5bcdd4826f1a665e72aba96
+        with:
+          version: ${{ matrix.k8s-version }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          k3d-args: ${{ env.EGRESS_ARG }}
 
-      - name: Run Make Manager
-        run: make manager
+      - name: Load image to k3d cluster
+        run: make image-load image-load-runtime-cluster
 
       - name: Prepare for e2e tests
         run: |
+          make vela-cli
           make e2e-cleanup
-          make e2e-setup
-          helm lint ./charts/vela-core
+          make e2e-setup-core
+          make setup-runtime-e2e-cluster
           helm test -n vela-system kubevela --timeout 5m
 
       - name: Run e2e tests
@@ -87,7 +101,7 @@ jobs:
         run: make end-e2e
 
       - name: Upload coverage report
-        uses: codecov/codecov-action@v1
+        uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: /tmp/e2e-profile.out

.github/workflows/e2e-test.yml

@@ -5,45 +5,57 @@ on:
     branches:
       - master
       - release-*
+    tags:
+      - v*
   workflow_dispatch: {}
   pull_request:
     branches:
       - master
       - release-*
 
+permissions:
+  contents: read
+
 env:
   # Common versions
-  GO_VERSION: '1.17'
-  GOLANGCI_VERSION: 'v1.38'
-  KIND_VERSION: 'v0.7.0'
+  GO_VERSION: '1.19'
 
 jobs:
 
   detect-noop:
+    permissions:
+      actions: write
     runs-on: ubuntu-20.04
     outputs:
       noop: ${{ steps.noop.outputs.should_skip }}
     steps:
       - name: Detect No-op Changes
         id: noop
-        uses: fkirc/skip-duplicate-actions@v3.3.0
+        uses: fkirc/skip-duplicate-actions@12aca0a884f6137d619d6a8a09fcc3406ced5281
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           paths_ignore: '["**.md", "**.mdx", "**.png", "**.jpg"]'
           do_not_skip: '["workflow_dispatch", "schedule", "push"]'
-          concurrent_skipping: false
+        continue-on-error: true
 
   e2e-tests:
     runs-on: aliyun
-    needs: detect-noop
+    needs: [ detect-noop ]
     if: needs.detect-noop.outputs.noop != 'true'
+    strategy:
+      matrix:
+        k8s-version: ["v1.20","v1.24"]
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.k8s-version }}
+      cancel-in-progress: true
+
 
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v2
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
 
       - name: Setup Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568
         with:
           go-version: ${{ env.GO_VERSION }}
 
@@ -51,33 +63,36 @@ jobs:
         run: |
           go get -v -t -d ./...
 
-      - name: Setup Kind
-        uses: engineerd/setup-kind@v0.5.0
-        with:
-          version: ${{ env.KIND_VERSION }}
-          skipClusterCreation: true
-
-      - name: Setup Kind Cluster
+      - name: Tear down K3d if exist
         run: |
-          kind delete cluster
-          kind create cluster --image kindest/node:v1.20.7@sha256:688fba5ce6b825be62a7c7fe1415b35da2bdfbb5a69227c499ea4cc0008661ca
-          kubectl version
-          kubectl cluster-info
+          k3d cluster delete || true
+          k3d cluster delete worker || true
 
-      - name: Load Image to kind cluster
-        run: make kind-load
+      - name: Calculate K3d args
+        run: |
+          EGRESS_ARG=""
+          if [[ "${{ matrix.k8s-version }}" == v1.24 ]]; then
+            EGRESS_ARG="--k3s-arg --egress-selector-mode=disabled@server:0"
+          fi
+          echo "EGRESS_ARG=${EGRESS_ARG}" >> $GITHUB_ENV 
+
+      - name: Setup K3d
+        uses: nolar/setup-k3d-k3s@293b8e5822a20bc0d5bcdd4826f1a665e72aba96
+        with:
+          version: ${{ matrix.k8s-version }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          k3d-args: ${{ env.EGRESS_ARG }}
+
+      - name: Load image to k3d cluster
+        run: make image-load
 
       - name: Run Make
         run: make
 
-      - name: Run Make Manager
-        run: make manager
-
       - name: Prepare for e2e tests
         run: |
           make e2e-cleanup
-          make e2e-setup
-          helm lint ./charts/vela-core
+          make e2e-setup-core
           helm test -n vela-system kubevela --timeout 5m
 
       - name: Run api e2e tests
@@ -93,7 +108,7 @@ jobs:
         run: make end-e2e
 
       - name: Upload coverage report
-        uses: codecov/codecov-action@v1
+        uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: /tmp/e2e-profile.out

.github/workflows/go.yml

@@ -11,11 +11,13 @@ on:
       - master
       - release-*
 
+permissions:  # added using https://github.com/step-security/secure-workflows
+  contents: read
+
 env:
   # Common versions
-  GO_VERSION: '1.17'
-  GOLANGCI_VERSION: 'v1.38'
-  KIND_VERSION: 'v0.7.0'
+  GO_VERSION: '1.19'
+  GOLANGCI_VERSION: 'v1.49'
 
 jobs:
 
@@ -23,15 +25,17 @@ jobs:
     runs-on: ubuntu-20.04
     outputs:
       noop: ${{ steps.noop.outputs.should_skip }}
+    permissions:
+      actions: write
     steps:
       - name: Detect No-op Changes
         id: noop
-        uses: fkirc/skip-duplicate-actions@v3.3.0
+        uses: fkirc/skip-duplicate-actions@12aca0a884f6137d619d6a8a09fcc3406ced5281
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           paths_ignore: '["**.md", "**.mdx", "**.png", "**.jpg"]'
           do_not_skip: '["workflow_dispatch", "schedule", "push"]'
-          concurrent_skipping: false
+        continue-on-error: true
 
   staticcheck:
     runs-on: ubuntu-20.04
@@ -40,27 +44,17 @@ jobs:
 
     steps:
       - name: Setup Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568
         with:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
         with:
           submodules: true
 
-      - name: Cache Go Dependencies
-        uses: actions/cache@v2
-        with:
-          path: .work/pkg
-          key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }}
-          restore-keys: ${{ runner.os }}-pkg-
-
-      - name: Install StaticCheck
-        run: GO111MODULE=on go get honnef.co/go/tools/cmd/staticcheck@v0.3.0
-
       - name: Static Check
-        run: staticcheck ./...
+        run: make staticcheck
 
       - name: License Header Check
         run: make check-license-header
@@ -69,31 +63,27 @@ jobs:
     runs-on: ubuntu-20.04
     needs: detect-noop
     if: needs.detect-noop.outputs.noop != 'true'
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for golangci/golangci-lint-action to fetch pull requests
 
     steps:
       - name: Setup Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568
         with:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
         with:
           submodules: true
 
-      - name: Cache Go Dependencies
-        uses: actions/cache@v2
-        with:
-          path: .work/pkg
-          key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }}
-          restore-keys: ${{ runner.os }}-pkg-
-
       # This action uses its own setup-go, which always seems to use the latest
       # stable version of Go. We could run 'make lint' to ensure our desired Go
       # version, but we prefer this action because it leaves 'annotations' (i.e.
       # it comments on PRs to point out linter violations).
       - name: Lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@07db5389c99593f11ad7b44463c2d4233066a9b1 # v3.3.0
         with:
           version: ${{ env.GOLANGCI_VERSION }}
 
@@ -104,35 +94,125 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
         with:
           submodules: true
 
       - name: Setup Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568
         with:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Setup node
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516
         with:
           node-version: '14'
 
       - name: Cache Go Dependencies
-        uses: actions/cache@v2
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
         with:
           path: .work/pkg
           key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }}
           restore-keys: ${{ runner.os }}-pkg-
 
-      - name: Check code formatting
-        run: go install golang.org/x/tools/cmd/goimports && make fmt
-
       - name: Run cross-build
         run: make cross-build
 
       - name: Check Diff
-        run: make check-diff
+        run: |
+          export PATH=$(pwd)/bin/:$PATH
+          make check-diff
               
       - name: Cleanup binary
         run: make build-cleanup
+
+  check-windows:
+    runs-on: windows-latest
+    needs: detect-noop
+    if: needs.detect-noop.outputs.noop != 'true'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
+        with:
+          submodules: true
+
+      - name: Setup Go
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: Cache Go Dependencies
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
+        with:
+          path: .work/pkg
+          key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }}
+          restore-keys: ${{ runner.os }}-pkg-
+
+      - name: Run Build CLI
+        run: make vela-cli
+
+      - name: Run CLI for version
+        shell: cmd
+        run: |
+          move .\bin\vela .\bin\vela.exe
+          .\bin\vela.exe version
+
+  check-core-image-build:
+    runs-on: ubuntu-latest
+    needs: detect-noop
+    if: needs.detect-noop.outputs.noop != 'true'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
+        with:
+          submodules: true
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v2.1.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v2.2.1
+      - name: Build Test for vela core
+        uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5 # v3.2.0
+        with:
+          context: .
+          file: Dockerfile
+          platforms: linux/amd64,linux/arm64
+
+  check-apiserver-image-build:
+    runs-on: ubuntu-latest
+    needs: detect-noop
+    if: needs.detect-noop.outputs.noop != 'true'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
+        with:
+          submodules: true
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v2.1.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v2.2.1
+      - name: Build Test for apiserver
+        uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5 # v3.2.0
+        with:
+          context: .
+          file: Dockerfile.apiserver
+          platforms: linux/amd64,linux/arm64
+
+  check-cli-image-build:
+    runs-on: ubuntu-latest
+    needs: detect-noop
+    if: needs.detect-noop.outputs.noop != 'true'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
+        with:
+          submodules: true
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v2.1.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v2.2.1
+      - name: Build Test for CLI
+        uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5 # v3.2.0
+        with:
+          context: .
+          file: Dockerfile.cli

.github/workflows/issue-commands.yml

@@ -5,17 +5,26 @@ on:
   issue_comment:
     types: [created]
 
+permissions:
+  contents: read
+
 jobs:
   bot:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v2
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
         with:
           repository: "oam-dev/kubevela-github-actions"
           path: ./actions
           ref: v0.4.2
-      - name: Install Actions
+      - name: Setup Node.js
+        uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516
+        with:
+          node-version: '14'
+          cache: 'npm'
+          cache-dependency-path: ./actions/package-lock.json
+      - name: Install Dependencies
         run: npm ci --production --prefix ./actions
       - name: Run Commands
         uses: ./actions/commands
@@ -24,12 +33,15 @@ jobs:
           configPath: issue-commands
 
   backport:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
     if: github.event.issue.pull_request && contains(github.event.comment.body, '/backport')
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
       - name: Extract Command
         id: command
-        uses: xt0rted/slash-command-action@v1
+        uses: xt0rted/slash-command-action@bf51f8f5f4ea3d58abc7eca58f77104182b23e88
         with:
           repo-token: ${{ secrets.VELA_BOT_TOKEN }}
           command: backport
@@ -38,7 +50,7 @@ jobs:
           allow-edits: "false"
           permission-level: read
       - name: Handle Command
-        uses: actions/github-script@v4
+        uses: actions/github-script@d556feaca394842dc55e4734bf3bb9f685482fa0
         env:
           VERSION: ${{ steps.command.outputs.command-arguments }}
         with:
@@ -59,11 +71,11 @@ jobs:
             })
             console.log("Added '" + label + "' label.")
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
         with:
           fetch-depth: 0
       - name: Open Backport PR
-        uses: zeebe-io/backport-action@v0.0.6
+        uses: zeebe-io/backport-action@2ee900dc92632adf994f8e437b6d16840fd61f58
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           github_workspace: ${{ github.workspace }}

.github/workflows/license.yml

@@ -9,13 +9,16 @@ on:
     branches:
       - master
       - release-*
+      -
+permissions:
+  contents: read
 
 jobs:
   license_check:
     runs-on: ubuntu-latest
     name: Check for unapproved licenses
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:

.github/workflows/registry.yml

@@ -8,17 +8,19 @@ on:
   workflow_dispatch: {}
 
 env:
-  BUCKET: ${{ secrets.OSS_BUCKET }}
-  ENDPOINT: ${{ secrets.OSS_ENDPOINT }}
   ACCESS_KEY: ${{ secrets.OSS_ACCESS_KEY }}
   ACCESS_KEY_SECRET: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
-  ARTIFACT_HUB_REPOSITORY_ID: ${{ secrets.ARTIFACT_HUB_REPOSITORY_ID }}
+
+permissions:
+  contents: read
 
 jobs:
-  publish-images:
+  publish-core-images:
+    permissions:
+      packages: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
       - name: Get the version
         id: get_version
         run: |
@@ -26,41 +28,37 @@ jobs:
           if [[ ${GITHUB_REF} == "refs/heads/master" ]]; then
             VERSION=latest
           fi
-          echo ::set-output name=VERSION::${VERSION}
+          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
       - name: Get git revision
         id: vars
         shell: bash
         run: |
-          echo "::set-output name=git_revision::$(git rev-parse --short HEAD)"
+          echo "git_revision=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
       - name: Login ghcr.io
-        uses: docker/login-action@v1
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Login docker.io
-        uses: docker/login-action@v1
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
         with:
           registry: docker.io
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Login Alibaba Cloud ACR
-        uses: docker/login-action@v1
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
         with:
-          registry: kubevela-registry.cn-hangzhou.cr.aliyuncs.com
-          username: ${{ secrets.ACR_USERNAME }}@aliyun-inner.com
+          registry: ${{ secrets.ACR_DOMAIN }}
+          username: ${{ secrets.ACR_USERNAME }}
           password: ${{ secrets.ACR_PASSWORD }}
-      - uses: docker/setup-qemu-action@v1
-      - uses: docker/setup-buildx-action@v1
+      - uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v2.1.0
+      - uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v2.2.1
         with:
           driver-opts: image=moby/buildkit:master
 
-      - name: Build & Pushing vela-core for ACR
-        run: |
-          docker build --build-arg GOPROXY=https://proxy.golang.org --build-arg VERSION=${{ steps.get_version.outputs.VERSION }} --build-arg GITVERSION=git-${{ steps.vars.outputs.git_revision }}  -t kubevela-registry.cn-hangzhou.cr.aliyuncs.com/oamdev/vela-core:${{ steps.get_version.outputs.VERSION }} .
-          docker push kubevela-registry.cn-hangzhou.cr.aliyuncs.com/oamdev/vela-core:${{ steps.get_version.outputs.VERSION }}
-      - uses: docker/build-push-action@v2
-        name: Build & Pushing vela-core for Dockerhub and GHCR
+      - uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5 # v3.2.0
+        name: Build & Pushing vela-core for Dockerhub, GHCR and ACR
         with:
           context: .
           file: Dockerfile
@@ -75,14 +73,72 @@ jobs:
             GOPROXY=https://proxy.golang.org
           tags: |-
             docker.io/oamdev/vela-core:${{ steps.get_version.outputs.VERSION }}
-            ghcr.io/${{ github.repository }}/vela-core:${{ steps.get_version.outputs.VERSION }}
+            ghcr.io/${{ github.repository_owner }}/oamdev/vela-core:${{ steps.get_version.outputs.VERSION }}
+            ${{ secrets.ACR_DOMAIN }}/oamdev/vela-core:${{ steps.get_version.outputs.VERSION }}
 
-      - name: Build & Pushing vela-apiserver for ACR
+      - uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5 # v3.2.0
+        name: Build & Pushing CLI for Dockerhub, GHCR and ACR
+        with:
+          context: .
+          file: Dockerfile.cli
+          labels: |-
+            org.opencontainers.image.source=https://github.com/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          build-args: |
+            GITVERSION=git-${{ steps.vars.outputs.git_revision }}
+            VERSION=${{ steps.get_version.outputs.VERSION }}
+            GOPROXY=https://proxy.golang.org
+          tags: |-
+            docker.io/oamdev/vela-cli:${{ steps.get_version.outputs.VERSION }}
+            ghcr.io/${{ github.repository_owner }}/oamdev/vela-cli:${{ steps.get_version.outputs.VERSION }}
+            ${{ secrets.ACR_DOMAIN }}/oamdev/vela-cli:${{ steps.get_version.outputs.VERSION }}
+
+  publish-addon-images:
+    permissions:
+      packages: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
+      - name: Get the version
+        id: get_version
         run: |
-          docker build --build-arg GOPROXY=https://proxy.golang.org --build-arg VERSION=${{ steps.get_version.outputs.VERSION }} --build-arg GITVERSION=git-${{ steps.vars.outputs.git_revision }} -t kubevela-registry.cn-hangzhou.cr.aliyuncs.com/oamdev/vela-apiserver:${{ steps.get_version.outputs.VERSION }} -f Dockerfile.apiserver .
-          docker push kubevela-registry.cn-hangzhou.cr.aliyuncs.com/oamdev/vela-apiserver:${{ steps.get_version.outputs.VERSION }}
-      - uses: docker/build-push-action@v2
-        name: Build & Pushing vela-apiserver for Dockerhub and GHCR
+          VERSION=${GITHUB_REF#refs/tags/}
+          if [[ ${GITHUB_REF} == "refs/heads/master" ]]; then
+            VERSION=latest
+          fi
+          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
+      - name: Get git revision
+        id: vars
+        shell: bash
+        run: |
+          echo "git_revision=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+      - name: Login ghcr.io
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Login docker.io
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
+        with:
+          registry: docker.io
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: Login Alibaba Cloud ACR
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
+        with:
+          registry: ${{ secrets.ACR_DOMAIN }}
+          username: ${{ secrets.ACR_USERNAME }}
+          password: ${{ secrets.ACR_PASSWORD }}
+      - uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v2.1.0
+      - uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v2.2.1
+        with:
+          driver-opts: image=moby/buildkit:master
+
+      - uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5 # v3.2.0
+        name: Build & Pushing vela-apiserver for Dockerhub, GHCR and ACR
         with:
           context: .
           file: Dockerfile.apiserver
@@ -97,14 +153,11 @@ jobs:
             GOPROXY=https://proxy.golang.org
           tags: |-
             docker.io/oamdev/vela-apiserver:${{ steps.get_version.outputs.VERSION }}
-            ghcr.io/${{ github.repository }}/vela-apiserver:${{ steps.get_version.outputs.VERSION }}
+            ghcr.io/${{ github.repository_owner }}/oamdev/vela-apiserver:${{ steps.get_version.outputs.VERSION }}
+            ${{ secrets.ACR_DOMAIN }}/oamdev/vela-apiserver:${{ steps.get_version.outputs.VERSION }}
 
-      - name: Build & Pushing vela runtime rollout for ACR
-        run: |
-          docker build --build-arg GOPROXY=https://proxy.golang.org --build-arg VERSION=${{ steps.get_version.outputs.VERSION }} --build-arg GITVERSION=git-${{ steps.vars.outputs.git_revision }}  -t kubevela-registry.cn-hangzhou.cr.aliyuncs.com/oamdev/vela-rollout:${{ steps.get_version.outputs.VERSION }} .
-          docker push kubevela-registry.cn-hangzhou.cr.aliyuncs.com/oamdev/vela-rollout:${{ steps.get_version.outputs.VERSION }}
-      - uses: docker/build-push-action@v2
-        name: Build & Pushing runtime rollout for Dockerhub and GHCR
+      - uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5 # v3.2.0
+        name: Build & Pushing runtime rollout Dockerhub, GHCR and ACR
         with:
           context: .
           file: runtime/rollout/Dockerfile
@@ -119,96 +172,8 @@ jobs:
             GOPROXY=https://proxy.golang.org
           tags: |-
             docker.io/oamdev/vela-rollout:${{ steps.get_version.outputs.VERSION }}
-            ghcr.io/${{ github.repository }}/vela-rollout:${{ steps.get_version.outputs.VERSION }}
-
-  publish-charts:
-    env:
-      HELM_CHARTS_DIR: charts
-      HELM_CHART: charts/vela-core
-      MINIMAL_HELM_CHART: charts/vela-minimal
-      LEGACY_HELM_CHART: legacy/charts/vela-core-legacy
-      OAM_RUNTIME_HELM_CHART: charts/oam-runtime
-      VELA_ROLLOUT_HELM_CHART: runtime/rollout/charts
-      LOCAL_OSS_DIRECTORY: .oss/
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@master
-      - name: Get git revision
-        id: vars
-        shell: bash
-        run: |
-          echo "::set-output name=git_revision::$(git rev-parse --short HEAD)"
-      - name: Install Helm
-        uses: azure/setup-helm@v1
-        with:
-          version: v3.4.0
-      - name: Setup node
-        uses: actions/setup-node@v2
-        with:
-          node-version: '14'
-      - name: Generate helm doc
-        run: |
-          make helm-doc-gen
-      - name: Prepare legacy chart
-        run: |
-          rsync -r $LEGACY_HELM_CHART $HELM_CHARTS_DIR
-          rsync -r $HELM_CHART/* $LEGACY_HELM_CHART --exclude=Chart.yaml --exclude=crds
-      - name: Prepare vela chart
-        run: |
-          rsync -r $VELA_ROLLOUT_HELM_CHART $HELM_CHARTS_DIR
-      - uses: oprypin/find-latest-tag@v1
-        with:
-          repository: oam-dev/kubevela
-          releases-only: true
-        id: latest_tag
-      - name: Tag helm chart image
-        run: |
-          latest_repo_tag=${{ steps.latest_tag.outputs.tag }}
-          sub="."
-          major="$(cut -d"$sub" -f1 <<<"$latest_repo_tag")"
-          minor="$(cut -d"$sub" -f2 <<<"$latest_repo_tag")"
-          patch="0"
-          current_repo_tag="$major.$minor.$patch"
-          image_tag=${GITHUB_REF#refs/tags/}
-          chart_version=$latest_repo_tag
-          if [[ ${GITHUB_REF} == "refs/heads/master" ]]; then
-            image_tag=latest
-            chart_version=${current_repo_tag}-nightly-build
-          fi
-          sed -i "s/latest/${image_tag}/g" $HELM_CHART/values.yaml
-          sed -i "s/latest/${image_tag}/g" $MINIMAL_HELM_CHART/values.yaml
-          sed -i "s/latest/${image_tag}/g" $LEGACY_HELM_CHART/values.yaml
-          sed -i "s/latest/${image_tag}/g" $OAM_RUNTIME_HELM_CHART/values.yaml
-          sed -i "s/latest/${image_tag}/g" $VELA_ROLLOUT_HELM_CHART/values.yaml
-          chart_smever=${chart_version#"v"}
-          sed -i "s/0.1.0/$chart_smever/g" $HELM_CHART/Chart.yaml
-          sed -i "s/0.1.0/$chart_smever/g" $MINIMAL_HELM_CHART/Chart.yaml
-          sed -i "s/0.1.0/$chart_smever/g" $LEGACY_HELM_CHART/Chart.yaml
-          sed -i "s/0.1.0/$chart_smever/g" $OAM_RUNTIME_HELM_CHART/Chart.yaml
-          sed -i "s/0.1.0/$chart_smever/g" $VELA_ROLLOUT_HELM_CHART/Chart.yaml
-      - name: Install ossutil
-        run: wget http://gosspublic.alicdn.com/ossutil/1.7.0/ossutil64 && chmod +x ossutil64 && mv ossutil64 ossutil
-      - name: Configure Alibaba Cloud OSSUTIL
-        run: ./ossutil --config-file .ossutilconfig config -i ${ACCESS_KEY} -k ${ACCESS_KEY_SECRET} -e ${ENDPOINT} -c .ossutilconfig
-      - name: sync cloud to local
-        run: ./ossutil --config-file .ossutilconfig sync oss://$BUCKET/core $LOCAL_OSS_DIRECTORY
-      - name: add artifacthub stuff to the repo
-        run: |
-          rsync $HELM_CHART/README.md $LEGACY_HELM_CHART/README.md
-          rsync $HELM_CHART/README.md $OAM_RUNTIME_HELM_CHART/README.md
-          rsync $HELM_CHART/README.md $VELA_ROLLOUT_HELM_CHART/README.md
-          sed -i "s/ARTIFACT_HUB_REPOSITORY_ID/$ARTIFACT_HUB_REPOSITORY_ID/g" hack/artifacthub/artifacthub-repo.yml
-          rsync hack/artifacthub/artifacthub-repo.yml $LOCAL_OSS_DIRECTORY
-      - name: Package helm charts
-        run: |
-          helm package $HELM_CHART --destination $LOCAL_OSS_DIRECTORY
-          helm package $MINIMAL_HELM_CHART --destination $LOCAL_OSS_DIRECTORY
-          helm package $LEGACY_HELM_CHART --destination $LOCAL_OSS_DIRECTORY
-          helm package $OAM_RUNTIME_HELM_CHART --destination $LOCAL_OSS_DIRECTORY
-          helm package $VELA_ROLLOUT_HELM_CHART --destination $LOCAL_OSS_DIRECTORY
-          helm repo index --url https://$BUCKET.$ENDPOINT/core $LOCAL_OSS_DIRECTORY
-      - name: sync local to cloud
-        run: ./ossutil --config-file .ossutilconfig sync $LOCAL_OSS_DIRECTORY oss://$BUCKET/core -f
+            ghcr.io/${{ github.repository_owner }}/oamdev/vela-rollout:${{ steps.get_version.outputs.VERSION }}
+            ${{ secrets.ACR_DOMAIN }}/oamdev/vela-rollout:${{ steps.get_version.outputs.VERSION }}
 
   publish-capabilities:
     env:
@@ -217,7 +182,7 @@ jobs:
       CAPABILITY_ENDPOINT: oss-cn-beijing.aliyuncs.com
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
       - name: Install ossutil
         run: wget http://gosspublic.alicdn.com/ossutil/1.7.0/ossutil64 && chmod +x ossutil64 && mv ossutil64 ossutil
       - name: Configure Alibaba Cloud OSSUTIL
@@ -227,4 +192,4 @@ jobs:
       - name: rsync all capabilites
         run: rsync vela-templates/registry/auto-gen/* $CAPABILITY_DIR
       - name: sync local to cloud
-        run: ./ossutil --config-file .ossutilconfig sync $CAPABILITY_DIR oss://$CAPABILITY_BUCKET -f
+        run: ./ossutil --config-file .ossutilconfig sync $CAPABILITY_DIR oss://$CAPABILITY_BUCKET -f

.github/workflows/release.yml

@@ -7,156 +7,86 @@ on:
   workflow_dispatch: { }
 
 env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   BUCKET: ${{ secrets.CLI_OSS_BUCKET }}
   ENDPOINT: ${{ secrets.CLI_OSS_ENDPOINT }}
   ACCESS_KEY: ${{ secrets.CLI_OSS_ACCESS_KEY }}
   ACCESS_KEY_SECRET: ${{ secrets.CLI_OSS_ACCESS_KEY_SECRET }}
 
+permissions:
+  contents: read
+
 jobs:
   build:
+    permissions:
+      contents: write
+      actions: read
+      checks: write
+      issues: read
+      packages: write
+      pull-requests: read
+      repository-projects: read
+      statuses: read
     runs-on: ubuntu-latest
-    name: build
-    strategy:
-      matrix:
-        TARGETS: [ linux/amd64, darwin/amd64, windows/amd64, linux/arm64, darwin/arm64 ]
-    env:
-      VELA_VERSION_KEY: github.com/oam-dev/kubevela/version.VelaVersion
-      VELA_GITVERSION_KEY: github.com/oam-dev/kubevela/version.GitRevision
-      GO_BUILD_ENV: GO111MODULE=on CGO_ENABLED=0
-      DIST_DIRS: find * -type d -exec
+    name: goreleaser
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
-      - name: Set up Go
-        uses: actions/setup-go@v2
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
         with:
-          go-version: 1.17
-      - name: Get release
-        id: get_release
-        uses: bruceadams/get-release@v1.2.2
+          fetch-depth: 0
+      - run: git fetch --force --tags
+      - name: Set up Go
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568
+        with:
+          go-version: 1.19
+          cache: true
+      - uses: goreleaser/goreleaser-action@9754a253a8673b0ea869c2e863b4e975497efd0c # v4.1.1
+        with:
+          distribution: goreleaser
+          version: 1.14.1
+          args: release --rm-dist --timeout 60m
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # Since goreleaser haven't supported aliyun OSS, we need to upload the release manually
       - name: Get version
         run: echo "VELA_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
-      - name: Get matrix
-        id: get_matrix
-        run: |
-          TARGETS=${{matrix.TARGETS}}
-          echo ::set-output name=OS::${TARGETS%/*}
-          echo ::set-output name=ARCH::${TARGETS#*/}
-      - name: Get ldflags
-        id: get_ldflags
-        run: |
-          LDFLAGS="-s -w -X ${{ env.VELA_VERSION_KEY }}=${{ env.VELA_VERSION }} -X ${{ env.VELA_GITVERSION_KEY }}=git-$(git rev-parse --short HEAD)"
-          echo "LDFLAGS=${LDFLAGS}" >> $GITHUB_ENV
-      - name: Build
-        run: |
-          ${{ env.GO_BUILD_ENV }} GOOS=${{ steps.get_matrix.outputs.OS }} GOARCH=${{ steps.get_matrix.outputs.ARCH }} \
-            go build -ldflags "${{ env.LDFLAGS }}" \
-            -o _bin/vela/${{ steps.get_matrix.outputs.OS }}-${{ steps.get_matrix.outputs.ARCH }}/vela -v \
-            ./references/cmd/cli/main.go
-          ${{ env.GO_BUILD_ENV }} GOOS=${{ steps.get_matrix.outputs.OS }} GOARCH=${{ steps.get_matrix.outputs.ARCH }} \
-            go build -ldflags "${{ env.LDFLAGS }}" \
-            -o _bin/kubectl-vela/${{ steps.get_matrix.outputs.OS }}-${{ steps.get_matrix.outputs.ARCH }}/kubectl-vela -v \
-            ./cmd/plugin/main.go
-      - name: Compress
-        run: |
-          echo "\n## Release Info\nVERSION: ${{ env.VELA_VERSION }}" >> README.md && \
-          echo "GIT_COMMIT: ${GITHUB_SHA}\n" >> README.md && \
-          cd _bin/vela && \
-          ${{ env.DIST_DIRS }} cp ../../LICENSE {} \; && \
-          ${{ env.DIST_DIRS }} cp ../../README.md {} \; && \
-          ${{ env.DIST_DIRS }} tar -zcf vela-{}.tar.gz {} \; && \
-          ${{ env.DIST_DIRS }} zip -r vela-{}.zip {} \; && \
-          cd ../kubectl-vela && \
-          ${{ env.DIST_DIRS }} cp ../../LICENSE {} \; && \
-          ${{ env.DIST_DIRS }} cp ../../README.md {} \; && \
-          ${{ env.DIST_DIRS }} tar -zcf kubectl-vela-{}.tar.gz {} \; && \
-          ${{ env.DIST_DIRS }} zip -r kubectl-vela-{}.zip {} \; && \
-          cd .. && \
-          sha256sum vela/vela-* kubectl-vela/kubectl-vela-* >> sha256-${{ steps.get_matrix.outputs.OS }}-${{ steps.get_matrix.outputs.ARCH }}.txt \
-      - name: Upload Vela tar.gz
-        uses: actions/upload-release-asset@v1.0.2
-        with:
-          upload_url: ${{ steps.get_release.outputs.upload_url }}
-          asset_path: ./_bin/vela/vela-${{ steps.get_matrix.outputs.OS }}-${{ steps.get_matrix.outputs.ARCH }}.tar.gz
-          asset_name: vela-${{ env.VELA_VERSION }}-${{ steps.get_matrix.outputs.OS }}-${{ steps.get_matrix.outputs.ARCH }}.tar.gz
-          asset_content_type: binary/octet-stream
-      - name: Upload Vela zip
-        uses: actions/upload-release-asset@v1.0.2
-        with:
-          upload_url: ${{ steps.get_release.outputs.upload_url }}
-          asset_path: ./_bin/vela/vela-${{ steps.get_matrix.outputs.OS }}-${{ steps.get_matrix.outputs.ARCH }}.zip
-          asset_name: vela-${{ env.VELA_VERSION }}-${{ steps.get_matrix.outputs.OS }}-${{ steps.get_matrix.outputs.ARCH }}.zip
-          asset_content_type: binary/octet-stream
-      - name: Upload Kubectl-Vela tar.gz
-        uses: actions/upload-release-asset@v1.0.2
-        with:
-          upload_url: ${{ steps.get_release.outputs.upload_url }}
-          asset_path: ./_bin/kubectl-vela/kubectl-vela-${{ steps.get_matrix.outputs.OS }}-${{ steps.get_matrix.outputs.ARCH }}.tar.gz
-          asset_name: kubectl-vela-${{ env.VELA_VERSION }}-${{ steps.get_matrix.outputs.OS }}-${{ steps.get_matrix.outputs.ARCH }}.tar.gz
-          asset_content_type: binary/octet-stream
-      - name: Upload Kubectl-Vela zip
-        uses: actions/upload-release-asset@v1.0.2
-        with:
-          upload_url: ${{ steps.get_release.outputs.upload_url }}
-          asset_path: ./_bin/kubectl-vela/kubectl-vela-${{ steps.get_matrix.outputs.OS }}-${{ steps.get_matrix.outputs.ARCH }}.zip
-          asset_name: kubectl-vela-${{ env.VELA_VERSION }}-${{ steps.get_matrix.outputs.OS }}-${{ steps.get_matrix.outputs.ARCH }}.zip
-          asset_content_type: binary/octet-stream
-      - name: Post sha256
-        uses: actions/upload-artifact@v2
-        with:
-          name: sha256sums
-          path: ./_bin/sha256-${{ steps.get_matrix.outputs.OS }}-${{ steps.get_matrix.outputs.ARCH }}.txt
-          retention-days: 1
       - name: Install ossutil
         run: wget http://gosspublic.alicdn.com/ossutil/1.7.0/ossutil64 && chmod +x ossutil64 && mv ossutil64 ossutil
       - name: Configure Alibaba Cloud OSSUTIL
-        run: ./ossutil --config-file .ossutilconfig config -i ${ACCESS_KEY} -k ${ACCESS_KEY_SECRET} -e ${ENDPOINT} -c .ossutilconfig
+        run: ./ossutil --config-file .ossutilconfig config -i ${ACCESS_KEY} -k ${ACCESS_KEY_SECRET} -e ${ENDPOINT}
+      - name: split files to be upload
+        run: mkdir -p ./dist/files_upload && mv ./dist/*.tar.gz ./dist/files_upload && mv ./dist/*.zip ./dist/files_upload
       - name: sync local to cloud
-        run: ./ossutil --config-file .ossutilconfig sync ./_bin/vela oss://$BUCKET/binary/vela/${{ env.VELA_VERSION }}
+        run: ./ossutil --config-file .ossutilconfig sync ./dist/files_upload oss://$BUCKET/binary/vela/${{ env.VELA_VERSION }}
       - name: sync the latest version file
+        if: ${{ !contains(env.VELA_VERSION,'alpha') && !contains(env.VELA_VERSION,'beta') }}
         run: |
-          touch ${{ env.VELA_VERSION }} > ./latest_version
-          ./ossutil --config-file .ossutilconfig ./latest_version oss://$BUCKET/binary/vela/latest_version
-
-
-
+          LATEST_VERSION=$(curl -fsSl https://static.kubevela.net/binary/vela/latest_version)
+          verlte() {
+            [  "$1" = "`echo -e "$1\n$2" | sort -V | head -n1`" ]
+          }
+          verlte ${{ env.VELA_VERSION }} $LATEST_VERSION && echo "${{ env.VELA_VERSION }} <= $LATEST_VERSION, skip update" && exit 0
+          echo ${{ env.VELA_VERSION }} > ./latest_version
+          ./ossutil --config-file .ossutilconfig cp -u ./latest_version oss://$BUCKET/binary/vela/latest_version
   upload-plugin-homebrew:
+    permissions:
+      contents: write
+      actions: read
+      checks: write
+      issues: read
+      packages: write
+      pull-requests: read
+      repository-projects: read
+      statuses: read
     needs: build
     runs-on: ubuntu-latest
     name: upload-sha256sums
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
-      - name: Get release
-        id: get_release
-        uses: bruceadams/get-release@v1.2.2
-      - name: Download sha256sums
-        uses: actions/download-artifact@v2
-        with:
-          name: sha256sums
-          path: cli-artifacts
-      - name: Display structure of downloaded files
-        run: ls -R
-        working-directory: cli-artifacts
-      - shell: bash
-        working-directory: cli-artifacts
-        run: |
-          for file in *
-          do
-            cat ${file} >> sha256sums.txt
-          done
-      - name: Upload Checksums
-        uses: actions/upload-release-asset@v1.0.2
-        with:
-          upload_url: ${{ steps.get_release.outputs.upload_url }}
-          asset_path: cli-artifacts/sha256sums.txt
-          asset_name: sha256sums.txt
-          asset_content_type: text/plain
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
       - name: Update kubectl plugin version in krew-index
-        uses: rajatjindal/krew-release-bot@v0.0.38
+        uses: rajatjindal/krew-release-bot@3320c0b546b5d2320613c46762bd3f73e2801bdc # v0.0.38
       - name: Update Homebrew formula
-        uses: dawidd6/action-homebrew-bump-formula@v3
+        uses: dawidd6/action-homebrew-bump-formula@02e79d9da43d79efa846d73695b6052cbbdbf48a # v3.8.3
         with:
           token: ${{ secrets.HOMEBREW_TOKEN }}
           formula: kubevela

.github/workflows/scorecards.yml

@@ -0,0 +1,60 @@
+name: Scorecards supply-chain security
+on:
+  schedule:
+    # Weekly on Saturdays.
+    - cron: '30 1 * * 6'
+  push:
+    branches: [ master ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecards analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Used to receive a badge. (Upcoming feature)
+      id-token: write
+      actions: read
+      contents: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@937ffa90d79c7d720498178154ad4c7ba1e4ad8c # tag=v2.1.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecards on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Publish the results for public repositories to enable scorecard badges. For more details, see
+          # https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories, `publish_results` will automatically be set to `false`, regardless
+          # of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # v2.1.37
+        with:
+          sarif_file: results.sarif

.github/workflows/sync-api.yml

@@ -7,25 +7,27 @@ on:
     tags:
       - "v*"
 
+permissions:
+  contents: read
+
+env:
+  GO_VERSION: '1.19'
+
 jobs:
   sync-core-api:
     runs-on: ubuntu-20.04
     steps:
-      - name: Set up Go 1.17
-        uses: actions/setup-go@v1
-        env:
-          GO_VERSION: '1.17'
-          GOLANGCI_VERSION: 'v1.38'
+      - name: Set up Go
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568
         with:
           go-version: ${{ env.GO_VERSION }}
-        id: go
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v2
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
 
       - name: Get the version
         id: get_version
-        run: echo ::set-output name=VERSION::${GITHUB_REF#refs/tags/}
+        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
 
       - name: Sync to kubevela-core-api Repo
         env:
@@ -34,4 +36,4 @@ jobs:
           COMMIT_ID: ${{ github.sha }}
         run: |
           bash ./hack/apis/clientgen.sh
-          bash ./hack/apis/sync.sh
+          bash ./hack/apis/sync.sh sync

.github/workflows/timed-task.yml

@@ -2,6 +2,10 @@ name: Timed Task
 on:
   schedule:
     - cron: '* * * * *'
+
+permissions:
+  contents: read
+
 jobs:
   clean-image:
     runs-on: aliyun

.github/workflows/trivy-scan.yml

@@ -0,0 +1,33 @@
+name: "Trivy Scan"
+
+on:
+  pull_request:
+    branches: [ master ]
+
+permissions:
+  contents: read
+
+jobs:
+  images:
+    name: Image Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
+
+      - name: Build Vela Core image from Dockerfile
+        run: |
+          docker build --build-arg GOPROXY=https://proxy.golang.org -t docker.io/oamdev/vela-core:${{ github.sha }} .
+
+      - name: Run Trivy vulnerability scanner for vela core
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: 'docker.io/oamdev/vela-core:${{ github.sha }}'
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        if: always()
+        with:
+          sarif_file: 'trivy-results.sarif'

.github/workflows/unit-test.yml

@@ -5,33 +5,36 @@ on:
     branches:
       - master
       - release-*
-  workflow_dispatch: {}
+  workflow_dispatch: { }
   pull_request:
     branches:
       - master
       - release-*
 
+permissions:
+  contents: read
+
 env:
   # Common versions
-  GO_VERSION: '1.17'
-  GOLANGCI_VERSION: 'v1.38'
-  KIND_VERSION: 'v0.7.0'
+  GO_VERSION: '1.19'
 
 jobs:
 
   detect-noop:
+    permissions:
+      actions: write  # for fkirc/skip-duplicate-actions to skip or stop workflow runs
     runs-on: ubuntu-20.04
     outputs:
       noop: ${{ steps.noop.outputs.should_skip }}
     steps:
       - name: Detect No-op Changes
         id: noop
-        uses: fkirc/skip-duplicate-actions@v3.3.0
+        uses: fkirc/skip-duplicate-actions@12aca0a884f6137d619d6a8a09fcc3406ced5281
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           paths_ignore: '["**.md", "**.mdx", "**.png", "**.jpg"]'
           do_not_skip: '["workflow_dispatch", "schedule", "push"]'
-          concurrent_skipping: false
+        continue-on-error: true
 
   unit-tests:
     runs-on: ubuntu-20.04
@@ -40,44 +43,47 @@ jobs:
 
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v1
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568
         with:
           go-version: ${{ env.GO_VERSION }}
-        id: go
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v2
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
         with:
           submodules: true
 
       - name: Cache Go Dependencies
-        uses: actions/cache@v2
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
         with:
           path: .work/pkg
           key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }}
           restore-keys: ${{ runner.os }}-pkg-
 
       - name: Install ginkgo
-        run:  |
+        run: |
+          sudo sed -i 's/azure\.//' /etc/apt/sources.list
+          sudo apt-get update
           sudo apt-get install -y golang-ginkgo-dev
 
-      - name: Setup Kind Cluster
-        uses: engineerd/setup-kind@v0.5.0
+      - name: Setup K3d
+        uses: nolar/setup-k3d-k3s@293b8e5822a20bc0d5bcdd4826f1a665e72aba96
         with:
-          version: ${{ env.KIND_VERSION }}
+          version: v1.20
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
+        # TODO need update action version to resolve node 12 deprecated.
       - name: install Kubebuilder
-        uses: RyanSiu1995/kubebuilder-action@v1.2
+        uses: RyanSiu1995/kubebuilder-action@ff52bff1bae252239223476e5ab0d71d6ba02343
         with:
           version: 3.1.0
           kubebuilderOnly: false
           kubernetesVersion: v1.21.2
-      
+
       - name: Run Make test
         run: make test
 
       - name: Upload coverage report
-        uses: codecov/codecov-action@v1
+        uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           file: ./coverage.txt

.gitignore

@@ -1,4 +1,4 @@
-# Binaries for programs and plugins
+# Binaries for programs and docgen
 *.exe
 *.exe~
 *.dll
@@ -7,6 +7,7 @@
 bin
 _bin
 e2e/vela
+vela
 
 # Test binary, build with `go test -c`
 *.test
@@ -32,6 +33,7 @@ vendor/
 
 # Vscode files
 .vscode
+.history
 
 pkg/test/vela
 config/crd/bases
@@ -49,4 +51,7 @@ tmp/
 git-page/
 
 # e2e rollout runtime image build
-runtime/rollout/e2e/tmp
+runtime/rollout/e2e/tmp
+vela.json
+
+dist/

.golangci.yml

@@ -38,7 +38,7 @@ linters-settings:
     # report about shadowed variables
     check-shadowing: false
 
-  golint:
+  revive:
     # minimal confidence for issues, default is 0.8
     min-confidence: 0.8
 
@@ -116,11 +116,20 @@ linters:
     - goconst
     - goimports
     - gofmt  # We enable this as well as goimports for its simplify mode.
-    - golint
+    - revive
     - unconvert
     - misspell
     - nakedret
-
+    - exportloopref
+  disable:
+    - deadcode
+    - scopelint
+    - structcheck
+    - varcheck
+    - rowserrcheck
+    - sqlclosecheck
+    - errchkjson
+    - contextcheck
   presets:
     - bugs
     - unused
@@ -137,7 +146,7 @@ issues:
         - errcheck
         - dupl
         - gosec
-        - scopelint
+        - exportloopref
         - unparam
 
     # Ease some gocritic warnings on test files.
@@ -186,7 +195,15 @@ issues:
 
     - text: "don't use an underscore"
       linters:
-        - golint
+        - revive
+
+    - text: "package-comments: should have a package comment"
+      linters:
+        - revive
+
+    - text: "error-strings: error strings should not be capitalized or end with punctuation or a newline"
+      linters:
+        - revive
 
   # Independently from option `exclude` we use default exclude patterns,
   # it can be disabled by this option. To list all

.goreleaser.yaml

@@ -0,0 +1,76 @@
+# This is an example .goreleaser.yml file with some sensible defaults.
+# Make sure to check the documentation at https://goreleaser.com
+builds:
+  - id: vela-cli
+    binary: vela
+    goos:
+      - linux
+      - windows
+      - darwin
+    goarch:
+      - amd64
+      - arm64
+    main: ./references/cmd/cli/main.go
+    ldflags:
+      - -s -w -X github.com/oam-dev/kubevela/version.VelaVersion={{ .Version }} -X github.com/oam-dev/kubevela/version.GitRevision=git-{{.ShortCommit}}
+    env:
+      - CGO_ENABLED=0
+
+  - id: kubectl-vela
+    binary: kubectl-vela
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - windows
+      - darwin
+    goarch:
+      - amd64
+      - arm64
+    main: ./cmd/plugin/main.go
+    ldflags:
+      - -s -w -X github.com/oam-dev/kubevela/version.VelaVersion={{ .Version }} -X github.com/oam-dev/kubevela/version.GitRevision=git-{{.ShortCommit}}
+
+archives:
+  - format: tar.gz
+    id: vela-cli-tgz
+    wrap_in_directory: '{{ .Os }}-{{ .Arch }}'
+    builds:
+      - vela-cli
+    name_template: '{{ trimsuffix .ArtifactName ".exe" }}-{{ .Tag }}-{{ .Os }}-{{ .Arch }}'
+    files: [ LICENSE, README.md ]
+  - format: zip
+    id: vela-cli-zip
+    builds:
+      - vela-cli
+    wrap_in_directory: '{{ .Os }}-{{ .Arch }}'
+    name_template: '{{ trimsuffix .ArtifactName ".exe" }}-{{ .Tag }}-{{ .Os }}-{{ .Arch }}'
+    files: [ LICENSE, README.md ]
+  - format: tar.gz
+    id: plugin-tgz
+    builds:
+      - kubectl-vela
+    wrap_in_directory: '{{ .Os }}-{{ .Arch }}'
+    name_template: '{{ trimsuffix .ArtifactName ".exe" }}-{{ .Tag }}-{{ .Os }}-{{ .Arch }}'
+    files: [ LICENSE, README.md ]
+  - format: zip
+    id: plugin-zip
+    builds:
+      - kubectl-vela
+    wrap_in_directory: '{{ .Os }}-{{ .Arch }}'
+    name_template: '{{ trimsuffix .ArtifactName ".exe" }}-{{ .Tag }}-{{ .Os }}-{{ .Arch }}'
+    files: [ LICENSE, README.md ]
+
+checksum:
+  name_template: 'sha256sums.txt'
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - '^docs:'
+      - '^test:'
+
+# The lines beneath this are called `modelines`. See `:help modeline`
+# Feel free to remove those if you don't want/use them.
+# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
+# vim: set ts=2 sw=2 tw=0 fo=cnqoj

.krew.yaml

@@ -33,8 +33,8 @@ spec:
         arch: amd64
     {{addURIAndSha "https://github.com/oam-dev/kubevela/releases/download/{{ .TagName }}/kubectl-vela-{{ .TagName }}-windows-amd64.zip" .TagName }}
     files:
-    - from: "*/kubectl-vela"
-      to: "kubectl-vela.exe"
+    - from: "*/kubectl-vela.exe"
+      to: "."
     - from: "*/LICENSE"
       to: "."
     bin: "kubectl-vela.exe"

CHANGELOG/CHANGELOG-1.0.md

@@ -15,7 +15,7 @@ This is a minor fix for release-1.0, please refer to release-1.1.x for the lates
 # v1.0.5
 
 1. Fix Terraform application status issue (#1611)
-2. applicaiton supports specifying different versions of Definition (#1597)
+2. application supports specifying different versions of Definition (#1597)
 3. Enable Dynamic Admission Control for Application (#1619)
 4. Update inner samples for "vela show xxx --web" (#1616)
 5. fix empty rolloutBatch will panic whole controller bug (#1646)
@@ -30,7 +30,7 @@ This is a minor fix for release-1.0, please refer to release-1.1.x for the lates
 **Please update Application CRD to upgrade from v1.0.3 to this release**
 
 ```
-kubectl apply -f https://raw.githubusercontent.com/oam-dev/kubevela/master/charts/vela-core/crds/core.oam.dev_applications.yaml
+kubectl apply -f https://raw.githubusercontent.com/kubevela/kubevela/master/charts/vela-core/crds/core.oam.dev_applications.yaml
 ```
 
 **Check the upgrade docs to upgrade from other release: https://kubevela.io/docs/advanced-install#upgrade**

CHANGELOG/CHANGELOG-1.2.md

@@ -31,7 +31,7 @@
 ## What's Changed
 
 * Fix: can't query data from the MongoDB by @barnettZQG in https://github.com/oam-dev/kubevela/pull/3095
-* Fix: use personel token of vela-bot instead of github token for homebrew update by @wonderflow in https://github.com/oam-dev/kubevela/pull/3096
+* Fix: use personal token of vela-bot instead of github token for homebrew update by @wonderflow in https://github.com/oam-dev/kubevela/pull/3096
 * Fix: acr image no version by @wangyikewxgm in https://github.com/oam-dev/kubevela/pull/3100
 * Fix: support generate cloud resource docs in Chinese by @zzxwill in https://github.com/oam-dev/kubevela/pull/3079
 * Fix: clear old data in mongodb unit test case by @barnettZQG in https://github.com/oam-dev/kubevela/pull/3103

CONTRIBUTING.md

@@ -1,66 +1,3 @@
 # CONTRIBUTING Guide
 
-## About KubeVela
-
-KubeVela project is initialized and maintained by the cloud native community since day 0 with [bootstrapping contributors from 8+ different organizations](https://github.com/oam-dev/kubevela/graphs/contributors).
-We intend for KubeVela to have an open governance since the very beginning and donate the project to neutral foundation as soon as it's released.
-To help us create a safe and positive community experience for all, we require all participants to adhere to the [Code of Conduct](./CODE_OF_CONDUCT.md).
-
-This document is a guide to help you through the process of contributing to KubeVela.
-
-## Become a contributor
-
-You can contribute to KubeVela in several ways. Here are some examples:
-
-* Contribute to the KubeVela codebase.
-* Contribute to the [KubeVela docs](https://github.com/oam-dev/kubevela.io).
-* Report and triage bugs.
-* Develop community CRD operators as workload or trait and contribute to [catalog](https://github.com/oam-dev/catalog).
-* Write technical documentation and blog posts, for users and contributors.
-* Organize meetups and user groups in your local area.
-* Help others by answering questions about KubeVela.
-
-For more ways to contribute, check out the [Open Source Guides](https://opensource.guide/how-to-contribute/).
-
-
-### Report bugs
-
-Before submitting a new issue, try to make sure someone hasn't already reported the problem.
-Look through the [existing issues](https://github.com/oam-dev/kubevela/issues) for similar issues.
-
-Report a bug by submitting a [bug report](https://github.com/oam-dev/kubevela/issues/new?assignees=&labels=kind%2Fbug&template=bug_report.md&title=).
-Make sure that you provide as much information as possible on how to reproduce the bug.
-
-Follow the issue template and add additional information that will help us replicate the problem.
-
-#### Security issues
-
-If you believe you've found a security vulnerability, please read our [security policy](https://github.com/oam-dev/kubevela/blob/master/SECURITY.md) for more details.
-
-### Suggest enhancements
-
-If you have an idea to improve KubeVela, submit an [feature request](https://github.com/oam-dev/kubevela/issues/new?assignees=&labels=kind%2Ffeature&template=feature_request.md&title=%5BFeature%5D).
-
-### Triage issues
-
-If you don't have the knowledge or time to code, consider helping with _issue triage_. The community will thank you for saving them time by spending some of yours.
-
-Read more about the ways you can [Triage issues](/contribute/triage-issues.md).
-
-### Answering questions
-
-If you have a question and you can't find the answer in the [documentation](https://kubevela.io/docs/),
-the next step is to ask it on the [github discussion](https://github.com/oam-dev/kubevela/discussions).
-
-It's important to us to help these users, and we'd love your help. You can help other KubeVela users by answering [their questions](https://github.com/oam-dev/kubevela/discussions).
-
-### Your first contribution
-
-Unsure where to begin contributing to KubeVela? Start by browsing issues labeled `good first issue` or `help wanted`.
-
-- [Good first issue](https://github.com/oam-dev/kubevela/labels/good%20first%20issue) issues are generally straightforward to complete.
-- [Help wanted](https://github.com/oam-dev/kubevela/labels/help%20wanted) issues are problems we would like the community to help us with regardless of complexity.
-
-If you're looking to make a code change, see how to set up your environment for [local development](contribute/developer-guide.md).
-
-When you're ready to contribute, it's time to [Create a pull request](/contribute/create-pull-request.md).
+Please refer to https://kubevela.io/docs/contributor/overview for details.

Dockerfile

@@ -1,6 +1,6 @@
 ARG BASE_IMAGE
 # Build the manager binary
-FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.17-alpine as builder
+FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.19-alpine@sha256:a9b24b67dc83b3383d22a14941c2b2b2ca6a103d805cac6820fd1355943beaf1 as builder
 
 WORKDIR /workspace
 # Copy the Go Modules manifests
@@ -15,9 +15,8 @@ ENV GOPROXY=${GOPROXY:-https://goproxy.cn}
 # and so that source changes don't invalidate our downloaded layer
 RUN go mod download
 
-# Copy the go source
-COPY cmd/core/main.go main.go
-COPY cmd/apiserver/main.go cmd/apiserver/main.go
+# Copy the go source for building core
+COPY cmd/core/ cmd/core/
 COPY apis/ apis/
 COPY pkg/ pkg/
 COPY version/ version/
@@ -29,14 +28,14 @@ ARG VERSION
 ARG GITVERSION
 RUN GO111MODULE=on CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
     go build -a -ldflags "-s -w -X github.com/oam-dev/kubevela/version.VelaVersion=${VERSION:-undefined} -X github.com/oam-dev/kubevela/version.GitRevision=${GITVERSION:-undefined}" \
-    -o manager-${TARGETARCH} main.go
+    -o manager-${TARGETARCH} cmd/core/main.go
 
 # Use alpine as base image due to the discussion in issue #1448
 # You can replace distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
 # Overwrite `BASE_IMAGE` by passing `--build-arg=BASE_IMAGE=gcr.io/distroless/static:nonroot`
-FROM ${BASE_IMAGE:-alpine:3.15}
-# This is required by daemon connnecting with cri
+FROM ${BASE_IMAGE:-alpine:3.15@sha256:cf34c62ee8eb3fe8aa24c1fab45d7e9d12768d945c3f5a6fd6a63d901e898479}
+# This is required by daemon connecting with cri
 RUN apk add --no-cache ca-certificates bash expat
 
 WORKDIR /

Dockerfile.apiserver

@@ -1,6 +1,6 @@
 ARG BASE_IMAGE
 # Build the manager binary
-FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.17-alpine as builder
+FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.19-alpine@sha256:a9b24b67dc83b3383d22a14941c2b2b2ca6a103d805cac6820fd1355943beaf1 as builder
 ARG GOPROXY
 ENV GOPROXY=${GOPROXY:-https://goproxy.cn}
 WORKDIR /workspace
@@ -11,9 +11,8 @@ COPY go.sum go.sum
 # and so that source changes don't invalidate our downloaded layer
 RUN go mod download
 
-# Copy the go source
-COPY cmd/core/main.go main.go
-COPY cmd/apiserver/main.go cmd/apiserver/main.go
+# Copy the go source for building apiserver
+COPY cmd/apiserver/ cmd/apiserver/
 COPY apis/ apis/
 COPY pkg/ pkg/
 COPY version/ version/
@@ -33,8 +32,8 @@ RUN GO111MODULE=on CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
 # Overwrite `BASE_IMAGE` by passing `--build-arg=BASE_IMAGE=gcr.io/distroless/static:nonroot`
 
-FROM ${BASE_IMAGE:-alpine:3.15}
-# This is required by daemon connnecting with cri
+FROM ${BASE_IMAGE:-alpine:3.15@sha256:cf34c62ee8eb3fe8aa24c1fab45d7e9d12768d945c3f5a6fd6a63d901e898479}
+# This is required by daemon connecting with cri
 RUN apk add --no-cache ca-certificates bash expat
 
 WORKDIR /

Dockerfile.cli

@@ -0,0 +1,43 @@
+ARG BASE_IMAGE
+# Build the cli binary
+FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.19-alpine@sha256:a9b24b67dc83b3383d22a14941c2b2b2ca6a103d805cac6820fd1355943beaf1 as builder
+ARG GOPROXY
+ENV GOPROXY=${GOPROXY:-https://goproxy.cn}
+WORKDIR /workspace
+# Copy the Go Modules manifests
+COPY go.mod go.mod
+COPY go.sum go.sum
+# cache deps before building and copying source so that we don't need to re-download as much
+# and so that source changes don't invalidate our downloaded layer
+RUN go mod download
+
+# Copy the go source
+COPY apis/ apis/
+COPY pkg/ pkg/
+COPY version/ version/
+COPY references/ references/
+
+# Build
+ARG TARGETARCH
+ARG VERSION
+ARG GITVERSION
+
+RUN GO111MODULE=on CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH:-amd64} \
+    go build -a -ldflags "-s -w -X github.com/oam-dev/kubevela/version.VelaVersion=${VERSION:-undefined} -X github.com/oam-dev/kubevela/version.GitRevision=${GITVERSION:-undefined}" \
+    -o vela-${TARGETARCH} ./references/cmd/cli/main.go
+
+
+# Use alpine as base image due to the discussion in issue #1448
+# You can replace distroless as minimal base image to package the manager binary
+# Refer to https://github.com/GoogleContainerTools/distroless for more details
+# Overwrite `BASE_IMAGE` by passing `--build-arg=BASE_IMAGE=gcr.io/distroless/static:nonroot`
+
+FROM ${BASE_IMAGE:-alpine:3.15@sha256:cf34c62ee8eb3fe8aa24c1fab45d7e9d12768d945c3f5a6fd6a63d901e898479}
+# This is required by daemon connecting with cri
+RUN apk add --no-cache ca-certificates bash expat
+
+WORKDIR /
+
+ARG TARGETARCH
+COPY --from=builder /workspace/vela-${TARGETARCH} /bin/vela
+ENTRYPOINT ["/bin/vela"]

Dockerfile.e2e

@@ -1,6 +1,6 @@
 ARG BASE_IMAGE
 # Build the manager binary
-FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.17-alpine as builder
+FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.19-alpine@sha256:a9b24b67dc83b3383d22a14941c2b2b2ca6a103d805cac6820fd1355943beaf1 as builder
 
 WORKDIR /workspace
 # Copy the Go Modules manifests
@@ -38,8 +38,8 @@ RUN GO111MODULE=on CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
 # Overwrite `BASE_IMAGE` by passing `--build-arg=BASE_IMAGE=gcr.io/distroless/static:nonroot`
 
-FROM ${BASE_IMAGE:-alpine:3.15}
-# This is required by daemon connnecting with cri
+FROM ${BASE_IMAGE:-alpine:3.15@sha256:cf34c62ee8eb3fe8aa24c1fab45d7e9d12768d945c3f5a6fd6a63d901e898479}
+# This is required by daemon connecting with cri
 RUN apk add --no-cache ca-certificates bash expat
 
 WORKDIR /

GOVERNANCE.md

@@ -0,0 +1 @@
+Refer to https://github.com/kubevela/community/blob/main/GOVERNANCE.md

ISSUE_TRIAGE.md

@@ -71,7 +71,7 @@ To get started with issue triage and finding issues that haven't been triaged yo
 ### Browse unlabeled issues
 
 The easiest and straight forward way of getting started and finding issues that haven't been triaged is to browse
-[unlabeled issues](https://github.com/oam-dev/kubevela/issues?q=is%3Aopen+is%3Aissue+no%3Alabel) and starting from
+[unlabeled issues](https://github.com/kubevela/kubevela/issues?q=is%3Aopen+is%3Aissue+no%3Alabel) and starting from
 the bottom and working yourself to the top.
 
 ### Subscribe to all notifications
@@ -95,7 +95,7 @@ to guide contributors to provide standard information that must be included for
 
 ### Standard issue information that must be included
 
-Given a certain [issue template]([template](https://github.com/oam-dev/kubevela/issues/new/choose)) have been used
+Given a certain [issue template]([template](https://github.com/kubevela/kubevela/issues/new/choose)) have been used
 by the issue author or depending how the issue is perceived by the issue triage responsible, the following should
 help you understand what standard issue information that must be included.
 
@@ -219,7 +219,7 @@ There's a minor typo/error/lack of information that adds a lot of confusion for
 
 ### Support requests and questions
 
-1. Kindly and politely direct the issue author to the [github discussion](https://github.com/oam-dev/kubevela/discussions)
+1. Kindly and politely direct the issue author to the [github discussion](https://github.com/kubevela/kubevela/discussions)
    and explain that issue is mainly used for tracking bugs and feature requests.
    If possible, it's usually a good idea to add some pointers to the issue author's question.
 2. Close the issue and label it with `type/question`.

Makefile

@@ -9,20 +9,20 @@ include makefiles/e2e.mk
 all: build
 
 # Run tests
-test: vet lint staticcheck unit-test-core test-cli-gen
+test: unit-test-core test-cli-gen
 	@$(OK) unit-tests pass
 
 test-cli-gen: 
 	mkdir -p ./bin/doc
-	go run ./hack/docgen/gen.go ./bin/doc
+	go run ./hack/docgen/cli/gen.go ./bin/doc
 unit-test-core:
-	go test -coverprofile=coverage.txt $(shell go list ./pkg/... ./cmd/... ./apis/... | grep -v apiserver)
+	go test -coverprofile=coverage.txt $(shell go list ./pkg/... ./cmd/... ./apis/... | grep -v apiserver | grep -v applicationconfiguration)
 	go test $(shell go list ./references/... | grep -v apiserver)
 unit-test-apiserver:
 	go test -gcflags=all=-l -coverprofile=coverage.txt $(shell go list ./pkg/... ./cmd/...  | grep -E 'apiserver|velaql')
 
 # Build vela cli binary
-build: fmt vet lint staticcheck vela-cli kubectl-vela
+build: vela-cli kubectl-vela
 	@$(OK) build succeed
 
 build-cleanup:
@@ -82,28 +82,28 @@ endif
 
 
 
-# load docker image to the kind cluster
-kind-load: kind-load-runtime-cluster
+# load docker image to the k3d cluster
+image-load:
 	docker build -t $(VELA_CORE_TEST_IMAGE) -f Dockerfile.e2e .
-	kind load docker-image $(VELA_CORE_TEST_IMAGE) || { echo >&2 "kind not installed or error loading image: $(VELA_CORE_TEST_IMAGE)"; exit 1; }
+	k3d image import $(VELA_CORE_TEST_IMAGE) || { echo >&2 "kind not installed or error loading image: $(VELA_CORE_TEST_IMAGE)"; exit 1; }
 
-kind-load-runtime-cluster:
+image-load-runtime-cluster:
 	/bin/sh hack/e2e/build_runtime_rollout.sh
 	docker build -t $(VELA_RUNTIME_ROLLOUT_TEST_IMAGE) -f runtime/rollout/e2e/Dockerfile.e2e runtime/rollout/e2e/
 	rm -rf runtime/rollout/e2e/tmp
-	kind load docker-image $(VELA_RUNTIME_ROLLOUT_TEST_IMAGE)  || { echo >&2 "kind not installed or error loading image: $(VELA_RUNTIME_ROLLOUT_TEST_IMAGE)"; exit 1; }
-	kind load docker-image $(VELA_RUNTIME_ROLLOUT_TEST_IMAGE) --name=$(RUNTIME_CLUSTER_NAME)  || { echo >&2 "kind not installed or error loading image: $(VELA_RUNTIME_ROLLOUT_TEST_IMAGE)"; exit 1; }
+	k3d image import $(VELA_RUNTIME_ROLLOUT_TEST_IMAGE)  || { echo >&2 "kind not installed or error loading image: $(VELA_RUNTIME_ROLLOUT_TEST_IMAGE)"; exit 1; }
+	k3d cluster get $(RUNTIME_CLUSTER_NAME) && k3d image import $(VELA_RUNTIME_ROLLOUT_TEST_IMAGE) --cluster=$(RUNTIME_CLUSTER_NAME) || echo "no worker cluster"
 
 # Run tests
-core-test: fmt vet manifests
+core-test:
 	go test ./pkg/... -coverprofile cover.out
 
 # Build vela core manager and apiserver binary
-manager: fmt vet lint manifests
+manager:
 	$(GOBUILD_ENV) go build -o bin/manager -a -ldflags $(LDFLAGS) ./cmd/core/main.go
 	$(GOBUILD_ENV) go build -o bin/apiserver -a -ldflags $(LDFLAGS) ./cmd/apiserver/main.go
 
-vela-runtime-rollout-manager: fmt vet lint manifests
+vela-runtime-rollout-manager:
 	$(GOBUILD_ENV) go build -o ./runtime/rollout/bin/manager -a -ldflags $(LDFLAGS) ./runtime/rollout/cmd/main.go
 
 # Generate manifests e.g. CRD, RBAC etc.
@@ -112,7 +112,7 @@ manifests: installcue kustomize
 	# TODO(yangsoon): kustomize will merge all CRD into a whole file, it may not work if we want patch more than one CRD in this way
 	$(KUSTOMIZE) build config/crd -o config/crd/base/core.oam.dev_applications.yaml
 	./hack/crd/cleanup.sh
-	go run ./hack/crd/dispatch/dispatch.go config/crd/base charts/vela-core/crds charts/oam-runtime/crds runtime/ charts/vela-minimal/crds
+	go run ./hack/crd/dispatch/dispatch.go config/crd/base charts/vela-core/crds runtime/ charts/vela-minimal/crds
 	rm -f config/crd/base/*
 	./vela-templates/gen_definitions.sh
 

OWNERS

@@ -1,12 +0,0 @@
-approvers:
-- kubevela-controller
-- kubevela-devex
-- kubevela-dashboard-approver
-
-reviewers:
-- kubevela-controller
-- oam-spec
-- kubevela-dashboard-reviewer
-
-members:
-- community-collaborators

OWNERS_ALIASES

@@ -1,60 +1 @@
-Reviewers:
-- Ghostbaby
-- StevenLeiZhang
-- chwetion
-- yue9944882
-- zxbyoyoyo
-- reetasingh
-- wangwang
-- evanli18
-- devholic
-- fourierr
-- JooKS-me
-
-Approvers:
-- Somefive (Multi-Cluster)
-- chivalryq (Vela CLI)
-- sunny0826 (kubevela.io)
-- hanxie-crypto (VelaUX)
-- FogDong (Workflow)
-- wangyikewxgm (Addon)
-- yangsoon (VelaQL）
-
-Maintainers:
-- wonderflow
-- hongchaodeng
-- captainroy-hy
-- resouer
-- barnettZQG
-- leejanee
-- zzxwill
-- BinaryHB0916
-- dhiguero
-
-Emeritus Members:
-- ryanzhang-oss
-- Fei-Guo
-- szihai
-- xiaoyuaiheshui
-- wenxinnnnn
-- silenceper
-- erdun
-- mosesyou
-- artursouza
-- woshilanren11
-
-bootstrap-contributors:     # thank you for bootstrapping KubeVela at the very early stage!
-- xiaoyuaiheshui
-- Ghostbaby
-- wenxinnnnn
-- silenceper
-- erdun
-- sunny0826
-- mosesyou
-- artursouza
-- wonderflow
-- hongchaodeng
-- ryanzhang-oss
-- woshilanren11
-- hanxie-crypto
-- zzxwill
+The owner file has been migrated to the community repo, please refer to https://github.com/kubevela/community/blob/main/OWNERS.md

README.md

@@ -1,73 +1,98 @@
 <div style="text-align: center">
   <p align="center">
-    <img src="https://raw.githubusercontent.com/oam-dev/kubevela.io/main/docs/resources/KubeVela-03.png">
+    <img src="https://raw.githubusercontent.com/kubevela/kubevela.io/main/docs/resources/KubeVela-03.png">
     <br><br>
     <i>Make shipping applications more enjoyable.</i>
   </p>
 </div>
 
-![Build status](https://github.com/oam-dev/kubevela/workflows/E2E/badge.svg)
-[![Go Report Card](https://goreportcard.com/badge/github.com/oam-dev/kubevela)](https://goreportcard.com/report/github.com/oam-dev/kubevela)
+![Build status](https://github.com/kubevela/kubevela/workflows/Go/badge.svg)
+[![Go Report Card](https://goreportcard.com/badge/github.com/kubevela/kubevela)](https://goreportcard.com/report/github.com/kubevela/kubevela)
 ![Docker Pulls](https://img.shields.io/docker/pulls/oamdev/vela-core)
-[![codecov](https://codecov.io/gh/oam-dev/kubevela/branch/master/graph/badge.svg)](https://codecov.io/gh/oam-dev/kubevela)
-[![LICENSE](https://img.shields.io/github/license/oam-dev/kubevela.svg?style=flat-square)](/LICENSE)
-[![Releases](https://img.shields.io/github/release/oam-dev/kubevela/all.svg?style=flat-square)](https://github.com/oam-dev/kubevela/releases)
-[![TODOs](https://img.shields.io/endpoint?url=https://api.tickgit.com/badge?repo=github.com/oam-dev/kubevela)](https://www.tickgit.com/browse?repo=github.com/oam-dev/kubevela)
+[![codecov](https://codecov.io/gh/kubevela/kubevela/branch/master/graph/badge.svg)](https://codecov.io/gh/kubevela/kubevela)
+[![LICENSE](https://img.shields.io/github/license/kubevela/kubevela.svg?style=flat-square)](/LICENSE)
+[![Releases](https://img.shields.io/github/release/kubevela/kubevela/all.svg?style=flat-square)](https://github.com/kubevela/kubevela/releases)
+[![TODOs](https://img.shields.io/endpoint?url=https://api.tickgit.com/badge?repo=github.com/kubevela/kubevela)](https://www.tickgit.com/browse?repo=github.com/kubevela/kubevela)
 [![Twitter](https://img.shields.io/twitter/url?style=social&url=https%3A%2F%2Ftwitter.com%2Foam_dev)](https://twitter.com/oam_dev)
 [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/kubevela)](https://artifacthub.io/packages/search?repo=kubevela)
 [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/4602/badge)](https://bestpractices.coreinfrastructure.org/projects/4602)
+![E2E status](https://github.com/kubevela/kubevela/workflows/E2E%20Test/badge.svg)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/kubevela/kubevela/badge)](https://api.securityscorecards.dev/projects/github.com/kubevela/kubevela)
 
 ## Introduction
 
 KubeVela is a modern application delivery platform that makes deploying and operating applications across today's hybrid, multi-cloud environments easier, faster and more reliable.
 
-![](docs/resources/what-is-kubevela.png)
+![kubevela](docs/resources/what-is-kubevela.png)
 
 ## Highlights
 
 KubeVela practices the "render, orchestrate, deploy" workflow with below highlighted values added to existing ecosystem:
 
-- *Application Centric* - KubeVela introduces [Open Application Model (OAM)](https://oam.dev/) as the consistent yet higher level API to capture and render a full deployment of microservices on top of hybrid environments. Placement strategy, traffic shifting and rolling update are declared at application level. No infrastructure level concern, simply deploy.
+* Deployment as Code
 
-- *Programmable Workflow* - KubeVela models application delivery as DAG (Directed Acyclic Graph) and expresses it with [CUE](https://cuelang.org/) - a modern data configuration language. This allows you to design application deployment steps per needs and orchestrate them in programmable approach. No restrictions, natively extensible.
+Declare your deployment plan as workflow, run it automatically with any CI/CD or GitOps system, extend or re-program the workflow steps with CUE. No add-hoc scripts, no dirty glue code, just deploy. The deployment workflow in KubeVela is powered by [Open Application Model](https://oam.dev/).
 
-- *Infrastructure Agnostic* - KubeVela works as an application delivery control plane that is fully decoupled from runtime infrastructure. It can deploy any workload types including containers, cloud services, databases, or even VM instances to any cloud or Kubernetes cluster, following the workflow designed by you.
+* Built-in security and compliance building blocks
+
+Choose from the wide range of LDAP integrations we provided out-of-box, enjoy multi-cluster authorization that is fully automated, pick and apply fine-grained RBAC modules and customize them per your own supply chain requirements.
+
+* Multi-cloud/hybrid-environments app delivery as first-class citizen
+
+Progressive rollout across test/staging/production environments, automatic canary, blue-green and continuous verification, rich placement strategy across clusters and clouds, fully managed cloud environments provision.
 
 ## Getting Started
 
-- [Introduction](https://kubevela.io/docs)
-- [Installation](https://kubevela.io/docs/install)
-- [Design Your First Deployment Plan](https://kubevela.io/docs/quick-start)
+* [Introduction](https://kubevela.io/docs)
+* [Installation](https://kubevela.io/docs/install)
+* [Deploy Your Application](https://kubevela.io/docs/quick-start)
 
 ## Documentation
 
 Full documentation is available on the [KubeVela website](https://kubevela.io/).
 
+## Blog
+
+Official blog is available on [KubeVela blog](https://kubevela.io/blog).
+
 ## Community
 
-- Slack:  [CNCF Slack](https://slack.cncf.io/) #kubevela channel (*English*)
-- Gitter: [oam-dev](https://gitter.im/oam-dev/community) (*English*)
+We want your contributions and suggestions!
+One of the easiest ways to contribute is to participate in discussions on the Github Issues/Discussion, chat on IM or the bi-weekly community calls.
+For more information on the community engagement, developer and contributing guidelines and more, head over to the [KubeVela community repo](https://github.com/kubevela/community).
+
+### Contact Us
+
+Reach out with any questions you may have and we'll make sure to answer them as soon as possible!
+
+- Slack:  [CNCF Slack kubevela channel](https://cloud-native.slack.com/archives/C01BLQ3HTJA) (*English*)
 - [DingTalk Group](https://page.dingtalk.com/wow/dingtalk/act/en-home): `23310022` (*Chinese*)
 - Wechat Group (*Chinese*): Broker wechat to add you into the user group.
  
   <img src="https://static.kubevela.net/images/barnett-wechat.jpg" width="200" />
-- Bi-weekly Community Call: [Meeting Notes](https://docs.google.com/document/d/1nqdFEyULekyksFHtFvgvFAYE-0AMHKoS3RMnaKsarjs).
-- Bi-weekly Chinese Community Call: [Video Records](https://space.bilibili.com/180074935/channel/seriesdetail?sid=1842207).
+
+### Community Call
+
+Every two weeks we host a community call to showcase new features, review upcoming milestones, and engage in a Q&A. All are welcome!
+
+- Bi-weekly Community Call:
+  - [Meeting Notes](https://docs.google.com/document/d/1nqdFEyULekyksFHtFvgvFAYE-0AMHKoS3RMnaKsarjs).
+  - [Video Records](https://www.youtube.com/channel/UCSCTHhGI5XJ0SEhDHVakPAA/videos).
+- Bi-weekly Chinese Community Call:
+  - [Video Records](https://space.bilibili.com/180074935/channel/seriesdetail?sid=1842207).
 
 ## Talks and Conferences
 
-| Engagement | Link        |
-|:-----------|:------------|
-| 🎤  Talks | - [KubeVela - The Modern App Delivery System in Alibaba](https://docs.google.com/presentation/d/1CWCLcsKpDQB3bBDTfdv2BZ8ilGGJv2E8L-iOA5HMrV0/edit?usp=sharing) |
-| 🌎 KubeCon | - [ [NA 2020] Standardizing Cloud Native Application Delivery Across Different Clouds](https://www.youtube.com/watch?v=0yhVuBIbHcI) <br> - [ [EU 2021] Zero Pain Microservice Development and Deployment with Dapr and KubeVela](https://sched.co/iE4S) |
-| 📺 Conferences | - [Dapr, Rudr, OAM: Mark Russinovich presents next gen app development & deployment](https://www.youtube.com/watch?v=eJCu6a-x9uo) <br> - [Mark Russinovich presents "The Future of Cloud Native Applications with OAM and Dapr"](https://myignite.techcommunity.microsoft.com/sessions/82059)|
+Check out [KubeVela videos](https://kubevela.io/videos/talks/en/oam-dapr) for these talks and conferences.
 
 ## Contributing
-Check out [CONTRIBUTING](./CONTRIBUTING.md) to see how to develop with KubeVela.
+
+Check out [CONTRIBUTING](https://kubevela.io/docs/contributor/overview) to see how to develop with KubeVela.
 
 ## Report Vulnerability
 
 Security is a first priority thing for us at KubeVela. If you come across a related issue, please send email to security@mail.kubevela.io .
 
 ## Code of Conduct
+
 KubeVela adopts [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md).

apis/core.oam.dev/common/register.go

@@ -1,11 +1,11 @@
 /*
-Copyright 2021 The KubeVela Authors.
+Copyright 2022 The KubeVela Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
-    http://www.apache.org/licenses/LICENSE-2.0
+	http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
@@ -14,12 +14,9 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package e2e
+package common
 
-import (
-	"github.com/onsi/ginkgo"
+const (
+	// Group api group name
+	Group = "core.oam.dev"
 )
-
-var _ = ginkgo.Describe("Setup", func() {
-
-})

apis/core.oam.dev/common/types.go

@@ -20,12 +20,14 @@ import (
 	"encoding/json"
 	"errors"
 
-	"github.com/oam-dev/terraform-controller/api/v1beta2"
+	types "github.com/oam-dev/terraform-controller/api/types/crossplane-runtime"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
+	workflowv1alpha1 "github.com/kubevela/workflow/api/v1alpha1"
+
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/condition"
 	"github.com/oam-dev/kubevela/apis/standard.oam.dev/v1alpha1"
 	"github.com/oam-dev/kubevela/pkg/oam"
@@ -119,7 +121,25 @@ type Terraform struct {
 	// Path is the sub-directory of remote git repository. It's valid when remote is set
 	Path string `json:"path,omitempty"`
 
-	v1beta2.BaseConfigurationSpec `json:",inline"`
+	// WriteConnectionSecretToReference specifies the namespace and name of a
+	// Secret to which any connection details for this managed resource should
+	// be written. Connection details frequently include the endpoint, username,
+	// and password required to connect to the managed resource.
+	// +optional
+	WriteConnectionSecretToReference *types.SecretReference `json:"writeConnectionSecretToRef,omitempty"`
+
+	// ProviderReference specifies the reference to Provider
+	ProviderReference *types.Reference `json:"providerRef,omitempty"`
+
+	// DeleteResource will determine whether provisioned cloud resources will be deleted when CR is deleted
+	// +kubebuilder:default:=true
+	DeleteResource bool `json:"deleteResource,omitempty"`
+
+	// Region is cloud provider's region. It will override the region in the region field of ProviderReference
+	Region string `json:"customRegion,omitempty"`
+
+	// GitCredentialsSecretReference specifies the reference to the secret containing the git credentials
+	GitCredentialsSecretReference *corev1.SecretReference `json:"gitCredentialsSecretReference,omitempty"`
 }
 
 // A WorkloadTypeDescriptor refer to a Workload Type
@@ -172,8 +192,6 @@ type Status struct {
 type ApplicationPhase string
 
 const (
-	// ApplicationRollingOut means the app is in the middle of rolling out
-	ApplicationRollingOut ApplicationPhase = "rollingOut"
 	// ApplicationStarting means the app is preparing for reconcile
 	ApplicationStarting ApplicationPhase = "starting"
 	// ApplicationRendering means the app is rendering
@@ -186,8 +204,8 @@ const (
 	ApplicationWorkflowSuspending ApplicationPhase = "workflowSuspending"
 	// ApplicationWorkflowTerminated means the app's workflow is terminated
 	ApplicationWorkflowTerminated ApplicationPhase = "workflowTerminated"
-	// ApplicationWorkflowFinished means the app's workflow is finished
-	ApplicationWorkflowFinished ApplicationPhase = "workflowFinished"
+	// ApplicationWorkflowFailed means the app's workflow is failed
+	ApplicationWorkflowFailed ApplicationPhase = "workflowFailed"
 	// ApplicationRunning means the app finished rendering and applied result to the cluster
 	ApplicationRunning ApplicationPhase = "running"
 	// ApplicationUnhealthy means the app finished rendering and applied result to the cluster, but still unhealthy
@@ -201,19 +219,19 @@ type WorkflowState string
 
 const (
 	// WorkflowStateInitializing means the workflow is in initial state
-	WorkflowStateInitializing WorkflowState = "initializing"
+	WorkflowStateInitializing WorkflowState = "Initializing"
 	// WorkflowStateTerminated means workflow is terminated manually, and it won't be started unless the spec changed.
-	WorkflowStateTerminated WorkflowState = "terminated"
+	WorkflowStateTerminated WorkflowState = "Terminated"
 	// WorkflowStateSuspended means workflow is suspended manually, and it can be resumed.
-	WorkflowStateSuspended WorkflowState = "suspended"
+	WorkflowStateSuspended WorkflowState = "Suspended"
 	// WorkflowStateSucceeded means workflow is running successfully, all steps finished.
 	WorkflowStateSucceeded WorkflowState = "Succeeded"
 	// WorkflowStateFinished means workflow is end.
-	WorkflowStateFinished WorkflowState = "finished"
+	WorkflowStateFinished WorkflowState = "Finished"
 	// WorkflowStateExecuting means workflow is still running or waiting some steps.
-	WorkflowStateExecuting WorkflowState = "executing"
+	WorkflowStateExecuting WorkflowState = "Executing"
 	// WorkflowStateSkipping means it will skip this reconcile and let next reconcile to handle it.
-	WorkflowStateSkipping WorkflowState = "skipping"
+	WorkflowStateSkipping WorkflowState = "Skipping"
 )
 
 // ApplicationComponentStatus record the health status of App component
@@ -230,6 +248,12 @@ type ApplicationComponentStatus struct {
 	Scopes             []corev1.ObjectReference `json:"scopes,omitempty"`
 }
 
+// Equal check if two ApplicationComponentStatus are equal
+func (in ApplicationComponentStatus) Equal(r ApplicationComponentStatus) bool {
+	return in.Name == r.Name && in.Namespace == r.Namespace &&
+		in.Cluster == r.Cluster && in.Env == r.Env
+}
+
 // ApplicationTraitStatus records the trait health status
 type ApplicationTraitStatus struct {
 	Type    string `json:"type"`
@@ -253,35 +277,6 @@ type RawComponent struct {
 	Raw runtime.RawExtension `json:"raw"`
 }
 
-// WorkflowStepStatus record the status of a workflow step
-type WorkflowStepStatus struct {
-	ID    string            `json:"id"`
-	Name  string            `json:"name,omitempty"`
-	Type  string            `json:"type,omitempty"`
-	Phase WorkflowStepPhase `json:"phase,omitempty"`
-	// A human readable message indicating details about why the workflowStep is in this state.
-	Message string `json:"message,omitempty"`
-	// A brief CamelCase message indicating details about why the workflowStep is in this state.
-	Reason   string          `json:"reason,omitempty"`
-	SubSteps *SubStepsStatus `json:"subSteps,omitempty"`
-	// FirstExecuteTime is the first time this step execution.
-	FirstExecuteTime metav1.Time `json:"firstExecuteTime,omitempty"`
-	// LastExecuteTime is the last time this step execution.
-	LastExecuteTime metav1.Time `json:"lastExecuteTime,omitempty"`
-}
-
-// WorkflowSubStepStatus record the status of a workflow step
-type WorkflowSubStepStatus struct {
-	ID    string            `json:"id"`
-	Name  string            `json:"name,omitempty"`
-	Type  string            `json:"type,omitempty"`
-	Phase WorkflowStepPhase `json:"phase,omitempty"`
-	// A human readable message indicating details about why the workflowStep is in this state.
-	Message string `json:"message,omitempty"`
-	// A brief CamelCase message indicating details about why the workflowStep is in this state.
-	Reason string `json:"reason,omitempty"`
-}
-
 // AppStatus defines the observed state of Application
 type AppStatus struct {
 	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
@@ -311,10 +306,12 @@ type AppStatus struct {
 	AppliedResources []ClusterObjectReference `json:"appliedResources,omitempty"`
 
 	// PolicyStatus records the status of policy
+	// Deprecated This field is only used by EnvBinding Policy which is deprecated.
 	PolicyStatus []PolicyStatus `json:"policy,omitempty"`
 }
 
 // PolicyStatus records the status of policy
+// Deprecated
 type PolicyStatus struct {
 	Name string `json:"name"`
 	Type string `json:"type"`
@@ -322,60 +319,27 @@ type PolicyStatus struct {
 	Status *runtime.RawExtension `json:"status,omitempty"`
 }
 
-// WorkflowStep defines how to execute a workflow step.
-type WorkflowStep struct {
-	// Name is the unique name of the workflow step.
-	Name string `json:"name"`
-
-	Type string `json:"type"`
-
-	// +kubebuilder:pruning:PreserveUnknownFields
-	Properties *runtime.RawExtension `json:"properties,omitempty"`
-
-	DependsOn []string `json:"dependsOn,omitempty"`
-
-	Inputs StepInputs `json:"inputs,omitempty"`
-
-	Outputs StepOutputs `json:"outputs,omitempty"`
-}
-
 // WorkflowStatus record the status of workflow
 type WorkflowStatus struct {
-	AppRevision string       `json:"appRevision,omitempty"`
-	Mode        WorkflowMode `json:"mode"`
-	Message     string       `json:"message,omitempty"`
+	AppRevision string                            `json:"appRevision,omitempty"`
+	Mode        string                            `json:"mode"`
+	Phase       workflowv1alpha1.WorkflowRunPhase `json:"status,omitempty"`
+	Message     string                            `json:"message,omitempty"`
+
+	Suspend      bool   `json:"suspend"`
+	SuspendState string `json:"suspendState,omitempty"`
 
-	Suspend    bool `json:"suspend"`
 	Terminated bool `json:"terminated"`
 	Finished   bool `json:"finished"`
 
-	ContextBackend *corev1.ObjectReference `json:"contextBackend,omitempty"`
-	Steps          []WorkflowStepStatus    `json:"steps,omitempty"`
+	ContextBackend *corev1.ObjectReference               `json:"contextBackend,omitempty"`
+	Steps          []workflowv1alpha1.WorkflowStepStatus `json:"steps,omitempty"`
 
 	StartTime metav1.Time `json:"startTime,omitempty"`
+	// +nullable
+	EndTime metav1.Time `json:"endTime,omitempty"`
 }
 
-// SubStepsStatus record the status of workflow steps.
-type SubStepsStatus struct {
-	StepIndex int                     `json:"stepIndex,omitempty"`
-	Mode      WorkflowMode            `json:"mode,omitempty"`
-	Steps     []WorkflowSubStepStatus `json:"steps,omitempty"`
-}
-
-// WorkflowStepPhase describes the phase of a workflow step.
-type WorkflowStepPhase string
-
-const (
-	// WorkflowStepPhaseSucceeded will make the controller run the next step.
-	WorkflowStepPhaseSucceeded WorkflowStepPhase = "succeeded"
-	// WorkflowStepPhaseFailed will report error in `message`.
-	WorkflowStepPhaseFailed WorkflowStepPhase = "failed"
-	// WorkflowStepPhaseStopped will make the controller stop the workflow.
-	WorkflowStepPhaseStopped WorkflowStepPhase = "stopped"
-	// WorkflowStepPhaseRunning will make the controller continue the workflow.
-	WorkflowStepPhaseRunning WorkflowStepPhase = "running"
-)
-
 // DefinitionType describes the type of DefinitionRevision.
 // +kubebuilder:validation:Enum=Component;Trait;Policy;WorkflowStep
 type DefinitionType string
@@ -394,16 +358,6 @@ const (
 	WorkflowStepType DefinitionType = "WorkflowStep"
 )
 
-// WorkflowMode describes the mode of workflow
-type WorkflowMode string
-
-const (
-	// WorkflowModeDAG describes the DAG mode of workflow
-	WorkflowModeDAG WorkflowMode = "DAG"
-	// WorkflowModeStep describes the step by step mode of workflow
-	WorkflowModeStep WorkflowMode = "StepByStep"
-)
-
 // AppRolloutStatus defines the observed state of AppRollout
 type AppRolloutStatus struct {
 	v1alpha1.RolloutStatus `json:",inline"`
@@ -433,9 +387,9 @@ type ApplicationComponent struct {
 	// +kubebuilder:pruning:PreserveUnknownFields
 	Properties *runtime.RawExtension `json:"properties,omitempty"`
 
-	DependsOn []string    `json:"dependsOn,omitempty"`
-	Inputs    StepInputs  `json:"inputs,omitempty"`
-	Outputs   StepOutputs `json:"outputs,omitempty"`
+	DependsOn []string                     `json:"dependsOn,omitempty"`
+	Inputs    workflowv1alpha1.StepInputs  `json:"inputs,omitempty"`
+	Outputs   workflowv1alpha1.StepOutputs `json:"outputs,omitempty"`
 
 	// Traits define the trait of one component, the type must be array to keep the order.
 	Traits []ApplicationTrait `json:"traits,omitempty"`
@@ -444,22 +398,10 @@ type ApplicationComponent struct {
 	// scopes in ApplicationComponent defines the component-level scopes
 	// the format is <scope-type:scope-instance-name> pairs, the key represents type of `ScopeDefinition` while the value represent the name of scope instance.
 	Scopes map[string]string `json:"scopes,omitempty"`
-}
 
-// StepOutputs defines output variable of WorkflowStep
-type StepOutputs []outputItem
-
-// StepInputs defines variable input of WorkflowStep
-type StepInputs []inputItem
-
-type inputItem struct {
-	ParameterKey string `json:"parameterKey"`
-	From         string `json:"from"`
-}
-
-type outputItem struct {
-	ValueFrom string `json:"valueFrom"`
-	Name      string `json:"name"`
+	// ReplicaKey is not empty means the component is replicated. This field is designed so that it can't be specified in application directly.
+	// So we set the json tag as "-". Instead, this will be filled when using replication policy.
+	ReplicaKey string `json:"-"`
 }
 
 // ClusterSelector defines the rules to select a Cluster resource.
@@ -488,14 +430,13 @@ type ClusterPlacement struct {
 	Distribution Distribution `json:"distribution,omitempty"`
 }
 
-// ResourceCreatorRole defines the resource creator.
-type ResourceCreatorRole string
-
 const (
 	// PolicyResourceCreator create the policy resource.
-	PolicyResourceCreator ResourceCreatorRole = "policy"
+	PolicyResourceCreator string = "policy"
 	// WorkflowResourceCreator create the resource in workflow.
-	WorkflowResourceCreator ResourceCreatorRole = "workflow"
+	WorkflowResourceCreator string = "workflow"
+	// DebugResourceCreator create the debug resource.
+	DebugResourceCreator string = "debug"
 )
 
 // OAMObjectReference defines the object reference for an oam resource
@@ -542,8 +483,8 @@ func NewOAMObjectReferenceFromObject(obj client.Object) OAMObjectReference {
 
 // ClusterObjectReference defines the object reference with cluster.
 type ClusterObjectReference struct {
-	Cluster                string              `json:"cluster,omitempty"`
-	Creator                ResourceCreatorRole `json:"creator,omitempty"`
+	Cluster                string `json:"cluster,omitempty"`
+	Creator                string `json:"creator,omitempty"`
 	corev1.ObjectReference `json:",inline"`
 }
 
@@ -636,3 +577,29 @@ type ReferredObjectList struct {
 	// +optional
 	Objects []ReferredObject `json:"objects,omitempty"`
 }
+
+// ContainerState defines the state of a container
+type ContainerState string
+
+const (
+	// ContainerRunning indicates the container is running
+	ContainerRunning ContainerState = "Running"
+	// ContainerWaiting indicates the container is waiting
+	ContainerWaiting ContainerState = "Waiting"
+	// ContainerTerminated indicates the container is terminated
+	ContainerTerminated ContainerState = "Terminated"
+)
+
+// ContainerStateToString convert the container state to string
+func ContainerStateToString(state corev1.ContainerState) string {
+	switch {
+	case state.Running != nil:
+		return "Running"
+	case state.Waiting != nil:
+		return "Waiting"
+	case state.Terminated != nil:
+		return "Terminated"
+	default:
+		return "Unknown"
+	}
+}

apis/core.oam.dev/common/types_test.go

@@ -58,3 +58,17 @@ func TestClusterObjectReference(t *testing.T) {
 	o2.Cluster = "c"
 	r.False(o2.Equal(o1))
 }
+
+func TestContainerStateToString(t *testing.T) {
+	r := require.New(t)
+	r.Equal("Waiting", ContainerStateToString(v1.ContainerState{
+		Waiting: &v1.ContainerStateWaiting{},
+	}))
+	r.Equal("Running", ContainerStateToString(v1.ContainerState{
+		Running: &v1.ContainerStateRunning{},
+	}))
+	r.Equal("Terminated", ContainerStateToString(v1.ContainerState{
+		Terminated: &v1.ContainerStateTerminated{},
+	}))
+	r.Equal("Unknown", ContainerStateToString(v1.ContainerState{}))
+}

apis/core.oam.dev/common/zz_generated.deepcopy.go

@@ -22,6 +22,8 @@ limitations under the License.
 package common
 
 import (
+	"github.com/kubevela/workflow/api/v1alpha1"
+	crossplane_runtime "github.com/oam-dev/terraform-controller/api/types/crossplane-runtime"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 )
@@ -107,12 +109,12 @@ func (in *ApplicationComponent) DeepCopyInto(out *ApplicationComponent) {
 	}
 	if in.Inputs != nil {
 		in, out := &in.Inputs, &out.Inputs
-		*out = make(StepInputs, len(*in))
+		*out = make(v1alpha1.StepInputs, len(*in))
 		copy(*out, *in)
 	}
 	if in.Outputs != nil {
 		in, out := &in.Outputs, &out.Outputs
-		*out = make(StepOutputs, len(*in))
+		*out = make(v1alpha1.StepOutputs, len(*in))
 		copy(*out, *in)
 	}
 	if in.Traits != nil {
@@ -572,68 +574,24 @@ func (in *Status) DeepCopy() *Status {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in StepInputs) DeepCopyInto(out *StepInputs) {
-	{
-		in := &in
-		*out = make(StepInputs, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StepInputs.
-func (in StepInputs) DeepCopy() StepInputs {
-	if in == nil {
-		return nil
-	}
-	out := new(StepInputs)
-	in.DeepCopyInto(out)
-	return *out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in StepOutputs) DeepCopyInto(out *StepOutputs) {
-	{
-		in := &in
-		*out = make(StepOutputs, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StepOutputs.
-func (in StepOutputs) DeepCopy() StepOutputs {
-	if in == nil {
-		return nil
-	}
-	out := new(StepOutputs)
-	in.DeepCopyInto(out)
-	return *out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SubStepsStatus) DeepCopyInto(out *SubStepsStatus) {
-	*out = *in
-	if in.Steps != nil {
-		in, out := &in.Steps, &out.Steps
-		*out = make([]WorkflowSubStepStatus, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SubStepsStatus.
-func (in *SubStepsStatus) DeepCopy() *SubStepsStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(SubStepsStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Terraform) DeepCopyInto(out *Terraform) {
 	*out = *in
-	in.BaseConfigurationSpec.DeepCopyInto(&out.BaseConfigurationSpec)
+	if in.WriteConnectionSecretToReference != nil {
+		in, out := &in.WriteConnectionSecretToReference, &out.WriteConnectionSecretToReference
+		*out = new(crossplane_runtime.SecretReference)
+		**out = **in
+	}
+	if in.ProviderReference != nil {
+		in, out := &in.ProviderReference, &out.ProviderReference
+		*out = new(crossplane_runtime.Reference)
+		**out = **in
+	}
+	if in.GitCredentialsSecretReference != nil {
+		in, out := &in.GitCredentialsSecretReference, &out.GitCredentialsSecretReference
+		*out = new(v1.SecretReference)
+		**out = **in
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Terraform.
@@ -656,12 +614,13 @@ func (in *WorkflowStatus) DeepCopyInto(out *WorkflowStatus) {
 	}
 	if in.Steps != nil {
 		in, out := &in.Steps, &out.Steps
-		*out = make([]WorkflowStepStatus, len(*in))
+		*out = make([]v1alpha1.WorkflowStepStatus, len(*in))
 		for i := range *in {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
 	in.StartTime.DeepCopyInto(&out.StartTime)
+	in.EndTime.DeepCopyInto(&out.EndTime)
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkflowStatus.
@@ -674,78 +633,6 @@ func (in *WorkflowStatus) DeepCopy() *WorkflowStatus {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *WorkflowStep) DeepCopyInto(out *WorkflowStep) {
-	*out = *in
-	if in.Properties != nil {
-		in, out := &in.Properties, &out.Properties
-		*out = new(runtime.RawExtension)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.DependsOn != nil {
-		in, out := &in.DependsOn, &out.DependsOn
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.Inputs != nil {
-		in, out := &in.Inputs, &out.Inputs
-		*out = make(StepInputs, len(*in))
-		copy(*out, *in)
-	}
-	if in.Outputs != nil {
-		in, out := &in.Outputs, &out.Outputs
-		*out = make(StepOutputs, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkflowStep.
-func (in *WorkflowStep) DeepCopy() *WorkflowStep {
-	if in == nil {
-		return nil
-	}
-	out := new(WorkflowStep)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *WorkflowStepStatus) DeepCopyInto(out *WorkflowStepStatus) {
-	*out = *in
-	if in.SubSteps != nil {
-		in, out := &in.SubSteps, &out.SubSteps
-		*out = new(SubStepsStatus)
-		(*in).DeepCopyInto(*out)
-	}
-	in.FirstExecuteTime.DeepCopyInto(&out.FirstExecuteTime)
-	in.LastExecuteTime.DeepCopyInto(&out.LastExecuteTime)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkflowStepStatus.
-func (in *WorkflowStepStatus) DeepCopy() *WorkflowStepStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(WorkflowStepStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *WorkflowSubStepStatus) DeepCopyInto(out *WorkflowSubStepStatus) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkflowSubStepStatus.
-func (in *WorkflowSubStepStatus) DeepCopy() *WorkflowSubStepStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(WorkflowSubStepStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *WorkloadGVK) DeepCopyInto(out *WorkloadGVK) {
 	*out = *in

apis/core.oam.dev/condition/condition.go

@@ -31,7 +31,7 @@ import (
 )
 
 // A ConditionType represents a condition a resource could be in.
-// nolint:golint
+// nolint
 type ConditionType string
 
 // Condition types.
@@ -45,7 +45,7 @@ const (
 )
 
 // A ConditionReason represents the reason a resource is in a condition.
-// nolint:golint
+// nolint
 type ConditionReason string
 
 // Reasons a resource is or is not ready.

apis/core.oam.dev/v1alpha1/applyonce_policy_types.go

@@ -0,0 +1,78 @@
+/*
+Copyright 2021 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+)
+
+const (
+	// ApplyOncePolicyType refers to the type of configuration drift policy
+	ApplyOncePolicyType = "apply-once"
+	// ApplyOnceStrategyOnAppUpdate policy takes effect on application updating
+	ApplyOnceStrategyOnAppUpdate ApplyOnceAffectStrategy = "onUpdate"
+	// ApplyOnceStrategyOnAppStateKeep policy takes effect on application state keep
+	ApplyOnceStrategyOnAppStateKeep ApplyOnceAffectStrategy = "onStateKeep"
+	// ApplyOnceStrategyAlways policy takes effect always
+	ApplyOnceStrategyAlways ApplyOnceAffectStrategy = "always"
+)
+
+// ApplyOnceAffectStrategy is a string that mark the policy effective stage
+type ApplyOnceAffectStrategy string
+
+// ApplyOncePolicySpec defines the spec of preventing configuration drift
+type ApplyOncePolicySpec struct {
+	Enable bool `json:"enable"`
+	// +optional
+	Rules []ApplyOncePolicyRule `json:"rules,omitempty"`
+}
+
+// ApplyOncePolicyRule defines a single apply-once policy rule
+type ApplyOncePolicyRule struct {
+	// +optional
+	Selector ResourcePolicyRuleSelector `json:"selector,omitempty"`
+	// +optional
+	Strategy *ApplyOnceStrategy `json:"strategy,omitempty"`
+}
+
+// ApplyOnceStrategy the strategy for resource path to allow configuration drift
+type ApplyOnceStrategy struct {
+	// Path the specified path that allow configuration drift
+	// like 'spec.template.spec.containers[0].resources' and '*' means the whole target allow configuration drift
+	Path []string `json:"path"`
+	// ApplyOnceAffectStrategy Decide when the strategy will take effect
+	// like affect:onUpdate/onStateKeep/always
+	ApplyOnceAffectStrategy ApplyOnceAffectStrategy `json:"affect"`
+}
+
+// Type the type name of the policy
+func (in *ApplyOncePolicySpec) Type() string {
+	return ApplyOncePolicyType
+}
+
+// FindStrategy find apply-once strategy for target resource
+func (in *ApplyOncePolicySpec) FindStrategy(manifest *unstructured.Unstructured) *ApplyOnceStrategy {
+	if !in.Enable {
+		return nil
+	}
+	for _, rule := range in.Rules {
+		if rule.Selector.Match(manifest) {
+			return rule.Strategy
+		}
+	}
+	return nil
+}

apis/core.oam.dev/v1alpha1/component_types.go

@@ -25,6 +25,8 @@ const (
 type RefObjectsComponentSpec struct {
 	// Objects the referrers to the Kubernetes objects
 	Objects []ObjectReferrer `json:"objects,omitempty"`
+	// URLs are the links that stores the referred objects
+	URLs []string `json:"urls,omitempty"`
 }
 
 // ObjectReferrer selects Kubernetes objects

apis/core.oam.dev/v1alpha1/envbinding_types.go

@@ -97,6 +97,7 @@ type EnvSelector struct {
 }
 
 // EnvConfig is the configuration for different environments.
+// Deprecated
 type EnvConfig struct {
 	Name      string       `json:"name"`
 	Placement EnvPlacement `json:"placement,omitempty"`
@@ -105,6 +106,7 @@ type EnvConfig struct {
 }
 
 // EnvBindingSpec defines a list of envs
+// Deprecated This spec is deprecated and replaced by Topology/Override Policy
 type EnvBindingSpec struct {
 	Envs []EnvConfig `json:"envs"`
 }
@@ -117,22 +119,28 @@ type PlacementDecision struct {
 
 // String encode placement decision
 func (in PlacementDecision) String() string {
+	if in.Namespace == "" {
+		return in.Cluster
+	}
 	return in.Cluster + "/" + in.Namespace
 }
 
 // EnvStatus records the status of one env
+// Deprecated
 type EnvStatus struct {
 	Env        string              `json:"env"`
 	Placements []PlacementDecision `json:"placements"`
 }
 
 // ClusterConnection records the connection with clusters and the last active app revision when they are active (still be used)
+// Deprecated
 type ClusterConnection struct {
 	ClusterName        string `json:"clusterName"`
 	LastActiveRevision string `json:"lastActiveRevision"`
 }
 
 // EnvBindingStatus records the status of all env
+// Deprecated
 type EnvBindingStatus struct {
 	Envs               []EnvStatus         `json:"envs"`
 	ClusterConnections []ClusterConnection `json:"clusterConnections"`

apis/core.oam.dev/v1alpha1/external_types.go

@@ -19,8 +19,6 @@ package v1alpha1
 import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
-
-	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
 )
 
 // +kubebuilder:object:root=true
@@ -49,27 +47,3 @@ type PolicyList struct {
 	metav1.ListMeta `json:"metadata,omitempty"`
 	Items           []Policy `json:"items"`
 }
-
-// +kubebuilder:object:root=true
-
-// Workflow is the Schema for the policy API
-// +kubebuilder:storageversion
-// +kubebuilder:resource:categories={oam}
-// +genclient
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type Workflow struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Steps []common.WorkflowStep `json:"steps,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// WorkflowList contains a list of Workflow
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type WorkflowList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []Workflow `json:"items"`
-}

apis/core.oam.dev/v1alpha1/garbagecollect_policy_types.go

@@ -18,8 +18,6 @@ package v1alpha1
 
 import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-
-	"github.com/oam-dev/kubevela/pkg/oam"
 )
 
 const (
@@ -33,24 +31,26 @@ type GarbageCollectPolicySpec struct {
 	// outdated resources will be kept until resourcetracker be deleted manually
 	KeepLegacyResource bool `json:"keepLegacyResource,omitempty"`
 
+	// Order defines the order of garbage collect
+	Order GarbageCollectOrder `json:"order,omitempty"`
+
 	// Rules defines list of rules to control gc strategy at resource level
 	// if one resource is controlled by multiple rules, first rule will be used
 	Rules []GarbageCollectPolicyRule `json:"rules,omitempty"`
 }
 
+// GarbageCollectOrder is the order of garbage collect
+type GarbageCollectOrder string
+
+const (
+	// OrderDependency is the order of dependency
+	OrderDependency GarbageCollectOrder = "dependency"
+)
+
 // GarbageCollectPolicyRule defines a single garbage-collect policy rule
 type GarbageCollectPolicyRule struct {
-	Selector GarbageCollectPolicyRuleSelector `json:"selector"`
-	Strategy GarbageCollectStrategy           `json:"strategy"`
-}
-
-// GarbageCollectPolicyRuleSelector select the targets of the rule
-// if both traitTypes and componentTypes are specified, combination logic is OR
-// if one resource is specified with conflict strategies, strategy as component go first.
-type GarbageCollectPolicyRuleSelector struct {
-	CompNames  []string `json:"componentNames"`
-	CompTypes  []string `json:"componentTypes"`
-	TraitTypes []string `json:"traitTypes"`
+	Selector ResourcePolicyRuleSelector `json:"selector"`
+	Strategy GarbageCollectStrategy     `json:"strategy"`
 }
 
 // GarbageCollectStrategy the strategy for target resource to recycle
@@ -66,24 +66,15 @@ const (
 	GarbageCollectStrategyOnAppUpdate GarbageCollectStrategy = "onAppUpdate"
 )
 
+// Type the type name of the policy
+func (in *GarbageCollectPolicySpec) Type() string {
+	return GarbageCollectPolicyType
+}
+
 // FindStrategy find gc strategy for target resource
-func (in GarbageCollectPolicySpec) FindStrategy(manifest *unstructured.Unstructured) *GarbageCollectStrategy {
+func (in *GarbageCollectPolicySpec) FindStrategy(manifest *unstructured.Unstructured) *GarbageCollectStrategy {
 	for _, rule := range in.Rules {
-		var compName, compType, traitType string
-		if labels := manifest.GetLabels(); labels != nil {
-			compName = labels[oam.LabelAppComponent]
-			compType = labels[oam.WorkloadTypeLabel]
-			traitType = labels[oam.TraitTypeLabel]
-		}
-		match := func(src []string, val string) (found bool) {
-			for _, _val := range src {
-				found = found || _val == val
-			}
-			return val != "" && found
-		}
-		if match(rule.Selector.CompNames, compName) ||
-			match(rule.Selector.CompTypes, compType) ||
-			match(rule.Selector.TraitTypes, traitType) {
+		if rule.Selector.Match(manifest) {
 			return &rule.Strategy
 		}
 	}

apis/core.oam.dev/v1alpha1/garbagecollect_policy_types_test.go

@@ -34,7 +34,7 @@ func TestGarbageCollectPolicySpec_FindStrategy(t *testing.T) {
 	}{
 		"trait type rule match": {
 			rules: []GarbageCollectPolicyRule{{
-				Selector: GarbageCollectPolicyRuleSelector{TraitTypes: []string{"a"}},
+				Selector: ResourcePolicyRuleSelector{TraitTypes: []string{"a"}},
 				Strategy: GarbageCollectStrategyNever,
 			}},
 			input: &unstructured.Unstructured{Object: map[string]interface{}{
@@ -46,7 +46,7 @@ func TestGarbageCollectPolicySpec_FindStrategy(t *testing.T) {
 		},
 		"trait type rule mismatch": {
 			rules: []GarbageCollectPolicyRule{{
-				Selector: GarbageCollectPolicyRuleSelector{TraitTypes: []string{"a"}},
+				Selector: ResourcePolicyRuleSelector{TraitTypes: []string{"a"}},
 				Strategy: GarbageCollectStrategyNever,
 			}},
 			input:    &unstructured.Unstructured{Object: map[string]interface{}{}},
@@ -54,10 +54,10 @@ func TestGarbageCollectPolicySpec_FindStrategy(t *testing.T) {
 		},
 		"trait type rule multiple match": {
 			rules: []GarbageCollectPolicyRule{{
-				Selector: GarbageCollectPolicyRuleSelector{TraitTypes: []string{"a"}},
+				Selector: ResourcePolicyRuleSelector{TraitTypes: []string{"a"}},
 				Strategy: GarbageCollectStrategyOnAppDelete,
 			}, {
-				Selector: GarbageCollectPolicyRuleSelector{TraitTypes: []string{"a"}},
+				Selector: ResourcePolicyRuleSelector{TraitTypes: []string{"a"}},
 				Strategy: GarbageCollectStrategyNever,
 			}},
 			input: &unstructured.Unstructured{Object: map[string]interface{}{
@@ -69,7 +69,7 @@ func TestGarbageCollectPolicySpec_FindStrategy(t *testing.T) {
 		},
 		"component type rule match": {
 			rules: []GarbageCollectPolicyRule{{
-				Selector: GarbageCollectPolicyRuleSelector{CompTypes: []string{"comp"}},
+				Selector: ResourcePolicyRuleSelector{CompTypes: []string{"comp"}},
 				Strategy: GarbageCollectStrategyNever,
 			}},
 			input: &unstructured.Unstructured{Object: map[string]interface{}{
@@ -82,11 +82,11 @@ func TestGarbageCollectPolicySpec_FindStrategy(t *testing.T) {
 		"rule match both component type and trait type, component type first": {
 			rules: []GarbageCollectPolicyRule{
 				{
-					Selector: GarbageCollectPolicyRuleSelector{CompTypes: []string{"comp"}},
+					Selector: ResourcePolicyRuleSelector{CompTypes: []string{"comp"}},
 					Strategy: GarbageCollectStrategyNever,
 				},
 				{
-					Selector: GarbageCollectPolicyRuleSelector{TraitTypes: []string{"trait"}},
+					Selector: ResourcePolicyRuleSelector{TraitTypes: []string{"trait"}},
 					Strategy: GarbageCollectStrategyOnAppDelete,
 				},
 			},
@@ -99,7 +99,7 @@ func TestGarbageCollectPolicySpec_FindStrategy(t *testing.T) {
 		},
 		"component name rule match": {
 			rules: []GarbageCollectPolicyRule{{
-				Selector: GarbageCollectPolicyRuleSelector{CompNames: []string{"comp-name"}},
+				Selector: ResourcePolicyRuleSelector{CompNames: []string{"comp-name"}},
 				Strategy: GarbageCollectStrategyNever,
 			}},
 			input: &unstructured.Unstructured{Object: map[string]interface{}{
@@ -109,6 +109,18 @@ func TestGarbageCollectPolicySpec_FindStrategy(t *testing.T) {
 			}},
 			expectStrategy: GarbageCollectStrategyNever,
 		},
+		"resource type rule match": {
+			rules: []GarbageCollectPolicyRule{{
+				Selector: ResourcePolicyRuleSelector{OAMResourceTypes: []string{"TRAIT"}},
+				Strategy: GarbageCollectStrategyNever,
+			}},
+			input: &unstructured.Unstructured{Object: map[string]interface{}{
+				"metadata": map[string]interface{}{
+					"labels": map[string]interface{}{oam.LabelOAMResourceType: "TRAIT"},
+				},
+			}},
+			expectStrategy: GarbageCollectStrategyNever,
+		},
 	}
 	for name, tc := range testCases {
 		t.Run(name, func(t *testing.T) {

apis/core.oam.dev/v1alpha1/policy_types.go

@@ -21,6 +21,10 @@ const (
 	TopologyPolicyType = "topology"
 	// OverridePolicyType refers to the type of override policy
 	OverridePolicyType = "override"
+	// DebugPolicyType refers to the type of debug policy
+	DebugPolicyType = "debug"
+	// ReplicationPolicyType refers to the type of replication policy
+	ReplicationPolicyType = "replication"
 )
 
 // TopologyPolicySpec defines the spec of topology policy
@@ -41,6 +45,10 @@ type Placement struct {
 	// Exclusive to "clusters"
 	ClusterLabelSelector map[string]string `json:"clusterLabelSelector,omitempty"`
 
+	// AllowEmpty ignore empty cluster error when no cluster returned for label
+	// selector
+	AllowEmpty bool `json:"allowEmpty,omitempty"`
+
 	// DeprecatedClusterSelector is a depreciated alias for ClusterLabelSelector.
 	// Deprecated: Use clusterLabelSelector instead.
 	DeprecatedClusterSelector map[string]string `json:"clusterSelector,omitempty"`
@@ -51,3 +59,11 @@ type OverridePolicySpec struct {
 	Components []EnvComponentPatch `json:"components,omitempty"`
 	Selector   []string            `json:"selector,omitempty"`
 }
+
+// ReplicationPolicySpec defines the spec of replication policy
+// Override policy should be used together with replication policy to select the deployment target components
+type ReplicationPolicySpec struct {
+	Keys []string `json:"keys,omitempty"`
+	// Selector is the subset of selected components which will be replicated.
+	Selector []string `json:"selector,omitempty"`
+}

apis/core.oam.dev/v1alpha1/readonly_policy_types.go

@@ -0,0 +1,49 @@
+/*
+Copyright 2022 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+
+const (
+	// ReadOnlyPolicyType refers to the type of read-only policy
+	ReadOnlyPolicyType = "read-only"
+)
+
+// ReadOnlyPolicySpec defines the spec of read-only policy
+type ReadOnlyPolicySpec struct {
+	Rules []ReadOnlyPolicyRule `json:"rules"`
+}
+
+// Type the type name of the policy
+func (in *ReadOnlyPolicySpec) Type() string {
+	return ReadOnlyPolicyType
+}
+
+// ReadOnlyPolicyRule defines the rule for read-only resources
+type ReadOnlyPolicyRule struct {
+	Selector ResourcePolicyRuleSelector `json:"selector"`
+}
+
+// FindStrategy return if the target resource is read-only
+func (in *ReadOnlyPolicySpec) FindStrategy(manifest *unstructured.Unstructured) bool {
+	for _, rule := range in.Rules {
+		if rule.Selector.Match(manifest) {
+			return true
+		}
+	}
+	return false
+}

apis/core.oam.dev/v1alpha1/register.go

@@ -18,12 +18,17 @@ package v1alpha1
 
 import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	k8sscheme "k8s.io/client-go/kubernetes/scheme"
 	"sigs.k8s.io/controller-runtime/pkg/scheme"
+
+	workflowv1alpha1 "github.com/kubevela/workflow/api/v1alpha1"
+
+	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
 )
 
 // Package type metadata.
 const (
-	Group   = "core.oam.dev"
+	Group   = common.Group
 	Version = "v1alpha1"
 )
 
@@ -52,5 +57,6 @@ var (
 
 func init() {
 	SchemeBuilder.Register(&Policy{}, &PolicyList{})
-	SchemeBuilder.Register(&Workflow{}, &WorkflowList{})
+	SchemeBuilder.Register(&workflowv1alpha1.Workflow{}, &workflowv1alpha1.WorkflowList{})
+	_ = SchemeBuilder.AddToScheme(k8sscheme.Scheme)
 }

apis/core.oam.dev/v1alpha1/resource_policy_types.go

@@ -0,0 +1,78 @@
+/*
+Copyright 2022 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/utils/pointer"
+	stringslices "k8s.io/utils/strings/slices"
+
+	"github.com/oam-dev/kubevela/pkg/oam"
+)
+
+// ResourcePolicyRuleSelector select the targets of the rule
+// if multiple conditions are specified, combination logic is AND
+type ResourcePolicyRuleSelector struct {
+	CompNames        []string `json:"componentNames,omitempty"`
+	CompTypes        []string `json:"componentTypes,omitempty"`
+	OAMResourceTypes []string `json:"oamTypes,omitempty"`
+	TraitTypes       []string `json:"traitTypes,omitempty"`
+	ResourceTypes    []string `json:"resourceTypes,omitempty"`
+	ResourceNames    []string `json:"resourceNames,omitempty"`
+}
+
+// Match check if current rule selector match the target resource
+// If at least one condition is matched and no other condition failed (could be empty), return true
+// Otherwise, return false
+func (in *ResourcePolicyRuleSelector) Match(manifest *unstructured.Unstructured) bool {
+	var compName, compType, oamType, traitType, resourceType, resourceName string
+	if labels := manifest.GetLabels(); labels != nil {
+		compName = labels[oam.LabelAppComponent]
+		compType = labels[oam.WorkloadTypeLabel]
+		oamType = labels[oam.LabelOAMResourceType]
+		traitType = labels[oam.TraitTypeLabel]
+	}
+	resourceType = manifest.GetKind()
+	resourceName = manifest.GetName()
+	match := func(src []string, val string) (found *bool) {
+		if len(src) == 0 {
+			return nil
+		}
+		return pointer.Bool(val != "" && stringslices.Contains(src, val))
+	}
+	conditions := []*bool{
+		match(in.CompNames, compName),
+		match(in.CompTypes, compType),
+		match(in.OAMResourceTypes, oamType),
+		match(in.TraitTypes, traitType),
+		match(in.ResourceTypes, resourceType),
+		match(in.ResourceNames, resourceName),
+	}
+	hasMatched := false
+	for _, cond := range conditions {
+		// if any non-empty condition failed, return false
+		if cond != nil && !*cond {
+			return false
+		}
+		// if condition succeed, record it
+		if cond != nil && *cond {
+			hasMatched = true
+		}
+	}
+	// if at least one condition is met, return true
+	return hasMatched
+}

apis/core.oam.dev/v1alpha1/sharedresource_policy_types.go

@@ -0,0 +1,49 @@
+/*
+Copyright 2022 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+
+const (
+	// SharedResourcePolicyType refers to the type of shared resource policy
+	SharedResourcePolicyType = "shared-resource"
+)
+
+// SharedResourcePolicySpec defines the spec of shared-resource policy
+type SharedResourcePolicySpec struct {
+	Rules []SharedResourcePolicyRule `json:"rules"`
+}
+
+// Type the type name of the policy
+func (in *SharedResourcePolicySpec) Type() string {
+	return SharedResourcePolicyType
+}
+
+// SharedResourcePolicyRule defines the rule for sharing resources
+type SharedResourcePolicyRule struct {
+	Selector ResourcePolicyRuleSelector `json:"selector"`
+}
+
+// FindStrategy return if the target resource should be shared
+func (in *SharedResourcePolicySpec) FindStrategy(manifest *unstructured.Unstructured) bool {
+	for _, rule := range in.Rules {
+		if rule.Selector.Match(manifest) {
+			return true
+		}
+	}
+	return false
+}

apis/core.oam.dev/v1alpha1/sharedresource_policy_types_test.go

@@ -0,0 +1,69 @@
+/*
+Copyright 2022 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+)
+
+func TestSharedResourcePolicySpec_FindStrategy(t *testing.T) {
+	testCases := map[string]struct {
+		rules   []SharedResourcePolicyRule
+		input   *unstructured.Unstructured
+		matched bool
+	}{
+		"shared resource rule resourceName match": {
+			rules: []SharedResourcePolicyRule{{
+				Selector: ResourcePolicyRuleSelector{ResourceNames: []string{"example"}},
+			}},
+			input: &unstructured.Unstructured{Object: map[string]interface{}{
+				"metadata": map[string]interface{}{
+					"name": "example",
+				},
+			}},
+			matched: true,
+		},
+		"shared resource rule resourceType match": {
+			rules: []SharedResourcePolicyRule{{
+				Selector: ResourcePolicyRuleSelector{ResourceTypes: []string{"ConfigMap", "Namespace"}},
+			}},
+			input: &unstructured.Unstructured{Object: map[string]interface{}{
+				"kind": "Namespace",
+			}},
+			matched: true,
+		},
+		"shared resource rule mismatch": {
+			rules: []SharedResourcePolicyRule{{
+				Selector: ResourcePolicyRuleSelector{ResourceNames: []string{"mismatch"}},
+			}},
+			input: &unstructured.Unstructured{Object: map[string]interface{}{
+				"kind": "Namespace",
+			}},
+			matched: false,
+		},
+	}
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			r := require.New(t)
+			spec := SharedResourcePolicySpec{Rules: tc.rules}
+			r.Equal(tc.matched, spec.FindStrategy(tc.input))
+		})
+	}
+}

apis/core.oam.dev/v1alpha1/takeover_policy_types.go

@@ -0,0 +1,49 @@
+/*
+Copyright 2022 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+
+const (
+	// TakeOverPolicyType refers to the type of take-over policy
+	TakeOverPolicyType = "take-over"
+)
+
+// TakeOverPolicySpec defines the spec of take-over policy
+type TakeOverPolicySpec struct {
+	Rules []TakeOverPolicyRule `json:"rules"`
+}
+
+// Type the type name of the policy
+func (in *TakeOverPolicySpec) Type() string {
+	return TakeOverPolicyType
+}
+
+// TakeOverPolicyRule defines the rule for taking over resources
+type TakeOverPolicyRule struct {
+	Selector ResourcePolicyRuleSelector `json:"selector"`
+}
+
+// FindStrategy return if the target resource should be taken over
+func (in *TakeOverPolicySpec) FindStrategy(manifest *unstructured.Unstructured) bool {
+	for _, rule := range in.Rules {
+		if rule.Selector.Match(manifest) {
+			return true
+		}
+	}
+	return false
+}

apis/core.oam.dev/v1alpha1/zz_generated.deepcopy.go

@@ -27,9 +27,37 @@ import (
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
 )
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ApplyOncePolicyRule) DeepCopyInto(out *ApplyOncePolicyRule) {
+	*out = *in
+	in.Selector.DeepCopyInto(&out.Selector)
+	if in.Strategy != nil {
+		in, out := &in.Strategy, &out.Strategy
+		*out = new(ApplyOnceStrategy)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplyOncePolicyRule.
+func (in *ApplyOncePolicyRule) DeepCopy() *ApplyOncePolicyRule {
+	if in == nil {
+		return nil
+	}
+	out := new(ApplyOncePolicyRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ApplyOncePolicySpec) DeepCopyInto(out *ApplyOncePolicySpec) {
 	*out = *in
+	if in.Rules != nil {
+		in, out := &in.Rules, &out.Rules
+		*out = make([]ApplyOncePolicyRule, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplyOncePolicySpec.
@@ -42,6 +70,26 @@ func (in *ApplyOncePolicySpec) DeepCopy() *ApplyOncePolicySpec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ApplyOnceStrategy) DeepCopyInto(out *ApplyOnceStrategy) {
+	*out = *in
+	if in.Path != nil {
+		in, out := &in.Path, &out.Path
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplyOnceStrategy.
+func (in *ApplyOnceStrategy) DeepCopy() *ApplyOnceStrategy {
+	if in == nil {
+		return nil
+	}
+	out := new(ApplyOnceStrategy)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ClusterConnection) DeepCopyInto(out *ClusterConnection) {
 	*out = *in
@@ -278,36 +326,6 @@ func (in *GarbageCollectPolicyRule) DeepCopy() *GarbageCollectPolicyRule {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *GarbageCollectPolicyRuleSelector) DeepCopyInto(out *GarbageCollectPolicyRuleSelector) {
-	*out = *in
-	if in.CompNames != nil {
-		in, out := &in.CompNames, &out.CompNames
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.CompTypes != nil {
-		in, out := &in.CompTypes, &out.CompTypes
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.TraitTypes != nil {
-		in, out := &in.TraitTypes, &out.TraitTypes
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GarbageCollectPolicyRuleSelector.
-func (in *GarbageCollectPolicyRuleSelector) DeepCopy() *GarbageCollectPolicyRuleSelector {
-	if in == nil {
-		return nil
-	}
-	out := new(GarbageCollectPolicyRuleSelector)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *GarbageCollectPolicySpec) DeepCopyInto(out *GarbageCollectPolicySpec) {
 	*out = *in
@@ -567,6 +585,44 @@ func (in *PolicyList) DeepCopyObject() runtime.Object {
 	return nil
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ReadOnlyPolicyRule) DeepCopyInto(out *ReadOnlyPolicyRule) {
+	*out = *in
+	in.Selector.DeepCopyInto(&out.Selector)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ReadOnlyPolicyRule.
+func (in *ReadOnlyPolicyRule) DeepCopy() *ReadOnlyPolicyRule {
+	if in == nil {
+		return nil
+	}
+	out := new(ReadOnlyPolicyRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ReadOnlyPolicySpec) DeepCopyInto(out *ReadOnlyPolicySpec) {
+	*out = *in
+	if in.Rules != nil {
+		in, out := &in.Rules, &out.Rules
+		*out = make([]ReadOnlyPolicyRule, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ReadOnlyPolicySpec.
+func (in *ReadOnlyPolicySpec) DeepCopy() *ReadOnlyPolicySpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ReadOnlyPolicySpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RefObjectsComponentSpec) DeepCopyInto(out *RefObjectsComponentSpec) {
 	*out = *in
@@ -577,6 +633,11 @@ func (in *RefObjectsComponentSpec) DeepCopyInto(out *RefObjectsComponentSpec) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	if in.URLs != nil {
+		in, out := &in.URLs, &out.URLs
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RefObjectsComponentSpec.
@@ -589,6 +650,152 @@ func (in *RefObjectsComponentSpec) DeepCopy() *RefObjectsComponentSpec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ReplicationPolicySpec) DeepCopyInto(out *ReplicationPolicySpec) {
+	*out = *in
+	if in.Keys != nil {
+		in, out := &in.Keys, &out.Keys
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Selector != nil {
+		in, out := &in.Selector, &out.Selector
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ReplicationPolicySpec.
+func (in *ReplicationPolicySpec) DeepCopy() *ReplicationPolicySpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ReplicationPolicySpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ResourcePolicyRuleSelector) DeepCopyInto(out *ResourcePolicyRuleSelector) {
+	*out = *in
+	if in.CompNames != nil {
+		in, out := &in.CompNames, &out.CompNames
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.CompTypes != nil {
+		in, out := &in.CompTypes, &out.CompTypes
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.OAMResourceTypes != nil {
+		in, out := &in.OAMResourceTypes, &out.OAMResourceTypes
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.TraitTypes != nil {
+		in, out := &in.TraitTypes, &out.TraitTypes
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.ResourceTypes != nil {
+		in, out := &in.ResourceTypes, &out.ResourceTypes
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.ResourceNames != nil {
+		in, out := &in.ResourceNames, &out.ResourceNames
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourcePolicyRuleSelector.
+func (in *ResourcePolicyRuleSelector) DeepCopy() *ResourcePolicyRuleSelector {
+	if in == nil {
+		return nil
+	}
+	out := new(ResourcePolicyRuleSelector)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SharedResourcePolicyRule) DeepCopyInto(out *SharedResourcePolicyRule) {
+	*out = *in
+	in.Selector.DeepCopyInto(&out.Selector)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SharedResourcePolicyRule.
+func (in *SharedResourcePolicyRule) DeepCopy() *SharedResourcePolicyRule {
+	if in == nil {
+		return nil
+	}
+	out := new(SharedResourcePolicyRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SharedResourcePolicySpec) DeepCopyInto(out *SharedResourcePolicySpec) {
+	*out = *in
+	if in.Rules != nil {
+		in, out := &in.Rules, &out.Rules
+		*out = make([]SharedResourcePolicyRule, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SharedResourcePolicySpec.
+func (in *SharedResourcePolicySpec) DeepCopy() *SharedResourcePolicySpec {
+	if in == nil {
+		return nil
+	}
+	out := new(SharedResourcePolicySpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TakeOverPolicyRule) DeepCopyInto(out *TakeOverPolicyRule) {
+	*out = *in
+	in.Selector.DeepCopyInto(&out.Selector)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TakeOverPolicyRule.
+func (in *TakeOverPolicyRule) DeepCopy() *TakeOverPolicyRule {
+	if in == nil {
+		return nil
+	}
+	out := new(TakeOverPolicyRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TakeOverPolicySpec) DeepCopyInto(out *TakeOverPolicySpec) {
+	*out = *in
+	if in.Rules != nil {
+		in, out := &in.Rules, &out.Rules
+		*out = make([]TakeOverPolicyRule, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TakeOverPolicySpec.
+func (in *TakeOverPolicySpec) DeepCopy() *TakeOverPolicySpec {
+	if in == nil {
+		return nil
+	}
+	out := new(TakeOverPolicySpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TopologyPolicySpec) DeepCopyInto(out *TopologyPolicySpec) {
 	*out = *in
@@ -604,67 +811,3 @@ func (in *TopologyPolicySpec) DeepCopy() *TopologyPolicySpec {
 	in.DeepCopyInto(out)
 	return out
 }
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Workflow) DeepCopyInto(out *Workflow) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	if in.Steps != nil {
-		in, out := &in.Steps, &out.Steps
-		*out = make([]common.WorkflowStep, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Workflow.
-func (in *Workflow) DeepCopy() *Workflow {
-	if in == nil {
-		return nil
-	}
-	out := new(Workflow)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Workflow) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *WorkflowList) DeepCopyInto(out *WorkflowList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]Workflow, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkflowList.
-func (in *WorkflowList) DeepCopy() *WorkflowList {
-	if in == nil {
-		return nil
-	}
-	out := new(WorkflowList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *WorkflowList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}

apis/core.oam.dev/v1alpha2/application_types.go

@@ -87,7 +87,7 @@ type ApplicationSpec struct {
 
 // Application is the Schema for the applications API
 // +kubebuilder:object:root=true
-// +kubebuilder:resource:categories={oam},shortName=app
+// +kubebuilder:resource:categories={oam},shortName={app,velaapp}
 // +kubebuilder:subresource:status
 // +kubebuilder:printcolumn:name="COMPONENT",type=string,JSONPath=`.spec.components[*].name`
 // +kubebuilder:printcolumn:name="TYPE",type=string,JSONPath=`.spec.components[*].type`

apis/core.oam.dev/v1alpha2/core_trait_types.go

@@ -1,65 +0,0 @@
-/*
-Copyright 2021 The KubeVela Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1alpha2
-
-import (
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
-	"github.com/oam-dev/kubevela/apis/core.oam.dev/condition"
-
-	"github.com/oam-dev/kubevela/pkg/oam"
-)
-
-var _ oam.Trait = &ManualScalerTrait{}
-
-// A ManualScalerTraitSpec defines the desired state of a ManualScalerTrait.
-type ManualScalerTraitSpec struct {
-	// ReplicaCount of the workload this trait applies to.
-	ReplicaCount int32 `json:"replicaCount"`
-
-	// WorkloadReference to the workload this trait applies to.
-	WorkloadReference corev1.ObjectReference `json:"workloadRef"`
-}
-
-// A ManualScalerTraitStatus represents the observed state of a
-// ManualScalerTrait.
-type ManualScalerTraitStatus struct {
-	condition.ConditionedStatus `json:",inline"`
-}
-
-// +kubebuilder:object:root=true
-
-// A ManualScalerTrait determines how many replicas a workload should have.
-// +kubebuilder:resource:categories={oam}
-// +kubebuilder:subresource:status
-type ManualScalerTrait struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   ManualScalerTraitSpec   `json:"spec,omitempty"`
-	Status ManualScalerTraitStatus `json:"status,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// ManualScalerTraitList contains a list of ManualScalerTrait.
-type ManualScalerTraitList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []ManualScalerTrait `json:"items"`
-}

apis/core.oam.dev/v1alpha2/methods.go

@@ -24,26 +24,6 @@ import (
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/condition"
 )
 
-// GetCondition of this ManualScalerTrait.
-func (tr *ManualScalerTrait) GetCondition(ct condition.ConditionType) condition.Condition {
-	return tr.Status.GetCondition(ct)
-}
-
-// SetConditions of this ManualScalerTrait.
-func (tr *ManualScalerTrait) SetConditions(c ...condition.Condition) {
-	tr.Status.SetConditions(c...)
-}
-
-// GetWorkloadReference of this ManualScalerTrait.
-func (tr *ManualScalerTrait) GetWorkloadReference() corev1.ObjectReference {
-	return tr.Spec.WorkloadReference
-}
-
-// SetWorkloadReference of this ManualScalerTrait.
-func (tr *ManualScalerTrait) SetWorkloadReference(r corev1.ObjectReference) {
-	tr.Spec.WorkloadReference = r
-}
-
 // GetCondition of this ApplicationConfiguration.
 func (ac *ApplicationConfiguration) GetCondition(ct condition.ConditionType) condition.Condition {
 	return ac.Status.GetCondition(ct)

apis/core.oam.dev/v1alpha2/register.go

@@ -21,11 +21,13 @@ import (
 
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"sigs.k8s.io/controller-runtime/pkg/scheme"
+
+	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
 )
 
 // Package type metadata.
 const (
-	Group   = "core.oam.dev"
+	Group   = common.Group
 	Version = "v1alpha2"
 )
 
@@ -85,14 +87,6 @@ var (
 	ApplicationConfigurationGroupVersionKind = SchemeGroupVersion.WithKind(ApplicationConfigurationKind)
 )
 
-// ManualScalerTrait type metadata.
-var (
-	ManualScalerTraitKind             = reflect.TypeOf(ManualScalerTrait{}).Name()
-	ManualScalerTraitGroupKind        = schema.GroupKind{Group: Group, Kind: ManualScalerTraitKind}.String()
-	ManualScalerTraitKindAPIVersion   = ManualScalerTraitKind + "." + SchemeGroupVersion.String()
-	ManualScalerTraitGroupVersionKind = SchemeGroupVersion.WithKind(ManualScalerTraitKind)
-)
-
 // HealthScope type metadata.
 var (
 	HealthScopeKind             = reflect.TypeOf(HealthScope{}).Name()
@@ -124,7 +118,6 @@ func init() {
 	SchemeBuilder.Register(&ScopeDefinition{}, &ScopeDefinitionList{})
 	SchemeBuilder.Register(&Component{}, &ComponentList{})
 	SchemeBuilder.Register(&ApplicationConfiguration{}, &ApplicationConfigurationList{})
-	SchemeBuilder.Register(&ManualScalerTrait{}, &ManualScalerTraitList{})
 	SchemeBuilder.Register(&HealthScope{}, &HealthScopeList{})
 	SchemeBuilder.Register(&Application{}, &ApplicationList{})
 	SchemeBuilder.Register(&ApplicationRevision{}, &ApplicationRevisionList{})

apis/core.oam.dev/v1alpha2/zz_generated.deepcopy.go

@@ -1520,97 +1520,6 @@ func (in *HistoryWorkload) DeepCopy() *HistoryWorkload {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ManualScalerTrait) DeepCopyInto(out *ManualScalerTrait) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	out.Spec = in.Spec
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManualScalerTrait.
-func (in *ManualScalerTrait) DeepCopy() *ManualScalerTrait {
-	if in == nil {
-		return nil
-	}
-	out := new(ManualScalerTrait)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *ManualScalerTrait) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ManualScalerTraitList) DeepCopyInto(out *ManualScalerTraitList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]ManualScalerTrait, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManualScalerTraitList.
-func (in *ManualScalerTraitList) DeepCopy() *ManualScalerTraitList {
-	if in == nil {
-		return nil
-	}
-	out := new(ManualScalerTraitList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *ManualScalerTraitList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ManualScalerTraitSpec) DeepCopyInto(out *ManualScalerTraitSpec) {
-	*out = *in
-	out.WorkloadReference = in.WorkloadReference
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManualScalerTraitSpec.
-func (in *ManualScalerTraitSpec) DeepCopy() *ManualScalerTraitSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ManualScalerTraitSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ManualScalerTraitStatus) DeepCopyInto(out *ManualScalerTraitStatus) {
-	*out = *in
-	in.ConditionedStatus.DeepCopyInto(&out.ConditionedStatus)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManualScalerTraitStatus.
-func (in *ManualScalerTraitStatus) DeepCopy() *ManualScalerTraitStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(ManualScalerTraitStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *MemoryResources) DeepCopyInto(out *MemoryResources) {
 	*out = *in

apis/core.oam.dev/v1beta1/application_types.go

@@ -23,6 +23,8 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 
+	workflowv1alpha1 "github.com/kubevela/workflow/api/v1alpha1"
+
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/condition"
 )
@@ -49,13 +51,11 @@ type AppPolicy struct {
 	Properties *runtime.RawExtension `json:"properties,omitempty"`
 }
 
-// WorkflowStep defines how to execute a workflow step.
-type WorkflowStep common.WorkflowStep
-
 // Workflow defines workflow steps and other attributes
 type Workflow struct {
-	Ref   string         `json:"ref,omitempty"`
-	Steps []WorkflowStep `json:"steps,omitempty"`
+	Ref   string                                `json:"ref,omitempty"`
+	Mode  *workflowv1alpha1.WorkflowExecuteMode `json:"mode,omitempty"`
+	Steps []workflowv1alpha1.WorkflowStep       `json:"steps,omitempty"`
 }
 
 // ApplicationSpec is the spec of Application
@@ -82,7 +82,7 @@ type ApplicationSpec struct {
 // Application is the Schema for the applications API
 // +kubebuilder:storageversion
 // +kubebuilder:subresource:status
-// +kubebuilder:resource:categories={oam},shortName=app
+// +kubebuilder:resource:categories={oam},shortName={app,velaapp}
 // +kubebuilder:printcolumn:name="COMPONENT",type=string,JSONPath=`.spec.components[*].name`
 // +kubebuilder:printcolumn:name="TYPE",type=string,JSONPath=`.spec.components[*].type`
 // +kubebuilder:printcolumn:name="PHASE",type=string,JSONPath=`.status.status`

apis/core.oam.dev/v1beta1/applicationrevision_types.go

@@ -17,6 +17,10 @@
 package v1beta1
 
 import (
+	"encoding/json"
+
+	"github.com/kubevela/pkg/util/compression"
+	workflowv1alpha1 "github.com/kubevela/workflow/api/v1alpha1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
@@ -27,6 +31,16 @@ import (
 
 // ApplicationRevisionSpec is the spec of ApplicationRevision
 type ApplicationRevisionSpec struct {
+	// ApplicationRevisionCompressibleFields represents all the fields that can be compressed.
+	ApplicationRevisionCompressibleFields `json:",inline"`
+
+	// Compression represents the compressed components in apprev in base64 (if compression is enabled).
+	Compression ApplicationRevisionCompression `json:"compression,omitempty"`
+}
+
+// ApplicationRevisionCompressibleFields represents all the fields that can be compressed.
+// So we can better organize them and compress only the compressible fields.
+type ApplicationRevisionCompressibleFields struct {
 	// Application records the snapshot of the created/modified Application
 	Application Application `json:"application"`
 
@@ -55,19 +69,74 @@ type ApplicationRevisionSpec struct {
 	Policies map[string]v1alpha1.Policy `json:"policies,omitempty"`
 
 	// Workflow records the external workflow
-	Workflow *v1alpha1.Workflow `json:"workflow,omitempty"`
+	Workflow *workflowv1alpha1.Workflow `json:"workflow,omitempty"`
 
 	// ReferredObjects records the referred objects used in the ref-object typed components
 	// +kubebuilder:pruning:PreserveUnknownFields
 	ReferredObjects []common.ReferredObject `json:"referredObjects,omitempty"`
 }
 
+// ApplicationRevisionCompression represents the compressed components in apprev in base64.
+type ApplicationRevisionCompression struct {
+	compression.CompressedText `json:",inline"`
+}
+
+// MarshalJSON serves the same purpose as the one in ResourceTrackerSpec.
+func (apprev *ApplicationRevisionSpec) MarshalJSON() ([]byte, error) {
+	type Alias ApplicationRevisionSpec
+	tmp := &struct {
+		*Alias
+	}{}
+
+	if apprev.Compression.Type == compression.Uncompressed {
+		tmp.Alias = (*Alias)(apprev)
+	} else {
+		cpy := apprev.DeepCopy()
+		err := cpy.Compression.EncodeFrom(cpy.ApplicationRevisionCompressibleFields)
+		cpy.ApplicationRevisionCompressibleFields = ApplicationRevisionCompressibleFields{
+			// Application needs to have components.
+			Application: Application{Spec: ApplicationSpec{Components: []common.ApplicationComponent{}}},
+		}
+		if err != nil {
+			return nil, err
+		}
+		tmp.Alias = (*Alias)(cpy)
+	}
+
+	return json.Marshal(tmp.Alias)
+}
+
+// UnmarshalJSON serves the same purpose as the one in ResourceTrackerSpec.
+func (apprev *ApplicationRevisionSpec) UnmarshalJSON(data []byte) error {
+	type Alias ApplicationRevisionSpec
+	tmp := &struct {
+		*Alias
+	}{}
+
+	if err := json.Unmarshal(data, tmp); err != nil {
+		return err
+	}
+
+	if tmp.Compression.Type != compression.Uncompressed {
+		err := tmp.Compression.DecodeTo(&tmp.ApplicationRevisionCompressibleFields)
+		if err != nil {
+			return err
+		}
+		tmp.Compression.Clean()
+	}
+
+	(*ApplicationRevisionSpec)(tmp.Alias).DeepCopyInto(apprev)
+	return nil
+}
+
 // ApplicationRevisionStatus is the status of ApplicationRevision
 type ApplicationRevisionStatus struct {
 	// Succeeded records if the workflow finished running with success
 	Succeeded bool `json:"succeeded"`
 	// Workflow the running status of the workflow
 	Workflow *common.WorkflowStatus `json:"workflow,omitempty"`
+	// Record the context values to the revision.
+	WorkflowContext map[string]string `json:"workflowContext,omitempty"`
 }
 
 // +kubebuilder:object:root=true

apis/core.oam.dev/v1beta1/applicationrevision_types_test.go

@@ -0,0 +1,86 @@
+/*
+Copyright 2021 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+
+	"github.com/kubevela/pkg/util/compression"
+	"github.com/stretchr/testify/assert"
+	"k8s.io/apimachinery/pkg/runtime"
+
+	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
+)
+
+func TestApplicationRevisionCompression(t *testing.T) {
+	// Fill data
+	spec := &ApplicationRevisionSpec{}
+	spec.Application = Application{Spec: ApplicationSpec{Components: []common.ApplicationComponent{{Name: "test-name"}}}}
+	spec.ComponentDefinitions = make(map[string]ComponentDefinition)
+	spec.ComponentDefinitions["def"] = ComponentDefinition{Spec: ComponentDefinitionSpec{PodSpecPath: "path"}}
+	spec.WorkloadDefinitions = make(map[string]WorkloadDefinition)
+	spec.WorkloadDefinitions["def"] = WorkloadDefinition{Spec: WorkloadDefinitionSpec{Reference: common.DefinitionReference{Name: "testdef"}}}
+	spec.TraitDefinitions = make(map[string]TraitDefinition)
+	spec.TraitDefinitions["def"] = TraitDefinition{Spec: TraitDefinitionSpec{ControlPlaneOnly: true}}
+	spec.ScopeDefinitions = make(map[string]ScopeDefinition)
+	spec.ScopeDefinitions["def"] = ScopeDefinition{Spec: ScopeDefinitionSpec{AllowComponentOverlap: true}}
+	spec.PolicyDefinitions = make(map[string]PolicyDefinition)
+	spec.PolicyDefinitions["def"] = PolicyDefinition{Spec: PolicyDefinitionSpec{ManageHealthCheck: true}}
+	spec.WorkflowStepDefinitions = make(map[string]WorkflowStepDefinition)
+	spec.WorkflowStepDefinitions["def"] = WorkflowStepDefinition{Spec: WorkflowStepDefinitionSpec{Reference: common.DefinitionReference{Name: "testname"}}}
+	spec.ReferredObjects = []common.ReferredObject{{RawExtension: runtime.RawExtension{Raw: []byte("123")}}}
+
+	testAppRev := &ApplicationRevision{Spec: *spec}
+
+	marshalAndUnmarshal := func(in *ApplicationRevision) (*ApplicationRevision, int) {
+		out := &ApplicationRevision{}
+		b, err := json.Marshal(in)
+		assert.NoError(t, err)
+		if in.Spec.Compression.Type != compression.Uncompressed {
+			assert.Contains(t, string(b), fmt.Sprintf("\"type\":\"%s\",\"data\":\"", in.Spec.Compression.Type))
+		}
+		err = json.Unmarshal(b, out)
+		assert.NoError(t, err)
+		assert.Equal(t, out.Spec.Compression.Type, in.Spec.Compression.Type)
+		assert.Equal(t, out.Spec.Compression.Data, "")
+		return out, len(b)
+	}
+
+	// uncompressed
+	testAppRev.Spec.Compression.SetType(compression.Uncompressed)
+	uncomp, uncompsize := marshalAndUnmarshal(testAppRev)
+
+	// zstd compressed
+	testAppRev.Spec.Compression.SetType(compression.Zstd)
+	zstdcomp, zstdsize := marshalAndUnmarshal(testAppRev)
+	// We will compare content later. Clear compression methods since it will interfere
+	// comparison and is verified earlier.
+	zstdcomp.Spec.Compression.SetType(compression.Uncompressed)
+
+	// gzip compressed
+	testAppRev.Spec.Compression.SetType(compression.Gzip)
+	gzipcomp, gzipsize := marshalAndUnmarshal(testAppRev)
+	gzipcomp.Spec.Compression.SetType(compression.Uncompressed)
+
+	assert.Equal(t, uncomp, zstdcomp)
+	assert.Equal(t, zstdcomp, gzipcomp)
+
+	assert.Less(t, zstdsize, uncompsize)
+	assert.Less(t, gzipsize, uncompsize)
+}

apis/core.oam.dev/v1beta1/core_types.go

@@ -120,7 +120,7 @@ type TraitDefinitionSpec struct {
 	PodDisruptive bool `json:"podDisruptive,omitempty"`
 
 	// AppliesToWorkloads specifies the list of workload kinds this trait
-	// applies to. Workload kinds are specified in kind.group/version format,
+	// applies to. Workload kinds are specified in resource.group/version format,
 	// e.g. server.core.oam.dev/v1alpha2. Traits that omit this field apply to
 	// all workload kinds.
 	// +optional
@@ -138,7 +138,8 @@ type TraitDefinitionSpec struct {
 	// +optional
 	ConflictsWith []string `json:"conflictsWith,omitempty"`
 
-	// Schematic defines the data format and template of the encapsulation of the trait
+	// Schematic defines the data format and template of the encapsulation of the trait.
+	// Only CUE and Kube schematic are supported for now.
 	// +optional
 	Schematic *common.Schematic `json:"schematic,omitempty"`
 
@@ -154,11 +155,32 @@ type TraitDefinitionSpec struct {
 	// ManageWorkload defines the trait would be responsible for creating the workload
 	// +optional
 	ManageWorkload bool `json:"manageWorkload,omitempty"`
-	// SkipRevisionAffect defines the update this trait will not generate a new application Revision
+	// ControlPlaneOnly defines which cluster is dispatched to
 	// +optional
-	SkipRevisionAffect bool `json:"skipRevisionAffect,omitempty"`
+	ControlPlaneOnly bool `json:"controlPlaneOnly,omitempty"`
+
+	// Stage defines the stage information to which this trait resource processing belongs.
+	// Currently, PreDispatch and PostDispatch are provided, which are used to control resource
+	// pre-process and post-process respectively.
+	// +optional
+	Stage StageType `json:"stage,omitempty"`
 }
 
+// StageType describes how the manifests should be dispatched.
+// Only one of the following stage types may be specified.
+// If none of the following types is specified, the default one
+// is DefaultDispatch.
+type StageType string
+
+const (
+	// PreDispatch means that pre dispatch for manifests
+	PreDispatch StageType = "PreDispatch"
+	// DefaultDispatch means that default dispatch for manifests
+	DefaultDispatch StageType = "DefaultDispatch"
+	// PostDispatch means that post dispatch for manifests
+	PostDispatch StageType = "PostDispatch"
+)
+
 // TraitDefinitionStatus is the status of TraitDefinition
 type TraitDefinitionStatus struct {
 	// ConditionedStatus reflects the observed status of a resource

apis/core.oam.dev/v1beta1/policy_definition.go

@@ -29,7 +29,8 @@ type PolicyDefinitionSpec struct {
 	// Reference to the CustomResourceDefinition that defines this trait kind.
 	Reference common.DefinitionReference `json:"definitionRef,omitempty"`
 
-	// Schematic defines the data format and template of the encapsulation of the policy definition
+	// Schematic defines the data format and template of the encapsulation of the policy definition.
+	// Only CUE schematic is supported for now.
 	// +optional
 	Schematic *common.Schematic `json:"schematic,omitempty"`
 
@@ -43,6 +44,9 @@ type PolicyDefinitionStatus struct {
 	// ConditionedStatus reflects the observed status of a resource
 	condition.ConditionedStatus `json:",inline"`
 
+	// ConfigMapRef refer to a ConfigMap which contains OpenAPI V3 JSON schema of Component parameters.
+	ConfigMapRef string `json:"configMapRef,omitempty"`
+
 	// LatestRevision of the component definition
 	// +optional
 	LatestRevision *common.Revision `json:"latestRevision,omitempty"`

apis/core.oam.dev/v1beta1/register.go

@@ -20,12 +20,15 @@ import (
 	"reflect"
 
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	k8sscheme "k8s.io/client-go/kubernetes/scheme"
 	"sigs.k8s.io/controller-runtime/pkg/scheme"
+
+	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
 )
 
 // Package type metadata.
 const (
-	Group   = "core.oam.dev"
+	Group   = common.Group
 	Version = "v1beta1"
 )
 
@@ -131,6 +134,7 @@ func init() {
 	SchemeBuilder.Register(&Application{}, &ApplicationList{})
 	SchemeBuilder.Register(&ApplicationRevision{}, &ApplicationRevisionList{})
 	SchemeBuilder.Register(&ResourceTracker{}, &ResourceTrackerList{})
+	_ = SchemeBuilder.AddToScheme(k8sscheme.Scheme)
 }
 
 // Resource takes an unqualified resource and returns a Group qualified GroupResource

apis/core.oam.dev/v1beta1/resourcetracker_types.go

@@ -21,19 +21,21 @@ import (
 	"reflect"
 	"strings"
 
-	errors2 "github.com/pkg/errors"
-	v1 "k8s.io/api/core/v1"
+	"github.com/pkg/errors"
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
+	"github.com/kubevela/pkg/util/compression"
+
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
 	"github.com/oam-dev/kubevela/apis/interfaces"
 	velatypes "github.com/oam-dev/kubevela/apis/types"
 	"github.com/oam-dev/kubevela/pkg/oam"
-	"github.com/oam-dev/kubevela/pkg/utils/errors"
+	velaerr "github.com/oam-dev/kubevela/pkg/utils/errors"
 )
 
 // +kubebuilder:object:root=true
@@ -69,9 +71,60 @@ const (
 
 // ResourceTrackerSpec define the spec of resourceTracker
 type ResourceTrackerSpec struct {
-	Type                  ResourceTrackerType `json:"type,omitempty"`
-	ApplicationGeneration int64               `json:"applicationGeneration"`
-	ManagedResources      []ManagedResource   `json:"managedResources,omitempty"`
+	Type                  ResourceTrackerType        `json:"type,omitempty"`
+	ApplicationGeneration int64                      `json:"applicationGeneration"`
+	ManagedResources      []ManagedResource          `json:"managedResources,omitempty"`
+	Compression           ResourceTrackerCompression `json:"compression,omitempty"`
+}
+
+// ResourceTrackerCompression represents the compressed components in ResourceTracker.
+type ResourceTrackerCompression struct {
+	compression.CompressedText `json:",inline"`
+}
+
+// MarshalJSON will encode ResourceTrackerSpec according to the compression type. If type specified,
+// it will encode data to compression data.
+// Note: this is not the standard json Marshal process but re-use the framework function.
+func (in *ResourceTrackerSpec) MarshalJSON() ([]byte, error) {
+	type Alias ResourceTrackerSpec
+	tmp := &struct{ *Alias }{}
+
+	if in.Compression.Type == compression.Uncompressed {
+		tmp.Alias = (*Alias)(in)
+	} else {
+		cpy := in.DeepCopy()
+		cpy.ManagedResources = nil
+		err := cpy.Compression.EncodeFrom(in.ManagedResources)
+		if err != nil {
+			return nil, err
+		}
+		tmp.Alias = (*Alias)(cpy)
+	}
+
+	return json.Marshal(tmp.Alias)
+}
+
+// UnmarshalJSON will decode ResourceTrackerSpec according to the compression type. If type specified,
+// it will decode data from compression data.
+// Note: this is not the standard json Unmarshal process but re-use the framework function.
+func (in *ResourceTrackerSpec) UnmarshalJSON(src []byte) error {
+	type Alias ResourceTrackerSpec
+	tmp := &struct{ *Alias }{}
+	if err := json.Unmarshal(src, tmp); err != nil {
+		return err
+	}
+
+	if tmp.Compression.Type != compression.Uncompressed {
+		tmp.ManagedResources = []ManagedResource{}
+		err := tmp.Compression.DecodeTo(&tmp.ManagedResources)
+		if err != nil {
+			return err
+		}
+		tmp.Compression.Clean()
+	}
+
+	(*ResourceTrackerSpec)(tmp.Alias).DeepCopyInto(in)
+	return nil
 }
 
 // ManagedResource define the resource to be managed by ResourceTracker
@@ -82,6 +135,8 @@ type ManagedResource struct {
 	Data *runtime.RawExtension `json:"raw,omitempty"`
 	// Deleted marks the resource to be deleted
 	Deleted bool `json:"deleted,omitempty"`
+	// SkipGC marks the resource to skip gc
+	SkipGC bool `json:"skipGC,omitempty"`
 }
 
 // Equal check if two managed resource equals
@@ -121,12 +176,13 @@ func (in ManagedResource) NamespacedName() types.NamespacedName {
 
 // ResourceKey computes the key for managed resource, resources with the same key points to the same resource
 func (in ManagedResource) ResourceKey() string {
-	gv, kind := in.GroupVersionKind().ToAPIVersionAndKind()
+	group := in.GroupVersionKind().Group
+	kind := in.GroupVersionKind().Kind
 	cluster := in.Cluster
 	if cluster == "" {
 		cluster = velatypes.ClusterLocalName
 	}
-	return strings.Join([]string{gv, kind, cluster, in.Namespace, in.Name}, "/")
+	return strings.Join([]string{group, kind, cluster, in.Namespace, in.Name}, "/")
 }
 
 // ComponentKey computes the key for the component which managed resource belongs to
@@ -137,7 +193,7 @@ func (in ManagedResource) ComponentKey() string {
 // UnmarshalTo unmarshal ManagedResource into target object
 func (in ManagedResource) UnmarshalTo(obj interface{}) error {
 	if in.Data == nil || in.Data.Raw == nil {
-		return errors.ManagedResourceHasNoDataError{}
+		return velaerr.ManagedResourceHasNoDataError{}
 	}
 	return json.Unmarshal(in.Data.Raw, obj)
 }
@@ -158,7 +214,7 @@ func (in ManagedResource) ToUnstructured() *unstructured.Unstructured {
 func (in ManagedResource) ToUnstructuredWithData() (*unstructured.Unstructured, error) {
 	obj := in.ToUnstructured()
 	if err := in.UnmarshalTo(obj); err != nil {
-		if errors2.Is(err, errors.ManagedResourceHasNoDataError{}) {
+		if errors.Is(err, velaerr.ManagedResourceHasNoDataError{}) {
 			return nil, err
 		}
 	}
@@ -191,12 +247,11 @@ func (in *ResourceTracker) findMangedResourceIndex(mr ManagedResource) int {
 	return -1
 }
 
-// AddManagedResource add object to managed resources, if exists, update
-func (in *ResourceTracker) AddManagedResource(rsc client.Object, metaOnly bool) (updated bool) {
+func newManagedResourceFromResource(rsc client.Object) ManagedResource {
 	gvk := rsc.GetObjectKind().GroupVersionKind()
-	mr := ManagedResource{
+	return ManagedResource{
 		ClusterObjectReference: common.ClusterObjectReference{
-			ObjectReference: v1.ObjectReference{
+			ObjectReference: corev1.ObjectReference{
 				APIVersion: gvk.GroupVersion().String(),
 				Kind:       gvk.Kind,
 				Name:       rsc.GetName(),
@@ -207,9 +262,24 @@ func (in *ResourceTracker) AddManagedResource(rsc client.Object, metaOnly bool)
 		OAMObjectReference: common.NewOAMObjectReferenceFromObject(rsc),
 		Deleted:            false,
 	}
+}
+
+// ContainsManagedResource check if resource exists in ResourceTracker
+func (in *ResourceTracker) ContainsManagedResource(rsc client.Object) bool {
+	mr := newManagedResourceFromResource(rsc)
+	return in.findMangedResourceIndex(mr) >= 0
+}
+
+// AddManagedResource add object to managed resources, if exists, update
+func (in *ResourceTracker) AddManagedResource(rsc client.Object, metaOnly bool, skipGC bool, creator string) (updated bool) {
+	mr := newManagedResourceFromResource(rsc)
+	mr.SkipGC = skipGC
 	if !metaOnly {
 		mr.Data = &runtime.RawExtension{Object: rsc}
 	}
+	if creator != "" {
+		mr.ClusterObjectReference.Creator = creator
+	}
 	if idx := in.findMangedResourceIndex(mr); idx >= 0 {
 		if reflect.DeepEqual(in.Spec.ManagedResources[idx], mr) {
 			return false
@@ -229,7 +299,7 @@ func (in *ResourceTracker) DeleteManagedResource(rsc client.Object, remove bool)
 	gvk := rsc.GetObjectKind().GroupVersionKind()
 	mr := ManagedResource{
 		ClusterObjectReference: common.ClusterObjectReference{
-			ObjectReference: v1.ObjectReference{
+			ObjectReference: corev1.ObjectReference{
 				APIVersion: gvk.GroupVersion().String(),
 				Kind:       gvk.Kind,
 				Name:       rsc.GetName(),
@@ -272,7 +342,7 @@ func (in *ResourceTracker) addClusterObjectReference(ref common.ClusterObjectRef
 // Deprecated
 func (in *ResourceTracker) AddTrackedResource(rsc interfaces.TrackableResource) bool {
 	return in.addClusterObjectReference(common.ClusterObjectReference{
-		ObjectReference: v1.ObjectReference{
+		ObjectReference: corev1.ObjectReference{
 			APIVersion: rsc.GetAPIVersion(),
 			Kind:       rsc.GetKind(),
 			Name:       rsc.GetName(),

apis/core.oam.dev/v1beta1/resourcetracker_types_test.go

@@ -18,12 +18,17 @@ package v1beta1
 
 import (
 	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
 	"testing"
+	"time"
 
+	"github.com/kubevela/pkg/util/compression"
 	"github.com/stretchr/testify/require"
-	v12 "k8s.io/api/apps/v1"
-	v1 "k8s.io/api/core/v1"
-	v13 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/utils/pointer"
@@ -111,10 +116,10 @@ func TestManagedResourceKeys(t *testing.T) {
 	input := ManagedResource{
 		ClusterObjectReference: common.ClusterObjectReference{
 			Cluster: "cluster",
-			ObjectReference: v1.ObjectReference{
+			ObjectReference: corev1.ObjectReference{
 				Namespace:  "namespace",
 				Name:       "name",
-				APIVersion: v12.SchemeGroupVersion.String(),
+				APIVersion: appsv1.SchemeGroupVersion.String(),
 				Kind:       "Deployment",
 			},
 		},
@@ -125,10 +130,10 @@ func TestManagedResourceKeys(t *testing.T) {
 		},
 	}
 	r.Equal("namespace/name", input.NamespacedName().String())
-	r.Equal("apps/v1/Deployment/cluster/namespace/name", input.ResourceKey())
+	r.Equal("apps/Deployment/cluster/namespace/name", input.ResourceKey())
 	r.Equal("env/component", input.ComponentKey())
 	r.Equal("Deployment name (Cluster: cluster, Namespace: namespace)", input.DisplayName())
-	var deploy1, deploy2 v12.Deployment
+	var deploy1, deploy2 appsv1.Deployment
 	deploy1.Spec.Replicas = pointer.Int32(5)
 	bs, err := json.Marshal(deploy1)
 	r.NoError(err)
@@ -155,17 +160,17 @@ func TestManagedResourceKeys(t *testing.T) {
 func TestResourceTracker_ManagedResource(t *testing.T) {
 	r := require.New(t)
 	input := &ResourceTracker{}
-	deploy1 := v12.Deployment{ObjectMeta: v13.ObjectMeta{Name: "deploy1"}}
-	input.AddManagedResource(&deploy1, true)
+	deploy1 := appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: "deploy1"}}
+	input.AddManagedResource(&deploy1, true, false, "")
 	r.Equal(1, len(input.Spec.ManagedResources))
-	cm2 := v1.ConfigMap{ObjectMeta: v13.ObjectMeta{Name: "cm2"}}
-	input.AddManagedResource(&cm2, false)
+	cm2 := corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: "cm2"}}
+	input.AddManagedResource(&cm2, false, false, "")
 	r.Equal(2, len(input.Spec.ManagedResources))
-	pod3 := v1.Pod{ObjectMeta: v13.ObjectMeta{Name: "pod3"}}
-	input.AddManagedResource(&pod3, false)
+	pod3 := corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "pod3"}}
+	input.AddManagedResource(&pod3, false, false, "")
 	r.Equal(3, len(input.Spec.ManagedResources))
 	deploy1.Spec.Replicas = pointer.Int32(5)
-	input.AddManagedResource(&deploy1, false)
+	input.AddManagedResource(&deploy1, false, false, "")
 	r.Equal(3, len(input.Spec.ManagedResources))
 	input.DeleteManagedResource(&cm2, false)
 	r.Equal(3, len(input.Spec.ManagedResources))
@@ -176,9 +181,170 @@ func TestResourceTracker_ManagedResource(t *testing.T) {
 	r.Equal(1, len(input.Spec.ManagedResources))
 	input.DeleteManagedResource(&pod3, true)
 	r.Equal(0, len(input.Spec.ManagedResources))
-	secret4 := v1.Secret{ObjectMeta: v13.ObjectMeta{Name: "secret4"}}
+	secret4 := corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "secret4"}}
 	input.DeleteManagedResource(&secret4, true)
 	r.Equal(0, len(input.Spec.ManagedResources))
 	input.DeleteManagedResource(&secret4, false)
 	r.Equal(1, len(input.Spec.ManagedResources))
 }
+
+func TestResourceTrackerCompression(t *testing.T) {
+	count := 20
+	r := require.New(t)
+
+	// Load some real CRDs, and other test data to simulate real use-cases.
+	// The user must have some large resourcetrackers if they use compression,
+	// so we load some large CRDs.
+	var data []string
+	paths := []string{
+		"../../../charts/vela-core/crds/core.oam.dev_applicationrevisions.yaml",
+		"../../../charts/vela-core/crds/core.oam.dev_applications.yaml",
+		"../../../charts/vela-core/crds/core.oam.dev_definitionrevisions.yaml",
+		"../../../charts/vela-core/crds/core.oam.dev_healthscopes.yaml",
+		"../../../charts/vela-core/crds/core.oam.dev_traitdefinitions.yaml",
+		"../../../charts/vela-core/crds/core.oam.dev_componentdefinitions.yaml",
+		"../../../charts/vela-core/crds/core.oam.dev_workloaddefinitions.yaml",
+		"../../../charts/vela-core/crds/standard.oam.dev_rollouts.yaml",
+		"../../../charts/vela-core/templates/kubevela-controller.yaml",
+		"../../../charts/vela-core/README.md",
+		"../../../pkg/velaql/providers/query/testdata/machinelearning.seldon.io_seldondeployments.yaml",
+		"../../../legacy/charts/vela-core-legacy/crds/standard.oam.dev_podspecworkloads.yaml",
+	}
+	for _, p := range paths {
+		b, err := os.ReadFile(p)
+		r.NoError(err)
+		data = append(data, string(b))
+	}
+	size := len(data)
+
+	// Gzip
+	var (
+		gzipCompressTime int64
+		gzipSize         int
+		gzipBs           []byte
+	)
+	for c := 0; c < count; c++ {
+		var err error
+		rtGzip := &ResourceTracker{}
+		for i := 0; i < size; i++ {
+			rtGzip.AddManagedResource(&corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: fmt.Sprintf("cm%d", i)}, Data: map[string]string{"1": data[i]}}, false, false, "")
+			rtGzip.AddManagedResource(&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: fmt.Sprintf("secret%d", i)}}, true, false, "")
+		}
+		rtGzip.Spec.Compression.Type = compression.Gzip
+		// Compress
+		t0 := time.Now()
+		gzipBs, err = json.Marshal(rtGzip)
+		elapsed := time.Since(t0).Nanoseconds()
+		if gzipCompressTime == 0 {
+			gzipCompressTime = elapsed
+		} else {
+			gzipCompressTime = (elapsed + gzipCompressTime) / 2
+		}
+		if gzipSize == 0 {
+			gzipSize = len(gzipBs)
+		} else {
+			gzipSize = (len(gzipBs) + gzipSize) / 2
+		}
+		r.NoError(err)
+		r.Contains(string(gzipBs), `"type":"gzip","data":`)
+	}
+
+	// Zstd
+	var (
+		zstdCompressTime int64
+		zstdSize         int
+		zstdBs           []byte
+	)
+	for c := 0; c < count; c++ {
+		var err error
+		rtZstd := &ResourceTracker{}
+		for i := 0; i < size; i++ {
+			rtZstd.AddManagedResource(&corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: fmt.Sprintf("cm%d", i)}, Data: map[string]string{"1": data[i]}}, false, false, "")
+			rtZstd.AddManagedResource(&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: fmt.Sprintf("secret%d", i)}}, true, false, "")
+		}
+		rtZstd.Spec.Compression.Type = compression.Zstd
+		t0 := time.Now()
+		zstdBs, err = json.Marshal(rtZstd)
+		elapsed := time.Since(t0).Nanoseconds()
+		if zstdCompressTime == 0 {
+			zstdCompressTime = elapsed
+		} else {
+			zstdCompressTime = (elapsed + zstdCompressTime) / 2
+		}
+		if zstdSize == 0 {
+			zstdSize = len(zstdBs)
+		} else {
+			zstdSize = (len(zstdBs) + zstdSize) / 2
+		}
+		r.NoError(err)
+		r.Contains(string(zstdBs), `"type":"zstd","data":`)
+	}
+
+	rtUncmp := &ResourceTracker{}
+	r.NoError(json.Unmarshal(gzipBs, rtUncmp))
+	r.Equal(size*2, len(rtUncmp.Spec.ManagedResources))
+	for i, rsc := range rtUncmp.Spec.ManagedResources {
+		r.Equal(i%2 == 1, rsc.Data == nil)
+	}
+	r.NoError(json.Unmarshal(zstdBs, rtUncmp))
+	r.Equal(size*2, len(rtUncmp.Spec.ManagedResources))
+	for i, rsc := range rtUncmp.Spec.ManagedResources {
+		r.Equal(i%2 == 1, rsc.Data == nil)
+	}
+	// No compression
+	var (
+		uncmpTime int64
+		uncmpSize int
+	)
+	rtUncmp.Spec.Compression.Type = compression.Uncompressed
+	for c := 0; c < count; c++ {
+		t0 := time.Now()
+		_bs, err := json.Marshal(rtUncmp)
+		if uncmpTime == 0 {
+			uncmpTime = time.Since(t0).Nanoseconds()
+		} else {
+			uncmpTime = (time.Since(t0).Nanoseconds() + uncmpTime) / 2
+		}
+		if uncmpSize == 0 {
+			uncmpSize = len(_bs)
+		} else {
+			uncmpSize = (len(_bs) + uncmpSize) / 2
+		}
+		r.NoError(err)
+		before, after := len(_bs), len(zstdBs)
+		r.Less(after, before)
+		before, after = len(_bs), len(gzipBs)
+		r.Less(after, before)
+	}
+
+	fmt.Printf(`Compressed Size:
+  uncompressed: %d bytes	100.00%%
+  gzip:         %d bytes	%.2f%%
+  zstd:         %d bytes	%.2f%%
+`,
+		uncmpSize,
+		gzipSize, float64(gzipSize)*100.0/float64(uncmpSize),
+		zstdSize, float64(zstdSize)*100.0/float64(uncmpSize))
+
+	fmt.Printf(`Marshal Time:
+  no compression: %d ns	1.00x
+  gzip:           %d ns	%.2fx
+  zstd:           %d ns	%.2fx
+`,
+		uncmpTime,
+		gzipCompressTime, float64(gzipCompressTime)/float64(uncmpTime),
+		zstdCompressTime, float64(zstdCompressTime)/float64(uncmpTime),
+	)
+}
+
+func TestResourceTrackerInvalidMarshal(t *testing.T) {
+	r := require.New(t)
+	rt := &ResourceTracker{}
+	rt.Spec.Compression.Type = "invalid"
+	_, err := json.Marshal(rt)
+	r.ErrorIs(err, compression.NewUnsupportedCompressionTypeError("invalid"))
+	r.True(strings.Contains(err.Error(), "invalid"))
+	r.ErrorIs(json.Unmarshal([]byte(`{"spec":{"compression":{"type":"invalid"}}}`), rt), compression.NewUnsupportedCompressionTypeError("invalid"))
+	r.NotNil(json.Unmarshal([]byte(`{"spec":{"compression":{"type":"gzip","data":"xxx"}}}`), rt))
+	r.NotNil(json.Unmarshal([]byte(`{"spec":["invalid"]}`), rt))
+}

apis/core.oam.dev/v1beta1/workflow_step_definition.go

@@ -29,7 +29,8 @@ type WorkflowStepDefinitionSpec struct {
 	// Reference to the CustomResourceDefinition that defines this trait kind.
 	Reference common.DefinitionReference `json:"definitionRef,omitempty"`
 
-	// Schematic defines the data format and template of the encapsulation of the workflow step definition
+	// Schematic defines the data format and template of the encapsulation of the workflow step definition.
+	// Only CUE schematic is supported for now.
 	// +optional
 	Schematic *common.Schematic `json:"schematic,omitempty"`
 }

apis/core.oam.dev/v1beta1/zz_generated.deepcopy.go

@@ -22,11 +22,12 @@ limitations under the License.
 package v1beta1
 
 import (
+	"github.com/kubevela/workflow/api/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
-	"github.com/oam-dev/kubevela/apis/core.oam.dev/v1alpha1"
+	core_oam_devv1alpha1 "github.com/oam-dev/kubevela/apis/core.oam.dev/v1alpha1"
 )
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
@@ -136,39 +137,7 @@ func (in *ApplicationRevision) DeepCopyObject() runtime.Object {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ApplicationRevisionList) DeepCopyInto(out *ApplicationRevisionList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]ApplicationRevision, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationRevisionList.
-func (in *ApplicationRevisionList) DeepCopy() *ApplicationRevisionList {
-	if in == nil {
-		return nil
-	}
-	out := new(ApplicationRevisionList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *ApplicationRevisionList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ApplicationRevisionSpec) DeepCopyInto(out *ApplicationRevisionSpec) {
+func (in *ApplicationRevisionCompressibleFields) DeepCopyInto(out *ApplicationRevisionCompressibleFields) {
 	*out = *in
 	in.Application.DeepCopyInto(&out.Application)
 	if in.ComponentDefinitions != nil {
@@ -222,7 +191,7 @@ func (in *ApplicationRevisionSpec) DeepCopyInto(out *ApplicationRevisionSpec) {
 	}
 	if in.Policies != nil {
 		in, out := &in.Policies, &out.Policies
-		*out = make(map[string]v1alpha1.Policy, len(*in))
+		*out = make(map[string]core_oam_devv1alpha1.Policy, len(*in))
 		for key, val := range *in {
 			(*out)[key] = *val.DeepCopy()
 		}
@@ -241,6 +210,71 @@ func (in *ApplicationRevisionSpec) DeepCopyInto(out *ApplicationRevisionSpec) {
 	}
 }
 
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationRevisionCompressibleFields.
+func (in *ApplicationRevisionCompressibleFields) DeepCopy() *ApplicationRevisionCompressibleFields {
+	if in == nil {
+		return nil
+	}
+	out := new(ApplicationRevisionCompressibleFields)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ApplicationRevisionCompression) DeepCopyInto(out *ApplicationRevisionCompression) {
+	*out = *in
+	out.CompressedText = in.CompressedText
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationRevisionCompression.
+func (in *ApplicationRevisionCompression) DeepCopy() *ApplicationRevisionCompression {
+	if in == nil {
+		return nil
+	}
+	out := new(ApplicationRevisionCompression)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ApplicationRevisionList) DeepCopyInto(out *ApplicationRevisionList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ApplicationRevision, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationRevisionList.
+func (in *ApplicationRevisionList) DeepCopy() *ApplicationRevisionList {
+	if in == nil {
+		return nil
+	}
+	out := new(ApplicationRevisionList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ApplicationRevisionList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ApplicationRevisionSpec) DeepCopyInto(out *ApplicationRevisionSpec) {
+	*out = *in
+	in.ApplicationRevisionCompressibleFields.DeepCopyInto(&out.ApplicationRevisionCompressibleFields)
+	out.Compression = in.Compression
+}
+
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationRevisionSpec.
 func (in *ApplicationRevisionSpec) DeepCopy() *ApplicationRevisionSpec {
 	if in == nil {
@@ -259,6 +293,13 @@ func (in *ApplicationRevisionStatus) DeepCopyInto(out *ApplicationRevisionStatus
 		*out = new(common.WorkflowStatus)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.WorkflowContext != nil {
+		in, out := &in.WorkflowContext, &out.WorkflowContext
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationRevisionStatus.
@@ -650,6 +691,22 @@ func (in *ResourceTracker) DeepCopyObject() runtime.Object {
 	return nil
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ResourceTrackerCompression) DeepCopyInto(out *ResourceTrackerCompression) {
+	*out = *in
+	out.CompressedText = in.CompressedText
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceTrackerCompression.
+func (in *ResourceTrackerCompression) DeepCopy() *ResourceTrackerCompression {
+	if in == nil {
+		return nil
+	}
+	out := new(ResourceTrackerCompression)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ResourceTrackerList) DeepCopyInto(out *ResourceTrackerList) {
 	*out = *in
@@ -692,6 +749,7 @@ func (in *ResourceTrackerSpec) DeepCopyInto(out *ResourceTrackerSpec) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	out.Compression = in.Compression
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceTrackerSpec.
@@ -927,9 +985,14 @@ func (in *TraitDefinitionStatus) DeepCopy() *TraitDefinitionStatus {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Workflow) DeepCopyInto(out *Workflow) {
 	*out = *in
+	if in.Mode != nil {
+		in, out := &in.Mode, &out.Mode
+		*out = new(v1alpha1.WorkflowExecuteMode)
+		**out = **in
+	}
 	if in.Steps != nil {
 		in, out := &in.Steps, &out.Steps
-		*out = make([]WorkflowStep, len(*in))
+		*out = make([]v1alpha1.WorkflowStep, len(*in))
 		for i := range *in {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
@@ -946,41 +1009,6 @@ func (in *Workflow) DeepCopy() *Workflow {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *WorkflowStep) DeepCopyInto(out *WorkflowStep) {
-	*out = *in
-	if in.Properties != nil {
-		in, out := &in.Properties, &out.Properties
-		*out = new(runtime.RawExtension)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.DependsOn != nil {
-		in, out := &in.DependsOn, &out.DependsOn
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.Inputs != nil {
-		in, out := &in.Inputs, &out.Inputs
-		*out = make(common.StepInputs, len(*in))
-		copy(*out, *in)
-	}
-	if in.Outputs != nil {
-		in, out := &in.Outputs, &out.Outputs
-		*out = make(common.StepOutputs, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkflowStep.
-func (in *WorkflowStep) DeepCopy() *WorkflowStep {
-	if in == nil {
-		return nil
-	}
-	out := new(WorkflowStep)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *WorkflowStepDefinition) DeepCopyInto(out *WorkflowStepDefinition) {
 	*out = *in

apis/types/capability.go

@@ -80,6 +80,8 @@ const (
 	OpenapiV3JSONSchema string = "openapi-v3-json-schema"
 	// UISchema is the key to store ui custom schema
 	UISchema string = "ui-schema"
+	// VelaQLConfigmapKey is the key to store velaql view
+	VelaQLConfigmapKey string = "template"
 )
 
 // CapabilityCategory defines the category of a capability
@@ -163,6 +165,7 @@ type Capability struct {
 	Center         string             `json:"center,omitempty"`
 	Status         string             `json:"status,omitempty"`
 	Description    string             `json:"description,omitempty"`
+	Example        string             `json:"example,omitempty"`
 	Labels         map[string]string  `json:"labels,omitempty"`
 	Category       CapabilityCategory `json:"category,omitempty"`
 

apis/types/componentmanifest.go

@@ -28,9 +28,11 @@ type ComponentManifest struct {
 	RevisionName     string
 	RevisionHash     string
 	ExternalRevision string
+	// StandardWorkload contains K8s resource generated from "output" block of ComponentDefinition
 	StandardWorkload *unstructured.Unstructured
-	Traits           []*unstructured.Unstructured
-	Scopes           []*corev1.ObjectReference
+	// Traits contains both resources generated from "outputs" block of ComponentDefinition and resources generated from TraitDefinition
+	Traits []*unstructured.Unstructured
+	Scopes []*corev1.ObjectReference
 
 	// PackagedWorkloadResources contain all the workload related resources. It could be a Helm
 	// Release, Git Repo or anything that can package and run a workload.

apis/types/multicluster.go

@@ -39,4 +39,18 @@ const (
 var (
 	// AnnotationClusterAlias the annotation key for cluster alias
 	AnnotationClusterAlias = config.MetaApiGroupName + "/cluster-alias"
+
+	// AnnotationClusterVersion the annotation key for cluster version
+	AnnotationClusterVersion = config.MetaApiGroupName + "/cluster-version"
 )
+
+// ClusterVersion defines the Version info of managed clusters.
+type ClusterVersion struct {
+	Major      string `json:"major"`
+	Minor      string `json:"minor"`
+	GitVersion string `json:"gitVersion,omitempty"`
+	Platform   string `json:"platform,omitempty"`
+}
+
+// ControlPlaneClusterVersion will be the default value of cluster info if managed cluster version get error, it will have value when vela-core started.
+var ControlPlaneClusterVersion ClusterVersion

apis/types/types.go

@@ -18,6 +18,13 @@ package types
 
 import "github.com/oam-dev/kubevela/pkg/oam"
 
+const (
+	// KubeVelaName name of kubevela
+	KubeVelaName = "kubevela"
+	// VelaCoreName name of vela-core
+	VelaCoreName = "vela-core"
+)
+
 const (
 	// DefaultKubeVelaReleaseName defines the default name of KubeVela Release
 	DefaultKubeVelaReleaseName = "kubevela"
@@ -41,6 +48,10 @@ var DefaultKubeVelaNS = "vela-system"
 const (
 	// AnnoDefinitionDescription is the annotation which describe what is the capability used for in a WorkloadDefinition/TraitDefinition Object
 	AnnoDefinitionDescription = "definition.oam.dev/description"
+	// AnnoDefinitionExampleURL is the annotation which describe url of usage examples of the capability, it will be loaded in documentation generate.
+	AnnoDefinitionExampleURL = "definition.oam.dev/example-url"
+	// AnnoDefinitionAlias is the annotation for definition alias
+	AnnoDefinitionAlias = "definition.oam.dev/alias"
 	// AnnoDefinitionIcon is the annotation which describe the icon url
 	AnnoDefinitionIcon = "definition.oam.dev/icon"
 	// AnnoDefinitionAppliedWorkloads is the annotation which describe what is the workloads used for in a TraitDefinition Object
@@ -53,6 +64,8 @@ const (
 	LabelDefinitionDeprecated = "custom.definition.oam.dev/deprecated"
 	// LabelDefinitionHidden is the label which describe whether the capability is hidden by UI
 	LabelDefinitionHidden = "custom.definition.oam.dev/ui-hidden"
+	// LabelDefinitionScope is the label which describe whether the capability's scope
+	LabelDefinitionScope = "custom.definition.oam.dev/scope"
 	// LabelNodeRoleGateway gateway role of node
 	LabelNodeRoleGateway = "node-role.kubernetes.io/gateway"
 	// LabelNodeRoleWorker worker role of node
@@ -61,9 +74,11 @@ const (
 	AnnoIngressControllerHTTPSPort = "ingress.controller/https-port"
 	// AnnoIngressControllerHTTPPort define ingress controller listen port for http
 	AnnoIngressControllerHTTPPort = "ingress.controller/http-port"
-	// LabelConfigType is the label for config type
+	// AnnoIngressControllerHost define ingress controller externally host
+	AnnoIngressControllerHost = "ingress.controller/host"
+	// LabelConfigType is the label marked as the template that generated the config.
 	LabelConfigType = "config.oam.dev/type"
-	// LabelConfigCatalog is the label for config catalog
+	// LabelConfigCatalog is the label marked as the secret generated from the config.
 	LabelConfigCatalog = "config.oam.dev/catalog"
 	// LabelConfigSubType is the sub-type for a config type
 	LabelConfigSubType = "config.oam.dev/sub-type"
@@ -73,10 +88,18 @@ const (
 	LabelConfigSyncToMultiCluster = "config.oam.dev/multi-cluster"
 	// LabelConfigIdentifier is the label for config identifier
 	LabelConfigIdentifier = "config.oam.dev/identifier"
+	// LabelConfigScope is the label for config scope
+	LabelConfigScope = "config.oam.dev/scope"
+	// AnnotationConfigSensitive is the annotation for the sensitization
+	AnnotationConfigSensitive = "config.oam.dev/sensitive"
+	// AnnotationConfigTemplateNamespace is the annotation for the template namespace
+	AnnotationConfigTemplateNamespace = "config.oam.dev/template-namespace"
 	// AnnotationConfigDescription is the annotation for config description
 	AnnotationConfigDescription = "config.oam.dev/description"
 	// AnnotationConfigAlias is the annotation for config alias
 	AnnotationConfigAlias = "config.oam.dev/alias"
+	// AnnotationConfigDistributionSpec is the annotation key of the application that distributes the configs
+	AnnotationConfigDistributionSpec = "config.oam.dev/distribution-spec"
 )
 
 const (
@@ -93,6 +116,7 @@ type Config map[string]string
 type EnvMeta struct {
 	Name      string `json:"name"`
 	Namespace string `json:"namespace"`
+	Labels    string `json:"labels"`
 	Current   string `json:"current"`
 }
 
@@ -142,11 +166,13 @@ const (
 	// TerraformProvider is the config type for terraform provider
 	TerraformProvider = "terraform-provider"
 	// DexConnector is the config type for dex connector
-	DexConnector = "config-dex-connector"
+	DexConnector = "dex-connector"
 	// ImageRegistry is the config type for image registry
-	ImageRegistry = "config-image-registry"
+	ImageRegistry = "image-registry"
 	// HelmRepository is the config type for Helm chart repository
-	HelmRepository = "config-helm-repository"
+	HelmRepository = "helm-repository"
+	// CatalogConfigDistribution is the catalog type
+	CatalogConfigDistribution = "config-distribution"
 )
 
 const (

charts/oam-runtime/Chart.yaml

@@ -1,21 +0,0 @@
-apiVersion: v2
-name: oam-runtime
-description: A Helm chart for oam-runtime aligns with OAM spec v0.2
-
-# A chart can be either an 'application' or a 'library' chart.
-#
-# Application charts are a collection of templates that can be packaged into versioned archives
-# to be deployed.
-#
-# Library charts provide useful utilities or functions for the chart developer. They're included as
-# a dependency of application charts to inject those utilities and functions into the rendering
-# pipeline. Library charts do not define any templates and therefore cannot be deployed.
-type: application
-
-# This is the chart version. This version number should be incremented each time you make changes
-# to the chart and its templates, including the app version.
-version: 0.1.0
-
-# This is the version number of the application being deployed. This version number should be
-# incremented each time you make changes to the application.
-appVersion: 0.1.0

charts/oam-runtime/crds/core.oam.dev_components.yaml

@@ -1,178 +0,0 @@
-
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.6.2
-  name: components.core.oam.dev
-spec:
-  group: core.oam.dev
-  names:
-    categories:
-    - oam
-    kind: Component
-    listKind: ComponentList
-    plural: components
-    singular: component
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.workload.kind
-      name: WORKLOAD-KIND
-      type: string
-    - jsonPath: .metadata.creationTimestamp
-      name: age
-      type: date
-    name: v1alpha2
-    schema:
-      openAPIV3Schema:
-        description: A Component describes how an OAM workload kind may be instantiated.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: A ComponentSpec defines the desired state of a Component.
-            properties:
-              helm:
-                description: HelmRelease records a Helm release used by a Helm module
-                  workload.
-                properties:
-                  release:
-                    description: Release records a Helm release used by a Helm module
-                      workload.
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  repository:
-                    description: HelmRelease records a Helm repository used by a Helm
-                      module workload.
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                required:
-                - release
-                - repository
-                type: object
-              parameters:
-                description: Parameters exposed by this component. ApplicationConfigurations
-                  that reference this component may specify values for these parameters,
-                  which will in turn be injected into the embedded workload.
-                items:
-                  description: A ComponentParameter defines a configurable parameter
-                    of a component.
-                  properties:
-                    description:
-                      description: Description of this parameter.
-                      type: string
-                    fieldPaths:
-                      description: FieldPaths specifies an array of fields within
-                        this Component's workload that will be overwritten by the
-                        value of this parameter. The type of the parameter (e.g. int,
-                        string) is inferred from the type of these fields; All fields
-                        must be of the same type. Fields are specified as JSON field
-                        paths without a leading dot, for example 'spec.replicas'.
-                      items:
-                        type: string
-                      type: array
-                    name:
-                      description: Name of this parameter. OAM ApplicationConfigurations
-                        will specify parameter values using this name.
-                      type: string
-                    required:
-                      default: false
-                      description: Required specifies whether or not a value for this
-                        parameter must be supplied when authoring an ApplicationConfiguration.
-                      type: boolean
-                  required:
-                  - fieldPaths
-                  - name
-                  type: object
-                type: array
-              workload:
-                description: A Workload that will be created for each ApplicationConfiguration
-                  that includes this Component. Workload is an instance of a workloadDefinition.
-                  We either use the GVK info or a special "type" field in the workload
-                  to associate the content of the workload with its workloadDefinition
-                type: object
-                x-kubernetes-embedded-resource: true
-                x-kubernetes-preserve-unknown-fields: true
-            required:
-            - workload
-            type: object
-          status:
-            description: A ComponentStatus represents the observed state of a Component.
-            properties:
-              conditions:
-                description: Conditions of the resource.
-                items:
-                  description: A Condition that may apply to a resource.
-                  properties:
-                    lastTransitionTime:
-                      description: LastTransitionTime is the last time this condition
-                        transitioned from one status to another.
-                      format: date-time
-                      type: string
-                    message:
-                      description: A Message containing details about this condition's
-                        last transition from one status to another, if any.
-                      type: string
-                    reason:
-                      description: A Reason for this condition's last transition from
-                        one status to another.
-                      type: string
-                    status:
-                      description: Status of this condition; is it currently True,
-                        False, or Unknown?
-                      type: string
-                    type:
-                      description: Type of this condition. At most one of each condition
-                        type may apply to a resource at any point in time.
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-              latestRevision:
-                description: LatestRevision of component
-                properties:
-                  name:
-                    type: string
-                  revision:
-                    format: int64
-                    type: integer
-                  revisionHash:
-                    description: RevisionHash record the hash value of the spec of
-                      ApplicationRevision object.
-                    type: string
-                required:
-                - name
-                - revision
-                type: object
-              observedGeneration:
-                description: The generation observed by the component controller.
-                format: int64
-                type: integer
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

charts/oam-runtime/crds/core.oam.dev_healthscopes.yaml

@@ -1,590 +0,0 @@
-
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.6.2
-  name: healthscopes.core.oam.dev
-spec:
-  group: core.oam.dev
-  names:
-    categories:
-    - oam
-    kind: HealthScope
-    listKind: HealthScopeList
-    plural: healthscopes
-    singular: healthscope
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .status.health
-      name: HEALTH
-      type: string
-    name: v1alpha2
-    schema:
-      openAPIV3Schema:
-        description: A HealthScope determines an aggregate health status based of
-          the health of components.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: A HealthScopeSpec defines the desired state of a HealthScope.
-            properties:
-              appReferences:
-                description: AppRefs records references of applications' components
-                items:
-                  description: AppReference records references of an application's
-                    components
-                  properties:
-                    appName:
-                      type: string
-                    compReferences:
-                      items:
-                        description: CompReference records references of a component's
-                          resources
-                        properties:
-                          compName:
-                            type: string
-                          traits:
-                            items:
-                              description: 'ObjectReference contains enough information
-                                to let you inspect or modify the referred object.
-                                --- New uses of this type are discouraged because
-                                of difficulty describing its usage when embedded in
-                                APIs.  1. Ignored fields.  It includes many fields
-                                which are not generally honored.  For instance, ResourceVersion
-                                and FieldPath are both very rarely valid in actual
-                                usage.  2. Invalid usage help.  It is impossible to
-                                add specific help for individual usage.  In most embedded
-                                usages, there are particular     restrictions like,
-                                "must refer only to types A and B" or "UID not honored"
-                                or "name must be restricted".     Those cannot be
-                                well described when embedded.  3. Inconsistent validation.  Because
-                                the usages are different, the validation rules are
-                                different by usage, which makes it hard for users
-                                to predict what will happen.  4. The fields are both
-                                imprecise and overly precise.  Kind is not a precise
-                                mapping to a URL. This can produce ambiguity     during
-                                interpretation and require a REST mapping.  In most
-                                cases, the dependency is on the group,resource tuple     and
-                                the version of the actual struct is irrelevant.  5.
-                                We cannot easily change it.  Because this type is
-                                embedded in many locations, updates to this type     will
-                                affect numerous schemas.  Don''t make new APIs embed
-                                an underspecified API type they do not control. Instead
-                                of using this type, create a locally provided and
-                                used type that is well-focused on your reference.
-                                For example, ServiceReferences for admission registration:
-                                https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
-                                .'
-                              properties:
-                                apiVersion:
-                                  description: API version of the referent.
-                                  type: string
-                                fieldPath:
-                                  description: 'If referring to a piece of an object
-                                    instead of an entire object, this string should
-                                    contain a valid JSON/Go field access statement,
-                                    such as desiredState.manifest.containers[2]. For
-                                    example, if the object reference is to a container
-                                    within a pod, this would take on a value like:
-                                    "spec.containers{name}" (where "name" refers to
-                                    the name of the container that triggered the event)
-                                    or if no container name is specified "spec.containers[2]"
-                                    (container with index 2 in this pod). This syntax
-                                    is chosen only to have some well-defined way of
-                                    referencing a part of an object. TODO: this design
-                                    is not final and this field is subject to change
-                                    in the future.'
-                                  type: string
-                                kind:
-                                  description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-                                  type: string
-                                name:
-                                  description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
-                                  type: string
-                                namespace:
-                                  description: 'Namespace of the referent. More info:
-                                    https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
-                                  type: string
-                                resourceVersion:
-                                  description: 'Specific resourceVersion to which
-                                    this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
-                                  type: string
-                                uid:
-                                  description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
-                                  type: string
-                              type: object
-                            type: array
-                          workload:
-                            description: 'ObjectReference contains enough information
-                              to let you inspect or modify the referred object. ---
-                              New uses of this type are discouraged because of difficulty
-                              describing its usage when embedded in APIs.  1. Ignored
-                              fields.  It includes many fields which are not generally
-                              honored.  For instance, ResourceVersion and FieldPath
-                              are both very rarely valid in actual usage.  2. Invalid
-                              usage help.  It is impossible to add specific help for
-                              individual usage.  In most embedded usages, there are
-                              particular     restrictions like, "must refer only to
-                              types A and B" or "UID not honored" or "name must be
-                              restricted".     Those cannot be well described when
-                              embedded.  3. Inconsistent validation.  Because the
-                              usages are different, the validation rules are different
-                              by usage, which makes it hard for users to predict what
-                              will happen.  4. The fields are both imprecise and overly
-                              precise.  Kind is not a precise mapping to a URL. This
-                              can produce ambiguity     during interpretation and
-                              require a REST mapping.  In most cases, the dependency
-                              is on the group,resource tuple     and the version of
-                              the actual struct is irrelevant.  5. We cannot easily
-                              change it.  Because this type is embedded in many locations,
-                              updates to this type     will affect numerous schemas.  Don''t
-                              make new APIs embed an underspecified API type they
-                              do not control. Instead of using this type, create a
-                              locally provided and used type that is well-focused
-                              on your reference. For example, ServiceReferences for
-                              admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
-                              .'
-                            properties:
-                              apiVersion:
-                                description: API version of the referent.
-                                type: string
-                              fieldPath:
-                                description: 'If referring to a piece of an object
-                                  instead of an entire object, this string should
-                                  contain a valid JSON/Go field access statement,
-                                  such as desiredState.manifest.containers[2]. For
-                                  example, if the object reference is to a container
-                                  within a pod, this would take on a value like: "spec.containers{name}"
-                                  (where "name" refers to the name of the container
-                                  that triggered the event) or if no container name
-                                  is specified "spec.containers[2]" (container with
-                                  index 2 in this pod). This syntax is chosen only
-                                  to have some well-defined way of referencing a part
-                                  of an object. TODO: this design is not final and
-                                  this field is subject to change in the future.'
-                                type: string
-                              kind:
-                                description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-                                type: string
-                              name:
-                                description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
-                                type: string
-                              namespace:
-                                description: 'Namespace of the referent. More info:
-                                  https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
-                                type: string
-                              resourceVersion:
-                                description: 'Specific resourceVersion to which this
-                                  reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
-                                type: string
-                              uid:
-                                description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
-                                type: string
-                            type: object
-                        type: object
-                      type: array
-                  type: object
-                type: array
-              probe-interval:
-                description: ProbeInterval is the amount of time in seconds between
-                  probing tries.
-                format: int32
-                type: integer
-              probe-timeout:
-                description: ProbeTimeout is the amount of time in seconds to wait
-                  when receiving a response before marked failure.
-                format: int32
-                type: integer
-              workloadRefs:
-                description: WorkloadReferences to the workloads that are in this
-                  scope.
-                items:
-                  description: 'ObjectReference contains enough information to let
-                    you inspect or modify the referred object. --- New uses of this
-                    type are discouraged because of difficulty describing its usage
-                    when embedded in APIs.  1. Ignored fields.  It includes many fields
-                    which are not generally honored.  For instance, ResourceVersion
-                    and FieldPath are both very rarely valid in actual usage.  2.
-                    Invalid usage help.  It is impossible to add specific help for
-                    individual usage.  In most embedded usages, there are particular     restrictions
-                    like, "must refer only to types A and B" or "UID not honored"
-                    or "name must be restricted".     Those cannot be well described
-                    when embedded.  3. Inconsistent validation.  Because the usages
-                    are different, the validation rules are different by usage, which
-                    makes it hard for users to predict what will happen.  4. The fields
-                    are both imprecise and overly precise.  Kind is not a precise
-                    mapping to a URL. This can produce ambiguity     during interpretation
-                    and require a REST mapping.  In most cases, the dependency is
-                    on the group,resource tuple     and the version of the actual
-                    struct is irrelevant.  5. We cannot easily change it.  Because
-                    this type is embedded in many locations, updates to this type     will
-                    affect numerous schemas.  Don''t make new APIs embed an underspecified
-                    API type they do not control. Instead of using this type, create
-                    a locally provided and used type that is well-focused on your
-                    reference. For example, ServiceReferences for admission registration:
-                    https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
-                    .'
-                  properties:
-                    apiVersion:
-                      description: API version of the referent.
-                      type: string
-                    fieldPath:
-                      description: 'If referring to a piece of an object instead of
-                        an entire object, this string should contain a valid JSON/Go
-                        field access statement, such as desiredState.manifest.containers[2].
-                        For example, if the object reference is to a container within
-                        a pod, this would take on a value like: "spec.containers{name}"
-                        (where "name" refers to the name of the container that triggered
-                        the event) or if no container name is specified "spec.containers[2]"
-                        (container with index 2 in this pod). This syntax is chosen
-                        only to have some well-defined way of referencing a part of
-                        an object. TODO: this design is not final and this field is
-                        subject to change in the future.'
-                      type: string
-                    kind:
-                      description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-                      type: string
-                    name:
-                      description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
-                      type: string
-                    namespace:
-                      description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
-                      type: string
-                    resourceVersion:
-                      description: 'Specific resourceVersion to which this reference
-                        is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
-                      type: string
-                    uid:
-                      description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
-                      type: string
-                  type: object
-                type: array
-            required:
-            - workloadRefs
-            type: object
-          status:
-            description: A HealthScopeStatus represents the observed state of a HealthScope.
-            properties:
-              appHealthConditions:
-                description: AppHealthConditions represents health condition of applications
-                  in the scope
-                items:
-                  description: AppHealthCondition represents health condition of an
-                    application
-                  properties:
-                    appName:
-                      type: string
-                    components:
-                      items:
-                        description: WorkloadHealthCondition represents informative
-                          health condition of a workload.
-                        properties:
-                          componentName:
-                            description: ComponentName represents the component name
-                              if target is a workload
-                            type: string
-                          customStatusMsg:
-                            type: string
-                          diagnosis:
-                            type: string
-                          healthStatus:
-                            description: HealthStatus represents health status strings.
-                            type: string
-                          targetWorkload:
-                            description: 'ObjectReference contains enough information
-                              to let you inspect or modify the referred object. ---
-                              New uses of this type are discouraged because of difficulty
-                              describing its usage when embedded in APIs.  1. Ignored
-                              fields.  It includes many fields which are not generally
-                              honored.  For instance, ResourceVersion and FieldPath
-                              are both very rarely valid in actual usage.  2. Invalid
-                              usage help.  It is impossible to add specific help for
-                              individual usage.  In most embedded usages, there are
-                              particular     restrictions like, "must refer only to
-                              types A and B" or "UID not honored" or "name must be
-                              restricted".     Those cannot be well described when
-                              embedded.  3. Inconsistent validation.  Because the
-                              usages are different, the validation rules are different
-                              by usage, which makes it hard for users to predict what
-                              will happen.  4. The fields are both imprecise and overly
-                              precise.  Kind is not a precise mapping to a URL. This
-                              can produce ambiguity     during interpretation and
-                              require a REST mapping.  In most cases, the dependency
-                              is on the group,resource tuple     and the version of
-                              the actual struct is irrelevant.  5. We cannot easily
-                              change it.  Because this type is embedded in many locations,
-                              updates to this type     will affect numerous schemas.  Don''t
-                              make new APIs embed an underspecified API type they
-                              do not control. Instead of using this type, create a
-                              locally provided and used type that is well-focused
-                              on your reference. For example, ServiceReferences for
-                              admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
-                              .'
-                            properties:
-                              apiVersion:
-                                description: API version of the referent.
-                                type: string
-                              fieldPath:
-                                description: 'If referring to a piece of an object
-                                  instead of an entire object, this string should
-                                  contain a valid JSON/Go field access statement,
-                                  such as desiredState.manifest.containers[2]. For
-                                  example, if the object reference is to a container
-                                  within a pod, this would take on a value like: "spec.containers{name}"
-                                  (where "name" refers to the name of the container
-                                  that triggered the event) or if no container name
-                                  is specified "spec.containers[2]" (container with
-                                  index 2 in this pod). This syntax is chosen only
-                                  to have some well-defined way of referencing a part
-                                  of an object. TODO: this design is not final and
-                                  this field is subject to change in the future.'
-                                type: string
-                              kind:
-                                description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-                                type: string
-                              name:
-                                description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
-                                type: string
-                              namespace:
-                                description: 'Namespace of the referent. More info:
-                                  https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
-                                type: string
-                              resourceVersion:
-                                description: 'Specific resourceVersion to which this
-                                  reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
-                                type: string
-                              uid:
-                                description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
-                                type: string
-                            type: object
-                          traits:
-                            items:
-                              description: TraitHealthCondition represents informative
-                                health condition of a trait.
-                              properties:
-                                customStatusMsg:
-                                  type: string
-                                diagnosis:
-                                  type: string
-                                healthStatus:
-                                  description: HealthStatus represents health status
-                                    strings.
-                                  type: string
-                                resource:
-                                  type: string
-                                type:
-                                  type: string
-                              required:
-                              - healthStatus
-                              - resource
-                              - type
-                              type: object
-                            type: array
-                          workloadStatus:
-                            description: WorkloadStatus represents status of workloads
-                              whose HealthStatus is UNKNOWN.
-                            type: string
-                        required:
-                        - healthStatus
-                        type: object
-                      type: array
-                    envName:
-                      type: string
-                  required:
-                  - appName
-                  type: object
-                type: array
-              conditions:
-                description: Conditions of the resource.
-                items:
-                  description: A Condition that may apply to a resource.
-                  properties:
-                    lastTransitionTime:
-                      description: LastTransitionTime is the last time this condition
-                        transitioned from one status to another.
-                      format: date-time
-                      type: string
-                    message:
-                      description: A Message containing details about this condition's
-                        last transition from one status to another, if any.
-                      type: string
-                    reason:
-                      description: A Reason for this condition's last transition from
-                        one status to another.
-                      type: string
-                    status:
-                      description: Status of this condition; is it currently True,
-                        False, or Unknown?
-                      type: string
-                    type:
-                      description: Type of this condition. At most one of each condition
-                        type may apply to a resource at any point in time.
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-              healthConditions:
-                description: WorkloadHealthConditions represents health condition
-                  of workloads in the scope Use AppHealthConditions to provide app
-                  level status
-                items:
-                  description: WorkloadHealthCondition represents informative health
-                    condition of a workload.
-                  properties:
-                    componentName:
-                      description: ComponentName represents the component name if
-                        target is a workload
-                      type: string
-                    customStatusMsg:
-                      type: string
-                    diagnosis:
-                      type: string
-                    healthStatus:
-                      description: HealthStatus represents health status strings.
-                      type: string
-                    targetWorkload:
-                      description: 'ObjectReference contains enough information to
-                        let you inspect or modify the referred object. --- New uses
-                        of this type are discouraged because of difficulty describing
-                        its usage when embedded in APIs.  1. Ignored fields.  It includes
-                        many fields which are not generally honored.  For instance,
-                        ResourceVersion and FieldPath are both very rarely valid in
-                        actual usage.  2. Invalid usage help.  It is impossible to
-                        add specific help for individual usage.  In most embedded
-                        usages, there are particular     restrictions like, "must
-                        refer only to types A and B" or "UID not honored" or "name
-                        must be restricted".     Those cannot be well described when
-                        embedded.  3. Inconsistent validation.  Because the usages
-                        are different, the validation rules are different by usage,
-                        which makes it hard for users to predict what will happen.  4.
-                        The fields are both imprecise and overly precise.  Kind is
-                        not a precise mapping to a URL. This can produce ambiguity     during
-                        interpretation and require a REST mapping.  In most cases,
-                        the dependency is on the group,resource tuple     and the
-                        version of the actual struct is irrelevant.  5. We cannot
-                        easily change it.  Because this type is embedded in many locations,
-                        updates to this type     will affect numerous schemas.  Don''t
-                        make new APIs embed an underspecified API type they do not
-                        control. Instead of using this type, create a locally provided
-                        and used type that is well-focused on your reference. For
-                        example, ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
-                        .'
-                      properties:
-                        apiVersion:
-                          description: API version of the referent.
-                          type: string
-                        fieldPath:
-                          description: 'If referring to a piece of an object instead
-                            of an entire object, this string should contain a valid
-                            JSON/Go field access statement, such as desiredState.manifest.containers[2].
-                            For example, if the object reference is to a container
-                            within a pod, this would take on a value like: "spec.containers{name}"
-                            (where "name" refers to the name of the container that
-                            triggered the event) or if no container name is specified
-                            "spec.containers[2]" (container with index 2 in this pod).
-                            This syntax is chosen only to have some well-defined way
-                            of referencing a part of an object. TODO: this design
-                            is not final and this field is subject to change in the
-                            future.'
-                          type: string
-                        kind:
-                          description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-                          type: string
-                        name:
-                          description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
-                          type: string
-                        namespace:
-                          description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
-                          type: string
-                        resourceVersion:
-                          description: 'Specific resourceVersion to which this reference
-                            is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
-                          type: string
-                        uid:
-                          description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
-                          type: string
-                      type: object
-                    traits:
-                      items:
-                        description: TraitHealthCondition represents informative health
-                          condition of a trait.
-                        properties:
-                          customStatusMsg:
-                            type: string
-                          diagnosis:
-                            type: string
-                          healthStatus:
-                            description: HealthStatus represents health status strings.
-                            type: string
-                          resource:
-                            type: string
-                          type:
-                            type: string
-                        required:
-                        - healthStatus
-                        - resource
-                        - type
-                        type: object
-                      type: array
-                    workloadStatus:
-                      description: WorkloadStatus represents status of workloads whose
-                        HealthStatus is UNKNOWN.
-                      type: string
-                  required:
-                  - healthStatus
-                  type: object
-                type: array
-              scopeHealthCondition:
-                description: ScopeHealthCondition represents health condition summary
-                  of the scope
-                properties:
-                  healthStatus:
-                    description: HealthStatus represents health status strings.
-                    type: string
-                  healthyWorkloads:
-                    format: int64
-                    type: integer
-                  total:
-                    format: int64
-                    type: integer
-                  unhealthyWorkloads:
-                    format: int64
-                    type: integer
-                  unknownWorkloads:
-                    format: int64
-                    type: integer
-                required:
-                - healthStatus
-                type: object
-            required:
-            - scopeHealthCondition
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

charts/oam-runtime/crds/core.oam.dev_manualscalertraits.yaml

@@ -1,134 +0,0 @@
-
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.6.2
-  name: manualscalertraits.core.oam.dev
-spec:
-  group: core.oam.dev
-  names:
-    categories:
-    - oam
-    kind: ManualScalerTrait
-    listKind: ManualScalerTraitList
-    plural: manualscalertraits
-    singular: manualscalertrait
-  scope: Namespaced
-  versions:
-  - name: v1alpha2
-    schema:
-      openAPIV3Schema:
-        description: A ManualScalerTrait determines how many replicas a workload should
-          have.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: A ManualScalerTraitSpec defines the desired state of a ManualScalerTrait.
-            properties:
-              replicaCount:
-                description: ReplicaCount of the workload this trait applies to.
-                format: int32
-                type: integer
-              workloadRef:
-                description: WorkloadReference to the workload this trait applies
-                  to.
-                properties:
-                  apiVersion:
-                    description: API version of the referent.
-                    type: string
-                  fieldPath:
-                    description: 'If referring to a piece of an object instead of
-                      an entire object, this string should contain a valid JSON/Go
-                      field access statement, such as desiredState.manifest.containers[2].
-                      For example, if the object reference is to a container within
-                      a pod, this would take on a value like: "spec.containers{name}"
-                      (where "name" refers to the name of the container that triggered
-                      the event) or if no container name is specified "spec.containers[2]"
-                      (container with index 2 in this pod). This syntax is chosen
-                      only to have some well-defined way of referencing a part of
-                      an object. TODO: this design is not final and this field is
-                      subject to change in the future.'
-                    type: string
-                  kind:
-                    description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-                    type: string
-                  name:
-                    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
-                    type: string
-                  namespace:
-                    description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
-                    type: string
-                  resourceVersion:
-                    description: 'Specific resourceVersion to which this reference
-                      is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
-                    type: string
-                  uid:
-                    description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
-                    type: string
-                type: object
-            required:
-            - replicaCount
-            - workloadRef
-            type: object
-          status:
-            description: A ManualScalerTraitStatus represents the observed state of
-              a ManualScalerTrait.
-            properties:
-              conditions:
-                description: Conditions of the resource.
-                items:
-                  description: A Condition that may apply to a resource.
-                  properties:
-                    lastTransitionTime:
-                      description: LastTransitionTime is the last time this condition
-                        transitioned from one status to another.
-                      format: date-time
-                      type: string
-                    message:
-                      description: A Message containing details about this condition's
-                        last transition from one status to another, if any.
-                      type: string
-                    reason:
-                      description: A Reason for this condition's last transition from
-                        one status to another.
-                      type: string
-                    status:
-                      description: Status of this condition; is it currently True,
-                        False, or Unknown?
-                      type: string
-                    type:
-                      description: Type of this condition. At most one of each condition
-                        type may apply to a resource at any point in time.
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

charts/oam-runtime/crds/core.oam.dev_scopedefinitions.yaml

@@ -1,153 +0,0 @@
-
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.6.2
-  name: scopedefinitions.core.oam.dev
-spec:
-  group: core.oam.dev
-  names:
-    categories:
-    - oam
-    kind: ScopeDefinition
-    listKind: ScopeDefinitionList
-    plural: scopedefinitions
-    shortNames:
-    - scope
-    singular: scopedefinition
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.definitionRef.name
-      name: DEFINITION-NAME
-      type: string
-    name: v1alpha2
-    schema:
-      openAPIV3Schema:
-        description: A ScopeDefinition registers a kind of Kubernetes custom resource
-          as a valid OAM scope kind by referencing its CustomResourceDefinition. The
-          CRD is used to validate the schema of the scope when it is embedded in an
-          OAM ApplicationConfiguration.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: A ScopeDefinitionSpec defines the desired state of a ScopeDefinition.
-            properties:
-              allowComponentOverlap:
-                description: AllowComponentOverlap specifies whether an OAM component
-                  may exist in multiple instances of this kind of scope.
-                type: boolean
-              definitionRef:
-                description: Reference to the CustomResourceDefinition that defines
-                  this scope kind.
-                properties:
-                  name:
-                    description: Name of the referenced CustomResourceDefinition.
-                    type: string
-                  version:
-                    description: Version indicate which version should be used if
-                      CRD has multiple versions by default it will use the first one
-                      if not specified
-                    type: string
-                required:
-                - name
-                type: object
-              extension:
-                description: Extension is used for extension needs by OAM platform
-                  builders
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              workloadRefsPath:
-                description: WorkloadRefsPath indicates if/where a scope accepts workloadRef
-                  objects
-                type: string
-            required:
-            - allowComponentOverlap
-            - definitionRef
-            type: object
-        type: object
-    served: true
-    storage: false
-    subresources: {}
-  - additionalPrinterColumns:
-    - jsonPath: .spec.definitionRef.name
-      name: DEFINITION-NAME
-      type: string
-    name: v1beta1
-    schema:
-      openAPIV3Schema:
-        description: A ScopeDefinition registers a kind of Kubernetes custom resource
-          as a valid OAM scope kind by referencing its CustomResourceDefinition. The
-          CRD is used to validate the schema of the scope when it is embedded in an
-          OAM ApplicationConfiguration.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: A ScopeDefinitionSpec defines the desired state of a ScopeDefinition.
-            properties:
-              allowComponentOverlap:
-                description: AllowComponentOverlap specifies whether an OAM component
-                  may exist in multiple instances of this kind of scope.
-                type: boolean
-              definitionRef:
-                description: Reference to the CustomResourceDefinition that defines
-                  this scope kind.
-                properties:
-                  name:
-                    description: Name of the referenced CustomResourceDefinition.
-                    type: string
-                  version:
-                    description: Version indicate which version should be used if
-                      CRD has multiple versions by default it will use the first one
-                      if not specified
-                    type: string
-                required:
-                - name
-                type: object
-              extension:
-                description: Extension is used for extension needs by OAM platform
-                  builders
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              workloadRefsPath:
-                description: WorkloadRefsPath indicates if/where a scope accepts workloadRef
-                  objects
-                type: string
-            required:
-            - allowComponentOverlap
-            - definitionRef
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

charts/oam-runtime/crds/core.oam.dev_traitdefinitions.yaml

@@ -1,645 +0,0 @@
-
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.6.2
-  name: traitdefinitions.core.oam.dev
-spec:
-  group: core.oam.dev
-  names:
-    categories:
-    - oam
-    kind: TraitDefinition
-    listKind: TraitDefinitionList
-    plural: traitdefinitions
-    shortNames:
-    - trait
-    singular: traitdefinition
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.appliesToWorkloads
-      name: APPLIES-TO
-      type: string
-    - jsonPath: .metadata.annotations.definition\.oam\.dev/description
-      name: DESCRIPTION
-      type: string
-    name: v1alpha2
-    schema:
-      openAPIV3Schema:
-        description: A TraitDefinition registers a kind of Kubernetes custom resource
-          as a valid OAM trait kind by referencing its CustomResourceDefinition. The
-          CRD is used to validate the schema of the trait when it is embedded in an
-          OAM ApplicationConfiguration.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: A TraitDefinitionSpec defines the desired state of a TraitDefinition.
-            properties:
-              appliesToWorkloads:
-                description: AppliesToWorkloads specifies the list of workload kinds
-                  this trait applies to. Workload kinds are specified in kind.group/version
-                  format, e.g. server.core.oam.dev/v1alpha2. Traits that omit this
-                  field apply to all workload kinds.
-                items:
-                  type: string
-                type: array
-              conflictsWith:
-                description: 'ConflictsWith specifies the list of traits(CRD name,
-                  Definition name, CRD group) which could not apply to the same workloads
-                  with this trait. Traits that omit this field can work with any other
-                  traits. Example rules: "service" # Trait definition name "services.k8s.io"
-                  # API resource/crd name "*.networking.k8s.io" # API group "labelSelector:foo=bar"
-                  # label selector labelSelector format: https://pkg.go.dev/k8s.io/apimachinery/pkg/labels#Parse'
-                items:
-                  type: string
-                type: array
-              definitionRef:
-                description: Reference to the CustomResourceDefinition that defines
-                  this trait kind.
-                properties:
-                  name:
-                    description: Name of the referenced CustomResourceDefinition.
-                    type: string
-                  version:
-                    description: Version indicate which version should be used if
-                      CRD has multiple versions by default it will use the first one
-                      if not specified
-                    type: string
-                required:
-                - name
-                type: object
-              extension:
-                description: Extension is used for extension needs by OAM platform
-                  builders
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              podDisruptive:
-                description: PodDisruptive specifies whether using the trait will
-                  cause the pod to restart or not.
-                type: boolean
-              revisionEnabled:
-                description: Revision indicates whether a trait is aware of component
-                  revision
-                type: boolean
-              schematic:
-                description: Schematic defines the data format and template of the
-                  encapsulation of the trait
-                properties:
-                  cue:
-                    description: CUE defines the encapsulation in CUE format
-                    properties:
-                      template:
-                        description: Template defines the abstraction template data
-                          of the capability, it will replace the old CUE template
-                          in extension field. Template is a required field if CUE
-                          is defined in Capability Definition.
-                        type: string
-                    required:
-                    - template
-                    type: object
-                  helm:
-                    description: A Helm represents resources used by a Helm module
-                    properties:
-                      release:
-                        description: Release records a Helm release used by a Helm
-                          module workload.
-                        type: object
-                        x-kubernetes-preserve-unknown-fields: true
-                      repository:
-                        description: HelmRelease records a Helm repository used by
-                          a Helm module workload.
-                        type: object
-                        x-kubernetes-preserve-unknown-fields: true
-                    required:
-                    - release
-                    - repository
-                    type: object
-                  kube:
-                    description: Kube defines the encapsulation in raw Kubernetes
-                      resource format
-                    properties:
-                      parameters:
-                        description: Parameters defines configurable parameters
-                        items:
-                          description: A KubeParameter defines a configurable parameter
-                            of a component.
-                          properties:
-                            description:
-                              description: Description of this parameter.
-                              type: string
-                            fieldPaths:
-                              description: "FieldPaths specifies an array of fields
-                                within this workload that will be overwritten by the
-                                value of this parameter. \tAll fields must be of the
-                                same type. Fields are specified as JSON field paths
-                                without a leading dot, for example 'spec.replicas'."
-                              items:
-                                type: string
-                              type: array
-                            name:
-                              description: Name of this parameter
-                              type: string
-                            required:
-                              default: false
-                              description: Required specifies whether or not a value
-                                for this parameter must be supplied when authoring
-                                an Application.
-                              type: boolean
-                            type:
-                              description: 'ValueType indicates the type of the parameter
-                                value, and only supports basic data types: string,
-                                number, boolean.'
-                              enum:
-                              - string
-                              - number
-                              - boolean
-                              type: string
-                          required:
-                          - fieldPaths
-                          - name
-                          - type
-                          type: object
-                        type: array
-                      template:
-                        description: Template defines the raw Kubernetes resource
-                        type: object
-                        x-kubernetes-preserve-unknown-fields: true
-                    required:
-                    - template
-                    type: object
-                  terraform:
-                    description: Terraform is the struct to describe cloud resources
-                      managed by Hashicorp Terraform
-                    properties:
-                      configuration:
-                        description: Configuration is Terraform Configuration
-                        type: string
-                      customRegion:
-                        description: Region is cloud provider's region. It will override
-                          the region in the region field of ProviderReference
-                        type: string
-                      deleteResource:
-                        default: true
-                        description: DeleteResource will determine whether provisioned
-                          cloud resources will be deleted when CR is deleted
-                        type: boolean
-                      path:
-                        description: Path is the sub-directory of remote git repository.
-                          It's valid when remote is set
-                        type: string
-                      providerRef:
-                        description: ProviderReference specifies the reference to
-                          Provider
-                        properties:
-                          name:
-                            description: Name of the referenced object.
-                            type: string
-                          namespace:
-                            default: default
-                            description: Namespace of the referenced object.
-                            type: string
-                        required:
-                        - name
-                        type: object
-                      type:
-                        default: hcl
-                        description: Type specifies which Terraform configuration
-                          it is, HCL or JSON syntax
-                        enum:
-                        - hcl
-                        - json
-                        - remote
-                        type: string
-                      writeConnectionSecretToRef:
-                        description: WriteConnectionSecretToReference specifies the
-                          namespace and name of a Secret to which any connection details
-                          for this managed resource should be written. Connection
-                          details frequently include the endpoint, username, and password
-                          required to connect to the managed resource.
-                        properties:
-                          name:
-                            description: Name of the secret.
-                            type: string
-                          namespace:
-                            description: Namespace of the secret.
-                            type: string
-                        required:
-                        - name
-                        type: object
-                    required:
-                    - configuration
-                    type: object
-                type: object
-              status:
-                description: Status defines the custom health policy and status message
-                  for trait
-                properties:
-                  customStatus:
-                    description: CustomStatus defines the custom status message that
-                      could display to user
-                    type: string
-                  healthPolicy:
-                    description: HealthPolicy defines the health check policy for
-                      the abstraction
-                    type: string
-                type: object
-              workloadRefPath:
-                description: WorkloadRefPath indicates where/if a trait accepts a
-                  workloadRef object
-                type: string
-            type: object
-          status:
-            description: TraitDefinitionStatus is the status of TraitDefinition
-            properties:
-              conditions:
-                description: Conditions of the resource.
-                items:
-                  description: A Condition that may apply to a resource.
-                  properties:
-                    lastTransitionTime:
-                      description: LastTransitionTime is the last time this condition
-                        transitioned from one status to another.
-                      format: date-time
-                      type: string
-                    message:
-                      description: A Message containing details about this condition's
-                        last transition from one status to another, if any.
-                      type: string
-                    reason:
-                      description: A Reason for this condition's last transition from
-                        one status to another.
-                      type: string
-                    status:
-                      description: Status of this condition; is it currently True,
-                        False, or Unknown?
-                      type: string
-                    type:
-                      description: Type of this condition. At most one of each condition
-                        type may apply to a resource at any point in time.
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-              configMapRef:
-                description: ConfigMapRef refer to a ConfigMap which contains OpenAPI
-                  V3 JSON schema of Component parameters.
-                type: string
-              latestRevision:
-                description: LatestRevision of the trait definition
-                properties:
-                  name:
-                    type: string
-                  revision:
-                    format: int64
-                    type: integer
-                  revisionHash:
-                    description: RevisionHash record the hash value of the spec of
-                      ApplicationRevision object.
-                    type: string
-                required:
-                - name
-                - revision
-                type: object
-            type: object
-        type: object
-    served: true
-    storage: false
-    subresources:
-      status: {}
-  - additionalPrinterColumns:
-    - jsonPath: .spec.appliesToWorkloads
-      name: APPLIES-TO
-      type: string
-    - jsonPath: .metadata.annotations.definition\.oam\.dev/description
-      name: DESCRIPTION
-      type: string
-    name: v1beta1
-    schema:
-      openAPIV3Schema:
-        description: A TraitDefinition registers a kind of Kubernetes custom resource
-          as a valid OAM trait kind by referencing its CustomResourceDefinition. The
-          CRD is used to validate the schema of the trait when it is embedded in an
-          OAM ApplicationConfiguration.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: A TraitDefinitionSpec defines the desired state of a TraitDefinition.
-            properties:
-              appliesToWorkloads:
-                description: AppliesToWorkloads specifies the list of workload kinds
-                  this trait applies to. Workload kinds are specified in kind.group/version
-                  format, e.g. server.core.oam.dev/v1alpha2. Traits that omit this
-                  field apply to all workload kinds.
-                items:
-                  type: string
-                type: array
-              conflictsWith:
-                description: 'ConflictsWith specifies the list of traits(CRD name,
-                  Definition name, CRD group) which could not apply to the same workloads
-                  with this trait. Traits that omit this field can work with any other
-                  traits. Example rules: "service" # Trait definition name "services.k8s.io"
-                  # API resource/crd name "*.networking.k8s.io" # API group "labelSelector:foo=bar"
-                  # label selector labelSelector format: https://pkg.go.dev/k8s.io/apimachinery/pkg/labels#Parse'
-                items:
-                  type: string
-                type: array
-              definitionRef:
-                description: Reference to the CustomResourceDefinition that defines
-                  this trait kind.
-                properties:
-                  name:
-                    description: Name of the referenced CustomResourceDefinition.
-                    type: string
-                  version:
-                    description: Version indicate which version should be used if
-                      CRD has multiple versions by default it will use the first one
-                      if not specified
-                    type: string
-                required:
-                - name
-                type: object
-              extension:
-                description: Extension is used for extension needs by OAM platform
-                  builders
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              manageWorkload:
-                description: ManageWorkload defines the trait would be responsible
-                  for creating the workload
-                type: boolean
-              podDisruptive:
-                description: PodDisruptive specifies whether using the trait will
-                  cause the pod to restart or not.
-                type: boolean
-              revisionEnabled:
-                description: Revision indicates whether a trait is aware of component
-                  revision
-                type: boolean
-              schematic:
-                description: Schematic defines the data format and template of the
-                  encapsulation of the trait
-                properties:
-                  cue:
-                    description: CUE defines the encapsulation in CUE format
-                    properties:
-                      template:
-                        description: Template defines the abstraction template data
-                          of the capability, it will replace the old CUE template
-                          in extension field. Template is a required field if CUE
-                          is defined in Capability Definition.
-                        type: string
-                    required:
-                    - template
-                    type: object
-                  helm:
-                    description: A Helm represents resources used by a Helm module
-                    properties:
-                      release:
-                        description: Release records a Helm release used by a Helm
-                          module workload.
-                        type: object
-                        x-kubernetes-preserve-unknown-fields: true
-                      repository:
-                        description: HelmRelease records a Helm repository used by
-                          a Helm module workload.
-                        type: object
-                        x-kubernetes-preserve-unknown-fields: true
-                    required:
-                    - release
-                    - repository
-                    type: object
-                  kube:
-                    description: Kube defines the encapsulation in raw Kubernetes
-                      resource format
-                    properties:
-                      parameters:
-                        description: Parameters defines configurable parameters
-                        items:
-                          description: A KubeParameter defines a configurable parameter
-                            of a component.
-                          properties:
-                            description:
-                              description: Description of this parameter.
-                              type: string
-                            fieldPaths:
-                              description: "FieldPaths specifies an array of fields
-                                within this workload that will be overwritten by the
-                                value of this parameter. \tAll fields must be of the
-                                same type. Fields are specified as JSON field paths
-                                without a leading dot, for example 'spec.replicas'."
-                              items:
-                                type: string
-                              type: array
-                            name:
-                              description: Name of this parameter
-                              type: string
-                            required:
-                              default: false
-                              description: Required specifies whether or not a value
-                                for this parameter must be supplied when authoring
-                                an Application.
-                              type: boolean
-                            type:
-                              description: 'ValueType indicates the type of the parameter
-                                value, and only supports basic data types: string,
-                                number, boolean.'
-                              enum:
-                              - string
-                              - number
-                              - boolean
-                              type: string
-                          required:
-                          - fieldPaths
-                          - name
-                          - type
-                          type: object
-                        type: array
-                      template:
-                        description: Template defines the raw Kubernetes resource
-                        type: object
-                        x-kubernetes-preserve-unknown-fields: true
-                    required:
-                    - template
-                    type: object
-                  terraform:
-                    description: Terraform is the struct to describe cloud resources
-                      managed by Hashicorp Terraform
-                    properties:
-                      configuration:
-                        description: Configuration is Terraform Configuration
-                        type: string
-                      customRegion:
-                        description: Region is cloud provider's region. It will override
-                          the region in the region field of ProviderReference
-                        type: string
-                      deleteResource:
-                        default: true
-                        description: DeleteResource will determine whether provisioned
-                          cloud resources will be deleted when CR is deleted
-                        type: boolean
-                      path:
-                        description: Path is the sub-directory of remote git repository.
-                          It's valid when remote is set
-                        type: string
-                      providerRef:
-                        description: ProviderReference specifies the reference to
-                          Provider
-                        properties:
-                          name:
-                            description: Name of the referenced object.
-                            type: string
-                          namespace:
-                            default: default
-                            description: Namespace of the referenced object.
-                            type: string
-                        required:
-                        - name
-                        type: object
-                      type:
-                        default: hcl
-                        description: Type specifies which Terraform configuration
-                          it is, HCL or JSON syntax
-                        enum:
-                        - hcl
-                        - json
-                        - remote
-                        type: string
-                      writeConnectionSecretToRef:
-                        description: WriteConnectionSecretToReference specifies the
-                          namespace and name of a Secret to which any connection details
-                          for this managed resource should be written. Connection
-                          details frequently include the endpoint, username, and password
-                          required to connect to the managed resource.
-                        properties:
-                          name:
-                            description: Name of the secret.
-                            type: string
-                          namespace:
-                            description: Namespace of the secret.
-                            type: string
-                        required:
-                        - name
-                        type: object
-                    required:
-                    - configuration
-                    type: object
-                type: object
-              skipRevisionAffect:
-                description: SkipRevisionAffect defines the update this trait will
-                  not generate a new application Revision
-                type: boolean
-              status:
-                description: Status defines the custom health policy and status message
-                  for trait
-                properties:
-                  customStatus:
-                    description: CustomStatus defines the custom status message that
-                      could display to user
-                    type: string
-                  healthPolicy:
-                    description: HealthPolicy defines the health check policy for
-                      the abstraction
-                    type: string
-                type: object
-              workloadRefPath:
-                description: WorkloadRefPath indicates where/if a trait accepts a
-                  workloadRef object
-                type: string
-            type: object
-          status:
-            description: TraitDefinitionStatus is the status of TraitDefinition
-            properties:
-              conditions:
-                description: Conditions of the resource.
-                items:
-                  description: A Condition that may apply to a resource.
-                  properties:
-                    lastTransitionTime:
-                      description: LastTransitionTime is the last time this condition
-                        transitioned from one status to another.
-                      format: date-time
-                      type: string
-                    message:
-                      description: A Message containing details about this condition's
-                        last transition from one status to another, if any.
-                      type: string
-                    reason:
-                      description: A Reason for this condition's last transition from
-                        one status to another.
-                      type: string
-                    status:
-                      description: Status of this condition; is it currently True,
-                        False, or Unknown?
-                      type: string
-                    type:
-                      description: Type of this condition. At most one of each condition
-                        type may apply to a resource at any point in time.
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-              configMapRef:
-                description: ConfigMapRef refer to a ConfigMap which contains OpenAPI
-                  V3 JSON schema of Component parameters.
-                type: string
-              latestRevision:
-                description: LatestRevision of the component definition
-                properties:
-                  name:
-                    type: string
-                  revision:
-                    format: int64
-                    type: integer
-                  revisionHash:
-                    description: RevisionHash record the hash value of the spec of
-                      ApplicationRevision object.
-                    type: string
-                required:
-                - name
-                - revision
-                type: object
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

charts/oam-runtime/crds/core.oam.dev_workloaddefinitions.yaml

@@ -1,604 +0,0 @@
-
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.6.2
-  name: workloaddefinitions.core.oam.dev
-spec:
-  group: core.oam.dev
-  names:
-    categories:
-    - oam
-    kind: WorkloadDefinition
-    listKind: WorkloadDefinitionList
-    plural: workloaddefinitions
-    shortNames:
-    - workload
-    singular: workloaddefinition
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.definitionRef.name
-      name: DEFINITION-NAME
-      type: string
-    name: v1alpha2
-    schema:
-      openAPIV3Schema:
-        description: A WorkloadDefinition registers a kind of Kubernetes custom resource
-          as a valid OAM workload kind by referencing its CustomResourceDefinition.
-          The CRD is used to validate the schema of the workload when it is embedded
-          in an OAM Component.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: A WorkloadDefinitionSpec defines the desired state of a WorkloadDefinition.
-            properties:
-              childResourceKinds:
-                description: ChildResourceKinds are the list of GVK of the child resources
-                  this workload generates
-                items:
-                  description: A ChildResourceKind defines a child Kubernetes resource
-                    kind with a selector
-                  properties:
-                    apiVersion:
-                      description: APIVersion of the child resource
-                      type: string
-                    kind:
-                      description: Kind of the child resource
-                      type: string
-                    selector:
-                      additionalProperties:
-                        type: string
-                      description: Selector to select the child resources that the
-                        workload wants to expose to traits
-                      type: object
-                  required:
-                  - apiVersion
-                  - kind
-                  type: object
-                type: array
-              definitionRef:
-                description: Reference to the CustomResourceDefinition that defines
-                  this workload kind.
-                properties:
-                  name:
-                    description: Name of the referenced CustomResourceDefinition.
-                    type: string
-                  version:
-                    description: Version indicate which version should be used if
-                      CRD has multiple versions by default it will use the first one
-                      if not specified
-                    type: string
-                required:
-                - name
-                type: object
-              extension:
-                description: Extension is used for extension needs by OAM platform
-                  builders
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              podSpecPath:
-                description: PodSpecPath indicates where/if this workload has K8s
-                  podSpec field if one workload has podSpec, trait can do lot's of
-                  assumption such as port, env, volume fields.
-                type: string
-              revisionLabel:
-                description: RevisionLabel indicates which label for underlying resources(e.g.
-                  pods) of this workload can be used by trait to create resource selectors(e.g.
-                  label selector for pods).
-                type: string
-              schematic:
-                description: Schematic defines the data format and template of the
-                  encapsulation of the workload
-                properties:
-                  cue:
-                    description: CUE defines the encapsulation in CUE format
-                    properties:
-                      template:
-                        description: Template defines the abstraction template data
-                          of the capability, it will replace the old CUE template
-                          in extension field. Template is a required field if CUE
-                          is defined in Capability Definition.
-                        type: string
-                    required:
-                    - template
-                    type: object
-                  helm:
-                    description: A Helm represents resources used by a Helm module
-                    properties:
-                      release:
-                        description: Release records a Helm release used by a Helm
-                          module workload.
-                        type: object
-                        x-kubernetes-preserve-unknown-fields: true
-                      repository:
-                        description: HelmRelease records a Helm repository used by
-                          a Helm module workload.
-                        type: object
-                        x-kubernetes-preserve-unknown-fields: true
-                    required:
-                    - release
-                    - repository
-                    type: object
-                  kube:
-                    description: Kube defines the encapsulation in raw Kubernetes
-                      resource format
-                    properties:
-                      parameters:
-                        description: Parameters defines configurable parameters
-                        items:
-                          description: A KubeParameter defines a configurable parameter
-                            of a component.
-                          properties:
-                            description:
-                              description: Description of this parameter.
-                              type: string
-                            fieldPaths:
-                              description: "FieldPaths specifies an array of fields
-                                within this workload that will be overwritten by the
-                                value of this parameter. \tAll fields must be of the
-                                same type. Fields are specified as JSON field paths
-                                without a leading dot, for example 'spec.replicas'."
-                              items:
-                                type: string
-                              type: array
-                            name:
-                              description: Name of this parameter
-                              type: string
-                            required:
-                              default: false
-                              description: Required specifies whether or not a value
-                                for this parameter must be supplied when authoring
-                                an Application.
-                              type: boolean
-                            type:
-                              description: 'ValueType indicates the type of the parameter
-                                value, and only supports basic data types: string,
-                                number, boolean.'
-                              enum:
-                              - string
-                              - number
-                              - boolean
-                              type: string
-                          required:
-                          - fieldPaths
-                          - name
-                          - type
-                          type: object
-                        type: array
-                      template:
-                        description: Template defines the raw Kubernetes resource
-                        type: object
-                        x-kubernetes-preserve-unknown-fields: true
-                    required:
-                    - template
-                    type: object
-                  terraform:
-                    description: Terraform is the struct to describe cloud resources
-                      managed by Hashicorp Terraform
-                    properties:
-                      configuration:
-                        description: Configuration is Terraform Configuration
-                        type: string
-                      customRegion:
-                        description: Region is cloud provider's region. It will override
-                          the region in the region field of ProviderReference
-                        type: string
-                      deleteResource:
-                        default: true
-                        description: DeleteResource will determine whether provisioned
-                          cloud resources will be deleted when CR is deleted
-                        type: boolean
-                      path:
-                        description: Path is the sub-directory of remote git repository.
-                          It's valid when remote is set
-                        type: string
-                      providerRef:
-                        description: ProviderReference specifies the reference to
-                          Provider
-                        properties:
-                          name:
-                            description: Name of the referenced object.
-                            type: string
-                          namespace:
-                            default: default
-                            description: Namespace of the referenced object.
-                            type: string
-                        required:
-                        - name
-                        type: object
-                      type:
-                        default: hcl
-                        description: Type specifies which Terraform configuration
-                          it is, HCL or JSON syntax
-                        enum:
-                        - hcl
-                        - json
-                        - remote
-                        type: string
-                      writeConnectionSecretToRef:
-                        description: WriteConnectionSecretToReference specifies the
-                          namespace and name of a Secret to which any connection details
-                          for this managed resource should be written. Connection
-                          details frequently include the endpoint, username, and password
-                          required to connect to the managed resource.
-                        properties:
-                          name:
-                            description: Name of the secret.
-                            type: string
-                          namespace:
-                            description: Namespace of the secret.
-                            type: string
-                        required:
-                        - name
-                        type: object
-                    required:
-                    - configuration
-                    type: object
-                type: object
-              status:
-                description: Status defines the custom health policy and status message
-                  for workload
-                properties:
-                  customStatus:
-                    description: CustomStatus defines the custom status message that
-                      could display to user
-                    type: string
-                  healthPolicy:
-                    description: HealthPolicy defines the health check policy for
-                      the abstraction
-                    type: string
-                type: object
-            required:
-            - definitionRef
-            type: object
-          status:
-            description: WorkloadDefinitionStatus is the status of WorkloadDefinition
-            properties:
-              conditions:
-                description: Conditions of the resource.
-                items:
-                  description: A Condition that may apply to a resource.
-                  properties:
-                    lastTransitionTime:
-                      description: LastTransitionTime is the last time this condition
-                        transitioned from one status to another.
-                      format: date-time
-                      type: string
-                    message:
-                      description: A Message containing details about this condition's
-                        last transition from one status to another, if any.
-                      type: string
-                    reason:
-                      description: A Reason for this condition's last transition from
-                        one status to another.
-                      type: string
-                    status:
-                      description: Status of this condition; is it currently True,
-                        False, or Unknown?
-                      type: string
-                    type:
-                      description: Type of this condition. At most one of each condition
-                        type may apply to a resource at any point in time.
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-            type: object
-        type: object
-    served: true
-    storage: false
-    subresources: {}
-  - additionalPrinterColumns:
-    - jsonPath: .spec.definitionRef.name
-      name: DEFINITION-NAME
-      type: string
-    - jsonPath: .metadata.annotations.definition\.oam\.dev/description
-      name: DESCRIPTION
-      type: string
-    name: v1beta1
-    schema:
-      openAPIV3Schema:
-        description: A WorkloadDefinition registers a kind of Kubernetes custom resource
-          as a valid OAM workload kind by referencing its CustomResourceDefinition.
-          The CRD is used to validate the schema of the workload when it is embedded
-          in an OAM Component.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: A WorkloadDefinitionSpec defines the desired state of a WorkloadDefinition.
-            properties:
-              childResourceKinds:
-                description: ChildResourceKinds are the list of GVK of the child resources
-                  this workload generates
-                items:
-                  description: A ChildResourceKind defines a child Kubernetes resource
-                    kind with a selector
-                  properties:
-                    apiVersion:
-                      description: APIVersion of the child resource
-                      type: string
-                    kind:
-                      description: Kind of the child resource
-                      type: string
-                    selector:
-                      additionalProperties:
-                        type: string
-                      description: Selector to select the child resources that the
-                        workload wants to expose to traits
-                      type: object
-                  required:
-                  - apiVersion
-                  - kind
-                  type: object
-                type: array
-              definitionRef:
-                description: Reference to the CustomResourceDefinition that defines
-                  this workload kind.
-                properties:
-                  name:
-                    description: Name of the referenced CustomResourceDefinition.
-                    type: string
-                  version:
-                    description: Version indicate which version should be used if
-                      CRD has multiple versions by default it will use the first one
-                      if not specified
-                    type: string
-                required:
-                - name
-                type: object
-              extension:
-                description: Extension is used for extension needs by OAM platform
-                  builders
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              podSpecPath:
-                description: PodSpecPath indicates where/if this workload has K8s
-                  podSpec field if one workload has podSpec, trait can do lot's of
-                  assumption such as port, env, volume fields.
-                type: string
-              revisionLabel:
-                description: RevisionLabel indicates which label for underlying resources(e.g.
-                  pods) of this workload can be used by trait to create resource selectors(e.g.
-                  label selector for pods).
-                type: string
-              schematic:
-                description: Schematic defines the data format and template of the
-                  encapsulation of the workload
-                properties:
-                  cue:
-                    description: CUE defines the encapsulation in CUE format
-                    properties:
-                      template:
-                        description: Template defines the abstraction template data
-                          of the capability, it will replace the old CUE template
-                          in extension field. Template is a required field if CUE
-                          is defined in Capability Definition.
-                        type: string
-                    required:
-                    - template
-                    type: object
-                  helm:
-                    description: A Helm represents resources used by a Helm module
-                    properties:
-                      release:
-                        description: Release records a Helm release used by a Helm
-                          module workload.
-                        type: object
-                        x-kubernetes-preserve-unknown-fields: true
-                      repository:
-                        description: HelmRelease records a Helm repository used by
-                          a Helm module workload.
-                        type: object
-                        x-kubernetes-preserve-unknown-fields: true
-                    required:
-                    - release
-                    - repository
-                    type: object
-                  kube:
-                    description: Kube defines the encapsulation in raw Kubernetes
-                      resource format
-                    properties:
-                      parameters:
-                        description: Parameters defines configurable parameters
-                        items:
-                          description: A KubeParameter defines a configurable parameter
-                            of a component.
-                          properties:
-                            description:
-                              description: Description of this parameter.
-                              type: string
-                            fieldPaths:
-                              description: "FieldPaths specifies an array of fields
-                                within this workload that will be overwritten by the
-                                value of this parameter. \tAll fields must be of the
-                                same type. Fields are specified as JSON field paths
-                                without a leading dot, for example 'spec.replicas'."
-                              items:
-                                type: string
-                              type: array
-                            name:
-                              description: Name of this parameter
-                              type: string
-                            required:
-                              default: false
-                              description: Required specifies whether or not a value
-                                for this parameter must be supplied when authoring
-                                an Application.
-                              type: boolean
-                            type:
-                              description: 'ValueType indicates the type of the parameter
-                                value, and only supports basic data types: string,
-                                number, boolean.'
-                              enum:
-                              - string
-                              - number
-                              - boolean
-                              type: string
-                          required:
-                          - fieldPaths
-                          - name
-                          - type
-                          type: object
-                        type: array
-                      template:
-                        description: Template defines the raw Kubernetes resource
-                        type: object
-                        x-kubernetes-preserve-unknown-fields: true
-                    required:
-                    - template
-                    type: object
-                  terraform:
-                    description: Terraform is the struct to describe cloud resources
-                      managed by Hashicorp Terraform
-                    properties:
-                      configuration:
-                        description: Configuration is Terraform Configuration
-                        type: string
-                      customRegion:
-                        description: Region is cloud provider's region. It will override
-                          the region in the region field of ProviderReference
-                        type: string
-                      deleteResource:
-                        default: true
-                        description: DeleteResource will determine whether provisioned
-                          cloud resources will be deleted when CR is deleted
-                        type: boolean
-                      path:
-                        description: Path is the sub-directory of remote git repository.
-                          It's valid when remote is set
-                        type: string
-                      providerRef:
-                        description: ProviderReference specifies the reference to
-                          Provider
-                        properties:
-                          name:
-                            description: Name of the referenced object.
-                            type: string
-                          namespace:
-                            default: default
-                            description: Namespace of the referenced object.
-                            type: string
-                        required:
-                        - name
-                        type: object
-                      type:
-                        default: hcl
-                        description: Type specifies which Terraform configuration
-                          it is, HCL or JSON syntax
-                        enum:
-                        - hcl
-                        - json
-                        - remote
-                        type: string
-                      writeConnectionSecretToRef:
-                        description: WriteConnectionSecretToReference specifies the
-                          namespace and name of a Secret to which any connection details
-                          for this managed resource should be written. Connection
-                          details frequently include the endpoint, username, and password
-                          required to connect to the managed resource.
-                        properties:
-                          name:
-                            description: Name of the secret.
-                            type: string
-                          namespace:
-                            description: Namespace of the secret.
-                            type: string
-                        required:
-                        - name
-                        type: object
-                    required:
-                    - configuration
-                    type: object
-                type: object
-              status:
-                description: Status defines the custom health policy and status message
-                  for workload
-                properties:
-                  customStatus:
-                    description: CustomStatus defines the custom status message that
-                      could display to user
-                    type: string
-                  healthPolicy:
-                    description: HealthPolicy defines the health check policy for
-                      the abstraction
-                    type: string
-                type: object
-            required:
-            - definitionRef
-            type: object
-          status:
-            description: WorkloadDefinitionStatus is the status of WorkloadDefinition
-            properties:
-              conditions:
-                description: Conditions of the resource.
-                items:
-                  description: A Condition that may apply to a resource.
-                  properties:
-                    lastTransitionTime:
-                      description: LastTransitionTime is the last time this condition
-                        transitioned from one status to another.
-                      format: date-time
-                      type: string
-                    message:
-                      description: A Message containing details about this condition's
-                        last transition from one status to another, if any.
-                      type: string
-                    reason:
-                      description: A Reason for this condition's last transition from
-                        one status to another.
-                      type: string
-                    status:
-                      description: Status of this condition; is it currently True,
-                        False, or Unknown?
-                      type: string
-                    type:
-                      description: Type of this condition. At most one of each condition
-                        type may apply to a resource at any point in time.
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

charts/oam-runtime/templates/NOTES.txt

@@ -1 +0,0 @@
-Welcome to use the oam-runtime follows OAM spec v0.2! Enjoy your shipping application journey!

charts/oam-runtime/templates/_helpers.tpl

@@ -1,63 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "oam-runtime.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "oam-runtime.fullname" -}}
-{{- if .Values.fullnameOverride -}}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- $name := default .Chart.Name .Values.nameOverride -}}
-{{- if contains $name .Release.Name -}}
-{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "oam-runtime.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-Common labels
-*/}}
-{{- define "oam-runtime.labels" -}}
-helm.sh/chart: {{ include "oam-runtime.chart" . }}
-{{ include "oam-runtime.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end -}}
-
-{{/*
-Selector labels
-*/}}
-{{- define "oam-runtime.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "oam-runtime.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end -}}
-
-{{/*
-Create the name of the service account to use
-*/}}
-{{- define "oam-runtime.serviceAccountName" -}}
-{{- if .Values.serviceAccount.create -}}
-    {{ default (include "oam-runtime.fullname" .) .Values.serviceAccount.name }}
-{{- else -}}
-    {{ default "default" .Values.serviceAccount.name }}
-{{- end -}}
-{{- end -}}

charts/oam-runtime/templates/admission-webhooks/job-patch/clusterrole.yaml

@@ -1,28 +0,0 @@
-{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled .Values.rbac.create (not .Values.admissionWebhooks.certManager.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name:  {{ template "oam-runtime.fullname" . }}-admission
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    app: {{ template "oam-runtime.name" . }}-admission
-    {{- include "oam-runtime.labels" . | nindent 4 }}
-rules:
-  - apiGroups:
-      - admissionregistration.k8s.io
-    resources:
-      - validatingwebhookconfigurations
-      - mutatingwebhookconfigurations
-    verbs:
-      - get
-      - update
-  - apiGroups:
-      - apiextensions.k8s.io
-    resources:
-      - customresourcedefinitions
-    verbs:
-      - get
-      - update
-{{- end }}

charts/oam-runtime/templates/admission-webhooks/job-patch/clusterrolebinding.yaml

@@ -1,20 +0,0 @@
-{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled .Values.rbac.create (not .Values.admissionWebhooks.certManager.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name:  {{ template "oam-runtime.fullname" . }}-admission
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    app: {{ template "oam-runtime.name" . }}-admission
-    {{- include "oam-runtime.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "oam-runtime.fullname" . }}-admission
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "oam-runtime.fullname" . }}-admission
-    namespace: {{ .Release.Namespace }}
-{{- end }}

charts/oam-runtime/templates/admission-webhooks/job-patch/job-createSecret.yaml

@@ -1,54 +0,0 @@
-{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled (not .Values.admissionWebhooks.certManager.enabled) }}
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name:  {{ template "oam-runtime.fullname" . }}-admission-create
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    app: {{ template "oam-runtime.name" . }}-admission-create
-    {{- include "oam-runtime.labels" . | nindent 4 }}
-spec:
-  {{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }}
-  # Alpha feature since k8s 1.12
-  ttlSecondsAfterFinished: 0
-  {{- end }}
-  template:
-    metadata:
-      name:  {{ template "oam-runtime.fullname" . }}-admission-create
-      labels:
-        app: {{ template "oam-runtime.name" . }}-admission-create
-        {{- include "oam-runtime.labels" . | nindent 8 }}
-    spec:
-      containers:
-        - name: create
-          image: {{ .Values.imageRegistry }}{{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
-          imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
-          args:
-            - create
-            - --host={{ template "oam-runtime.name" . }}-webhook,{{ template "oam-runtime.name" . }}-webhook.{{ .Release.Namespace }}.svc
-            - --namespace={{ .Release.Namespace }}
-            - --secret-name={{ template "oam-runtime.fullname" . }}-admission
-            - --key-name=tls.key
-            - --cert-name=tls.crt
-      restartPolicy: OnFailure
-      serviceAccountName: {{ template "oam-runtime.fullname" . }}-admission
-      {{- with .Values.admissionWebhooks.patch.nodeSelector }}
-      nodeSelector:
-      {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.admissionWebhooks.patch.affinity }}
-      affinity:
-{{ toYaml . | indent 8 }}
-      {{- end }}
-      {{- with .Values.admissionWebhooks.patch.tolerations }}
-      tolerations:
-{{ toYaml . | indent 8 }}
-      {{- end }}
-      securityContext:
-        runAsGroup: 2000
-        runAsNonRoot: true
-        runAsUser: 2000
-{{- end }}

charts/oam-runtime/templates/admission-webhooks/job-patch/job-patchWebhook.yaml

@@ -1,53 +0,0 @@
-{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled (not .Values.admissionWebhooks.certManager.enabled) }}
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name:  {{ template "oam-runtime.fullname" . }}-admission-patch
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    "helm.sh/hook": post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    app: {{ template "oam-runtime.name" . }}-admission-patch
-    {{- include "oam-runtime.labels" . | nindent 4 }}
-spec:
-  {{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }}
-  # Alpha feature since k8s 1.12
-  ttlSecondsAfterFinished: 0
-  {{- end }}
-  template:
-    metadata:
-      name:  {{ template "oam-runtime.fullname" . }}-admission-patch
-      labels:
-        app: {{ template "oam-runtime.name" . }}-admission-patch
-        {{- include "oam-runtime.labels" . | nindent 8 }}
-    spec:
-      containers:
-        - name: patch
-          image: {{ .Values.imageRegistry }}{{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
-          imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
-          args:
-            - patch
-            - --webhook-name={{ template "oam-runtime.fullname" . }}-admission
-            - --namespace={{ .Release.Namespace }}
-            - --secret-name={{ template "oam-runtime.fullname" . }}-admission
-            - --patch-failure-policy={{ .Values.admissionWebhooks.failurePolicy }}
-      restartPolicy: OnFailure
-      serviceAccountName: {{ template "oam-runtime.fullname" . }}-admission
-      {{- with .Values.admissionWebhooks.patch.nodeSelector }}
-      nodeSelector:
-      {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.admissionWebhooks.patch.affinity }}
-      affinity:
-      {{ toYaml . | indent 8 }}
-      {{- end }}
-      {{- with .Values.admissionWebhooks.patch.tolerations }}
-      tolerations:
-      {{ toYaml . | indent 8 }}
-      {{- end }}
-      securityContext:
-        runAsGroup: 2000
-        runAsNonRoot: true
-        runAsUser: 2000
-{{- end }}

charts/oam-runtime/templates/admission-webhooks/job-patch/role.yaml

@@ -1,21 +0,0 @@
-{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled .Values.rbac.create (not .Values.admissionWebhooks.certManager.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name:  {{ template "oam-runtime.fullname" . }}-admission
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    app: {{ template "oam-runtime.name" . }}-admission
-    {{- include "oam-runtime.labels" . | nindent 4 }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get
-      - create
-{{- end }}

charts/oam-runtime/templates/admission-webhooks/job-patch/rolebinding.yaml

@@ -1,21 +0,0 @@
-{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled .Values.rbac.create (not .Values.admissionWebhooks.certManager.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name:  {{ template "oam-runtime.fullname" . }}-admission
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    app: {{ template "oam-runtime.name" . }}-admission
-    {{- include "oam-runtime.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ template "oam-runtime.fullname" . }}-admission
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "oam-runtime.fullname" . }}-admission
-    namespace: {{ .Release.Namespace }}
-{{- end }}

charts/oam-runtime/templates/admission-webhooks/job-patch/serviceaccount.yaml

@@ -1,13 +0,0 @@
-{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled .Values.rbac.create (not .Values.admissionWebhooks.certManager.enabled) }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name:  {{ template "oam-runtime.fullname" . }}-admission
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    app: {{ template "oam-runtime.name" . }}-admission
-    {{- include "oam-runtime.labels" . | nindent 4 }}
-{{- end }}

charts/oam-runtime/templates/admission-webhooks/mutatingWebhookConfiguration.yaml

@@ -1,69 +0,0 @@
-{{- if .Values.admissionWebhooks.enabled -}}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-  name: {{ template "oam-runtime.fullname" . }}-admission
-  namespace: {{ .Release.Namespace }}
-  {{- if .Values.admissionWebhooks.certManager.enabled }}
-  annotations:
-    cert-manager.io/inject-ca-from: {{ printf "%s/%s-root-cert" .Release.Namespace (include "oam-runtime.fullname" .) | quote }}
-  {{- end }}
-webhooks:
-  - clientConfig:
-      caBundle: Cg==
-      service:
-        name: {{ template "oam-runtime.name" . }}-webhook
-        namespace: {{ .Release.Namespace }}
-        path: /mutating-core-oam-dev-v1alpha2-applicationconfigurations
-    {{- if .Values.admissionWebhooks.patch.enabled  }}
-    failurePolicy: Ignore
-    {{- else }}
-    failurePolicy: Fail
-    {{- end }}
-    name: mutating.core.oam.dev.v1alpha2.applicationconfigurations
-    sideEffects: None
-    rules:
-      - apiGroups:
-          - core.oam.dev
-        apiVersions:
-          - v1alpha2
-        operations:
-          - CREATE
-          - UPDATE
-        resources:
-          - applicationconfigurations
-        scope: Namespaced
-    admissionReviewVersions:
-      - v1beta1
-      - v1
-    timeoutSeconds: 5
-  - clientConfig:
-      caBundle: Cg==
-      service:
-        name: {{ template "oam-runtime.name" . }}-webhook
-        namespace: {{ .Release.Namespace }}
-        path: /mutating-core-oam-dev-v1alpha2-components
-    {{- if .Values.admissionWebhooks.patch.enabled  }}
-    failurePolicy: Ignore
-    {{- else }}
-    failurePolicy: Fail
-    {{- end }}
-    name: mutating.core.oam-dev.v1alpha2.components
-    sideEffects: None
-    rules:
-      - apiGroups:
-          - core.oam.dev
-        apiVersions:
-          - v1alpha2
-        operations:
-          - CREATE
-          - UPDATE
-        resources:
-          - components
-        scope: Namespaced
-    admissionReviewVersions:
-      - v1beta1
-      - v1
-    timeoutSeconds: 5
-
-{{- end -}}

charts/oam-runtime/templates/admission-webhooks/validatingWebhookConfiguration.yaml

@@ -1,69 +0,0 @@
-{{- if .Values.admissionWebhooks.enabled -}}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: {{ template "oam-runtime.fullname" . }}-admission
-  namespace: {{ .Release.Namespace }}
-  {{- if .Values.admissionWebhooks.certManager.enabled }}
-  annotations:
-    cert-manager.io/inject-ca-from: {{ printf "%s/%s-root-cert" .Release.Namespace (include "oam-runtime.fullname" .) | quote }}
-  {{- end }}
-webhooks:
-  - clientConfig:
-      caBundle: Cg==
-      service:
-        name: {{ template "oam-runtime.name" . }}-webhook
-        namespace: {{ .Release.Namespace }}
-        path: /validating-core-oam-dev-v1alpha2-applicationconfigurations
-    {{- if .Values.admissionWebhooks.patch.enabled  }}
-    failurePolicy: Ignore
-    {{- else }}
-    failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
-    {{- end }}
-    name: validating.core.oam.dev.v1alpha2.applicationconfigurations
-    sideEffects: None
-    rules:
-      - apiGroups:
-          - core.oam.dev
-        apiVersions:
-          - v1alpha2
-        operations:
-          - CREATE
-          - UPDATE
-        resources:
-          - applicationconfigurations
-        scope: Namespaced
-    admissionReviewVersions:
-      - v1beta1
-      - v1
-    timeoutSeconds: 5
-  - clientConfig:
-      caBundle: Cg==
-      service:
-        name: {{ template "oam-runtime.name" . }}-webhook
-        namespace: {{ .Release.Namespace }}
-        path: /validating-core-oam-dev-v1alpha2-components
-    {{- if .Values.admissionWebhooks.patch.enabled  }}
-    failurePolicy: Ignore
-    {{- else }}
-    failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
-    {{- end }}
-    name: validating.core.oam.dev.v1alpha2.components
-    sideEffects: None
-    rules:
-      - apiGroups:
-          - core.oam.dev
-        apiVersions:
-          - v1alpha2
-        operations:
-          - CREATE
-          - UPDATE
-        resources:
-          - components
-        scope: Namespaced
-    admissionReviewVersions:
-      - v1beta1
-      - v1
-    timeoutSeconds: 5
-          
-{{- end -}}

charts/oam-runtime/templates/admission-webhooks/webhookService.yaml

@@ -1,19 +0,0 @@
-{{- if .Values.admissionWebhooks.enabled -}}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ template "oam-runtime.name" . }}-webhook
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "oam-runtime.labels" . | nindent 4 }}
-spec:
-  type: {{ .Values.webhookService.type }}
-  ports:
-    - port: 443
-      targetPort: {{ .Values.webhookService.port }}
-      protocol: TCP
-      name: https
-  selector:
-    {{ include "oam-runtime.selectorLabels" . | nindent 6 }}
-
-{{- end -}}

charts/oam-runtime/templates/certmanager.yaml

@@ -1,55 +0,0 @@
-{{- if and .Values.admissionWebhooks.certManager.enabled -}}
-
-# The following manifests contain a self-signed issuer CR and a certificate CR.
-# More document can be found at https://docs.cert-manager.io
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: {{ template "oam-runtime.fullname" . }}-self-signed-issuer
-spec:
-  selfSigned: {}
-
----
-# Generate a CA Certificate used to sign certificates for the webhook
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: {{ template "oam-runtime.fullname" . }}-root-cert
-spec:
-  secretName: {{ template "oam-runtime.fullname" . }}-root-cert
-  duration: 43800h # 5y
-  revisionHistoryLimit: {{ .Values.admissionWebhooks.certManager.revisionHistoryLimit }}
-  issuerRef:
-    name: {{ template "oam-runtime.fullname" . }}-self-signed-issuer
-  commonName: "ca.webhook.oam-runtime"
-  isCA: true
-  
----
-# Create an Issuer that uses the above generated CA certificate to issue certs
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: {{ template "oam-runtime.fullname" . }}-root-issuer
-  namespace: {{ .Release.Namespace }}
-spec:
-  ca:
-    secretName: {{ template "oam-runtime.fullname" . }}-root-cert
-
----
-# generate a serving certificate for the apiservices to use
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: {{ template "oam-runtime.fullname" . }}-admission
-  namespace: {{ .Release.Namespace }}
-spec:
-  secretName: {{ template "oam-runtime.fullname" . }}-admission
-  duration: 8760h # 1y
-  revisionHistoryLimit: {{ .Values.admissionWebhooks.certManager.revisionHistoryLimit }}
-  issuerRef:
-    name: {{ template "oam-runtime.fullname" . }}-root-issuer
-  dnsNames:
-    - {{ template "oam-runtime.name" . }}-webhook.{{ .Release.Namespace }}.svc
-    - {{ template "oam-runtime.name" . }}-webhook.{{ .Release.Namespace }}.svc.cluster.local
-
-{{- end }}