Chore: upgrade moby dependency to fix security issue (#5937)

Signed-off-by: Somefive <yd219913@alibaba-inc.com>

.github/CODEOWNERS

@@ -1,39 +1,39 @@
 # This file is a github code protect rule follow the codeowners https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/creating-a-repository-on-github/about-code-owners#example-of-a-codeowners-file
 
-*                                  @barnettZQG @wonderflow @leejanee @Somefive @jefree-cat @FogDong
+*                                  @barnettZQG @wonderflow @leejanee @Somefive @jefree-cat @FogDong @wangyikewxgm @chivalryq
 design/                            @barnettZQG @leejanee @wonderflow @Somefive @jefree-cat @FogDong
 
 # Owner of Core Controllers
-pkg/controller/core.oam.dev       @Somefive @FogDong @barnettZQG @wonderflow
+pkg/controller/core.oam.dev       @Somefive @FogDong @barnettZQG @wonderflow @wangyikewxgm @chivalryq
 
 # Owner of Standard Controllers
-pkg/controller/standard.oam.dev   @wangyikewxgm @barnettZQG @wonderflow
+pkg/controller/standard.oam.dev   @wangyikewxgm @barnettZQG @wonderflow @Somefive
 
 # Owner of CUE
 pkg/cue                            @leejanee @FogDong @Somefive
 pkg/stdlib                         @leejanee @FogDong @Somefive
 
 # Owner of Workflow
-pkg/workflow                       @leejanee @FogDong @Somefive
+pkg/workflow                       @leejanee @FogDong @Somefive @wangyikewxgm @chivalryq
 
 # Owner of rollout
 pkg/controller/common/rollout/     @wangyikewxgm @wonderflow
 runtime/rollout                    @wangyikewxgm @wonderflow
 
 # Owner of vela templates
-vela-templates/                     @Somefive @barnettZQG @wonderflow @FogDong
+vela-templates/                     @Somefive @barnettZQG @wonderflow @FogDong @wangyikewxgm @chivalryq
 
 # Owner of vela CLI
-references/cli/                     @Somefive @zzxwill @StevenLeiZhang @charlie0129 @chivalryq
+references/cli/                     @Somefive @zzxwill @StevenLeiZhang @charlie0129 @wangyikewxgm @chivalryq
 
 # Owner of vela addon framework
 pkg/addon/                         @wangyikewxgm @wonderflow @charlie0129
 
 # Owner of resource keeper and tracker
-pkg/resourcekeeper                 @Somefive @FogDong
-pkg/resourcetracker                @Somefive @FogDong
+pkg/resourcekeeper                 @Somefive @FogDong @chivalryq
+pkg/resourcetracker                @Somefive @FogDong @chivalryq
 
-.github/                           @chivalryq @wonderflow
-makefiles                          @chivalryq @wonderflow
-go.*                               @chivalryq @wonderflow
+.github/                           @chivalryq @wonderflow @Somefive @FogDong @wangyikewxgm
+makefiles                          @chivalryq @wonderflow @Somefive @FogDong @wangyikewxgm
+go.*                               @chivalryq @wonderflow @Somefive @FogDong @wangyikewxgm
 

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,8 @@
 
 ### Description of your changes
 
+copilot:all
+
 <!--
 
 Briefly describe what this pull request does. We love pull requests that resolve an open KubeVela issue. If yours does, you

.github/workflows/back-port.yml

@@ -10,14 +10,14 @@ permissions:
 jobs:
   # align with crossplane's choice https://github.com/crossplane/crossplane/blob/master/.github/workflows/backport.yml
   open-pr:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     if: github.event.pull_request.merged
     permissions:
       contents: write
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
         with:
           fetch-depth: 0
 

.github/workflows/chart.yml

@@ -29,9 +29,9 @@ jobs:
       MINIMAL_HELM_CHART_NAME: vela-minimal
       LEGACY_HELM_CHART_NAME: vela-core-legacy
       VELA_ROLLOUT_HELM_CHART_NAME: vela-rollout
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
       - name: Get git revision
         id: vars
         shell: bash

.github/workflows/codeql-analysis.yml

@@ -10,7 +10,7 @@ permissions:
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     permissions:
       actions: read  # for github/codeql-action/init to get workflow details
@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # v2.1.37

.github/workflows/commit-lint.yml

@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   check:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: thehanimo/pr-title-checker@v1.3.7
         with:

.github/workflows/core-api-test.yml

@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   core-api-test:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
       - name: Set up Go 1.19
         uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9
@@ -25,7 +25,7 @@ jobs:
         id: go
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
 
       - name: Get the version
         id: get_version

.github/workflows/definition-lint.yml

@@ -20,7 +20,7 @@ env:
 
 jobs:
   definition-doc:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: Setup Go
         uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9
@@ -28,7 +28,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
         with:
           submodules: true
 

.github/workflows/e2e-multicluster-test.yml

@@ -25,7 +25,7 @@ jobs:
   detect-noop:
     permissions:
       actions: write
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     outputs:
       noop: ${{ steps.noop.outputs.should_skip }}
     steps:
@@ -39,20 +39,27 @@ jobs:
         continue-on-error: true
 
   e2e-multi-cluster-tests:
-    runs-on: aliyun
+    runs-on: self-hosted
     needs: [ detect-noop ]
     if: needs.detect-noop.outputs.noop != 'true'
     strategy:
       matrix:
-        k8s-version: ["v1.20","v1.24"]
+        k8s-version: ["v1.26"]
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.k8s-version }}
       cancel-in-progress: true
 
-
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
+
+      - name: Install tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install make gcc jq ca-certificates curl gnupg -y
+          snap install docker
+          snap install kubectl --classic
+          snap install helm --classic
 
       - name: Setup Go
         uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9
@@ -71,7 +78,7 @@ jobs:
       - name: Calculate K3d args
         run: |
           EGRESS_ARG=""
-          if [[ "${{ matrix.k8s-version }}" == v1.24 ]]; then
+          if [[ "${{ matrix.k8s-version }}" == v1.26 ]]; then
             EGRESS_ARG="--k3s-arg --egress-selector-mode=disabled@server:0"
           fi
           echo "EGRESS_ARG=${EGRESS_ARG}" >> $GITHUB_ENV 
@@ -99,14 +106,13 @@ jobs:
           sed -i "s/0.0.0.0:[0-9]\+/$internal_ip:6443/"  /tmp/worker.kubeconfig
 
       - name: Load image to k3d cluster (hub and worker)
-        run: make image-load image-load-runtime-cluster
+        run: make image-load
 
       - name: Cleanup for e2e tests
         run: |
           make vela-cli
           make e2e-cleanup
           make e2e-setup-core-auth
-          make setup-runtime-e2e-cluster
 
       - name: Run e2e multicluster tests
         run: |
@@ -118,7 +124,7 @@ jobs:
           make end-e2e-core-shards
 
       - name: Upload coverage report
-        uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70
+        uses: codecov/codecov-action@894ff025c7b54547a9a2a1e9f228beae737ad3c2
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: /tmp/e2e-profile.out,/tmp/e2e_multicluster_test.out
@@ -130,4 +136,6 @@ jobs:
 
       - name: Cleanup image
         if: ${{ always() }}
-        run: make image-cleanup
+        run: |
+          make image-cleanup
+          docker image prune -f --filter "until=24h"

.github/workflows/e2e-rollout-test.yml

@@ -1,17 +1,17 @@
 name: E2E Rollout Test
 
 on:
-  push:
-    branches:
-      - master
-      - release-*
-    tags:
-      - v*
+#  push:
+#    branches:
+#      - master
+#      - release-*
+#    tags:
+#      - v*
   workflow_dispatch: {}
-  pull_request:
-    branches:
-      - master
-      - release-*
+#  pull_request:
+#    branches:
+#      - master
+#      - release-*
 
 permissions:
   contents: read
@@ -25,7 +25,7 @@ jobs:
   detect-noop:
     permissions:
       actions: write
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     outputs:
       noop: ${{ steps.noop.outputs.should_skip }}
     steps:
@@ -39,12 +39,12 @@ jobs:
         continue-on-error: true
 
   e2e-rollout-tests:
-    runs-on: aliyun
+    runs-on: self-hosted
     needs: [ detect-noop ]
     if: needs.detect-noop.outputs.noop != 'true'
     strategy:
       matrix:
-        k8s-version: ["v1.20","v1.24"]
+        k8s-version: ["v1.26"]
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.k8s-version }}
       cancel-in-progress: true
@@ -52,7 +52,7 @@ jobs:
 
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
 
       - name: Setup Go
         uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9
@@ -63,6 +63,11 @@ jobs:
         run: |
           go get -v -t -d ./...
 
+      - name: Get Ginkgo
+        run: |
+          go install github.com/onsi/ginkgo/ginkgo
+          go get github.com/onsi/gomega/...
+
       - name: Tear down K3d if exist
         run: |
           k3d cluster delete || true
@@ -71,7 +76,7 @@ jobs:
       - name: Calculate K3d args
         run: |
           EGRESS_ARG=""
-          if [[ "${{ matrix.k8s-version }}" == v1.24 ]]; then
+          if [[ "${{ matrix.k8s-version }}" == v1.26 ]]; then
             EGRESS_ARG="--k3s-arg --egress-selector-mode=disabled@server:0"
           fi
           echo "EGRESS_ARG=${EGRESS_ARG}" >> $GITHUB_ENV 
@@ -101,7 +106,7 @@ jobs:
         run: make end-e2e
 
       - name: Upload coverage report
-        uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70
+        uses: codecov/codecov-action@894ff025c7b54547a9a2a1e9f228beae737ad3c2
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: /tmp/e2e-profile.out
@@ -113,4 +118,7 @@ jobs:
 
       - name: Cleanup image
         if: ${{ always() }}
-        run: make image-cleanup
+        run: |
+          make image-cleanup
+          docker image prune -a -f --filter "until=24h"
+

.github/workflows/e2e-test.yml

@@ -25,7 +25,7 @@ jobs:
   detect-noop:
     permissions:
       actions: write
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     outputs:
       noop: ${{ steps.noop.outputs.should_skip }}
     steps:
@@ -39,20 +39,27 @@ jobs:
         continue-on-error: true
 
   e2e-tests:
-    runs-on: aliyun
+    runs-on: self-hosted
     needs: [ detect-noop ]
     if: needs.detect-noop.outputs.noop != 'true'
     strategy:
       matrix:
-        k8s-version: ["v1.20","v1.24"]
+        k8s-version: ["v1.26"]
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.k8s-version }}
       cancel-in-progress: true
 
-
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
+
+      - name: Install tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install make gcc jq ca-certificates curl gnupg -y
+          snap install docker
+          snap install kubectl --classic
+          snap install helm --classic
 
       - name: Setup Go
         uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9
@@ -63,6 +70,11 @@ jobs:
         run: |
           go get -v -t -d ./...
 
+      - name: Get Ginkgo
+        run: |
+          go install github.com/onsi/ginkgo/ginkgo
+          go get github.com/onsi/gomega/...
+
       - name: Tear down K3d if exist
         run: |
           k3d cluster delete || true
@@ -71,7 +83,7 @@ jobs:
       - name: Calculate K3d args
         run: |
           EGRESS_ARG=""
-          if [[ "${{ matrix.k8s-version }}" == v1.24 ]]; then
+          if [[ "${{ matrix.k8s-version }}" == v1.26 ]]; then
             EGRESS_ARG="--k3s-arg --egress-selector-mode=disabled@server:0"
           fi
           echo "EGRESS_ARG=${EGRESS_ARG}" >> $GITHUB_ENV 
@@ -108,7 +120,7 @@ jobs:
         run: make end-e2e
 
       - name: Upload coverage report
-        uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70
+        uses: codecov/codecov-action@894ff025c7b54547a9a2a1e9f228beae737ad3c2
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: /tmp/e2e-profile.out
@@ -120,4 +132,6 @@ jobs:
 
       - name: Cleanup image
         if: ${{ always() }}
-        run: make image-cleanup
+        run: |
+          make image-cleanup
+          docker image prune -f --filter "until=24h"

.github/workflows/go.yml

@@ -22,7 +22,7 @@ env:
 jobs:
 
   detect-noop:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     outputs:
       noop: ${{ steps.noop.outputs.should_skip }}
     permissions:
@@ -38,7 +38,7 @@ jobs:
         continue-on-error: true
 
   staticcheck:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     needs: detect-noop
     if: needs.detect-noop.outputs.noop != 'true'
 
@@ -49,7 +49,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
         with:
           submodules: true
 
@@ -60,7 +60,7 @@ jobs:
         run: make check-license-header
 
   lint:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     needs: detect-noop
     if: needs.detect-noop.outputs.noop != 'true'
     permissions:
@@ -74,7 +74,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
         with:
           submodules: true
 
@@ -88,13 +88,13 @@ jobs:
           version: ${{ env.GOLANGCI_VERSION }}
 
   check-diff:
-    runs-on: aliyun
+    runs-on: ubuntu-22.04
     needs: detect-noop
     if: needs.detect-noop.outputs.noop != 'true'
 
     steps:
       - name: Checkout
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
         with:
           submodules: true
 
@@ -115,6 +115,16 @@ jobs:
           key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }}
           restore-keys: ${{ runner.os }}-pkg-
 
+      - name: Tear down K3d if exist
+        run: |
+          k3d cluster delete || true
+
+      - name: Setup K3d (Hub)
+        uses: nolar/setup-k3d-k3s@293b8e5822a20bc0d5bcdd4826f1a665e72aba96
+        with:
+          version: ${{ matrix.k8s-version }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Run cross-build
         run: make cross-build
 
@@ -133,7 +143,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
         with:
           submodules: true
 
@@ -159,12 +169,12 @@ jobs:
           .\bin\vela.exe version
 
   check-core-image-build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     needs: detect-noop
     if: needs.detect-noop.outputs.noop != 'true'
     steps:
       - name: Checkout
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
         with:
           submodules: true
       - name: Set up QEMU
@@ -179,12 +189,12 @@ jobs:
           platforms: linux/amd64,linux/arm64
 
   check-cli-image-build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     needs: detect-noop
     if: needs.detect-noop.outputs.noop != 'true'
     steps:
       - name: Checkout
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
         with:
           submodules: true
       - name: Set up QEMU

.github/workflows/issue-commands.yml

@@ -1,4 +1,4 @@
-name: Run commands when issues are labeled or comments added
+name: Run commands for issues and pull requetss
 on:
   issues:
     types: [labeled, opened]
@@ -10,10 +10,10 @@ permissions:
 
 jobs:
   bot:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
         with:
           repository: "oam-dev/kubevela-github-actions"
           path: ./actions
@@ -51,7 +51,7 @@ jobs:
           allow-edits: "false"
           permission-level: read
       - name: Handle Command
-        uses: actions/github-script@98814c53be79b1d30f795b907e553d8679345975
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410
         env:
           VERSION: ${{ steps.command.outputs.command-arguments }}
         with:
@@ -72,7 +72,7 @@ jobs:
             })
             console.log("Added '" + label + "' label.")
       - name: Checkout
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
         with:
           fetch-depth: 0
       - name: Open Backport PR
@@ -80,3 +80,61 @@ jobs:
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           github_workspace: ${{ github.workspace }}
+
+  retest:
+    runs-on: ubuntu-22.04
+    if: github.event.issue.pull_request && contains(github.event.comment.body, '/retest')
+    permissions:
+      actions: write
+      contents: write
+      pull-requests: write
+      issues: write
+    steps:
+      - name: Retest the current pull request
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410
+        env:
+          PULL_REQUEST_ID: ${{ github.event.issue.number }}
+          COMMENT_ID: ${{ github.event.comment.id }}
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const pull_request_id = process.env.PULL_REQUEST_ID
+            const comment_id = process.env.COMMENT_ID
+            const comment_body = process.env.COMMENT_BODY
+            console.log("retest pr: #" + pull_request_id + " comment: " + comment_body)
+            const {data: pr} = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: pull_request_id,
+            })
+            console.log("pr: " + JSON.stringify(pr))
+            const action = comment_body.split(" ")[0]
+            let workflow_ids = comment_body.split(" ").slice(1).filter(line => line.length > 0).map(line => line + ".yml")
+            if (workflow_ids.length == 0) workflow_ids = ["go.yml", "unit-test.yml", "e2e-test.yml", "e2e-multicluster-test.yml"]
+            for (let i = 0; i < workflow_ids.length; i++) {
+              const workflow_id = workflow_ids[i]
+              const {data: runs} = await github.rest.actions.listWorkflowRuns({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: workflow_id,
+                head_sha: pr.head.sha,
+              })
+              console.log("runs for " + workflow_id + ": ", JSON.stringify(runs))
+              runs.workflow_runs.forEach((workflow_run) => {
+                if (workflow_run.status === "in_progress") return
+                let handler = github.rest.actions.reRunWorkflow
+                if (action === "/retest-failed") handler = github.rest.actions.reRunWorkflowFailedJobs
+                handler({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  run_id: workflow_run.id
+                })
+              })
+            }
+            github.rest.reactions.createForIssueComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              comment_id: comment_id,
+              content: "eyes",
+            });

.github/workflows/license.yml

@@ -15,10 +15,10 @@ permissions:
 
 jobs:
   license_check:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     name: Check for unapproved licenses
     steps:
-      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:

.github/workflows/registry.yml

@@ -18,9 +18,9 @@ jobs:
   publish-core-images:
     permissions:
       packages: write
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
       - name: Get the version
         id: get_version
         run: |
@@ -98,9 +98,9 @@ jobs:
   publish-addon-images:
     permissions:
       packages: write
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
       - name: Get the version
         id: get_version
         run: |
@@ -161,9 +161,9 @@ jobs:
       CAPABILITY_BUCKET: kubevela-registry
       CAPABILITY_DIR: capabilities
       CAPABILITY_ENDPOINT: oss-cn-beijing.aliyuncs.com
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
       - name: Install ossutil
         run: wget http://gosspublic.alicdn.com/ossutil/1.7.0/ossutil64 && chmod +x ossutil64 && mv ossutil64 ossutil
       - name: Configure Alibaba Cloud OSSUTIL

.github/workflows/release.yml

@@ -26,11 +26,11 @@ jobs:
       pull-requests: read
       repository-projects: read
       statuses: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     name: goreleaser
     steps:
       - name: Checkout
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
         with:
           fetch-depth: 0
       - run: git fetch --force --tags
@@ -78,16 +78,16 @@ jobs:
       repository-projects: read
       statuses: read
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     if: ${{ !contains(github.ref, 'alpha') && !contains(github.ref, 'beta') && !contains(github.ref, 'rc') }}
     name: upload-sha256sums
     steps:
       - name: Checkout
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
       - name: Update kubectl plugin version in krew-index
-        uses: rajatjindal/krew-release-bot@92da038bbf995803124a8e50ebd438b2f37bbbb0 # v0.0.43
+        uses: rajatjindal/krew-release-bot@df3eb197549e3568be8b4767eec31c5e8e8e6ad8 # v0.0.46
       - name: Update Homebrew formula
-        uses: dawidd6/action-homebrew-bump-formula@e9b43cd30eec6ea80777e7e22e1526beb1675c18 # v3.9.0
+        uses: dawidd6/action-homebrew-bump-formula@d3667e5ae14df19579e4414897498e3e88f2f458 # v3.10.0
         with:
           token: ${{ secrets.HOMEBREW_TOKEN }}
           formula: kubevela

.github/workflows/scorecards.yml

@@ -12,7 +12,7 @@ permissions: read-all
 jobs:
   analysis:
     name: Scorecards analysis
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       # Needed to upload the results to code-scanning dashboard.
       security-events: write
@@ -23,12 +23,12 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@e38b1902ae4f44df626f11ba0734b14fb91f8f86 # tag=v2.1.2
+        uses: ossf/scorecard-action@80e868c13c90f172d68d1f4501dee99e2479f7af # tag=v2.1.3
         with:
           results_file: results.sarif
           results_format: sarif

.github/workflows/sdk-test.yml

@@ -23,10 +23,10 @@ env:
 
 jobs:
   sdk-tests:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
 
       - name: Setup Go
         uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9
@@ -42,10 +42,10 @@ jobs:
         run: make vela-cli
 
       - name: Build SDK
-        run: bin/vela def gen-api -f vela-templates/definitions/internal/ -o ./kubevela-go-sdk --package=github.com/kubevela-contrib/kubevela-go-sdk
+        run: bin/vela def gen-api -f vela-templates/definitions/internal/ -o ./kubevela-go-sdk --package=github.com/kubevela-contrib/kubevela-go-sdk --init
 
       - name: Validate SDK
         run: |
           cd kubevela-go-sdk
           go mod tidy
-          golangci-lint run --timeout 5m ./...
+          golangci-lint run --timeout 5m -e "exported:" -e "dot-imports" ./...

.github/workflows/sync-api.yml

@@ -15,7 +15,7 @@ env:
 
 jobs:
   sync-core-api:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
       - name: Set up Go
         uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9
@@ -23,7 +23,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
 
       - name: Get the version
         id: get_version

.github/workflows/sync-sdk.yaml

@@ -19,7 +19,7 @@ env:
 
 jobs:
   sync_sdk:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
       - name: Set up Go
         uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9
@@ -27,7 +27,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
 
       - name: Get the version
         id: get_version

.github/workflows/timed-task.yml

@@ -1,14 +0,0 @@
-name: Timed Task
-on:
-  schedule:
-    - cron: '* * * * *'
-
-permissions:
-  contents: read
-
-jobs:
-  clean-image:
-    runs-on: aliyun
-    steps:
-      - name: Cleanup image
-        run: docker image prune -f

.github/workflows/trivy-scan.yml

@@ -10,10 +10,10 @@ permissions:
 jobs:
   images:
     name: Image Scan
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: Checkout code
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
 
       - name: Build Vela Core image from Dockerfile
         run: |

.github/workflows/unit-test.yml

@@ -23,7 +23,7 @@ jobs:
   detect-noop:
     permissions:
       actions: write  # for fkirc/skip-duplicate-actions to skip or stop workflow runs
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     outputs:
       noop: ${{ steps.noop.outputs.should_skip }}
     steps:
@@ -37,7 +37,7 @@ jobs:
         continue-on-error: true
 
   unit-tests:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     needs: detect-noop
     if: needs.detect-noop.outputs.noop != 'true'
 
@@ -48,7 +48,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
         with:
           submodules: true
 
@@ -83,7 +83,7 @@ jobs:
         run: make test
 
       - name: Upload coverage report
-        uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70
+        uses: codecov/codecov-action@894ff025c7b54547a9a2a1e9f228beae737ad3c2
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           file: ./coverage.txt

Makefile

@@ -113,7 +113,7 @@ manifests: installcue kustomize
 	# TODO(yangsoon): kustomize will merge all CRD into a whole file, it may not work if we want patch more than one CRD in this way
 	$(KUSTOMIZE) build config/crd -o config/crd/base/core.oam.dev_applications.yaml
 	./hack/crd/cleanup.sh
-	go run ./hack/crd/dispatch/dispatch.go config/crd/base charts/vela-core/crds runtime/ charts/vela-minimal/crds
+	go run ./hack/crd/dispatch/dispatch.go config/crd/base charts/vela-core/crds
 	rm -f config/crd/base/*
 	./vela-templates/gen_definitions.sh
 
@@ -132,5 +132,4 @@ def-install:
 	./hack/utils/installdefinition.sh
 
 helm-doc-gen: helmdoc
-	readme-generator -v charts/vela-core/values.yaml -r charts/vela-core/README.md
-	readme-generator -v charts/vela-minimal/values.yaml -r charts/vela-minimal/README.md
+	readme-generator -v charts/vela-core/values.yaml -r charts/vela-core/README.md

apis/core.oam.dev/v1alpha1/garbagecollect_policy_types.go

@@ -31,6 +31,9 @@ type GarbageCollectPolicySpec struct {
 	// outdated resources will be kept until resourcetracker be deleted manually
 	KeepLegacyResource bool `json:"keepLegacyResource,omitempty"`
 
+	// ContinueOnFailure if is set, continue to execute gc when the workflow fails, by default gc will be executed only after the workflow succeeds
+	ContinueOnFailure bool `json:"continueOnFailure,omitempty"`
+
 	// Order defines the order of garbage collect
 	Order GarbageCollectOrder `json:"order,omitempty"`
 

apis/core.oam.dev/v1beta1/resourcetracker_types_test.go

@@ -200,11 +200,8 @@ func TestResourceTrackerCompression(t *testing.T) {
 		"../../../charts/vela-core/crds/core.oam.dev_applicationrevisions.yaml",
 		"../../../charts/vela-core/crds/core.oam.dev_applications.yaml",
 		"../../../charts/vela-core/crds/core.oam.dev_definitionrevisions.yaml",
-		"../../../charts/vela-core/crds/core.oam.dev_healthscopes.yaml",
 		"../../../charts/vela-core/crds/core.oam.dev_traitdefinitions.yaml",
 		"../../../charts/vela-core/crds/core.oam.dev_componentdefinitions.yaml",
-		"../../../charts/vela-core/crds/core.oam.dev_workloaddefinitions.yaml",
-		"../../../charts/vela-core/crds/standard.oam.dev_rollouts.yaml",
 		"../../../charts/vela-core/templates/kubevela-controller.yaml",
 		"../../../charts/vela-core/README.md",
 		"../../../pkg/velaql/providers/query/testdata/machinelearning.seldon.io_seldondeployments.yaml",

apis/types/capability.go

@@ -176,9 +176,8 @@ type Capability struct {
 	Namespace string `json:"namespace,omitempty"`
 
 	// Plugin Source
-	Source  *Source       `json:"source,omitempty"`
-	Install *Installation `json:"install,omitempty"`
-	CrdInfo *CRDInfo      `json:"crdInfo,omitempty"`
+	Source  *Source  `json:"source,omitempty"`
+	CrdInfo *CRDInfo `json:"crdInfo,omitempty"`
 
 	// Terraform
 	TerraformConfiguration string `json:"terraformConfiguration,omitempty"`

apis/types/multicluster.go

@@ -37,9 +37,6 @@ const (
 )
 
 var (
-	// AnnotationClusterAlias the annotation key for cluster alias
-	AnnotationClusterAlias = config.MetaApiGroupName + "/cluster-alias"
-
 	// AnnotationClusterVersion the annotation key for cluster version
 	AnnotationClusterVersion = config.MetaApiGroupName + "/cluster-version"
 )

apis/types/types.go

@@ -137,13 +137,19 @@ const (
 	TypeCD = "Continuous Delivery"
 
 	// TypeExtension defines one category
-	TypeExtension = "Managing Extension"
+	TypeExtension = "Managing Extensions"
 
 	// TypeSystem defines one category
-	TypeSystem = "Others"
+	TypeSystem = "System Tools"
 
-	// TypePlugin defines one category used in Kubectl Plugin
-	TypePlugin = "Plugin Command"
+	// TypeAuxiliary defines auxiliary commands
+	TypeAuxiliary = "Auxiliary Tools"
+
+	// TypePlatform defines platform management commands
+	TypePlatform = "Managing Platform"
+
+	// TypeLegacy defines legacy commands
+	TypeLegacy = "Legacy Commands"
 )
 
 // LabelArg is the argument `label` of a definition

charts/vela-core/README.md

@@ -38,17 +38,16 @@ helm install --create-namespace -n vela-system kubevela kubevela/vela-core --wai
 
 ### KubeVela core parameters
 
-| Name                          | Description                                                                                   | Value     |
-| ----------------------------- | --------------------------------------------------------------------------------------------- | --------- |
-| `systemDefinitionNamespace`   | System definition namespace, if unspecified, will use built-in variable `.Release.Namespace`. | `nil`     |
-| `applicationRevisionLimit`    | Application revision limit                                                                    | `2`       |
-| `definitionRevisionLimit`     | Definition revision limit                                                                     | `2`       |
-| `concurrentReconciles`        | concurrentReconciles is the concurrent reconcile number of the controller                     | `4`       |
-| `controllerArgs.reSyncPeriod` | The period for resync the applications                                                        | `5m`      |
-| `OAMSpecVer`                  | OAMSpecVer is the oam spec version controller want to setup                                   | `v0.3`    |
-| `disableCaps`                 | Disable capability                                                                            | `rollout` |
-| `dependCheckWait`             | dependCheckWait is the time to wait for ApplicationConfiguration's dependent-resource ready   | `30s`     |
-
+| Name                          | Description                                                                                   | Value  |
+| ----------------------------- | --------------------------------------------------------------------------------------------- | ------ |
+| `systemDefinitionNamespace`   | System definition namespace, if unspecified, will use built-in variable `.Release.Namespace`. | `nil`  |
+| `applicationRevisionLimit`    | Application revision limit                                                                    | `2`    |
+| `definitionRevisionLimit`     | Definition revision limit                                                                     | `2`    |
+| `concurrentReconciles`        | concurrentReconciles is the concurrent reconcile number of the controller                     | `4`    |
+| `controllerArgs.reSyncPeriod` | The period for resync the applications                                                        | `5m`   |
+| `OAMSpecVer`                  | OAMSpecVer is the oam spec version controller want to setup                                   | `v0.3` |
+| `disableCaps`                 | Disable capability                                                                            | `all`  |
+| `dependCheckWait`             | dependCheckWait is the time to wait for ApplicationConfiguration's dependent-resource ready   | `30s`  |
 
 ### KubeVela workflow parameters
 
@@ -59,7 +58,6 @@ helm install --create-namespace -n vela-system kubevela kubevela/vela-core --wai
 | `workflow.backoff.maxTime.failedState` | The max backoff time of workflow in a failed condition | `300`   |
 | `workflow.step.errorRetryTimes`        | The max retry times of a failed workflow step          | `10`    |
 
-
 ### KubeVela controller parameters
 
 | Name                        | Description                          | Value              |
@@ -77,7 +75,6 @@ helm install --create-namespace -n vela-system kubevela kubevela/vela-core --wai
 | `webhookService.port`       | KubeVela webhook service port        | `9443`             |
 | `healthCheck.port`          | KubeVela health check port           | `9440`             |
 
-
 ### KubeVela controller optimization parameters
 
 | Name                                                         | Description                                                                                                                                                                                                                      | Value   |
@@ -104,7 +101,6 @@ helm install --create-namespace -n vela-system kubevela kubevela/vela-core --wai
 | `featureGates.sharedDefinitionStorageForApplicationRevision` | use definition cache to reduce duplicated definition storage for application revision, must be used with InformerCacheFilterUnnecessaryFields                                                                                    | `true`  |
 | `featureGates.disableWorkflowContextConfigMapCache`          | disable the workflow context's configmap informer cache                                                                                                                                                                          | `true`  |
 
-
 ### MultiCluster parameters
 
 | Name                                                        | Description                                                                                 | Value                            |
@@ -115,7 +111,7 @@ helm install --create-namespace -n vela-system kubevela kubevela/vela-core --wai
 | `multicluster.clusterGateway.replicaCount`                  | ClusterGateway replica count                                                                | `1`                              |
 | `multicluster.clusterGateway.port`                          | ClusterGateway port                                                                         | `9443`                           |
 | `multicluster.clusterGateway.image.repository`              | ClusterGateway image repository                                                             | `oamdev/cluster-gateway`         |
-| `multicluster.clusterGateway.image.tag`                     | ClusterGateway image tag                                                                    | `v1.8.0`                         |
+| `multicluster.clusterGateway.image.tag`                     | ClusterGateway image tag                                                                    | `v1.9.0-alpha.2`                 |
 | `multicluster.clusterGateway.image.pullPolicy`              | ClusterGateway image pull policy                                                            | `IfNotPresent`                   |
 | `multicluster.clusterGateway.resources.requests.cpu`        | ClusterGateway cpu request                                                                  | `50m`                            |
 | `multicluster.clusterGateway.resources.requests.memory`     | ClusterGateway memory request                                                               | `20Mi`                           |
@@ -125,7 +121,6 @@ helm install --create-namespace -n vela-system kubevela kubevela/vela-core --wai
 | `multicluster.clusterGateway.secureTLS.certPath`            | Path to the certificate file                                                                | `/etc/k8s-cluster-gateway-certs` |
 | `multicluster.clusterGateway.secureTLS.certManager.enabled` | Whether to enable cert-manager                                                              | `false`                          |
 
-
 ### Test parameters
 
 | Name                  | Description         | Value                |
@@ -135,7 +130,6 @@ helm install --create-namespace -n vela-system kubevela kubevela/vela-core --wai
 | `test.k8s.repository` | Test k8s repository | `oamdev/alpine-k8s`  |
 | `test.k8s.tag`        | Test k8s tag        | `1.18.2`             |
 
-
 ### Common parameters
 
 | Name                          | Description                                                                                                                                                        | Value                |

charts/vela-core/crds/core.oam.dev_applicationrevisions.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.11.3
   name: applicationrevisions.core.oam.dev
 spec:
   group: core.oam.dev
@@ -2306,6 +2306,11 @@ spec:
                                     alias:
                                       type: string
                                   type: object
+                                mode:
+                                  description: Mode is only valid for sub steps, it
+                                    defines the mode of the sub steps
+                                  nullable: true
+                                  type: string
                                 name:
                                   description: Name is the unique name of the workflow
                                     step.
@@ -4168,6 +4173,11 @@ spec:
                             alias:
                               type: string
                           type: object
+                        mode:
+                          description: Mode is only valid for sub steps, it defines
+                            the mode of the sub steps
+                          nullable: true
+                          type: string
                         name:
                           description: Name is the unique name of the workflow step.
                           type: string

charts/vela-core/crds/core.oam.dev_applications.yaml

@@ -3,7 +3,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     cert-manager.io/inject-ca-from: vela-system/kubevela-vela-core-root-cert
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.11.3
   name: applications.core.oam.dev
 spec:
   group: core.oam.dev
@@ -1068,6 +1068,11 @@ spec:
                             alias:
                               type: string
                           type: object
+                        mode:
+                          description: Mode is only valid for sub steps, it defines
+                            the mode of the sub steps
+                          nullable: true
+                          type: string
                         name:
                           description: Name is the unique name of the workflow step.
                           type: string

charts/vela-core/crds/core.oam.dev_componentdefinitions.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.11.3
   name: componentdefinitions.core.oam.dev
 spec:
   group: core.oam.dev

charts/vela-core/crds/core.oam.dev_definitionrevisions.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.11.3
   name: definitionrevisions.core.oam.dev
 spec:
   group: core.oam.dev

charts/vela-core/crds/core.oam.dev_healthscopes.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.11.3
   name: healthscopes.core.oam.dev
 spec:
   group: core.oam.dev

charts/vela-core/crds/core.oam.dev_policies.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.11.3
   name: policies.core.oam.dev
 spec:
   group: core.oam.dev

charts/vela-core/crds/core.oam.dev_policydefinitions.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.11.3
   name: policydefinitions.core.oam.dev
 spec:
   group: core.oam.dev

charts/vela-core/crds/core.oam.dev_resourcetrackers.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.11.3
   name: resourcetrackers.core.oam.dev
 spec:
   group: core.oam.dev

charts/vela-core/crds/core.oam.dev_scopedefinitions.yaml

@@ -1,146 +0,0 @@
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
-  name: scopedefinitions.core.oam.dev
-spec:
-  group: core.oam.dev
-  names:
-    categories:
-    - oam
-    kind: ScopeDefinition
-    listKind: ScopeDefinitionList
-    plural: scopedefinitions
-    shortNames:
-    - scope
-    singular: scopedefinition
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.definitionRef.name
-      name: DEFINITION-NAME
-      type: string
-    name: v1alpha2
-    schema:
-      openAPIV3Schema:
-        description: A ScopeDefinition registers a kind of Kubernetes custom resource
-          as a valid OAM scope kind by referencing its CustomResourceDefinition. The
-          CRD is used to validate the schema of the scope when it is embedded in an
-          OAM ApplicationConfiguration.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: A ScopeDefinitionSpec defines the desired state of a ScopeDefinition.
-            properties:
-              allowComponentOverlap:
-                description: AllowComponentOverlap specifies whether an OAM component
-                  may exist in multiple instances of this kind of scope.
-                type: boolean
-              definitionRef:
-                description: Reference to the CustomResourceDefinition that defines
-                  this scope kind.
-                properties:
-                  name:
-                    description: Name of the referenced CustomResourceDefinition.
-                    type: string
-                  version:
-                    description: Version indicate which version should be used if
-                      CRD has multiple versions by default it will use the first one
-                      if not specified
-                    type: string
-                required:
-                - name
-                type: object
-              extension:
-                description: Extension is used for extension needs by OAM platform
-                  builders
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              workloadRefsPath:
-                description: WorkloadRefsPath indicates if/where a scope accepts workloadRef
-                  objects
-                type: string
-            required:
-            - allowComponentOverlap
-            - definitionRef
-            type: object
-        type: object
-    served: true
-    storage: false
-    subresources: {}
-  - additionalPrinterColumns:
-    - jsonPath: .spec.definitionRef.name
-      name: DEFINITION-NAME
-      type: string
-    name: v1beta1
-    schema:
-      openAPIV3Schema:
-        description: A ScopeDefinition registers a kind of Kubernetes custom resource
-          as a valid OAM scope kind by referencing its CustomResourceDefinition. The
-          CRD is used to validate the schema of the scope when it is embedded in an
-          OAM ApplicationConfiguration.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: A ScopeDefinitionSpec defines the desired state of a ScopeDefinition.
-            properties:
-              allowComponentOverlap:
-                description: AllowComponentOverlap specifies whether an OAM component
-                  may exist in multiple instances of this kind of scope.
-                type: boolean
-              definitionRef:
-                description: Reference to the CustomResourceDefinition that defines
-                  this scope kind.
-                properties:
-                  name:
-                    description: Name of the referenced CustomResourceDefinition.
-                    type: string
-                  version:
-                    description: Version indicate which version should be used if
-                      CRD has multiple versions by default it will use the first one
-                      if not specified
-                    type: string
-                required:
-                - name
-                type: object
-              extension:
-                description: Extension is used for extension needs by OAM platform
-                  builders
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              workloadRefsPath:
-                description: WorkloadRefsPath indicates if/where a scope accepts workloadRef
-                  objects
-                type: string
-            required:
-            - allowComponentOverlap
-            - definitionRef
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources: {}

charts/vela-core/crds/core.oam.dev_traitdefinitions.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.11.3
   name: traitdefinitions.core.oam.dev
 spec:
   group: core.oam.dev

charts/vela-core/crds/core.oam.dev_workflowstepdefinitions.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.11.3
   name: workflowstepdefinitions.core.oam.dev
 spec:
   group: core.oam.dev

charts/vela-core/crds/core.oam.dev_workloaddefinitions.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.11.3
   name: workloaddefinitions.core.oam.dev
 spec:
   group: core.oam.dev

charts/vela-core/crds/standard.oam.dev_rollouts.yaml

@@ -1,477 +0,0 @@
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
-  name: rollouts.standard.oam.dev
-spec:
-  group: standard.oam.dev
-  names:
-    categories:
-    - oam
-    kind: Rollout
-    listKind: RolloutList
-    plural: rollouts
-    shortNames:
-    - rollout
-    singular: rollout
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .status.rolloutTargetSize
-      name: TARGET
-      type: string
-    - jsonPath: .status.upgradedReplicas
-      name: UPGRADED
-      type: string
-    - jsonPath: .status.upgradedReadyReplicas
-      name: READY
-      type: string
-    - jsonPath: .status.batchRollingState
-      name: BATCH-STATE
-      type: string
-    - jsonPath: .status.rollingState
-      name: ROLLING-STATE
-      type: string
-    - jsonPath: .metadata.creationTimestamp
-      name: AGE
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: Rollout is the Schema for the Rollout API
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: RolloutSpec defines how to describe an update between different
-              compRevision
-            properties:
-              componentName:
-                description: ComponentName specify the component name
-                type: string
-              rolloutPlan:
-                description: RolloutPlan is the details on how to rollout the resources
-                properties:
-                  batchPartition:
-                    description: All pods in the batches up to the batchPartition
-                      (included) will have the target resource specification while
-                      the rest still have the source resource This is designed for
-                      the operators to manually rollout Default is the the number
-                      of batches which will rollout all the batches
-                    format: int32
-                    type: integer
-                  canaryMetric:
-                    description: CanaryMetric provides a way for the rollout process
-                      to automatically check certain metrics before complete the process
-                    items:
-                      description: CanaryMetric holds the reference to metrics used
-                        for canary analysis
-                      properties:
-                        interval:
-                          description: Interval represents the windows size
-                          type: string
-                        metricsRange:
-                          description: Range value accepted for this metric
-                          properties:
-                            max:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              description: Maximum value
-                              x-kubernetes-int-or-string: true
-                            min:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              description: Minimum value
-                              x-kubernetes-int-or-string: true
-                          type: object
-                        name:
-                          description: Name of the metric
-                          type: string
-                        templateRef:
-                          description: TemplateRef references a metric template object
-                          properties:
-                            apiVersion:
-                              description: API version of the referent.
-                              type: string
-                            fieldPath:
-                              description: 'If referring to a piece of an object instead
-                                of an entire object, this string should contain a
-                                valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
-                                For example, if the object reference is to a container
-                                within a pod, this would take on a value like: "spec.containers{name}"
-                                (where "name" refers to the name of the container
-                                that triggered the event) or if no container name
-                                is specified "spec.containers[2]" (container with
-                                index 2 in this pod). This syntax is chosen only to
-                                have some well-defined way of referencing a part of
-                                an object. TODO: this design is not final and this
-                                field is subject to change in the future.'
-                              type: string
-                            kind:
-                              description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-                              type: string
-                            name:
-                              description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
-                              type: string
-                            namespace:
-                              description: 'Namespace of the referent. More info:
-                                https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
-                              type: string
-                            resourceVersion:
-                              description: 'Specific resourceVersion to which this
-                                reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
-                              type: string
-                            uid:
-                              description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
-                              type: string
-                          type: object
-                          x-kubernetes-map-type: atomic
-                      required:
-                      - name
-                      type: object
-                    type: array
-                  numBatches:
-                    description: The number of batches, default = 1
-                    format: int32
-                    type: integer
-                  paused:
-                    description: Paused the rollout, default is false
-                    type: boolean
-                  rolloutBatches:
-                    description: The exact distribution among batches. its size has
-                      to be exactly the same as the NumBatches (if set) The total
-                      number cannot exceed the targetSize or the size of the source
-                      resource We will IGNORE the last batch's replica field if it's
-                      a percentage since round errors can lead to inaccurate sum We
-                      highly recommend to leave the last batch's replica field empty
-                    items:
-                      description: RolloutBatch is used to describe how the each batch
-                        rollout should be
-                      properties:
-                        batchRolloutWebhooks:
-                          description: RolloutWebhooks provides a way for the batch
-                            rollout to interact with an external process
-                          items:
-                            description: RolloutWebhook holds the reference to external
-                              checks used for canary analysis
-                            properties:
-                              expectedStatus:
-                                description: ExpectedStatus contains all the expected
-                                  http status code that we will accept as success
-                                items:
-                                  type: integer
-                                type: array
-                              metadata:
-                                additionalProperties:
-                                  type: string
-                                description: Metadata (key-value pairs) for this webhook
-                                type: object
-                              method:
-                                description: Method the HTTP call method, default
-                                  is POST
-                                type: string
-                              name:
-                                description: Name of this webhook
-                                type: string
-                              type:
-                                description: Type of this webhook
-                                type: string
-                              url:
-                                description: URL address of this webhook
-                                type: string
-                            required:
-                            - name
-                            - type
-                            - url
-                            type: object
-                          type: array
-                        canaryMetric:
-                          description: CanaryMetric provides a way for the batch rollout
-                            process to automatically check certain metrics before
-                            moving to the next batch
-                          items:
-                            description: CanaryMetric holds the reference to metrics
-                              used for canary analysis
-                            properties:
-                              interval:
-                                description: Interval represents the windows size
-                                type: string
-                              metricsRange:
-                                description: Range value accepted for this metric
-                                properties:
-                                  max:
-                                    anyOf:
-                                    - type: integer
-                                    - type: string
-                                    description: Maximum value
-                                    x-kubernetes-int-or-string: true
-                                  min:
-                                    anyOf:
-                                    - type: integer
-                                    - type: string
-                                    description: Minimum value
-                                    x-kubernetes-int-or-string: true
-                                type: object
-                              name:
-                                description: Name of the metric
-                                type: string
-                              templateRef:
-                                description: TemplateRef references a metric template
-                                  object
-                                properties:
-                                  apiVersion:
-                                    description: API version of the referent.
-                                    type: string
-                                  fieldPath:
-                                    description: 'If referring to a piece of an object
-                                      instead of an entire object, this string should
-                                      contain a valid JSON/Go field access statement,
-                                      such as desiredState.manifest.containers[2].
-                                      For example, if the object reference is to a
-                                      container within a pod, this would take on a
-                                      value like: "spec.containers{name}" (where "name"
-                                      refers to the name of the container that triggered
-                                      the event) or if no container name is specified
-                                      "spec.containers[2]" (container with index 2
-                                      in this pod). This syntax is chosen only to
-                                      have some well-defined way of referencing a
-                                      part of an object. TODO: this design is not
-                                      final and this field is subject to change in
-                                      the future.'
-                                    type: string
-                                  kind:
-                                    description: 'Kind of the referent. More info:
-                                      https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-                                    type: string
-                                  name:
-                                    description: 'Name of the referent. More info:
-                                      https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
-                                    type: string
-                                  namespace:
-                                    description: 'Namespace of the referent. More
-                                      info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
-                                    type: string
-                                  resourceVersion:
-                                    description: 'Specific resourceVersion to which
-                                      this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
-                                    type: string
-                                  uid:
-                                    description: 'UID of the referent. More info:
-                                      https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
-                                    type: string
-                                type: object
-                                x-kubernetes-map-type: atomic
-                            required:
-                            - name
-                            type: object
-                          type: array
-                        instanceInterval:
-                          description: The wait time, in seconds, between instances
-                            upgrades, default = 0
-                          format: int32
-                          type: integer
-                        maxUnavailable:
-                          anyOf:
-                          - type: integer
-                          - type: string
-                          description: MaxUnavailable is the max allowed number of
-                            pods that is unavailable during the upgrade. We will mark
-                            the batch as ready as long as there are less or equal
-                            number of pods unavailable than this number. default =
-                            0
-                          x-kubernetes-int-or-string: true
-                        podList:
-                          description: The list of Pods to get upgraded it is mutually
-                            exclusive with the Replicas field
-                          items:
-                            type: string
-                          type: array
-                        replicas:
-                          anyOf:
-                          - type: integer
-                          - type: string
-                          description: 'Replicas is the number of pods to upgrade
-                            in this batch it can be an absolute number (ex: 5) or
-                            a percentage of total pods we will ignore the percentage
-                            of the last batch to just fill the gap it is mutually
-                            exclusive with the PodList field'
-                          x-kubernetes-int-or-string: true
-                      type: object
-                    type: array
-                  rolloutStrategy:
-                    description: RolloutStrategy defines strategies for the rollout
-                      plan The default is IncreaseFirstRolloutStrategyType
-                    type: string
-                  rolloutWebhooks:
-                    description: RolloutWebhooks provide a way for the rollout to
-                      interact with an external process
-                    items:
-                      description: RolloutWebhook holds the reference to external
-                        checks used for canary analysis
-                      properties:
-                        expectedStatus:
-                          description: ExpectedStatus contains all the expected http
-                            status code that we will accept as success
-                          items:
-                            type: integer
-                          type: array
-                        metadata:
-                          additionalProperties:
-                            type: string
-                          description: Metadata (key-value pairs) for this webhook
-                          type: object
-                        method:
-                          description: Method the HTTP call method, default is POST
-                          type: string
-                        name:
-                          description: Name of this webhook
-                          type: string
-                        type:
-                          description: Type of this webhook
-                          type: string
-                        url:
-                          description: URL address of this webhook
-                          type: string
-                      required:
-                      - name
-                      - type
-                      - url
-                      type: object
-                    type: array
-                  targetSize:
-                    description: The size of the target resource. The default is the
-                      same as the size of the source resource.
-                    format: int32
-                    type: integer
-                type: object
-              sourceRevisionName:
-                description: SourceRevisionName contains the name of the componentRevisionName  that
-                  we need to upgrade from. it can be empty only when it's the first
-                  time to deploy the application
-                type: string
-              targetRevisionName:
-                description: TargetRevisionName contains the name of the componentRevisionName
-                  that we need to upgrade to.
-                type: string
-            required:
-            - componentName
-            - rolloutPlan
-            - targetRevisionName
-            type: object
-          status:
-            description: CompRolloutStatus defines the observed state of rollout
-            properties:
-              LastSourceRevision:
-                description: LastSourceRevision contains the name of the componentRevisionName
-                  that we need to upgrade from. We will restart the rollout if this
-                  is not the same as the spec
-                type: string
-              batchRollingState:
-                description: BatchRollingState only meaningful when the Status is
-                  rolling
-                type: string
-              conditions:
-                description: Conditions of the resource.
-                items:
-                  description: A Condition that may apply to a resource.
-                  properties:
-                    lastTransitionTime:
-                      description: LastTransitionTime is the last time this condition
-                        transitioned from one status to another.
-                      format: date-time
-                      type: string
-                    message:
-                      description: A Message containing details about this condition's
-                        last transition from one status to another, if any.
-                      type: string
-                    reason:
-                      description: A Reason for this condition's last transition from
-                        one status to another.
-                      type: string
-                    status:
-                      description: Status of this condition; is it currently True,
-                        False, or Unknown?
-                      type: string
-                    type:
-                      description: Type of this condition. At most one of each condition
-                        type may apply to a resource at any point in time.
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-              currentBatch:
-                description: The current batch the rollout is working on/blocked it
-                  starts from 0
-                format: int32
-                type: integer
-              lastAppliedPodTemplateIdentifier:
-                description: lastAppliedPodTemplateIdentifier is a string that uniquely
-                  represent the last pod template each workload type could use different
-                  ways to identify that so we cannot compare between resources We
-                  update this field only after a successful rollout
-                type: string
-              lastTargetRevision:
-                description: LastUpgradedTargetRevision contains the name of the componentRevisionName
-                  that we upgraded to We will restart the rollout if this is not the
-                  same as the spec
-                type: string
-              rollingState:
-                description: RollingState is the Rollout State
-                type: string
-              rolloutOriginalSize:
-                description: RolloutTargetSize is the size of the target resources.
-                  This is determined once the initial spec verification and does not
-                  change until the rollout is restarted
-                format: int32
-                type: integer
-              rolloutTargetSize:
-                description: RolloutTargetSize is the size of the target resources.
-                  This is determined once the initial spec verification and does not
-                  change until the rollout is restarted
-                format: int32
-                type: integer
-              targetGeneration:
-                description: NewPodTemplateIdentifier is a string that uniquely represent
-                  the new pod template each workload type could use different ways
-                  to identify that so we cannot compare between resources
-                type: string
-              upgradedReadyReplicas:
-                description: UpgradedReadyReplicas is the number of Pods upgraded
-                  by the rollout controller that have a Ready Condition.
-                format: int32
-                type: integer
-              upgradedReplicas:
-                description: UpgradedReplicas is the number of Pods upgraded by the
-                  rollout controller
-                format: int32
-                type: integer
-            required:
-            - currentBatch
-            - lastTargetRevision
-            - rollingState
-            - upgradedReadyReplicas
-            - upgradedReplicas
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}

charts/vela-core/templates/definitions/autodetect.yaml

@@ -1,10 +0,0 @@
-apiVersion: core.oam.dev/v1beta1
-kind: WorkloadDefinition
-metadata:
-  annotations:
-    definition.oam.dev/description: "autodetects.core.oam.dev is the default workload type of ComponentDefinition"
-  name: autodetects.core.oam.dev
-  namespace: {{ include "systemDefinitionNamespace" . }}
-spec:
-  definitionRef:
-    name: autodetects.core.oam.dev

charts/vela-core/templates/definitions/healthscopes.yaml

@@ -1,10 +0,0 @@
-apiVersion: core.oam.dev/v1beta1
-kind: ScopeDefinition
-metadata:
-  name: healthscopes.core.oam.dev
-  namespace: {{ include "systemDefinitionNamespace" . }}
-spec:
-  workloadRefsPath: spec.workloadRefs
-  allowComponentOverlap: true
-  definitionRef:
-    name: healthscopes.core.oam.dev

charts/vela-core/templates/defwithtemplate/affinity.yaml

@@ -113,6 +113,7 @@ spec:
         			}]
         	}
         }
+
         #labelSelector: {
         	matchLabels?: [string]: string
         	matchExpressions?: [...{
@@ -121,21 +122,25 @@ spec:
         		values?: [...string]
         	}]
         }
+
         #podAffinityTerm: {
         	labelSelector?: #labelSelector
         	namespaces?: [...string]
         	topologyKey:        string
         	namespaceSelector?: #labelSelector
         }
+
         #nodeSelecor: {
         	key:      string
         	operator: *"In" | "NotIn" | "Exists" | "DoesNotExist" | "Gt" | "Lt"
         	values?: [...string]
         }
+
         #nodeSelectorTerm: {
         	matchExpressions?: [...#nodeSelecor]
         	matchFields?: [...#nodeSelecor]
         }
+
         parameter: {
         	// +usage=Specify the pod affinity scheduling rules
         	podAffinity?: {

charts/vela-core/templates/defwithtemplate/apply-once.yaml

@@ -17,12 +17,14 @@ spec:
         	// +usage=Specify the path of the resource that allow configuration drift
         	path: [...string]
         }
+
         #ApplyOncePolicyRule: {
         	// +usage=Specify how to select the targets of the rule
         	selector?: #ResourcePolicyRuleSelector
         	// +usage=Specify the strategy for configuring the resource level configuration drift behaviour
         	strategy: #ApplyOnceStrategy
         }
+
         #ResourcePolicyRuleSelector: {
         	// +usage=Select resources by component names
         	componentNames?: [...string]
@@ -37,6 +39,7 @@ spec:
         	// +usage=Select resources by their names
         	resourceNames?: [...string]
         }
+
         parameter: {
         	// +usage=Whether to enable apply-once for the whole application
         	enable: *false | bool

charts/vela-core/templates/defwithtemplate/apply-remaining.yaml

@@ -24,6 +24,7 @@ spec:
         apply: op.#ApplyRemaining & {
         	parameter
         }
+
         parameter: {
         	// +usage=Declare the name of the component
         	exceptions?: [...string]

charts/vela-core/templates/defwithtemplate/check-metrics.yaml

@@ -0,0 +1,59 @@
+# Code generated by KubeVela templates. DO NOT EDIT. Please edit the original cue file.
+# Definition source cue file: vela-templates/definitions/internal/check-metrics.cue
+apiVersion: core.oam.dev/v1beta1
+kind: WorkflowStepDefinition
+metadata:
+  annotations:
+    custom.definition.oam.dev/category: Application Delivery
+    definition.oam.dev/description: Verify application's metrics
+  labels:
+    custom.definition.oam.dev/catalog: Delivery
+  name: check-metrics
+  namespace: {{ include "systemDefinitionNamespace" . }}
+spec:
+  schematic:
+    cue:
+      template: |
+        import (
+        	"vela/op"
+        )
+
+        check: op.#PromCheck & {
+        	query:          parameter.query
+        	metricEndpoint: parameter.metricEndpoint
+        	condition:      parameter.condition
+        	stepID:         context.stepSessionID
+        	duration:       parameter.duration
+        	failDuration:   parameter.failDuration
+        }
+
+        fail: op.#Steps & {
+        	if check.failed != _|_ {
+        		if check.failed == true {
+        			breakWorkflow: op.#Fail & {
+        				message: check.message
+        			}
+        		}
+        	}
+        }
+
+        wait: op.#ConditionalWait & {
+        	continue: check.result
+        	if check.message != _|_ {
+        		message: check.message
+        	}
+        }
+
+        parameter: {
+        	// +usage=Query is a raw prometheus query to perform
+        	query: string
+        	// +usage=The HTTP address and port of the prometheus server
+        	metricEndpoint?: "http://prometheus-server.o11y-system.svc:9090" | string
+        	// +usage=Condition is an expression which determines if a measurement is considered successful. eg: >=0.95
+        	condition: string
+        	// +usage=Duration defines the duration of time required for this step to be considered successful.
+        	duration?: *"5m" | string
+        	// +usage=FailDuration is the duration of time that, if the check fails, will result in the step being marked as failed.
+        	failDuration?: *"2m" | string
+        }
+

charts/vela-core/templates/defwithtemplate/clean-jobs.yaml

@@ -20,6 +20,7 @@ spec:
         	labelselector?: {...}
         	namespace: *context.namespace | string
         }
+
         cleanJobs: op.#Delete & {
         	value: {
         		apiVersion: "batch/v1"
@@ -39,6 +40,7 @@ spec:
         		}
         	}
         }
+
         cleanPods: op.#Delete & {
         	value: {
         		apiVersion: "v1"

charts/vela-core/templates/defwithtemplate/collect-service-endpoints.yaml

@@ -35,6 +35,7 @@ spec:
         		}
         	}
         } @step(1)
+
         outputs: {
         	eps_port_name_filtered: *[] | [...]
         	if parameter.portName == _|_ {
@@ -69,9 +70,11 @@ spec:
         		endpoints: eps_port_filtered
         	}
         }
+
         wait: op.#ConditionalWait & {
         	continue: len(outputs.endpoints) > 0
         } @step(2)
+
         value: {
         	if len(outputs.endpoints) > 0 {
         		endpoint: outputs.endpoints[0].endpoint
@@ -79,6 +82,7 @@ spec:
         		url:      "\(parameter.protocal)://\(endpoint.host):\(_portStr)"
         	}
         }
+
         parameter: {
         	// +usage=Specify the name of the application
         	name?: string

charts/vela-core/templates/defwithtemplate/command.yaml

@@ -107,9 +107,11 @@ spec:
         		}]
         	}
         }
+
         parameter: *#PatchParams | close({
         	// +usage=Specify the commands for multiple containers
         	containers: [...#PatchParams]
         })
+
         errs: [ for c in patch.spec.template.spec.containers if c.err != _|_ {c.err}]
 

charts/vela-core/templates/defwithtemplate/container-image.yaml

@@ -72,9 +72,11 @@ spec:
         		}]
         	}
         }
+
         parameter: #PatchParams | close({
         	// +usage=Specify the container image for multiple containers
         	containers: [...#PatchParams]
         })
+
         errs: [ for c in patch.spec.template.spec.containers if c.err != _|_ {c.err}]
 

charts/vela-core/templates/defwithtemplate/cpuscaler.yaml

@@ -29,6 +29,7 @@ spec:
         		targetCPUUtilizationPercentage: parameter.cpuUtil
         	}
         }
+
         parameter: {
         	// +usage=Specify the minimal number of replicas to which the autoscaler can scale down
         	min: *1 | int

charts/vela-core/templates/defwithtemplate/cron-task.yaml

@@ -147,6 +147,7 @@ spec:
         		}
         	}
         }
+
         parameter: {
         	// +usage=Specify the labels in the workload
         	labels?: [string]: string
@@ -276,6 +277,7 @@ spec:
         	// +usage=Instructions for assessing whether the container is in a suitable state to serve traffic.
         	readinessProbe?: #HealthProbe
         }
+
         #HealthProbe: {
 
         	// +usage=Instructions for assessing container health by executing a command. Either this attribute or the httpGet attribute or the tcpSocket attribute MUST be specified. This attribute is mutually exclusive with both the httpGet attribute and the tcpSocket attribute.
@@ -318,8 +320,5 @@ spec:
         	failureThreshold: *3 | int
         }
   workload:
-    definition:
-      apiVersion: batch/v1beta1
-      kind: CronJob
-    type: cronjobs.batch
+    type: autodetects.core.oam.dev
 

charts/vela-core/templates/defwithtemplate/daemon.yaml

@@ -66,6 +66,7 @@ spec:
         		}
         	},
         ]
+
         volumesList: [
         	if parameter.volumeMounts != _|_ && parameter.volumeMounts.pvc != _|_ for v in parameter.volumeMounts.pvc {
         		{
@@ -114,6 +115,7 @@ spec:
         		}
         	},
         ]
+
         deDupVolumesArray: [
         	for val in [
         		for i, vi in volumesList {
@@ -126,6 +128,7 @@ spec:
         		val
         	},
         ]
+
         output: {
         	apiVersion: "apps/v1"
         	kind:       "DaemonSet"
@@ -275,6 +278,7 @@ spec:
         		}
         	}
         }
+
         exposePorts: [
         	if parameter.ports != _|_ for v in parameter.ports if v.expose == true {
         		port:       v.port
@@ -287,6 +291,7 @@ spec:
         		}
         	},
         ]
+
         outputs: {
         	if len(exposePorts) != 0 {
         		webserviceExpose: {
@@ -301,6 +306,7 @@ spec:
         		}
         	}
         }
+
         parameter: {
         	// +usage=Specify the labels in the workload
         	labels?: [string]: string
@@ -469,6 +475,7 @@ spec:
         		hostnames: [...string]
         	}]
         }
+
         #HealthProbe: {
 
         	// +usage=Instructions for assessing container health by executing a command. Either this attribute or the httpGet attribute or the tcpSocket attribute MUST be specified. This attribute is mutually exclusive with both the httpGet attribute and the tcpSocket attribute.

charts/vela-core/templates/defwithtemplate/deploy-cloud-resource.yaml

@@ -26,6 +26,7 @@ spec:
         	// context.namespace indicates the name of the app
         	name: context.name
         }
+
         parameter: {
         	// +usage=Declare the name of the env-binding policy, if empty, the first env-binding policy will be used
         	policy: *"" | string

charts/vela-core/templates/defwithtemplate/deploy.yaml

@@ -18,6 +18,9 @@ spec:
         	"vela/op"
         )
 
+        if parameter.auto == false {
+        	suspend: op.#Suspend & {message: "Waiting approval to the deploy step \"\(context.stepName)\""}
+        }
         deploy: op.#Deploy & {
         	policies:                 parameter.policies
         	parallelism:              parameter.parallelism

charts/vela-core/templates/defwithtemplate/deploy2env.yaml

@@ -27,6 +27,7 @@ spec:
         	// context.namespace indicates the namespace of the app
         	namespace: context.namespace
         }
+
         parameter: {
         	// +usage=Declare the name of the env-binding policy, if empty, the first env-binding policy will be used
         	policy: *"" | string

charts/vela-core/templates/defwithtemplate/deploy2runtime.yaml

@@ -41,6 +41,7 @@ spec:
         		}
         	}
         }
+
         parameter: {
         	// +usage=Declare the runtime clusters to apply, if empty, all runtime clusters will be used
         	clusters?: [...string]

charts/vela-core/templates/defwithtemplate/env.yaml

@@ -98,9 +98,11 @@ spec:
         		}]
         	}
         }
+
         parameter: *#PatchParams | close({
         	// +usage=Specify the environment variables for multiple containers
         	containers: [...#PatchParams]
         })
+
         errs: [ for c in patch.spec.template.spec.containers if c.err != _|_ {c.err}]
 

charts/vela-core/templates/defwithtemplate/envbinding.yaml

@@ -26,6 +26,7 @@ spec:
         		disable: *false | bool
         	}]
         }
+
         parameter: envs: [...{
         	name: string
         	placement?: {

charts/vela-core/templates/defwithtemplate/export-data.yaml

@@ -38,12 +38,14 @@ spec:
         		stringData: parameter.data
         	}
         } @step(1)
+
         getPlacements: op.#GetPlacementsFromTopologyPolicies & {
         	policies: *[] | [...string]
         	if parameter.topology != _|_ {
         		policies: [parameter.topology]
         	}
-        }      @step(2)
+        } @step(2)
+
         apply: op.#Steps & {
         	for p in getPlacements.placements {
         		(p.cluster): op.#Apply & {
@@ -52,6 +54,7 @@ spec:
         		}
         	}
         } @step(3)
+
         parameter: {
         	// +usage=Specify the name of the export destination
         	name?: string

charts/vela-core/templates/defwithtemplate/export-service.yaml

@@ -49,12 +49,14 @@ spec:
         		ports: [{port: parameter.targetPort}]
         	}]
         }] @step(1)
+
         getPlacements: op.#GetPlacementsFromTopologyPolicies & {
         	policies: *[] | [...string]
         	if parameter.topology != _|_ {
         		policies: [parameter.topology]
         	}
-        }      @step(2)
+        } @step(2)
+
         apply: op.#Steps & {
         	for p in getPlacements.placements {
         		for o in objects {
@@ -65,6 +67,7 @@ spec:
         		}
         	}
         } @step(3)
+
         parameter: {
         	// +usage=Specify the name of the export destination
         	name?: string

charts/vela-core/templates/defwithtemplate/expose.yaml

@@ -17,6 +17,7 @@ spec:
       template: |
         import (
         	"strconv"
+        	"strings"
         )
 
         outputs: service: {
@@ -25,22 +26,66 @@ spec:
         	metadata: name:        context.name
         	metadata: annotations: parameter.annotations
         	spec: {
-        		selector: "app.oam.dev/component": context.name
-        		ports: [
-        			for p in parameter.port {
-        				name:       "port-" + strconv.FormatInt(p, 10)
-        				port:       p
-        				targetPort: p
+        		if parameter["matchLabels"] == _|_ {
+        			selector: "app.oam.dev/component": context.name
+        		}
+        		if parameter["matchLabels"] != _|_ {
+        			selector: parameter["matchLabels"]
+        		}
+
+        		// compatible with the old way
+        		if parameter["port"] != _|_ if parameter["ports"] == _|_ {
+        			ports: [
+        				for p in parameter.port {
+        					name:       "port-" + strconv.FormatInt(p, 10)
+        					port:       p
+        					targetPort: p
+        				},
+        			]
+        		}
+        		if parameter["ports"] != _|_ {
+        			ports: [ for v in parameter.ports {
+        				port:       v.port
+        				targetPort: v.port
+        				if v.name != _|_ {
+        					name: v.name
+        				}
+        				if v.name == _|_ {
+        					_name: "port-" + strconv.FormatInt(v.port, 10)
+        					name:  *_name | string
+        					if v.protocol != "TCP" {
+        						name: _name + "-" + strings.ToLower(v.protocol)
+        					}
+        				}
+        				if v.nodePort != _|_ if parameter.type == "NodePort" {
+        					nodePort: v.nodePort
+        				}
+        				if v.protocol != _|_ {
+        					protocol: v.protocol
+        				}
         			},
-        		]
+        			]
+        		}
         		type: parameter.type
         	}
         }
         parameter: {
-        	// +usage=Specify the exposion ports
-        	port: [...int]
+        	// +usage=Deprecated, the old way to specify the exposion ports
+        	port?: [...int]
+        	// +usage=Specify portsyou want customer traffic sent to
+        	ports?: [...{
+        		// +usage=Number of port to expose on the pod's IP address
+        		port: int
+        		// +usage=Name of the port
+        		name?: string
+        		// +usage=Protocol for port. Must be UDP, TCP, or SCTP
+        		protocol: *"TCP" | "UDP" | "SCTP"
+        		// +usage=exposed node port. Only Valid when exposeType is NodePort
+        		nodePort?: int
+        	}]
         	// +usage=Specify the annotaions of the exposed service
-        	annotations: [string]: string
+        	annotations: [string]:  string
+        	matchLabels?: [string]: string
         	// +usage=Specify what kind of Service you want. options: "ClusterIP","NodePort","LoadBalancer","ExternalName"
         	type: *"ClusterIP" | "NodePort" | "LoadBalancer" | "ExternalName"
         }

charts/vela-core/templates/defwithtemplate/garbage-collect.yaml

@@ -13,10 +13,11 @@ spec:
       template: |
         #GarbageCollectPolicyRule: {
         	// +usage=Specify how to select the targets of the rule
-        	selector: [...#ResourcePolicyRuleSelector]
+        	selector: #ResourcePolicyRuleSelector
         	// +usage=Specify the strategy for target resource to recycle
         	strategy: *"onAppUpdate" | "onAppDelete" | "never"
         }
+
         #ResourcePolicyRuleSelector: {
         	// +usage=Select resources by component names
         	componentNames?: [...string]
@@ -31,9 +32,12 @@ spec:
         	// +usage=Select resources by their names
         	resourceNames?: [...string]
         }
+
         parameter: {
         	// +usage=If is set, outdated versioned resourcetracker will not be recycled automatically, outdated resources will be kept until resourcetracker be deleted manually
         	keepLegacyResource: *false | bool
+        	// +usage=If is set, continue to execute gc when the workflow fails, by default gc will be executed only after the workflow succeeds
+        	continueOnFailure: *false | bool
         	// +usage=Specify the list of rules to control gc strategy at resource level, if one resource is controlled by multiple rules, first rule will be used
         	rules?: [...#GarbageCollectPolicyRule]
         }

charts/vela-core/templates/defwithtemplate/gateway.yaml

@@ -30,6 +30,7 @@ spec:
         		]
         	}
         }
+
         legacyAPI: context.clusterVersion.minor < 19
         outputs: ingress: {
         	if legacyAPI {
@@ -87,6 +88,7 @@ spec:
         		}]
         	}
         }
+
         parameter: {
         	// +usage=Specify the domain you want to expose
         	domain?: string
@@ -113,19 +115,20 @@ spec:
       }
       if context.outputs.ingress.status.loadBalancer.ingress != _|_ {
       	let igs = context.outputs.ingress.status.loadBalancer.ingress
+      	let host = context.outputs.ingress.spec.rules[0].host
         if igs[0].ip != _|_ {
-        	if igs[0].host != _|_ {
+        	if host != _|_ {
       	    message: "Visiting URL: " + context.outputs.ingress.spec.rules[0].host + ", IP: " + igs[0].ip
         	}
-        	if igs[0].host == _|_ {
+        	if host == _|_ {
       	    message: "Host not specified, visit the cluster or load balancer in front of the cluster with IP: " + igs[0].ip
         	}
         }
         if igs[0].ip == _|_ {
-        	if igs[0].host != _|_ {
+        	if host != _|_ {
       		  message: "Visiting URL: " + context.outputs.ingress.spec.rules[0].host
       		}
-        	if igs[0].host != _|_ {
+        	if host == _|_ {
       	    message: "Host not specified, visit the cluster or load balancer in front of the cluster"
       		}
         }

charts/vela-core/templates/defwithtemplate/generate-jdbc-connection.yaml

@@ -34,11 +34,13 @@ spec:
         dbName:   op.#ConvertString & {bt: base64.Decode(null, output.value.data["DB_NAME"])}
         username: op.#ConvertString & {bt: base64.Decode(null, output.value.data["DB_USER"])}
         password: op.#ConvertString & {bt: base64.Decode(null, output.value.data["DB_PASSWORD"])}
+
         env: [
         	{name: "url", value:      "jdbc://" + dbHost.str + ":" + dbPort.str + "/" + dbName.str + "?characterEncoding=utf8&useSSL=false"},
         	{name: "username", value: username.str},
         	{name: "password", value: password.str},
         ]
+
         parameter: {
         	// +usage=Specify the name of the secret generated by database component
         	name: string

charts/vela-core/templates/defwithtemplate/health.yaml

@@ -1,34 +0,0 @@
-# Code generated by KubeVela templates. DO NOT EDIT. Please edit the original cue file.
-# Definition source cue file: vela-templates/definitions/internal/health.cue
-apiVersion: core.oam.dev/v1beta1
-kind: PolicyDefinition
-metadata:
-  annotations:
-    definition.oam.dev/description: Apply periodical health checking to the application.
-  name: health
-  namespace: {{ include "systemDefinitionNamespace" . }}
-spec:
-  manageHealthCheck: true
-  schematic:
-    cue:
-      template: |
-        output: {
-        	apiVersion: "core.oam.dev/v1alpha2"
-        	kind:       "HealthScope"
-        	spec: {
-        		"probe-timeout":  parameter.probeTimeout
-        		"probe-interval": parameter.probeInterval
-        		appReferences: [{
-        			appName: context.appName
-        		}]
-        		workloadRefs: []
-        		manageHealthCheck: true
-        	}
-        }
-        parameter: {
-        	// +usage=Specify health checking timeout(seconds), default 10s
-        	probeTimeout: *10 | int
-        	// +usage=Specify health checking interval(seconds), default 30s
-        	probeInterval: *30 | int
-        }
-

charts/vela-core/templates/defwithtemplate/ingress-1-20.yaml

@@ -29,6 +29,7 @@ spec:
         		]
         	}
         }
+
         outputs: ingress: {
         	apiVersion: "networking.k8s.io/v1"
         	kind:       "Ingress"
@@ -50,6 +51,7 @@ spec:
         		]
         	}]
         }
+
         parameter: {
         	// +usage=Specify the domain you want to expose
         	domain: string

charts/vela-core/templates/defwithtemplate/ingress.yaml

@@ -29,6 +29,7 @@ spec:
         		]
         	}
         }
+
         outputs: ingress: {
         	apiVersion: "networking.k8s.io/v1beta1"
         	kind:       "Ingress"
@@ -46,6 +47,7 @@ spec:
         		]
         	}]
         }
+
         parameter: {
         	// +usage=Specify the domain you want to expose
         	domain: string

charts/vela-core/templates/defwithtemplate/k8s-objects.yaml

@@ -12,6 +12,7 @@ spec:
     cue:
       template: |
         output: parameter.objects[0]
+
         outputs: {
         	for i, v in parameter.objects {
         		if i > 0 {

charts/vela-core/templates/defwithtemplate/nocalhost.yaml

@@ -38,6 +38,7 @@ spec:
         		type: "ClusterIP"
         	}
         }
+
         patch: metadata: annotations: {
         	"dev.nocalhost/application-name":      context.appName
         	"dev.nocalhost/application-namespace": context.namespace

charts/vela-core/templates/defwithtemplate/notification.yaml

@@ -159,6 +159,7 @@ spec:
         		}
         	}
         }
+
         block: {
         	type:      string
         	block_id?: string
@@ -192,18 +193,21 @@ spec:
         		initial_time?: string
         	}]
         }
+
         textType: {
         	type:      string
         	text:      string
         	emoji?:    bool
         	verbatim?: bool
         }
+
         option: {
         	text:         textType
         	value:        string
         	description?: textType
         	url?:         string
         }
+
         // send webhook notification
         ding: op.#Steps & {
         	if parameter.dingding != _|_ {
@@ -233,6 +237,7 @@ spec:
         		}
         	}
         }
+
         lark: op.#Steps & {
         	if parameter.lark != _|_ {
         		if parameter.lark.url.value != _|_ {
@@ -261,6 +266,7 @@ spec:
         		}
         	}
         }
+
         slack: op.#Steps & {
         	if parameter.slack != _|_ {
         		if parameter.slack.url.value != _|_ {
@@ -289,6 +295,7 @@ spec:
         		}
         	}
         }
+
         email: op.#Steps & {
         	if parameter.email != _|_ {
         		if parameter.email.from.password.value != _|_ {

charts/vela-core/templates/defwithtemplate/override.yaml

@@ -28,6 +28,7 @@ spec:
         		disable: *false | bool
         	}]
         }
+
         parameter: {
         	// +usage=Specify the overridden component configuration.
         	components: [...#PatchParams]

charts/vela-core/templates/defwithtemplate/print-message-in-status.yaml

@@ -17,6 +17,7 @@ spec:
         )
 
         parameter: message: string
+
         msg: op.#Message & {
         	message: parameter.message
         }

charts/vela-core/templates/defwithtemplate/read-only.yaml

@@ -15,6 +15,7 @@ spec:
         	// +usage=Specify how to select the targets of the rule
         	selector: #RuleSelector
         }
+
         #RuleSelector: {
         	// +usage=Select resources by component names
         	componentNames?: [...string]
@@ -29,6 +30,7 @@ spec:
         	// +usage=Select resources by their names
         	resourceNames?: [...string]
         }
+
         parameter: {
         	// +usage=Specify the list of rules to control read only strategy at resource level.
         	// The selected resource will be read-only to the current application. If the target resource does

charts/vela-core/templates/defwithtemplate/ref-objects.yaml

@@ -28,12 +28,14 @@ spec:
         	labelSelector?: [string]: string
         	...
         }
+
         output: {
         	if len(parameter.objects) > 0 {
         		parameter.objects[0]
         	}
         	...
         }
+
         outputs: {
         	for i, v in parameter.objects {
         		if i > 0 {

charts/vela-core/templates/defwithtemplate/resource.yaml

@@ -51,6 +51,7 @@ spec:
         		}
         	}]
         }
+
         parameter: {
         	// +usage=Specify the amount of cpu for requests and limits
         	cpu?: *1 | number | string

charts/vela-core/templates/defwithtemplate/service-account.yaml

@@ -41,6 +41,7 @@ spec:
         }
         // +patchStrategy=retainKeys
         patch: spec: template: spec: serviceAccountName: parameter.name
+
         _clusterPrivileges: [ if parameter.privileges != _|_ for p in parameter.privileges if p.scope == "cluster" {p}]
         _namespacePrivileges: [ if parameter.privileges != _|_ for p in parameter.privileges if p.scope == "namespace" {p}]
         outputs: {

charts/vela-core/templates/defwithtemplate/service-binding.yaml

@@ -39,6 +39,7 @@ spec:
         		]
         	}]
         }
+
         parameter: {
         	// +usage=The mapping of environment variables to secret
         	envMappings: [string]: #KeySecret

charts/vela-core/templates/defwithtemplate/share-cloud-resource.yaml

@@ -27,6 +27,7 @@ spec:
         	// context.namespace indicates the name of the app
         	name: context.name
         }
+
         parameter: {
         	// +usage=Declare the location to bind
         	placements: [...{

charts/vela-core/templates/defwithtemplate/shared-resource.yaml

@@ -13,8 +13,9 @@ spec:
       template: |
         #SharedResourcePolicyRule: {
         	// +usage=Specify how to select the targets of the rule
-        	selector: [...#ResourcePolicyRuleSelector]
+        	selector: #ResourcePolicyRuleSelector
         }
+
         #ResourcePolicyRuleSelector: {
         	// +usage=Select resources by component names
         	componentNames?: [...string]
@@ -29,6 +30,7 @@ spec:
         	// +usage=Select resources by their names
         	resourceNames?: [...string]
         }
+
         parameter: {
         	// +usage=Specify the list of rules to control shared-resource strategy at resource level.
         	// The selected resource will be sharable across applications. (That means multiple applications

charts/vela-core/templates/defwithtemplate/sidecar.yaml

@@ -103,6 +103,7 @@ spec:
         	// +usage=Instructions for assessing whether the container is in a suitable state to serve traffic.
         	readinessProbe?: #HealthProbe
         }
+
         #HealthProbe: {
 
         	// +usage=Instructions for assessing container health by executing a command. Either this attribute or the httpGet attribute or the tcpSocket attribute MUST be specified. This attribute is mutually exclusive with both the httpGet attribute and the tcpSocket attribute.

charts/vela-core/templates/defwithtemplate/startup-probe.yaml

@@ -116,6 +116,7 @@ spec:
         		}
         	}
         }
+
         patch: spec: template: spec: {
         	if parameter.probes == _|_ {
         		// +patchKey=name
@@ -160,9 +161,11 @@ spec:
         		}]
         	}
         }
+
         parameter: *#StartupProbeParams | close({
         	// +usage=Specify the startup probe for multiple containers
         	probes: [...#StartupProbeParams]
         })
+
         errs: [ for c in patch.spec.template.spec.containers if c.err != _|_ {c.err}]
 

charts/vela-core/templates/defwithtemplate/storage.yaml

@@ -61,6 +61,7 @@ spec:
         		}
         	},
         ]
+
         volumeMountsList: [
         	if parameter.pvc != _|_ for v in parameter.pvc {
         		if v.volumeMode == "Filesystem" {
@@ -107,6 +108,7 @@ spec:
         		}
         	},
         ]
+
         envList: [
         	if parameter.configMap != _|_ for v in parameter.configMap if v.mountToEnv != _|_ {
         		{
@@ -145,6 +147,7 @@ spec:
         		}
         	},
         ]
+
         volumeDevicesList: *[
         			for v in parameter.pvc if v.volumeMode == "Block" {
         		{
@@ -156,6 +159,7 @@ spec:
         		}
         	},
         ] | []
+
         deDupVolumesArray: [
         	for val in [
         		for i, vi in volumesList {
@@ -168,6 +172,7 @@ spec:
         		val
         	},
         ]
+
         patch: spec: template: spec: {
         	// +patchKey=name
         	volumes: deDupVolumesArray
@@ -182,6 +187,7 @@ spec:
         	}, ...]
 
         }
+
         outputs: {
         	for v in parameter.pvc {
         		if v.mountOnly == false {
@@ -252,6 +258,7 @@ spec:
         	}
 
         }
+
         parameter: {
         	// +usage=Declare pvc type storage
         	pvc?: [...{

charts/vela-core/templates/defwithtemplate/suspend.yaml

@@ -24,6 +24,7 @@ spec:
         		message: parameter.message
         	}
         }
+
         parameter: {
         	// +usage=Specify the wait duration time to resume workflow such as "30s", "1min" or "2m15s"
         	duration?: string

charts/vela-core/templates/defwithtemplate/take-over.yaml

@@ -13,8 +13,9 @@ spec:
       template: |
         #PolicyRule: {
         	// +usage=Specify how to select the targets of the rule
-        	selector: [...#RuleSelector]
+        	selector: #RuleSelector
         }
+
         #RuleSelector: {
         	// +usage=Select resources by component names
         	componentNames?: [...string]
@@ -29,6 +30,7 @@ spec:
         	// +usage=Select resources by their names
         	resourceNames?: [...string]
         }
+
         parameter: {
         	// +usage=Specify the list of rules to control take over strategy at resource level.
         	// The selected resource will be able to be taken over by the current application when the resource belongs to no

charts/vela-core/templates/defwithtemplate/task.yaml

@@ -113,6 +113,7 @@ spec:
         		}
         	}
         }
+
         parameter: {
         	// +usage=Specify the labels in the workload
         	labels?: [string]: string
@@ -209,6 +210,7 @@ spec:
         	// +usage=Instructions for assessing whether the container is in a suitable state to serve traffic.
         	readinessProbe?: #HealthProbe
         }
+
         #HealthProbe: {
 
         	// +usage=Instructions for assessing container health by executing a command. Either this attribute or the httpGet attribute or the tcpSocket attribute MUST be specified. This attribute is mutually exclusive with both the httpGet attribute and the tcpSocket attribute.

charts/vela-core/templates/defwithtemplate/vela-cli.yaml

@@ -33,6 +33,7 @@ spec:
         		}
         	},
         ]
+
         volumesList: [
         	if parameter.storage != _|_ && parameter.storage.secret != _|_ for v in parameter.storage.secret {
         		{
@@ -53,6 +54,7 @@ spec:
         		}
         	},
         ]
+
         deDupVolumesArray: [
         	for val in [
         		for i, vi in volumesList {
@@ -65,6 +67,7 @@ spec:
         		val
         	},
         ]
+
         job: op.#Apply & {
         	value: {
         		apiVersion: "batch/v1"
@@ -99,9 +102,11 @@ spec:
         		}
         	}
         }
+
         log: op.#Log & {
         	source: resources: [{labelSelector: "workflow.oam.dev/step-name": "\(context.name)-\(context.stepName)"}]
         }
+
         fail: op.#Steps & {
         	if job.value.status.failed != _|_ {
         		if job.value.status.failed > 2 {
@@ -111,9 +116,11 @@ spec:
         		}
         	}
         }
+
         wait: op.#ConditionalWait & {
         	continue: job.value.status.succeeded != _|_ && job.value.status.succeeded > 0
         }
+
         parameter: {
         	// +usage=Specify the name of the addon.
         	addonName: string

charts/vela-core/templates/defwithtemplate/volumes.yaml

@@ -50,6 +50,7 @@ spec:
         		},
         	]
         }
+
         parameter: {
         	// +usage=Declare volumes and volumeMounts
         	volumes?: [...{

charts/vela-core/templates/defwithtemplate/webhook.yaml

@@ -68,6 +68,7 @@ spec:
         		} @step(7)
         	}
         }
+
         parameter: {
         	// +usage=Specify the webhook url
         	url: close({

charts/vela-core/templates/defwithtemplate/webservice.yaml

@@ -67,6 +67,7 @@ spec:
         		}
         	},
         ]
+
         volumesList: [
         	if parameter.volumeMounts != _|_ && parameter.volumeMounts.pvc != _|_ for v in parameter.volumeMounts.pvc {
         		{
@@ -115,6 +116,7 @@ spec:
         		}
         	},
         ]
+
         deDupVolumesArray: [
         	for val in [
         		for i, vi in volumesList {
@@ -127,6 +129,7 @@ spec:
         		val
         	},
         ]
+
         output: {
         	apiVersion: "apps/v1"
         	kind:       "Deployment"
@@ -284,6 +287,7 @@ spec:
         		}
         	}
         }
+
         exposePorts: [
         	if parameter.ports != _|_ for v in parameter.ports if v.expose == true {
         		port:       v.port
@@ -306,6 +310,7 @@ spec:
         		}
         	},
         ]
+
         outputs: {
         	if len(exposePorts) != 0 {
         		webserviceExpose: {
@@ -320,6 +325,7 @@ spec:
         		}
         	}
         }
+
         parameter: {
         	// +usage=Specify the labels in the workload
         	labels?: [string]: string
@@ -496,6 +502,7 @@ spec:
         		hostnames: [...string]
         	}]
         }
+
         #HealthProbe: {
 
         	// +usage=Instructions for assessing container health by executing a command. Either this attribute or the httpGet attribute or the tcpSocket attribute MUST be specified. This attribute is mutually exclusive with both the httpGet attribute and the tcpSocket attribute.

charts/vela-core/templates/defwithtemplate/worker.yaml

@@ -64,6 +64,7 @@ spec:
         		}
         	},
         ]
+
         volumesList: [
         	if parameter.volumeMounts != _|_ && parameter.volumeMounts.pvc != _|_ for v in parameter.volumeMounts.pvc {
         		{
@@ -112,6 +113,7 @@ spec:
         		}
         	},
         ]
+
         deDupVolumesArray: [
         	for val in [
         		for i, vi in volumesList {
@@ -124,6 +126,7 @@ spec:
         		val
         	},
         ]
+
         output: {
         	apiVersion: "apps/v1"
         	kind:       "Deployment"
@@ -234,6 +237,7 @@ spec:
         		}
         	}
         }
+
         parameter: {
         	// +usage=Which image would you like to use for your service
         	// +short=i
@@ -363,6 +367,7 @@ spec:
         	// +usage=Instructions for assessing whether the container is in a suitable state to serve traffic.
         	readinessProbe?: #HealthProbe
         }
+
         #HealthProbe: {
 
         	// +usage=Instructions for assessing container health by executing a command. Either this attribute or the httpGet attribute or the tcpSocket attribute MUST be specified. This attribute is mutually exclusive with both the httpGet attribute and the tcpSocket attribute.

charts/vela-core/templates/kubevela-controller.yaml

@@ -350,7 +350,7 @@ spec:
             - mountPath: {{ .Values.admissionWebhooks.certificate.mountPath }}
               name: tls-cert-vol
               readOnly: true
-          {{ if and .Values.multicluster.clusterGateway.secureTLS.enabled .Values.multicluster.clusterGateway.direct }}
+          {{ if and .Values.multicluster.enabled .Values.multicluster.clusterGateway.secureTLS.enabled .Values.multicluster.clusterGateway.direct }}
             - mountPath: /cluster-gateway-tls-cert
               name: tls-cert-vol-cg
               readOnly: true
@@ -362,7 +362,7 @@ spec:
           secret:
             defaultMode: 420
             secretName: {{ template "kubevela.fullname" . }}-admission
-      {{ if and .Values.multicluster.clusterGateway.secureTLS.enabled .Values.multicluster.clusterGateway.direct }}
+      {{ if and .Values.multicluster.enabled .Values.multicluster.clusterGateway.secureTLS.enabled .Values.multicluster.clusterGateway.direct }}
         - name: tls-cert-vol-cg
           secret:
             defaultMode: 420

charts/vela-core/values.yaml

@@ -24,7 +24,7 @@ controllerArgs:
 OAMSpecVer: "v0.3"
 
 ## @param disableCaps Disable capability
-disableCaps: "rollout"
+disableCaps: "all"
 
 ## @param dependCheckWait dependCheckWait is the time to wait for ApplicationConfiguration's dependent-resource ready
 dependCheckWait: 30s
@@ -158,7 +158,7 @@ multicluster:
     port: 9443
     image:
       repository: oamdev/cluster-gateway
-      tag: v1.8.0
+      tag: v1.9.0-alpha.2
       pullPolicy: IfNotPresent
     resources:
       requests:

charts/vela-minimal/.helmignore

@@ -1,23 +0,0 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/

charts/vela-minimal/Chart.yaml

@@ -1,24 +0,0 @@
-apiVersion: v1
-name: vela-minimal
-description: A Helm chart for KubeVela minimal
-
-# A chart can be either an 'application' or a 'library' chart.
-#
-# Application charts are a collection of templates that can be packaged into versioned archives
-# to be deployed.
-#
-# Library charts provide useful utilities or functions for the chart developer. They're included as
-# a dependency of application charts to inject those utilities and functions into the rendering
-# pipeline. Library charts do not define any templates and therefore cannot be deployed.
-type: application
-
-# This is the chart version. This version number should be incremented each time you make changes
-# to the chart and its templates, including the app version.
-version: 0.1.0
-
-# This is the version number of the application being deployed. This version number should be
-# incremented each time you make changes to the application.
-appVersion: 0.1.0
-
-home: https://kubevela.io
-icon: https://kubevela.io/img/logo.jpg

charts/vela-minimal/README.md

@@ -1,150 +0,0 @@
-<div style="text-align: center">
-  <p align="center">
-    <img src="https://raw.githubusercontent.com/kubevela/kubevela.io/main/docs/resources/KubeVela-03.png">
-    <br><br>
-    <i>Make shipping applications more enjoyable.</i>
-  </p>
-</div>
-
-![Build status](https://github.com/kubevela/kubevela/workflows/E2E/badge.svg)
-[![Go Report Card](https://goreportcard.com/badge/github.com/kubevela/kubevela)](https://goreportcard.com/report/github.com/kubevela/kubevela)
-![Docker Pulls](https://img.shields.io/docker/pulls/oamdev/vela-core)
-[![codecov](https://codecov.io/gh/kubevela/kubevela/branch/master/graph/badge.svg)](https://codecov.io/gh/kubevela/kubevela)
-[![LICENSE](https://img.shields.io/github/license/kubevela/kubevela.svg?style=flat-square)](/LICENSE)
-[![Releases](https://img.shields.io/github/release/kubevela/kubevela/all.svg?style=flat-square)](https://github.com/kubevela/kubevela/releases)
-[![TODOs](https://img.shields.io/endpoint?url=https://api.tickgit.com/badge?repo=github.com/kubevela/kubevela)](https://www.tickgit.com/browse?repo=github.com/oam-dev/kubevela)
-[![Twitter](https://img.shields.io/twitter/url?style=social&url=https%3A%2F%2Ftwitter.com%2Foam_dev)](https://twitter.com/oam_dev)
-[![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/kubevela)](https://artifacthub.io/packages/search?repo=kubevela)
-[![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/4602/badge)](https://bestpractices.coreinfrastructure.org/projects/4602)
-
-# KubeVela Minimal helm chart
-
-KubeVela is a modern application platform that makes deploying and managing applications across today's hybrid, multi-cloud environments easier and faster.
-
-KubeVela Minimal is the minimal version of KubeVela, it only contains the minimal components to run KubeVela and do not support features like multi clusters and env binding. For more complete experience, please install the [full version of KubeVela]((https://kubevela.io/docs/install)).
-
-KubeVela Minimal contains the following CRDs:
-
-CRD Name | Usage
------------- | -------------
-applications.core.oam.dev  | KubeVela Core Application Object
-applicationrevisions.core.oam.dev | The revision CRD of Application
-componentdefinitions.core.oam.dev | ComponentDefinition Object
-traitdefinitions.core.oam.dev  | TraitDefinition Object
-workflowstepdefinitions.core.oam.dev | Workflowstep Object
-scopedefinitions.core.oam.dev | ScopeDefinition Object
-policydefinitions.core.oam.dev | PolicyDefinition Object
- workloaddefinitions.core.oam.dev  | WorkloadDefinition Object
-definitionrevisions.core.oam.dev | The revision CRD for all definition objects
-rollouts.standard.oam.dev | Rollout feature trait
-resourcetrackers.core.oam.dev | Garbage Collection feature
-healthscopes.core.oam.dev | Health Check feature
-
-## TL;DR
-
-```bash
-helm repo add kubevela https://charts.kubevela.net/core
-helm repo update
-helm install --create-namespace -n vela-system kubevela kubevela/vela-minimal --wait
-```
-
-## Prerequisites
-
-- Kubernetes >= v1.19 && < v1.22
-  
-## Parameters
-
-### KubeVela core parameters
-
-| Name                          | Description                                                                                   | Value                |
-| ----------------------------- | --------------------------------------------------------------------------------------------- | -------------------- |
-| `systemDefinitionNamespace`   | System definition namespace, if unspecified, will use built-in variable `.Release.Namespace`. | `nil`                |
-| `applicationRevisionLimit`    | Application revision limit                                                                    | `10`                 |
-| `definitionRevisionLimit`     | Definition revision limit                                                                     | `20`                 |
-| `concurrentReconciles`        | concurrentReconciles is the concurrent reconcile number of the controller                     | `4`                  |
-| `controllerArgs.reSyncPeriod` | The period for resync the applications                                                        | `5m`                 |
-| `OAMSpecVer`                  | OAMSpecVer is the oam spec version controller want to setup                                   | `minimal`            |
-| `disableCaps`                 | Disable capability                                                                            | `envbinding,rollout` |
-| `applyOnceOnly`               | Valid applyOnceOnly values: true/false/on/off/force                                           | `off`                |
-| `dependCheckWait`             | dependCheckWait is the time to wait for ApplicationConfiguration's dependent-resource ready   | `30s`                |
-
-
-### KubeVela workflow parameters
-
-| Name                                   | Description                                            | Value   |
-| -------------------------------------- | ------------------------------------------------------ | ------- |
-| `workflow.enableSuspendOnFailure`      | Enable suspend on workflow failure                     | `false` |
-| `workflow.backoff.maxTime.waitState`   | The max backoff time of workflow in a wait condition   | `60`    |
-| `workflow.backoff.maxTime.failedState` | The max backoff time of workflow in a failed condition | `300`   |
-| `workflow.step.errorRetryTimes`        | The max retry times of a failed workflow step          | `10`    |
-
-
-### KubeVela controller parameters
-
-| Name                        | Description                          | Value              |
-| --------------------------- | ------------------------------------ | ------------------ |
-| `replicaCount`              | KubeVela controller replica count    | `1`                |
-| `imageRegistry`             | Image registry                       | `""`               |
-| `image.repository`          | Image repository                     | `oamdev/vela-core` |
-| `image.tag`                 | Image tag                            | `latest`           |
-| `image.pullPolicy`          | Image pull policy                    | `Always`           |
-| `resources.limits.cpu`      | KubeVela controller's cpu limit      | `500m`             |
-| `resources.limits.memory`   | KubeVela controller's memory limit   | `1Gi`              |
-| `resources.requests.cpu`    | KubeVela controller's cpu request    | `50m`              |
-| `resources.requests.memory` | KubeVela controller's memory request | `20Mi`             |
-| `webhookService.type`       | KubeVela webhook service type        | `ClusterIP`        |
-| `webhookService.port`       | KubeVela webhook service port        | `9443`             |
-| `healthCheck.port`          | KubeVela health check port           | `9440`             |
-
-
-### MultiCluster parameters
-
-| Name                                                  | Description                      | Value                            |
-| ----------------------------------------------------- | -------------------------------- | -------------------------------- |
-| `multicluster.enabled`                                | Whether to enable multi-cluster  | `true`                           |
-| `multicluster.clusterGateway.replicaCount`            | ClusterGateway replica count     | `1`                              |
-| `multicluster.clusterGateway.port`                    | ClusterGateway port              | `9443`                           |
-| `multicluster.clusterGateway.image.repository`        | ClusterGateway image repository  | `oamdev/cluster-gateway`         |
-| `multicluster.clusterGateway.image.tag`               | ClusterGateway image tag         | `v1.7.0`                         |
-| `multicluster.clusterGateway.image.pullPolicy`        | ClusterGateway image pull policy | `IfNotPresent`                   |
-| `multicluster.clusterGateway.resources.limits.cpu`    | ClusterGateway cpu limit         | `100m`                           |
-| `multicluster.clusterGateway.resources.limits.memory` | ClusterGateway memory limit      | `200Mi`                          |
-| `multicluster.clusterGateway.secureTLS.enabled`       | Whether to enable secure TLS     | `true`                           |
-| `multicluster.clusterGateway.secureTLS.certPath`      | Path to the certificate file     | `/etc/k8s-cluster-gateway-certs` |
-
-
-### Test parameters
-
-| Name                  | Description         | Value                |
-| --------------------- | ------------------- | -------------------- |
-| `test.app.repository` | Test app repository | `oamdev/hello-world` |
-| `test.app.tag`        | Test app tag        | `v1`                 |
-| `test.k8s.repository` | Test k8s repository | `oamdev/alpine-k8s`  |
-| `test.k8s.tag`        | Test k8s tag        | `1.18.2`             |
-
-
-### Common parameters
-
-| Name                          | Description                                                                                                                | Value                |
-| ----------------------------- | -------------------------------------------------------------------------------------------------------------------------- | -------------------- |
-| `imagePullSecrets`            | Image pull secrets                                                                                                         | `[]`                 |
-| `nameOverride`                | Override name                                                                                                              | `""`                 |
-| `fullnameOverride`            | Fullname override                                                                                                          | `""`                 |
-| `serviceAccount.create`       | Specifies whether a service account should be created                                                                      | `true`               |
-| `serviceAccount.annotations`  | Annotations to add to the service account                                                                                  | `{}`                 |
-| `serviceAccount.name`         | The name of the service account to use. If not set and create is true, a name is generated using the fullname template     | `nil`                |
-| `nodeSelector`                | Node selector                                                                                                              | `{}`                 |
-| `tolerations`                 | Tolerations                                                                                                                | `[]`                 |
-| `affinity`                    | Affinity                                                                                                                   | `{}`                 |
-| `rbac.create`                 | Specifies whether a RBAC role should be created                                                                            | `true`               |
-| `logDebug`                    | Enable debug logs for development purpose                                                                                  | `false`              |
-| `logFilePath`                 | If non-empty, write log files in this path                                                                                 | `""`                 |
-| `logFileMaxSize`              | Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited. | `1024`               |
-| `kubeClient.qps`              | The qps for reconcile clients, default is 50                                                                               | `50`                 |
-| `kubeClient.burst`            | The burst for reconcile clients, default is 100                                                                            | `100`                |
-| `authentication.enabled`      | Enable authentication for application                                                                                      | `false`              |
-| `authentication.withUser`     | Application authentication will impersonate as the request User                                                            | `false`              |
-| `authentication.defaultUser`  | Application authentication will impersonate as the User if no user provided in Application                                 | `kubevela:vela-core` |
-| `authentication.groupPattern` | Application authentication will impersonate as the request Group that matches the pattern                                  | `kubevela:*`         |
-
-