Update middleware-operator image version to 0.2.28

fix: update image restriction to include docker.io prefix for beclab

.github/workflows/check.yaml

@@ -3,12 +3,28 @@ name: Lint and Test Charts
 on:
   push:
     branches: [ "main", "release-*" ]
-    paths-ignore:
-      - 'docs/**'    
+    paths:
+      - '!docs/**'    
+      - 'apps/.olares/**'
+      - 'build/**'
+      - 'cli/**'
+      - 'daemon/**'
+      - 'framework/**/.olares/**'
+      - 'infrastructure/**/.olares/**'
+      - 'platform/**/.olares/**'
+      - 'vendor/**'
   pull_request_target:
     branches: [ "main", "release-*" ]
-    paths-ignore:
-      - 'docs/**'    
+    paths:
+      - '!docs/**'    
+      - 'apps/.olares/**'
+      - 'build/**'
+      - 'cli/**'
+      - 'daemon/**'
+      - 'framework/**/.olares/**'
+      - 'infrastructure/**/.olares/**'
+      - 'platform/**/.olares/**'
+      - 'vendor/**'
 
   workflow_dispatch:
 
@@ -59,7 +75,7 @@ jobs:
     steps:
       - id: generate
         run: |
-          v=1.12.2-$(echo $RANDOM$RANDOM)
+          v=1.12.3-$(echo $RANDOM$RANDOM)
           echo "version=$v" >> "$GITHUB_OUTPUT"
 
   upload-cli:
@@ -211,7 +227,7 @@ jobs:
           url: 'https://cloud-dev-api.bttcdn.com/v1/resource/installTest'
           method: 'POST'
           customHeaders: '{"Authorization": "${{ secrets.INSTALL_SECRET }}"}'
-          data: 'versions=${{ needs.test-version.outputs.version }}&downloadUrl=https://dc3p1870nn3cj.cloudfront.net/install-wizard-v${{ needs.test-version.outputs.version }}.tar.gz'
+          data: 'versions=${{ needs.test-version.outputs.version }}&downloadUrl=https://cdn.olares.com/install-wizard-v${{ needs.test-version.outputs.version }}.tar.gz'
           contentType: "application/x-www-form-urlencoded"
 
       - name: Check Result

.github/workflows/module_appservice_build_main.yaml

@@ -0,0 +1,32 @@
+name: App-Service Build test
+on: 
+  push:
+    branches:
+      - "module-appservice"
+    paths:
+      - 'framework/app-service/**'
+      - '!framework/app-service/.olares/**'
+      - '!framework/app-service/README.md'
+      - '!framework/app-service/PROJECT'
+  pull_request:
+    branches:
+      - "module-appservice"
+    paths:
+      - 'framework/app-service/**'
+      - '!framework/app-service/.olares/**'
+      - '!framework/app-service/README.md'
+      - '!framework/app-service/PROJECT'
+jobs:
+  build0-main:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y btrfs-progs libbtrfs-dev
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v3
+        with:
+          go-version: '1.24.6'
+      - run: make build
+        working-directory: framework/app-service

.github/workflows/module_appservice_publish_docker.yaml

@@ -0,0 +1,62 @@
+name: Publish app-service to Dockerhub
+
+on:
+    workflow_dispatch:
+      inputs:
+        tags:
+          description: 'Release Tags'
+
+jobs:
+  publish_dockerhub_amd64:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v3
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASS }}
+      - name: Build and push amd64 Docker image
+        uses: docker/build-push-action@v3
+        with:
+          push: true
+          tags: beclab/app-service:${{ github.event.inputs.tags }}-amd64
+          context: framework/app-service
+          file: framework/app-service/Dockerfile
+          platforms: linux/amd64
+  publish_dockerhub_arm64:
+    runs-on: self-hosted
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v3
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASS }}
+      - name: Build and push arm64 Docker image
+        uses: docker/build-push-action@v3
+        with:
+          push: true
+          tags: beclab/app-service:${{ github.event.inputs.tags }}-arm64
+          context: framework/app-service
+          file: framework/app-service/Dockerfile
+          platforms: linux/arm64
+
+  publish_manifest:
+    needs:
+    - publish_dockerhub_amd64
+    - publish_dockerhub_arm64
+    runs-on: ubuntu-latest
+    steps:
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASS }}
+
+      - name: Push manifest
+        run: |
+          docker manifest create beclab/app-service:${{ github.event.inputs.tags }} --amend beclab/app-service:${{ github.event.inputs.tags }}-amd64 --amend beclab/app-service:${{ github.event.inputs.tags }}-arm64
+          docker manifest push beclab/app-service:${{ github.event.inputs.tags }}

.github/workflows/module_appservice_publish_imageservice.yaml

@@ -0,0 +1,63 @@
+name: Publish image-service to Dockerhub
+
+on:
+    workflow_dispatch:
+      inputs:
+        tags:
+          description: 'Release Tags'
+
+jobs:
+  publish_dockerhub_amd64:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v3
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASS }}
+      - name: Build and push amd64 Docker image
+        uses: docker/build-push-action@v3
+        with:
+          push: true
+          tags: beclab/image-service:${{ github.event.inputs.tags }}-amd64
+          context: framework/app-service
+          file: framework/app-service/Dockerfile.image
+          platforms: linux/amd64
+  publish_dockerhub_arm64:
+    runs-on: self-hosted
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v3
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASS }}
+      - name: Build and push arm64 Docker image
+        uses: docker/build-push-action@v3
+        with:
+          push: true
+          tags: beclab/image-service:${{ github.event.inputs.tags }}-arm64
+          context: framework/app-service
+          file: framework/app-service/Dockerfile.image
+          platforms: linux/arm64
+
+  publish_manifest:
+    needs:
+      - publish_dockerhub_amd64
+      - publish_dockerhub_arm64
+    runs-on: ubuntu-latest
+    steps:
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASS }}
+
+      - name: Push manifest
+        run: |
+          docker manifest create beclab/image-service:${{ github.event.inputs.tags }} --amend beclab/image-service:${{ github.event.inputs.tags }}-amd64 --amend beclab/image-service:${{ github.event.inputs.tags }}-arm64
+          docker manifest push beclab/image-service:${{ github.event.inputs.tags }}
+

.github/workflows/release-daemon.yaml

@@ -44,9 +44,9 @@ jobs:
         with:
           go-version: 1.22.1
 
-      - name: install udev-devel
+      - name: install udev-devel and pcap-devel
         run: |
-          sudo apt update && sudo apt install -y libudev-dev
+          sudo apt update && sudo apt install -y libudev-dev libpcap-dev
 
       - name: Install x86_64 cross-compiler
         run: sudo apt-get update && sudo apt-get install -y build-essential

.github/workflows/release-daily.yaml

@@ -17,7 +17,7 @@ jobs:
     steps:
       - id: generate
         run: |
-          v=1.12.2-$(date +"%Y%m%d")
+          v=1.12.3-$(date +"%Y%m%d")
           echo "version=$v" >> "$GITHUB_OUTPUT"
 
   release-id:

.github/workflows/release.yaml

@@ -162,7 +162,7 @@ jobs:
       - name: Get checksum
         id: vars
         run: |
-          echo "version_md5sum=$(curl -sSfL https://dc3p1870nn3cj.cloudfront.net${{ secrets.REPO_PATH }}install-wizard-v${{ github.event.inputs.tags }}.${{ needs.release-id.outputs.id }}.md5sum.txt|awk '{print $1}')" >> $GITHUB_OUTPUT
+          echo "version_md5sum=$(curl -sSfL https://cdn.olares.com${{ secrets.REPO_PATH }}install-wizard-v${{ github.event.inputs.tags }}.${{ needs.release-id.outputs.id }}.md5sum.txt|awk '{print $1}')" >> $GITHUB_OUTPUT
 
       - name: Update checksum
         uses: eball/write-tag-to-version-file@latest

.gitignore

@@ -37,4 +37,6 @@ docs/.vitepress/dist/
 docs/.vitepress/cache/
 node_modules
 .idea/
-cli/olares-cli*
+cli/olares-cli*
+
+framework/app-service/bin

README.md

@@ -8,7 +8,9 @@
 [![GitHub release (latest by date)](https://img.shields.io/github/v/release/beclab/olares)](https://github.com/beclab/olares/releases)
 [![GitHub Repo stars](https://img.shields.io/github/stars/beclab/olares?style=social)](https://github.com/beclab/olares/stargazers)
 [![Discord](https://img.shields.io/badge/Discord-7289DA?logo=discord&logoColor=white)](https://discord.gg/olares)
-[![License](https://img.shields.io/badge/License-Olares-darkblue)](https://github.com/beclab/olares/blob/main/LICENSE.md)
+[![License](https://img.shields.io/badge/License-AGPL--3.0-blue)](https://github.com/beclab/olares/blob/main/LICENSE)
+
+<a href="https://trendshift.io/repositories/15376" target="_blank"><img src="https://trendshift.io/api/badge/repositories/15376" alt="beclab%2FOlares | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a>
 
 <p>
   <a href="./README.md"><img alt="Readme in English" src="https://img.shields.io/badge/English-FFFFFF"></a>
@@ -21,7 +23,7 @@
 <p align="center">
   <a href="https://olares.com">Website</a> ·
   <a href="https://docs.olares.com">Documentation</a> ·
-  <a href="https://larepass.olares.com">Download LarePass</a> ·
+  <a href="https://www.olares.com/larepass">Download LarePass</a> ·
   <a href="https://github.com/beclab/apps">Olares Apps</a> ·
   <a href="https://space.olares.com">Olares Space</a>
 </p>
@@ -30,10 +32,10 @@
 >
 >*It's time for a change.* 
 
-![Personal Cloud](https://file.bttcdn.com/github/olares/public-cloud-to-personal-cloud.jpg)
+![Personal Cloud](https://app.cdn.olares.com/github/olares/public-cloud-to-personal-cloud.jpg)
 We believe you have a fundamental right to control your digital life. The most effective way to uphold this right is by hosting your data locally, on your own hardware.
 
-Olares is an **open-source personal cloud operating system** designed to empower you to own and manage your digital assets locally. Instead of relying on public cloud services, you can deploy powerful open-source alternatives locally on Olares, such as Ollama for hosting LLMs, SD WebUI for image generation, and Mastodon for building censor free social space. Imagine the power of the cloud, but with you in complete command.
+Olares is an **open-source personal cloud operating system** designed to empower you to own and manage your digital assets locally. Instead of relying on public cloud services, you can deploy powerful open-source alternatives locally on Olares, such as Ollama for hosting LLMs, ComfyUI for image generation, and Perplexica for private, AI-driven search and reasoning. Imagine the power of the cloud, but with you in complete command.
 
 > 🌟 *Star us to receive instant notifications about new releases and updates.* 
 
@@ -41,7 +43,7 @@ Olares is an **open-source personal cloud operating system** designed to empower
 
 Just as Public clouds offer IaaS, PaaS, and SaaS layers, Olares provides open-source alternatives to each of these layers.
 
-  ![Tech Stacks](https://file.bttcdn.com/github/olares/olares-architecture.jpg)
+  ![Tech Stacks](https://app.cdn.olares.com/github/olares/olares-architecture.jpg)
 
  For detailed description of each component, refer to [Olares architecture](https://docs.olares.com/manual/concepts/system-architecture.html).
 
@@ -66,15 +68,15 @@ Here are some screenshots from the UI for a sneak peek:
 
 | **Desktop–Streamlined and familiar portal**     |  **Files–A secure home to your data**
 | :--------: | :-------: |
-| ![Desktop](https://file.bttcdn.com/github/terminus/v2/desktop.jpg) | ![Files](https://file.bttcdn.com/github/terminus/v2/files.jpg) |
+| ![Desktop](https://app.cdn.olares.com/github/terminus/v2/desktop.jpg) | ![Files](https://app.cdn.olares.com/github/terminus/v2/files.jpg) |
 | **Vault–1Password alternative**|**Market–App ecosystem in your control** |
-| ![vault](https://file.bttcdn.com/github/terminus/v2/vault.jpg) | ![market](https://file.bttcdn.com/github/terminus/v2/market.jpg) |
+| ![vault](https://app.cdn.olares.com/github/terminus/v2/vault.jpg) | ![market](https://app.cdn.olares.com/github/terminus/v2/market.jpg) |
 |**Wise–Your digital secret garden** | **Settings–Manage Olares efficiently** |
-| ![settings](https://file.bttcdn.com/github/terminus/v2/wise.jpg) | ![](https://file.bttcdn.com/github/terminus/v2/settings.jpg) |
+| ![settings](https://app.cdn.olares.com/github/terminus/v2/wise.jpg) | ![](https://app.cdn.olares.com/github/terminus/v2/settings.jpg) |
 |**Dashboard–Constant system monitoring**  | **Profile–Your unique homepage** |
-| ![dashboard](https://file.bttcdn.com/github/terminus/v2/dashboard.jpg) | ![profile](https://file.bttcdn.com/github/terminus/v2/profile.jpg) |
+| ![dashboard](https://app.cdn.olares.com/github/terminus/v2/dashboard.jpg) | ![profile](https://app.cdn.olares.com/github/terminus/v2/profile.jpg) |
 | **Studio–Develop, debug, and deploy**|**Control Hub–Manage Kubernetes clusters easily**  |
-| ![Studio](https://file.bttcdn.com/github/terminus/v2/devbox.jpg) | ![Controlhub](https://file.bttcdn.com/github/terminus/v2/controlhub.jpg)|
+| ![Studio](https://app.cdn.olares.com/github/terminus/v2/devbox.jpg) | ![Controlhub](https://app.cdn.olares.com/github/terminus/v2/controlhub.jpg)|
 
 
 ## Key use cases

README_CN.md

@@ -8,7 +8,9 @@
 [![GitHub release (latest by date)](https://img.shields.io/github/v/release/beclab/terminus)](https://github.com/beclab/olares/releases)
 [![GitHub Repo stars](https://img.shields.io/github/stars/beclab/terminus?style=social)](https://github.com/beclab/olares/stargazers)
 [![Discord](https://img.shields.io/badge/Discord-7289DA?logo=discord&logoColor=white)](https://discord.gg/olares)
-[![License](https://img.shields.io/badge/License-Olares-darkblue)](https://github.com/beclab/olares/blob/main/LICENSE.md)
+[![License](https://img.shields.io/badge/License-AGPL--3.0-blue)](https://github.com/beclab/olares/blob/main/LICENSE)
+
+<a href="https://trendshift.io/repositories/15376" target="_blank"><img src="https://trendshift.io/api/badge/repositories/15376" alt="beclab%2FOlares | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a>
 
 <p>
   <a href="./README.md"><img alt="Readme in English" src="https://img.shields.io/badge/English-FFFFFF"></a>
@@ -21,7 +23,7 @@
 <p align="center">
   <a href="https://olares.com">网站</a> ·
   <a href="https://docs.olares.com">文档</a> ·
-  <a href="https://larepass.olares.com">下载 LarePass</a> ·
+  <a href="https://www.olares.cn/larepass">下载 LarePass</a> ·
   <a href="https://github.com/beclab/apps">Olares 应用</a> ·
   <a href="https://space.olares.com">Olares Space</a>
 </p>
@@ -30,11 +32,11 @@
 >
 > *是时候做出改变了。*
 
-![个人云](https://file.bttcdn.com/github/olares/public-cloud-to-personal-cloud.jpg)
+![个人云](https://app.cdn.olares.com/github/olares/public-cloud-to-personal-cloud.jpg)
 
 我们坚信，**您拥有掌控自己数字生活的基本权利**。维护这一权利最有效的方式，就是将您的数据托管在本地，在您自己的硬件上。
 
-Olares 是一款开源个人云操作系统，旨在让您能够轻松在本地拥有并管理自己的数字资产。您无需再依赖公有云服务，而可以在 Olares 上本地部署强大的开源平替服务或应用，例如可以使用 Ollama 托管大语言模型，使用 SD WebUI 用于图像生成，以及使用 Mastodon 构建不受审查的社交空间。Olares 让你坐拥云计算的强大威力，又能完全将其置于自己掌控之下。
+Olares 是一款开源个人云操作系统，旨在让您能够轻松在本地拥有并管理自己的数字资产。您无需再依赖公有云服务，而可以在 Olares 上本地部署强大的开源平替服务或应用，例如可以使用 Ollama 托管大语言模型，使用 ComfyUI 生成图像，以及使用 Perplexica 打造本地化、注重隐私的 AI 搜索与问答体验。Olares 让您坐拥云计算的强大威力，又能完全将其置于自己掌控之下。
 
 > 为 Olares 点亮 🌟 以及时获取新版本和更新的通知。
 
@@ -42,7 +44,7 @@ Olares 是一款开源个人云操作系统，旨在让您能够轻松在本地
 
 公有云具有基础设施即服务（IaaS）、平台即服务（PaaS）和软件即服务（SaaS）等层级。Olares 为这些层级提供了开源替代方案。
 
-  ![技术栈](https://file.bttcdn.com/github/olares/olares-architecture.jpg)
+  ![技术栈](https://app.cdn.olares.com/github/olares/olares-architecture.jpg)
 
 详细描述请参考 [Olares 架构](https://docs.olares.cn/zh/manual/concepts/system-architecture.html)文档。
 
@@ -68,15 +70,15 @@ Olares 提供了一系列功能，旨在提升安全性、使用便捷性以及
 
 | **桌面：熟悉高效的访问入口**     |  **文件管理器：安全存储数据**
 | :--------: | :-------: |
-| ![桌面](https://file.bttcdn.com/github/terminus/v2/desktop.jpg) | ![文件](https://file.bttcdn.com/github/terminus/v2/files.jpg) |
+| ![桌面](https://app.cdn.olares.com/github/terminus/v2/desktop.jpg) | ![文件](https://app.cdn.olares.com/github/terminus/v2/files.jpg) |
 | **Vault：密码无忧管理**|**市场：可控的应用生态系统** |
-| ![vault](https://file.bttcdn.com/github/terminus/v2/vault.jpg) | ![市场](https://file.bttcdn.com/github/terminus/v2/market.jpg) |
+| ![vault](https://app.cdn.olares.com/github/terminus/v2/vault.jpg) | ![市场](https://app.cdn.olares.com/github/terminus/v2/market.jpg) |
 |**Wise：数字后花园** | **设置：高效管理 Olares** |
-| ![设置](https://file.bttcdn.com/github/terminus/v2/wise.jpg) | ![](https://file.bttcdn.com/github/terminus/v2/settings.jpg) |
+| ![设置](https://app.cdn.olares.com/github/terminus/v2/wise.jpg) | ![](https://app.cdn.olares.com/github/terminus/v2/settings.jpg) |
 |**仪表盘：持续监控 Olares**  | **Profile：独特的个人主页** |
-| ![面板](https://file.bttcdn.com/github/terminus/v2/dashboard.jpg) | ![profile](https://file.bttcdn.com/github/terminus/v2/profile.jpg) |
+| ![面板](https://app.cdn.olares.com/github/terminus/v2/dashboard.jpg) | ![profile](https://app.cdn.olares.com/github/terminus/v2/profile.jpg) |
 | **Studio：一站式开发、调试和部署**|**控制面板：轻松管理 Kubernetes 集群**  |
-| ![Devbox](https://file.bttcdn.com/github/terminus/v2/devbox.jpg) | ![控制中心](https://file.bttcdn.com/github/terminus/v2/controlhub.jpg)|
+| ![Devbox](https://app.cdn.olares.com/github/terminus/v2/devbox.jpg) | ![控制中心](https://app.cdn.olares.com/github/terminus/v2/controlhub.jpg)|
 
 ## 使用场景
 

README_JP.md

@@ -8,7 +8,9 @@
 [![GitHub release (latest by date)](https://img.shields.io/github/v/release/beclab/olares)](https://github.com/beclab/olares/releases)
 [![GitHub Repo stars](https://img.shields.io/github/stars/beclab/olares?style=social)](https://github.com/beclab/olares/stargazers)
 [![Discord](https://img.shields.io/badge/Discord-7289DA?logo=discord&logoColor=white)](https://discord.gg/olares)
-[![License](https://img.shields.io/badge/License-Olares-darkblue)](https://github.com/beclab/olares/blob/main/LICENSE.md)
+[![License](https://img.shields.io/badge/License-AGPL--3.0-blue)](https://github.com/beclab/olares/blob/main/LICENSE)
+
+<a href="https://trendshift.io/repositories/15376" target="_blank"><img src="https://trendshift.io/api/badge/repositories/15376" alt="beclab%2FOlares | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a>
 
 <p>
   <a href="./README.md"><img alt="Readme in English" src="https://img.shields.io/badge/English-FFFFFF"></a>
@@ -21,7 +23,7 @@
 <p align="center">
   <a href="https://olares.com">ウェブサイト</a> ·
   <a href="https://docs.olares.com">ドキュメント</a> ·
-  <a href="https://larepass.olares.com">LarePassをダウンロード</a> ·
+  <a href="https://www.olares.com/larepass">LarePassをダウンロード</a> ·
   <a href="https://github.com/beclab/apps">Olaresアプリ</a> ·
   <a href="https://space.olares.com">Olares Space</a>
 </p>
@@ -30,21 +32,20 @@
 >
 >*今こそ、変革の時です。*
 
-![自身のデジタル](https://file.bttcdn.com/github/olares/public-cloud-to-personal-cloud.jpg)
+![自身のデジタル](https://app.cdn.olares.com/github/olares/public-cloud-to-personal-cloud.jpg)
 
 私たちは、あなたが自身のデジタルライフをコントロールする基本的な権利を有すると確信しています。この権利を守る最も効果的な方法は、あなたのデータをローカルの、あなた自身のハードウェア上でホストすることです。
 
-Olaresは、あなたが自身のデジタル資産をローカルで容易に所有し管理できるよう設計された、オープンソースのパーソナルクラウドOSです。もはやパブリッククラウドサービスに依存する必要はありません。Olares上で、例えばOllamaを利用した大規模言語モデルのホスティング、SD WebUIによる画像生成、Mastodonを用いた検閲のないソーシャルスペースの構築など、強力なオープンソースの代替サービスやアプリケーションをローカルにデプロイできます。Olaresは、クラウドコンピューティングの絶大な力を活用しつつ、それを完全に自身のコントロール下に置くことを可能にします。
-
+Olaresは、あなたが自身のデジタル資産をローカルで所有し管理できるように設計された、オープンソースのパーソナルクラウドOSです。パブリッククラウドサービスに依存する代わりに、Olares上で強力なオープンソースの代替をローカルにデプロイできます。例えば、LLMのホスティングにはOllama、画像生成にはComfyUI、そしてプライバシーを重視したAI駆動の検索と推論にはPerplexicaを利用できます。クラウドの力をそのままに、主導権は常にあなたの手に。
 > 🌟 *新しいリリースや更新についての通知を受け取るために、スターを付けてください。*
 
 ## アーキテクチャ
 
 パブリッククラウドは、IaaS (Infrastructure as a Service)、PaaS (Platform as a Service)、SaaS (Software as a Service) といったサービスレイヤーで構成されています。Olaresは、これら各レイヤーに対するオープンソースの代替ソリューションを提供しています。
 
-  ![Olaresのアーキテクチ](https://file.bttcdn.com/github/olares/olares-architecture.jpg)
+  ![Olaresのアーキテクチ](https://app.cdn.olares.com/github/olares/olares-architecture.jpg)
 
-各コンポーネントの詳細については、[Olares アーキテクチャ](https://docs.olares.com/manual/concepts/system-architecture.html)（英語版）をご参照ください。
+各コンポーネントの詳細については、[Olares アーキテクチャ](https://docs.olares.com/developer/concepts/system-architecture.html)（英語版）をご参照ください。
 
 > 🔍**OlaresとNASの違いは何ですか？**
 >
@@ -67,15 +68,15 @@ Olaresは、セキュリティ、使いやすさ、開発の柔軟性を向上
 
 | **デスクトップ：馴染みやすく効率的なアクセスポイント** |  **ファイルマネージャー：データを安全に保管** |
 | :--------: | :-------: |
-| ![桌面](https://file.bttcdn.com/github/terminus/v2/desktop.jpg) | ![文件](https://file.bttcdn.com/github/terminus/v2/files.jpg) |
+| ![桌面](https://app.cdn.olares.com/github/terminus/v2/desktop.jpg) | ![文件](https://app.cdn.olares.com/github/terminus/v2/files.jpg) |
 | **Vault：安心のパスワード管理**|**マーケット：コントロール可能なアプリエコシステム** |
-| ![vault](https://file.bttcdn.com/github/terminus/v2/vault.jpg) | ![市场](https://file.bttcdn.com/github/terminus/v2/market.jpg) |
+| ![vault](https://app.cdn.olares.com/github/terminus/v2/vault.jpg) | ![市场](https://app.cdn.olares.com/github/terminus/v2/market.jpg) |
 | **Wise：あなただけのデジタルガーデン** | **設定：Olaresを効率的に管理** |
-| ![设置](https://file.bttcdn.com/github/terminus/v2/wise.jpg) | ![](https://file.bttcdn.com/github/terminus/v2/settings.jpg) |
+| ![设置](https://app.cdn.olares.com/github/terminus/v2/wise.jpg) | ![](https://app.cdn.olares.com/github/terminus/v2/settings.jpg) |
 | **ダッシュボード：Olaresを継続的に監視** | **プロフィール：ユニークなパーソナルページ** |
-| ![面板](https://file.bttcdn.com/github/terminus/v2/dashboard.jpg) | ![profile](https://file.bttcdn.com/github/terminus/v2/profile.jpg) |
+| ![面板](https://app.cdn.olares.com/github/terminus/v2/dashboard.jpg) | ![profile](https://app.cdn.olares.com/github/terminus/v2/profile.jpg) |
 | **Studio：開発、デバッグ、デプロイをワンストップで**|**コントロールパネル：Kubernetesクラスターを簡単に管理** |
-| ![Devbox](https://file.bttcdn.com/github/terminus/v2/devbox.jpg) | ![控制中心](https://file.bttcdn.com/github/terminus/v2/controlhub.jpg)|
+| ![Devbox](https://app.cdn.olares.com/github/terminus/v2/devbox.jpg) | ![控制中心](https://app.cdn.olares.com/github/terminus/v2/controlhub.jpg)|
 
 ## なぜOlaresなのか？
 

apps/.olares/config/user/helm-charts/system-apps/templates/files-permission.yaml

@@ -11,3 +11,17 @@ subjects:
 - kind: ServiceAccount
   name: system-frontend
   namespace: {{ .Release.Namespace }}
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: backend:{{ .Values.bfl.username }}:system-frontend:media-server-svc
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Values.bfl.username }}:media-server-svc
+subjects:
+- kind: ServiceAccount
+  name: system-frontend
+  namespace: {{ .Release.Namespace }}

apps/.olares/config/user/helm-charts/system-apps/templates/files-provider.yaml

@@ -35,34 +35,6 @@ rules:
   - "/api/nodes/*"
   verbs: ["*"]
 
-# ---
-# apiVersion: sys.bytetrade.io/v1alpha1
-# kind: ProviderRegistry
-# metadata:
-#   name: files-provider
-#   namespace: user-system-{{ .Values.bfl.username }}
-# spec:
-#   dataType: files
-#   deployment: files
-#   description: files provider
-#   endpoint: files-service.{{ .Release.Namespace }}
-#   group: service.files
-#   kind: provider
-#   namespace: {{ .Release.Namespace }}
-#   opApis:
-#     - name: Query
-#       uri: /provider/query_file
-#     - name: GetSearchFolderStatus
-#       uri: /provider/get_search_folder_status
-#     - name: UpdateSearchFolderPaths
-#       uri: /provider/update_search_folder_paths
-#     - name: GetDatasetFolderStatus
-#       uri: /provider/get_dataset_folder_status
-#     - name: UpdateDatasetFolderPaths
-#       uri: /provider/update_dataset_folder_paths
-#   version: v1
-# status:
-#   state: active
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -78,8 +50,23 @@ rules:
   - "/provider/update_search_folder_paths"
   - "/provider/get_dataset_folder_status"
   - "/provider/update_dataset_folder_paths"
+  - "/seahub/api/*"
+  - "/system/configuration/encoding"
+  - "/api/search/get_directory/"
   verbs: ["*"]
 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Values.bfl.username }}:media-server-svc
+  annotations:
+    provider-registry-ref: user-system-{{ .Values.bfl.username }}/media-server-service
+    provider-service-ref: media-server-service.os-framework:9090
+rules:
+- nonResourceURLs: 
+  - "/System/Configuration/encoding"
+  verbs: ["*"]
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1

apps/.olares/config/user/helm-charts/system-apps/templates/hami-permission.yaml

@@ -0,0 +1,27 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: backend:{{ .Values.bfl.username }}:system-frontend:hami-scheduler-svc
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Values.bfl.username }}:hami-scheduler-svc
+subjects:
+- kind: ServiceAccount
+  name: system-frontend
+  namespace: {{ .Release.Namespace }}
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: backend:{{ .Values.bfl.username }}:system-frontend:hami-webui-svc
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Values.bfl.username }}:hami-webui-svc
+subjects:
+- kind: ServiceAccount
+  name: system-frontend
+  namespace: {{ .Release.Namespace }}

apps/.olares/config/user/helm-charts/system-apps/templates/hami-provider.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Values.bfl.username }}:hami-scheduler-svc
+  annotations:
+    provider-registry-ref: user-system-{{ .Values.bfl.username }}/hami-scheduler
+    provider-service-ref: https://hami-scheduler.kube-system
+rules:
+- nonResourceURLs: 
+  - "/gpus*"
+  verbs: ["*"]
+
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Values.bfl.username }}:hami-webui-svc
+  annotations:
+    provider-registry-ref: user-system-{{ .Values.bfl.username }}/hami-webui
+    provider-service-ref: hami-webui.kube-system:3000
+rules:
+- nonResourceURLs: 
+  - "/api/vgpu/v1/*"
+  verbs: ["*"]  

apps/.olares/config/user/helm-charts/system-apps/templates/infisical-provider.yaml

@@ -4,7 +4,7 @@ metadata:
   name: {{ .Values.bfl.username }}:infisical-frontend-svc
   annotations:
     provider-registry-ref: user-space-{{ .Values.bfl.username }}/infisical
-    provider-service-ref: infisical-service.os-framework:8080
+    provider-service-ref: infisical-service.os-protected:8080
 rules:
 - nonResourceURLs: ["/admin/*"]
   verbs: ["*"]
@@ -16,7 +16,7 @@ metadata:
   name: {{ .Values.bfl.username }}:infisical-frontend-domain
   annotations:
     provider-registry-ref: {{ .Values.bfl.username }}/settings
-    provider-service-ref: infisical-service.os-framework:8080
+    provider-service-ref: infisical-service.os-protected:8080
 rules:
 - nonResourceURLs: ["/admin/*"]
   verbs: ["*"]

apps/.olares/config/user/helm-charts/system-apps/templates/notification-permission.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: backend:{{ .Values.bfl.username }}:notification-provider-svc
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Values.bfl.username }}:notification-provider-svc
+subjects:
+- kind: ServiceAccount
+  name: system-frontend
+  namespace: {{ .Release.Namespace }}

apps/.olares/config/user/helm-charts/system-apps/templates/notification-provider.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Values.bfl.username }}:notification-provider-svc
+  annotations:
+    provider-registry-ref: user-system-{{ .Values.bfl.username }}/notifications-server
+    provider-service-ref: notifications-server.os-framework:80
+rules:
+- nonResourceURLs: 
+  - "/notification/*"
+  verbs: ["*"]

apps/.olares/config/user/helm-charts/system-apps/templates/olares-app.yaml

@@ -209,6 +209,21 @@ spec:
       port: 80
       targetPort: 91
 ---
+apiVersion: v1
+kind: Service
+metadata:
+  name: share-fe-service
+  namespace: user-space-{{ .Values.bfl.username }}
+spec:
+  selector:
+    app: olares-app
+  type: ClusterIP
+  ports:
+    - protocol: TCP
+      name: share
+      port: 80
+      targetPort: 92
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -220,12 +235,12 @@ metadata:
     applications.app.bytetrade.io/owner: '{{ .Values.bfl.username }}'
     applications.app.bytetrade.io/author: bytetrade.io
   annotations:
-    applications.app.bytetrade.io/default-thirdlevel-domains: '[{"appName": "olares-app","entranceName":"dashboard","thirdLevelDomain":"dashboard"},{"appName":"olares-app","entranceName":"control-hub","thirdLevelDomain":"control-hub"},{"appName":"olares-app","entranceName":"files","thirdLevelDomain":"files"},{"appName": "olares-app","entranceName":"vault","thirdLevelDomain":"vault"},{"appName":"olares-app","entranceName":"headscale","thirdLevelDomain":"headscale"},{"appName":"olares-app","entranceName":"settings","thirdLevelDomain":"settings"},{"appName": "olares-app","entranceName":"market","thirdLevelDomain":"market"},{"appName":"olares-app","entranceName":"profile","thirdLevelDomain":"profile"}]'
-    applications.app.bytetrade.io/icon: https://file.bttcdn.com/appstore/olaresapps/icon.png
+    applications.app.bytetrade.io/default-thirdlevel-domains: '[{"appName": "olares-app","entranceName":"dashboard","thirdLevelDomain":"dashboard"},{"appName":"olares-app","entranceName":"control-hub","thirdLevelDomain":"control-hub"},{"appName":"olares-app","entranceName":"files","thirdLevelDomain":"files"},{"appName":"olares-app","entranceName":"share","thirdLevelDomain":"share"},{"appName": "olares-app","entranceName":"vault","thirdLevelDomain":"vault"},{"appName":"olares-app","entranceName":"headscale","thirdLevelDomain":"headscale"},{"appName":"olares-app","entranceName":"settings","thirdLevelDomain":"settings"},{"appName": "olares-app","entranceName":"market","thirdLevelDomain":"market"},{"appName":"olares-app","entranceName":"profile","thirdLevelDomain":"profile"}]'
+    applications.app.bytetrade.io/icon: https://app.cdn.olares.com/appstore/olaresapps/icon.png
     applications.app.bytetrade.io/title: 'Olares Apps'
     applications.app.bytetrade.io/version: '0.0.1'
     applications.app.bytetrade.io/policies: '{"policies":[{"entranceName":"dashboard","uriRegex":"/js/script.js", "level":"public"},{"entranceName":"dashboard","uriRegex":"/js/api/send", "level":"public"}]}'
-    applications.app.bytetrade.io/entrances: '[{"name":"files", "host":"files-fe-service", "port":80,"title":"Files","windowPushState":true,"icon":"https://file.bttcdn.com/appstore/files/icon.png"},{"name":"vault", "host":"vault-service", "port":80,"title":"Vault","windowPushState":true,"icon":"https://file.bttcdn.com/appstore/vault/icon.png"},{"name":"market", "host":"appstore-fe-service", "port":80,"title":"Market","windowPushState":true,"icon":"https://file.bttcdn.com/appstore/appstore/icon.png"},{"name":"settings", "host":"settings-service", "port":80,"title":"Settings","icon":"https://file.bttcdn.com/appstore/settings/icon.png"},{"name":"profile", "host":"profile-service", "port":80,"title":"Profile","windowPushState":true,"icon":"https://file.bttcdn.com/appstore/profile/icon.png"},{"name":"dashboard","host":"dashboard-service","port":80,"title":"Dashboard","windowPushState":true,"icon":"https://file.bttcdn.com/appstore/dashboard/icon.png"},{"name":"control-hub","host":"control-hub-service","port":80,"title":"Control Hub","windowPushState":true,"icon":"https://file.bttcdn.com/appstore/control-hub/icon.png"},{"name":"headscale", "host":"headscale-svc", "port":80,"title":"Headscale","invisible": true,"icon":"https://file.bttcdn.com/appstore/headscale/icon.png"}]'
+    applications.app.bytetrade.io/entrances: '[{"name":"files", "host":"files-fe-service", "port":80,"title":"Files","windowPushState":true,"icon":"https://app.cdn.olares.com/appstore/files/icon.png"},{"name":"share","authLevel":"public", "host":"share-fe-service", "port":80,"title":"Share","windowPushState":true,"icon":"https://app.cdn.olares.com/appstore/files/icon.png","invisible":true},{"name":"vault", "host":"vault-service", "port":80,"title":"Vault","windowPushState":true,"icon":"https://app.cdn.olares.com/appstore/vault/icon.png"},{"name":"market", "host":"appstore-fe-service", "port":80,"title":"Market","windowPushState":true,"icon":"https://app.cdn.olares.com/appstore/appstore/icon.png"},{"name":"settings", "host":"settings-service", "port":80,"title":"Settings","icon":"https://app.cdn.olares.com/appstore/settings/icon.png"},{"name":"profile", "host":"profile-service", "port":80,"title":"Profile","windowPushState":true,"icon":"https://app.cdn.olares.com/appstore/profile/icon.png"},{"name":"dashboard","host":"dashboard-service","port":80,"title":"Dashboard","windowPushState":true,"icon":"https://app.cdn.olares.com/appstore/dashboard/icon.png"},{"name":"control-hub","host":"control-hub-service","port":80,"title":"Control Hub","windowPushState":true,"icon":"https://app.cdn.olares.com/appstore/control-hub/icon.png"},{"name":"headscale", "host":"headscale-svc", "port":80,"title":"Headscale","invisible": true,"icon":"https://app.cdn.olares.com/appstore/headscale/icon.png"}]'
 spec:
   replicas: 1
   selector:
@@ -249,11 +264,11 @@ spec:
       initContainers:
         - args:
             - -it
-            - authelia-backend.os-framework:9091,infisical-service:80,system-server.user-system-{{ .Values.bfl.username }}:80,nats.user-system-{{ .Values.bfl.username }}:4222
+            - authelia-backend.user-system-{{ .Values.bfl.username }}:9091,infisical-service.user-system-{{ .Values.bfl.username }}:8080,system-server.user-system-{{ .Values.bfl.username }}:80,nats.user-system-{{ .Values.bfl.username }}:4222
           image: owncloudci/wait-for:latest
           imagePullPolicy: IfNotPresent
           name: check-auth
-        - name: terminus-sidecar-init
+        - name: olares-sidecar-init
           image: openservicemesh/init:v1.2.3
           imagePullPolicy: IfNotPresent
           securityContext:
@@ -302,26 +317,8 @@ spec:
           - |
             chown -R 1000:1000 /uploadstemp && \
             chown -R 1000:1000 /appdata 
-        - name: init-container
-          image: 'postgres:16.0-alpine3.18'
-          command:
-            - sh
-            - '-c'
-            - >-
-              echo -e "Checking for the availability of PostgreSQL Server deployment"; until psql -h $PGHOST -p $PGPORT -U $PGUSER -d $PGDB -c "SELECT 1"; do sleep 1; printf "-"; done; sleep 5; echo -e " >> PostgreSQL DB Server has started";
-          env:
-            - name: PGHOST
-              value: citus-master-svc.user-system-{{ .Values.bfl.username }}
-            - name: PGPORT
-              value: "5432"
-            - name: PGUSER
-              value: cloud_drive_integration_{{ .Values.bfl.username }}
-            - name: PGPASSWORD
-              value: "{{ $pg_password | b64dec }}"
-            - name: PGDB
-              value: user_space_{{ .Values.bfl.username }}_cloud_drive_integration
         - name: olares-app-init
-          image: beclab/system-frontend:v1.4.33
+          image: beclab/system-frontend:v1.6.16
           imagePullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -333,7 +330,7 @@ spec:
               name: www-dir
        
       containers:
-        - name: terminus-envoy-sidecar
+        - name: olares-envoy-sidecar
           image: bytetrade/envoy:v1.25.11
           imagePullPolicy: IfNotPresent
           securityContext:
@@ -347,7 +344,7 @@ spec:
             - name: tapr
               containerPort: 15080
           volumeMounts:
-            - name: terminus-sidecar-config
+            - name: olares-sidecar-config
               readOnly: true
               mountPath: /etc/envoy/envoy.yaml
               subPath: envoy.yaml
@@ -370,6 +367,7 @@ spec:
             - containerPort: 89
             - containerPort: 90
             - containerPort: 91
+            - containerPort: 92
             - containerPort: 8090
           command:
             - /bin/sh
@@ -379,7 +377,7 @@ spec:
               cp -r /www/nginxs/* /etc/nginx/conf.d/
               nginx -g 'daemon off;'
           volumeMounts:
-            - name: terminus-sidecar-config
+            - name: olares-sidecar-config
               readOnly: true
               mountPath: /etc/envoy/envoy.yaml
               subPath: envoy.yaml
@@ -442,15 +440,11 @@ spec:
             - name: NATS_SUBJECT_VAULT
               value: os.vault.{{ .Values.bfl.username}}
         - name: user-service
-          image: beclab/user-service:v0.0.54
+          image: beclab/user-service:v0.0.73
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 3000
           env:
-        {{- range $key, $val := .Values.terminusGlobalEnvs }}
-            - name: {{ $key }}
-              value: {{ $val | quote }}
-        {{- end }}
             - name: DEV_MODE
               value: ''
             - name: MY_NAME
@@ -517,60 +511,12 @@ spec:
               value: redis-cluster-proxy.user-system-{{ .Values.bfl.username }}
             - name: REDIS_PORT
               value: '6379'
-              
-        - name: drive-server
-          image: beclab/drive:v0.0.72
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: OS_SYSTEM_SERVER
-              value: system-server.user-system-{{ .Values.bfl.username }}
-            - name: DATABASE_URL
-              value: postgres://cloud_drive_integration_{{ .Values.bfl.username }}:{{ $pg_password | b64dec }}@citus-master-svc.user-system-{{ .Values.bfl.username }}:5432/user_space_{{ .Values.bfl.username }}_cloud_drive_integration
-            - name: REDIS_URL
-              value: redis://:{{ $redis_password | b64dec }}@redis-cluster-proxy.user-system-{{ .Values.bfl.username }}:6379/0
-            - name: TASK_EXECUTOR_MAX_THREADS
-              value: '6'
-          ports: 
-            - containerPort: 8181
-          volumeMounts:
-            - name: upload-data
-              mountPath: /data/Home
-            - name: upload-appdata
-              mountPath: /appdata/
-            - name: userspace-app-dir
-              mountPath: /data/Application
-            - name: data-dir
-              mountPath: /data
-
-        - name: task-executor
-          image: beclab/driveexecutor:v0.0.72
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: OS_SYSTEM_SERVER
-              value: system-server.user-system-{{ .Values.bfl.username }}
-            - name: DATABASE_URL
-              value: postgres://cloud_drive_integration_{{ .Values.bfl.username }}:{{ $pg_password | b64dec }}@citus-master-svc.user-system-{{ .Values.bfl.username }}:5432/user_space_{{ .Values.bfl.username }}_cloud_drive_integration
-            - name: REDIS_URL
-              value: redis://:{{ $redis_password | b64dec }}@redis-cluster-proxy.user-system-{{ .Values.bfl.username }}:6379/0
-            - name: TASK_EXECUTOR_MAX_THREADS
-              value: '6'
-          ports: 
-            - containerPort: 8181
-          volumeMounts:
-            - name: upload-data
-              mountPath: /data/Home
-            - name: upload-appdata
-              mountPath: /appdata/
-            - name: userspace-app-dir
-              mountPath: /data/Application
-            - name: data-dir
-              mountPath: /data
       volumes:
         - name: userspace-dir
           hostPath:
             type: Directory
             path: '{{ .Values.userspace.userData }}'
-        - name: terminus-sidecar-config
+        - name: olares-sidecar-config
           configMap:
             name: user-service-sidecar-ws-configs
             items:
@@ -616,56 +562,6 @@ spec:
               - key: headscale.conf
                 path: headscale.conf
 
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cloud-drive-integration-secrets
-  namespace: user-system-{{ .Values.bfl.username }}
-type: Opaque
-data:
-  pg_password: {{ $pg_password }}
----
-apiVersion: apr.bytetrade.io/v1alpha1
-kind: MiddlewareRequest
-metadata:
-  name: cloud-drive-integration-pg
-  namespace: user-system-{{ .Values.bfl.username }}
-spec:
-  app: cloud-drive-integration
-  appNamespace: {{ .Release.Namespace }}
-  middleware: postgres
-  postgreSQL:
-    user: cloud_drive_integration_{{ .Values.bfl.username }}
-    password:
-      valueFrom:
-        secretKeyRef:
-          key: pg_password
-          name: cloud-drive-integration-secrets
-    databases:
-    - name: cloud-drive-integration
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: cloud-drive-integration-secrets-auth
-  namespace: {{ .Release.Namespace }}
-data:
-  redis_password: {{ $redis_password_data }}
-  redis_addr: redis-cluster-proxy.user-system-{{ .Values.bfl.username }}:6379
-  redis_host: redis-cluster-proxy.user-system-{{ .Values.bfl.username }}
-  redis_port: '6379'
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: cloud-drive-integration-userspace-data
-  namespace: {{ .Release.Namespace }}
-data:
-  appData: "{{ .Values.userspace.appData }}"
-  appCache: "{{ .Values.userspace.appCache }}"
-  username: "{{ .Values.bfl.username }}"
-
 ---
 apiVersion: v1
 kind: Secret
@@ -729,200 +625,7 @@ spec:
           sub: allow
           pub: allow
     user: user-system-{{ .Values.bfl.username }}-files-frontend
----
-apiVersion: v1
-data:
-  envoy.yaml: |
-    admin:
-      access_log_path: "/dev/stdout"
-      address:
-        socket_address:
-          address: 0.0.0.0
-          port_value: 15000
-    static_resources:
-      listeners:
-        - name: listener_0
-          address:
-            socket_address:
-              address: 0.0.0.0
-              port_value: 15003
-          listener_filters:
-            - name: envoy.filters.listener.original_dst
-              typed_config:
-                "@type": type.googleapis.com/envoy.extensions.filters.listener.original_dst.v3.OriginalDst
-          filter_chains:
-            - filters:
-                - name: envoy.filters.network.http_connection_manager
-                  typed_config:
-                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
-                    stat_prefix: desktop_http
-                    upgrade_configs:
-                      - upgrade_type: websocket
-                      - upgrade_type: tailscale-control-protocol
-                    skip_xff_append: false
-                    max_request_headers_kb: 500
-                    codec_type: AUTO
-                    route_config:
-                      name: local_route
-                      virtual_hosts:
-                        - name: service
-                          domains: ["*"]
-                          routes:
-                            - match:
-                                prefix: "/upload"
-                              route:
-                                cluster: upload_original_dst
-                                timeout: 1800s
-                                idle_timeout: 1800s
-                            - match:
-                                prefix: "/"
-                              route:
-                                cluster: original_dst
-                                timeout: 1800s
-                                idle_timeout: 1800s
-                    http_protocol_options:
-                      accept_http_10: true
-                    http_filters:
-                      - name: envoy.filters.http.ext_authz
-                        typed_config:
-                          "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
-                          http_service:
-                            path_prefix: '/api/verify/'
-                            server_uri:
-                              uri: authelia-backend.os-framework:9091
-                              cluster: authelia
-                              timeout: 2s
-                            authorization_request:
-                              allowed_headers:
-                                patterns:
-                                  - exact: accept
-                                  - exact: cookie
-                                  - exact: proxy-authorization
-                                  - prefix: x-unauth-
-                                  - exact: x-authorization
-                                  - exact: x-bfl-user
-                                  - exact: x-real-ip
-                                  - exact: terminus-nonce
-                                  - exact: x-provider-proxy
-                              headers_to_add:
-                                - key: X-Forwarded-Method
-                                  value: '%REQ(:METHOD)%'
-                                - key: X-Forwarded-Proto
-                                  value: '%REQ(:SCHEME)%'
-                                - key: X-Forwarded-Host
-                                  value: '%REQ(:AUTHORITY)%'
-                                - key: X-Forwarded-Uri
-                                  value: '%REQ(:PATH)%'
-                                - key: X-Forwarded-For
-                                  value: '%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%'
-                            authorization_response:
-                              allowed_upstream_headers:
-                                patterns:
-                                  - exact: authorization
-                                  - exact: proxy-authorization
-                                  - prefix: remote-
-                                  - prefix: authelia-
-                              allowed_client_headers:
-                                patterns:
-                                  - exact: set-cookie
-                              allowed_client_headers_on_success:
-                                patterns:
-                                  - exact: set-cookie
-                          failure_mode_allow: false
-                      - name: envoy.filters.http.router
-                        typed_config:
-                          "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
 
-        - name: listener_image
-          address:
-            socket_address:
-              address: 127.0.0.1
-              port_value: 15080
-          filter_chains:
-            - filters:
-                - name: envoy.filters.network.http_connection_manager
-                  typed_config:
-                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
-                    stat_prefix: tapr_http
-                    http_protocol_options:
-                      accept_http_10: true
-                    upgrade_configs:
-                      - upgrade_type: websocket
-                    skip_xff_append: false
-                    codec_type: AUTO
-                    route_config:
-                      name: local_route
-                      virtual_hosts:
-                        - name: service
-                          domains: ["*"]
-                          routes:
-                            - match:
-                                prefix: "/images/upload"
-                              route:
-                                cluster: images
-                    http_filters:
-                      - name: envoy.filters.http.router
-                        typed_config:
-                          "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
-
-
-      clusters:
-        - name: original_dst
-          connect_timeout: 120s
-          type: ORIGINAL_DST
-          lb_policy: CLUSTER_PROVIDED
-          common_http_protocol_options:
-            idle_timeout: 10s
-        - name: upload_original_dst
-          connect_timeout: 5000s
-          type: LOGICAL_DNS
-          dns_lookup_family: V4_ONLY
-          dns_refresh_rate: 600s
-          lb_policy: ROUND_ROBIN
-          load_assignment:
-            cluster_name: upload_original_dst
-            endpoints:
-              - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: files-service.os-framework
-                          port_value: 80
-        - name: authelia
-          connect_timeout: 2s
-          type: LOGICAL_DNS
-          dns_lookup_family: V4_ONLY
-          dns_refresh_rate: 600s
-          lb_policy: ROUND_ROBIN
-          load_assignment:
-            cluster_name: authelia
-            endpoints:
-              - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: authelia-backend.os-framework
-                          port_value: 9091
-        - name: images
-          connect_timeout: 5s
-          type: LOGICAL_DNS
-          dns_lookup_family: V4_ONLY
-          dns_refresh_rate: 600s
-          lb_policy: ROUND_ROBIN
-          load_assignment:
-            cluster_name: images
-            endpoints:
-              - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: tapr-images-svc.user-system-{{ .Values.bfl.username }}
-                          port_value: 8080
-kind: ConfigMap
-metadata:
-  name: sidecar-upload-configs
-  namespace: {{ .Release.Namespace }}
-  
 ---
 apiVersion: v1
 kind: Secret
@@ -979,6 +682,7 @@ spec:
           key: redis_password
           name: user-service-secrets
     namespace: user-service
+
 ---
 apiVersion: v1
 kind: Service
@@ -987,7 +691,22 @@ metadata:
   namespace: {{ .Release.Namespace }}
 spec:
   type: ExternalName
-  externalName: vault-server.os-framework.svc.cluster.local
+  externalName: vault-server.user-system-{{ .Values.bfl.username }}.svc.cluster.local
+  ports:
+    - protocol: TCP
+      port: 3000
+      targetPort: 3000
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: vault-server
+  namespace: user-system-{{ .Values.bfl.username }}
+spec:
+  type: ClusterIP
+  selector:
+    app: systemserver
   ports:
     - protocol: TCP
       port: 3000
@@ -1046,7 +765,7 @@ data:
                       http_service:
                         path_prefix: '/api/verify/'
                         server_uri:
-                          uri: authelia-backend.os-framework:9091
+                          uri: authelia-backend.user-system-{{ .Values.bfl.username }}:9091
                           cluster: authelia
                           timeout: 2s
                         authorization_request:
@@ -1143,7 +862,7 @@ data:
                 - endpoint:
                     address:
                       socket_address:
-                        address: authelia-backend.os-framework
+                        address: authelia-backend.user-system-{{ .Values.bfl.username }}
                         port_value: 9091
       - name: images
         connect_timeout: 5s
@@ -1222,7 +941,7 @@ data:
                       http_service:
                         path_prefix: '/api/verify/'
                         server_uri:
-                          uri: authelia-backend.os-framework:9091
+                          uri: authelia-backend.user-system-{{ .Values.bfl.username }}:9091
                           cluster: authelia
                           timeout: 2s
                         authorization_request:
@@ -1334,7 +1053,7 @@ data:
                 - endpoint:
                     address:
                       socket_address:
-                        address: authelia-backend.os-framework
+                        address: authelia-backend.user-system-{{ .Values.bfl.username }}
                         port_value: 9091
       - name: images
         connect_timeout: 5s
@@ -1412,7 +1131,7 @@ data:
                       http_service:
                         path_prefix: '/api/verify/'
                         server_uri:
-                          uri: authelia-backend.os-framework:9091
+                          uri: authelia-backend.user-system-{{ .Values.bfl.username }}:9091
                           cluster: authelia
                           timeout: 2s
                         authorization_request:
@@ -1524,7 +1243,7 @@ data:
                 - endpoint:
                     address:
                       socket_address:
-                        address: authelia-backend.os-framework
+                        address: authelia-backend.user-system-{{ .Values.bfl.username }}
                         port_value: 9091
       - name: images
         connect_timeout: 5s

apps/.olares/config/user/helm-charts/system-apps/templates/prometheus-provider.yaml

@@ -0,0 +1,11 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Values.bfl.username }}:prometheus-k8s
+  annotations:
+    provider-registry-ref: {{ .Values.bfl.username }}/4ae9f19e
+    provider-service-ref: http://prometheus-k8s.kubesphere-monitoring-system:9090
+rules:
+- nonResourceURLs: 
+  - "*"
+  verbs: ["*"]

apps/.olares/config/user/helm-charts/system-apps/templates/seafile-provider.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Values.bfl.username }}:seafile-frontend-domain-desktop
+  annotations:
+    provider-registry-ref: {{ .Values.bfl.username }}/desktop
+    provider-service-ref: seafile.os-framework.os-framework:80
+rules:
+- nonResourceURLs: 
+  - "/seahub/*"
+  - "/seafhttp/*"
+  verbs: ["*"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: user:{{ .Values.bfl.username }}:seafile-frontend-domain-desktop
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Values.bfl.username }}:seafile-frontend-domain-desktop
+subjects:
+- kind: User
+  name: '{{ .Values.bfl.username }}'
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: seafile
+  namespace: user-space-{{ .Values.bfl.username }}
+spec:
+  type: ExternalName
+  externalName: system-server.user-system-{{ .Values.bfl.username }}.svc.cluster.local
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 28080

apps/.olares/config/user/helm-charts/system-apps/templates/search-permission.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: backend:{{ .Values.bfl.username }}:search-provider-svc
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Values.bfl.username }}:search-provider-svc
+subjects:
+- kind: ServiceAccount
+  name: system-frontend
+  namespace: {{ .Release.Namespace }}

apps/.olares/config/user/helm-charts/system-apps/templates/search-provider.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Values.bfl.username }}:search-provider-svc
+  annotations:
+    provider-registry-ref: user-system-{{ .Values.bfl.username }}/search3
+    provider-service-ref: search3.os-framework:80
+rules:
+- nonResourceURLs: 
+  - "/document/search*"
+  - "/task/*"
+  - "/search/*"
+  - "/monitorsetting/*"
+  verbs: ["*"]

apps/.olares/config/user/helm-charts/system-apps/templates/user-service-provider.yaml

@@ -15,6 +15,7 @@ rules:
   - "/api/account/all"
   - "/api/cookie/retrieve"
   - "/api/cookie"
+  - "/api/abilities"
   verbs: ["*"]
 
 ---
@@ -30,3 +31,42 @@ rules:
   - "/server/intent/send"
   - "/server/ai_message"
   verbs: ["*"]  
+
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Values.bfl.username }}:desktop
+  annotations:
+    provider-registry-ref: {{ .Values.bfl.username }}/desktop
+    provider-service-ref: edge-desktop.{{ .Release.Namespace }}
+rules:
+- nonResourceURLs: 
+  - "/server/intent/send"
+  verbs: ["*"]  
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Namespace }}:desktop
+  annotations:
+    provider-registry-ref: {{ .Release.Namespace }}/desktop
+    provider-service-ref: edge-desktop.{{ .Release.Namespace }}
+rules:
+- nonResourceURLs: 
+  - "/server/intent/send"
+  verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Values.bfl.username }}:dashboard
+  annotations:
+    provider-registry-ref: {{ .Values.bfl.username }}/dashboard
+    provider-service-ref: prometheus-k8s.kubesphere-monitoring-system:9090
+rules:
+  - nonResourceURLs:
+      - "*"
+    verbs: ["*"]

apps/.olares/config/user/helm-charts/wizard/templates/wizard_deploy.yaml

@@ -22,14 +22,14 @@ spec:
       initContainers:
       - args:
         - -it
-        - authelia-backend.os-framework:9091
+        - authelia-backend.user-system-{{ .Values.bfl.username }}:9091
         image: owncloudci/wait-for:latest
         imagePullPolicy: IfNotPresent
         name: check-auth
 
       containers:
       - name: wizard
-        image: beclab/wizard:v1.4.3
+        image: beclab/wizard:v1.6.5
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 80

build/base-package/install.ps1

@@ -1,9 +1,9 @@
 $currentPath = Get-Location
 $architecture = $env:PROCESSOR_ARCHITECTURE
-$downloadCdnUrlFromEnv = $env:DOWNLOAD_CDN_URL
+$cdnServiceFromEnv = $env:OLARES_SYSTEM_CDN_SERVICE
 $version = "#__VERSION__"
 $releaseID = "#__RELEASE_ID__"
-$downloadUrl = "https://dc3p1870nn3cj.cloudfront.net"
+$cdnService = "https://cdn.olares.com"
 
 function Test-Wait {
   while ($true) {
@@ -40,8 +40,8 @@ if ($architecture -like "ARM") {
   $arch = "arm64"
 }
 
-if (-Not $downloadCdnUrlFromEnv -eq "") {
-  $downloadUrl = $downloadCdnUrlFromEnv
+if (-Not $cdnServiceFromEnv -eq "") {
+  $cdnService = $cdnServiceFromEnv
 }
 
 $CLI_PROGRAM_PATH = "{0}\" -f $currentPath
@@ -55,7 +55,7 @@ if (-not [string]::IsNullOrEmpty($releaseID) -and $releaseID.Substring(0,3) -ne
 } else {
   $CLI_FILE = "olares-cli-v{0}_windows_{1}.tar.gz" -f $CLI_VERSION, $arch
 }
-$CLI_URL = "{0}/{1}" -f $downloadUrl, $CLI_FILE
+$CLI_URL = "{0}/{1}" -f $cdnService, $CLI_FILE
 $CLI_PATH = "{0}{1}" -f $CLI_PROGRAM_PATH, $CLI_FILE
 
 $download = 0

build/base-package/install.sh

@@ -7,10 +7,18 @@ function command_exists() {
 	  command -v "$@" > /dev/null 2>&1
 }
 
+if [[ x"$REPO_PATH" == x"" ]]; then
+    export REPO_PATH="#__REPO_PATH__"
+fi
+
+if [[ "x${REPO_PATH:3}" == "xREPO_PATH__" ]]; then
+    export REPO_PATH="/"
+fi
+
 if [[ x"$VERSION" == x"" ]]; then
     if [[ "$LOCAL_RELEASE" == "1" ]]; then
         ts=$(date +%Y%m%d%H%M%S)
-        export VERSION="1.12.2-$ts"
+        export VERSION="1.12.3-$ts"
         echo "will build and use a local release of Olares with version: $VERSION"
         echo ""
     else
@@ -20,7 +28,7 @@ fi
 
 if [[ "x${VERSION}" == "x" || "x${VERSION:3}" == "xVERSION__" ]]; then
     echo "error: Olares version is unspecified, please set the VERSION env var and rerun this script."
-    echo "for example: VERSION=1.12.2-20241124 bash $0"
+    echo "for example: VERSION=1.12.3-20241124 bash $0"
     exit 1
 fi
 
@@ -69,9 +77,9 @@ if [ ! -d $BASE_DIR ]; then
     mkdir -p $BASE_DIR
 fi
 
-cdn_url=${DOWNLOAD_CDN_URL}
+cdn_url=${OLARES_SYSTEM_CDN_SERVICE}
 if [ -z ${cdn_url} ]; then
-    cdn_url="https://dc3p1870nn3cj.cloudfront.net"
+    cdn_url="https://cdn.olares.com"
 fi
 
 RELEASE_ID="#__RELEASE_ID__"
@@ -92,13 +100,17 @@ if [[ "$LOCAL_RELEASE" == "1" ]]; then
     fi
     INSTALL_OLARES_CLI=$(which olares-cli)
 else
-    if command_exists olares-cli && [[ "$(olares-cli -v | awk '{print $3}')" == "$VERSION" ]]; then
+    expected_vendor="main"
+    if [[ "$(basename "$REPO_PATH")" == "olares-one" ]]; then
+        expected_vendor="OlaresOne"
+    fi
+    if command_exists olares-cli && [[ "$(olares-cli -v | awk '{print $3}')" == "$VERSION" ]] && [[ "$(olares-cli --vendor)" == "$expected_vendor" ]]; then
         INSTALL_OLARES_CLI=$(which olares-cli)
         echo "olares-cli already installed and is the expected version"
         echo ""
     else
         if [[ ! -f ${CLI_FILE} ]]; then
-            CLI_URL="${cdn_url}/${CLI_FILE}"
+            CLI_URL="${cdn_url}${REPO_PATH}${CLI_FILE}"
 
             echo "downloading Olares installer from ${CLI_URL} ..."
             echo ""
@@ -138,7 +150,7 @@ fi
 
 PARAMS="--version $VERSION --base-dir $BASE_DIR"
 KUBE_PARAM="--kube $KUBE_TYPE"
-CDN="--download-cdn-url ${cdn_url}"
+CDN="--cdn-service ${cdn_url}"
 
 if [[ -f $BASE_DIR/.prepared ]]; then
     echo "file $BASE_DIR/.prepared detected, skip preparing phase"

build/base-package/joincluster.sh

@@ -7,6 +7,15 @@ function command_exists() {
 	  command -v "$@" > /dev/null 2>&1
 }
 
+if [[ x"$REPO_PATH" == x"" ]]; then
+    export REPO_PATH="#__REPO_PATH__"
+fi
+
+
+if [[ "x${REPO_PATH:3}" == "xREPO_PATH__" ]]; then
+    export REPO_PATH="/"
+fi
+
 function read_tty() {
     echo -n $1
     read $2 < /dev/tty
@@ -149,7 +158,7 @@ export VERSION="#__VERSION__"
 
 if [[ "x${VERSION}" == "x" || "x${VERSION:3}" == "xVERSION__" ]]; then
     echo "error: Olares version is unspecified, please set the VERSION env var and rerun this script."
-    echo "for example: VERSION=1.12.2-20241124 bash $0"
+    echo "for example: VERSION=1.12.3-20241124 bash $0"
     exit 1
 fi
 
@@ -158,9 +167,9 @@ if [ ! -d $BASE_DIR ]; then
     mkdir -p $BASE_DIR
 fi
 
-cdn_url=${DOWNLOAD_CDN_URL}
+cdn_url=${OLARES_SYSTEM_CDN_SERVICE}
 if [[ -z "${cdn_url}" ]]; then
-    cdn_url="https://dc3p1870nn3cj.cloudfront.net"
+    cdn_url="https://cdn.olares.com"
 fi
 
 set_master_host_ssh_options
@@ -172,15 +181,17 @@ else
   RELEASE_ID_SUFFIX=".$RELEASE_ID"
 fi
 CLI_FILE="olares-cli-v${VERSION}_linux_${ARCH}${RELEASE_ID_SUFFIX}.tar.gz"
-
-if command_exists olares-cli && [[ "$(olares-cli -v | awk '{print $3}')" == "$VERSION" ]]; then
+expected_vendor="main"
+if [[ "$(basename "$REPO_PATH")" == "olares-one" ]]; then
+    expected_vendor="OlaresOne"
+fi
+if command_exists olares-cli && [[ "$(olares-cli -v | awk '{print $3}')" == "$VERSION" ]] && [[ "$(olares-cli --vendor)" == "$expected_vendor" ]]; then
     INSTALL_OLARES_CLI=$(which olares-cli)
     echo "olares-cli already installed and is the expected version"
     echo ""
 else
     if [[ ! -f ${CLI_FILE} ]]; then
-        CLI_URL="${cdn_url}/${CLI_FILE}"
-
+        CLI_URL="${cdn_url}${REPO_PATH}${CLI_FILE}"
         echo "downloading Olares installer from ${CLI_URL} ..."
         echo ""
 
@@ -214,7 +225,7 @@ if [[ ! "$master_olares_version" ]]; then
     exit 1
 fi
 PARAMS="--version $master_olares_version --base-dir $BASE_DIR"
-CDN="--download-cdn-url ${cdn_url}"
+CDN="--cdn-service ${cdn_url}"
 
 if [[ -f $BASE_DIR/.prepared ]]; then
     echo "file $BASE_DIR/.prepared detected, skip preparing phase"

build/base-package/publicAddnode.sh

@@ -716,7 +716,7 @@ EOF
                     local filename=$(echo -n "$img"|md5sum|awk '{print $1}')
                     filename="$filename.tar.gz"
                     echo "downloading ${filename} ..."
-                    curl -fsSL https://dc3p1870nn3cj.cloudfront.net/${filename} -o $BASE_DIR/images/$filename
+                    curl -fsSL https://cdn.olares.com/${filename} -o $BASE_DIR/images/$filename
                 done < $BASE_DIR/images/images.node.mf
             fi
         fi

build/base-package/publicRestoreInstaller.sh

@@ -1603,7 +1603,7 @@ install_containerd(){
     #                 local filename=$(echo -n "$img"|md5sum|awk '{print $1}')
     #                 filename="$filename.tar.gz"
     #                 echo "downloading ${filename} ..."
-    #                 curl -fsSL https://dc3p1870nn3cj.cloudfront.net/${filename} -o $BASE_DIR/images/$filename
+    #                 curl -fsSL https://cdn.olares.com/${filename} -o $BASE_DIR/images/$filename
     #             done < $BASE_DIR/images/images.mf
     #         fi
     #     fi

build/base-package/wizard/config/settings/templates/system_namespace.yaml

@@ -17,6 +17,7 @@ metadata:
     kubesphere.io/creator: '{{ .Values.user.name }}'
   labels:
     kubesphere.io/workspace: system-workspace
+    openpolicyagent.org/webhook: ignore
   name: os-platform
 
 ---
@@ -27,6 +28,19 @@ metadata:
     kubesphere.io/creator: '{{ .Values.user.name }}'
   labels:
     kubesphere.io/workspace: system-workspace
+    openpolicyagent.org/webhook: ignore
   name: os-framework
 
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    kubesphere.io/creator: '{{ .Values.user.name }}'
+  labels:
+    kubesphere.io/workspace: system-workspace
+    openpolicyagent.org/webhook: ignore
+  name: os-protected
+
+
 

build/build-manifest.py

@@ -7,7 +7,7 @@ import requests
 import sys
 import json
 
-CDN_URL = "https://dc3p1870nn3cj.cloudfront.net"
+CDN_URL = "https://cdn.olares.com"
 
 def get_file_size(objectid, fileid):
     url = f"{CDN_URL}/{objectid}"

build/build-manifest.sh

@@ -2,7 +2,7 @@
 
 
 set -e
-cdn_url="https://dc3p1870nn3cj.cloudfront.net"
+cdn_url="https://cdn.olares.com"
 
 download_checksum(){
     local name=$1

build/build.sh

@@ -66,6 +66,12 @@ if [ ! -z $RELEASE_ID ]; then
     sh -c "$SED 's/#__RELEASE_ID__/${RELEASE_ID}/' joincluster.sh"
 fi
 
+# replace repo path placeholder in scripts if provided
+if [ ! -z "$REPO_PATH" ]; then
+    sh -c "$SED 's|#__REPO_PATH__|${REPO_PATH}|g' install.sh"
+    sh -c "$SED 's|#__REPO_PATH__|${REPO_PATH}|g' joincluster.sh"
+fi
+
 $TAR --exclude=wizard/tools --exclude=.git -zcvf ${BASE_DIR}/../install-wizard-${VERSION}.tar.gz .
 
 popd

build/package.sh

@@ -76,4 +76,9 @@ run_cmd "cp -rf framework/bfl/.olares/config/launcher ${DIST}/wizard/config/"
 echo "packaging gpu ..."
 run_cmd "cp -rf infrastructure/gpu/.olares/config/gpu ${DIST}/wizard/config/"
 
-echo "packaging completed"
+
+echo "packaging env config ..."
+run_cmd "cp -rf build/system-env.yaml ${DIST}/system-env.yaml"
+run_cmd "cp -rf build/user-env.yaml ${DIST}/user-env.yaml"
+
+echo "packaging completed"

build/save-images.sh

@@ -7,13 +7,13 @@ fi
 cat $1|while read image; do
     name=$(echo -n "$image"|md5sum|awk '{print $1}')
     if [ ! -z "$FROM_S3" ]; then
-        curl -fsSLI https://dc3p1870nn3cj.cloudfront.net/$path$name.tar.gz > /dev/null
+        curl -fsSLI https://cdn.olares.com/$path$name.tar.gz > /dev/null
         if [ $? -ne 0 ]; then
             docker pull $image --platform $PLATFORM
             docker save $image -o $name.tar
             gzip $name.tar
         else
-            curl -fsSL https://dc3p1870nn3cj.cloudfront.net/$path$name.tar.gz -o $name.tar.gz
+            curl -fsSL https://cdn.olares.com/$path$name.tar.gz -o $name.tar.gz
         fi
     else
         docker pull $image --platform $PLATFORM

build/system-env.yaml

@@ -0,0 +1,42 @@
+apiVersion: v1
+systemEnvs:
+  # the remote service provides a unified base url for all legacy services
+  # including:
+  # DID_GATE_URL,
+  # OLARES_SPACE_URL,
+  # FIREBASE_PUSH_URL,
+  # FRP_LIST_URL,
+  # TAILSCALE_CONTROLPLANE_URL,
+  # MARKET_PROVIDER,
+  # TERMINUS_CERT_SERVICE_API,
+  # TERMINUS_DNS_SERVICE_API
+  - envName: OLARES_SYSTEM_REMOTE_SERVICE
+    default: "https://api.olares.com"
+    type: url
+    editable: true
+    required: true
+  # the legacy DOWNLOAD_CDN_URL
+  - envName: OLARES_SYSTEM_CDN_SERVICE
+    default: "https://cdn.olares.com"
+    type: url
+    editable: true
+    required: true
+  # docker hub mirror endpoint for docker.io registry
+  - envName: OLARES_SYSTEM_DOCKERHUB_SERVICE
+    type: url
+    editable: true
+    required: false
+  # the legacy OLARES_ROOT_DIR
+  - envName: OLARES_SYSTEM_ROOT_PATH
+    default: /olares
+    editable: false
+    required: true
+  # the legacy OLARES_FS_TYPE
+  - envName: OLARES_SYSTEM_ROOTFS_TYPE
+    default: fs
+    editable: false
+    required: true
+  # the legacy CUDA_VERSION
+  - envName: OLARES_SYSTEM_CUDA_VERSION
+    editable: false
+    required: false

build/upload-deps.sh

@@ -28,9 +28,9 @@ while read line; do
     checksum="$name.checksum.txt"
 
     echo "if exists $filename ... "
-    curl -fsSLI https://dc3p1870nn3cj.cloudfront.net/$path$name > /dev/null
+    curl -fsSLI https://cdn.olares.com/$path$name > /dev/null
     if [ $? -ne 0 ]; then
-        code=$(curl -o /dev/null -fsSLI -w "%{http_code}" https://dc3p1870nn3cj.cloudfront.net/$path$name)
+        code=$(curl -o /dev/null -fsSLI -w "%{http_code}" https://cdn.olares.com/$path$name)
         if [ $code -eq 403 ]; then
 
             bash ${BASE_DIR}/download-deps.sh $PLATFORM $line

build/upload-images.sh

@@ -12,9 +12,9 @@ cat $1|while read image; do
     checksum="$name.checksum.txt"
     manifest="$name.manifest.json"
 
-    curl -fsSLI https://dc3p1870nn3cj.cloudfront.net/$path$name.tar.gz > /dev/null
+    curl -fsSLI https://cdn.olares.com/$path$name.tar.gz > /dev/null
     if [ $? -ne 0 ]; then
-        code=$(curl -o /dev/null -fsSLI -w "%{http_code}" https://dc3p1870nn3cj.cloudfront.net/$path$name.tar.gz)
+        code=$(curl -o /dev/null -fsSLI -w "%{http_code}" https://cdn.olares.com/$path$name.tar.gz)
         if [ $code -eq 403 ]; then
             set -ex
             skopeo copy --insecure-policy docker://$image oci-archive:$name.tar
@@ -45,9 +45,9 @@ cat $1|while read image; do
     
 
     # re-upload checksum.txt
-    curl -fsSLI https://dc3p1870nn3cj.cloudfront.net/$path$checksum > /dev/null
+    curl -fsSLI https://cdn.olares.com/$path$checksum > /dev/null
     if [ $? -ne 0 ]; then
-        code=$(curl -o /dev/null -fsSLI -w "%{http_code}" https://dc3p1870nn3cj.cloudfront.net/$path$checksum)
+        code=$(curl -o /dev/null -fsSLI -w "%{http_code}" https://cdn.olares.com/$path$checksum)
         if [ $code -eq 403 ]; then
             set -ex
             skopeo copy --insecure-policy docker://$image oci-archive:$name.tar
@@ -74,9 +74,9 @@ cat $1|while read image; do
     fi
 
     # upload manifest.json
-    curl -fsSLI https://dc3p1870nn3cj.cloudfront.net/$path$manifest > /dev/null
+    curl -fsSLI https://cdn.olares.com/$path$manifest > /dev/null
     if [ $? -ne 0 ]; then   
-        code=$(curl -o /dev/null -fsSLI -w "%{http_code}" https://dc3p1870nn3cj.cloudfront.net/$path$manifest)
+        code=$(curl -o /dev/null -fsSLI -w "%{http_code}" https://cdn.olares.com/$path$manifest)
         if [ $code -eq 403 ]; then
             set -ex
             BASE_DIR=$(dirname $(realpath -s $0))

build/user-env.yaml

@@ -0,0 +1,72 @@
+apiVersion: v1
+userEnvs:
+  - envName: OLARES_USER_EMAIL
+    type: string
+    editable: true
+  - envName: OLARES_USER_USERNAME
+    type: string
+    editable: true
+  - envName: OLARES_USER_PASSWORD
+    type: password
+    editable: true
+  - envName: OLARES_USER_TIMEZONE
+    type: string
+    editable: true
+  - envName: OLARES_USER_SMTP_ENABLED
+    type: bool
+    editable: true
+  - envName: OLARES_USER_SMTP_SERVER
+    type: domain
+    editable: true
+  - envName: OLARES_USER_SMTP_PORT
+    type: number
+    editable: true
+  - envName: OLARES_USER_SMTP_USERNAME
+    type: string
+    editable: true
+  - envName: OLARES_USER_SMTP_PASSWORD
+    type: password
+    editable: true
+  - envName: OLARES_USER_SMTP_FROM_ADDRESS
+    type: email
+    editable: true
+  - envName: OLARES_USER_SMTP_SECURE
+    type: bool
+    editable: true
+    default: "true"
+  - envName: OLARES_USER_SMTP_USE_TLS
+    type: bool
+    editable: true
+  - envName: OLARES_USER_SMTP_USE_SSL
+    type: bool
+    editable: true
+  - envName: OLARES_USER_SMTP_SECURITY_PROTOCOLS
+    type: string
+    editable: true        
+  - envName: OLARES_USER_OPENAI_APIKEY
+    type: password
+    editable: true
+  - envName: OLARES_USER_CUSTOM_OPENAI_SERVICE
+    type: url
+    editable: true    
+  - envName: OLARES_USER_CUSTOM_OPENAI_APIKEY
+    type: password
+    editable: true
+  - envName: OLARES_USER_HUGGINGFACE_SERVICE
+    type: url
+    editable: true
+    default: "https://huggingface.co/"
+  - envName: OLARES_USER_HUGGINGFACE_TOKEN
+    type: password
+    editable: true
+  - envName: OLARES_USER_PYPI_SERVICE
+    type: url
+    editable: true
+    default: "https://pypi.org/simple/"
+  - envName: OLARES_USER_GITHUB_SERVICE
+    type: url
+    editable: true
+    default: "https://github.com/"
+  - envName: OLARES_USER_GITHUB_TOKEN
+    type: password
+    editable: true

cli/cmd/ctl/disk/extend.go

@@ -0,0 +1,445 @@
+package disk
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"strconv"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/beclab/Olares/cli/pkg/utils"
+	"github.com/beclab/Olares/cli/pkg/utils/lvm"
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+)
+
+const defaultOlaresVGName = "olares-vg"
+
+func NewExtendDiskCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "extend",
+		Short: "extend disk operations",
+		Run: func(cmd *cobra.Command, args []string) {
+			// early return if no unmounted disks found
+			unmountedDevices, err := lvm.FindUnmountedDevices()
+			if err != nil {
+				log.Fatalf("Error finding unmounted devices: %v\n", err)
+			}
+
+			if len(unmountedDevices) == 0 {
+				log.Println("No unmounted disks found to extend.")
+				return
+			}
+
+			// select volume group to extend
+			currentVgs, err := lvm.FindCurrentLVM()
+			if err != nil {
+				log.Fatalf("Error finding current LVM: %v\n", err)
+			}
+
+			if len(currentVgs) == 0 {
+				log.Println("No valid volume groups found to extend.")
+				return
+			}
+
+			selectedVg, err := selectExtendingVG(currentVgs)
+			if err != nil {
+				log.Fatalf("Error selecting volume group: %v\n", err)
+			}
+			log.Printf("Selected volume group to extend: %s\n", selectedVg)
+
+			// select logical volume to extend
+			lvInVg, err := lvm.FindLvByVgName(selectedVg)
+			if err != nil {
+				log.Fatalf("Error finding logical volumes in volume group %s: %v\n", selectedVg, err)
+			}
+
+			if len(lvInVg) == 0 {
+				log.Printf("No logical volumes found in volume group %s to extend.\n", selectedVg)
+				return
+			}
+
+			selectedLv, err := selectExtendingLV(selectedVg, lvInVg)
+			if err != nil {
+				log.Fatalf("Error selecting logical volume: %v\n", err)
+			}
+			log.Printf("Selected logical volume to extend: %s\n", selectedLv)
+
+			// select unmounted devices to create physical volume
+			selectedDevice, err := selectExtendingDevices(unmountedDevices)
+			if err != nil {
+				log.Fatalf("Error selecting unmounted device: %v\n", err)
+			}
+			log.Printf("Selected unmounted device to use: %s\n", selectedDevice)
+
+			options := &LvmExtendOptions{
+				VgName:     selectedVg,
+				DevicePath: selectedDevice,
+				LvName:     selectedLv,
+				DeviceBlk:  unmountedDevices[selectedDevice],
+			}
+
+			log.Printf("Extending logical volume %s in volume group %s using device %s\n", options.LvName, options.VgName, options.DevicePath)
+			cleanupNeeded, err := options.cleanupDiskParts()
+			if err != nil {
+				log.Fatalf("Error during disk partition cleanup check: %v\n", err)
+			}
+
+			if cleanupNeeded {
+				do, err := options.destroyWarning()
+				if err != nil {
+					log.Fatalf("Error during partition cleanup confirmation: %v\n", err)
+				}
+				if !do {
+					log.Println("Operation aborted by user.")
+					return
+				}
+
+				err = options.deleteDevicePartitions()
+				if err != nil {
+					log.Fatalf("Error deleting device partitions: %v\n", err)
+				}
+
+			} else {
+				do, err := options.makeDecision()
+				if err != nil {
+					log.Fatalf("Error during extension confirmation: %v\n", err)
+				}
+				if !do {
+					log.Println("Operation aborted by user.")
+					return
+				}
+			}
+
+			err = options.extendLVM()
+			if err != nil {
+				log.Fatalf("Error extending LVM: %v\n", err)
+			}
+
+			log.Println("Disk extension completed successfully.")
+
+			// end of command run, and show result
+			// show the result of the extension
+			lvInVg, err = lvm.FindLvByVgName(selectedVg)
+			if err != nil {
+				log.Fatalf("Error finding logical volumes in volume group %s: %v\n", selectedVg, err)
+			}
+
+			w := tabwriter.NewWriter(os.Stdout, 0, 8, 2, ' ', 0)
+
+			fmt.Fprint(w, "id\tLV\tVG\tLSize\tMountpoints\n")
+			for idx, lv := range lvInVg {
+				fmt.Fprintf(w, "%d\t%s\t%s\t%s\t%s\n", idx+1, lv.LvName, lv.VgName, lv.LvSize, strings.Join(lv.Mountpoints, ","))
+			}
+			w.Flush()
+
+		},
+	}
+
+	return cmd
+}
+
+type LvmExtendOptions struct {
+	VgName     string
+	DevicePath string
+	LvName     string
+	DeviceBlk  *lvm.BlkPart
+}
+
+func selectExtendingVG(vgs []*lvm.VgItem) (string, error) {
+	// if only one vg, return it directly
+	if len(vgs) == 1 {
+		return vgs[0].VgName, nil
+	}
+
+	reader, err := utils.GetBufIOReaderOfTerminalInput()
+	if err != nil {
+		return "", errors.Wrap(err, "failed to get terminal input reader")
+	}
+
+	fmt.Println("Multiple volume groups found. Please select one to extend:")
+	fmt.Println("")
+	// print header
+	w := tabwriter.NewWriter(os.Stdout, 0, 8, 2, ' ', 0)
+
+	fmt.Fprint(w, "id\tVG\tVSize\tVFree\n")
+	for idx, vg := range vgs {
+		fmt.Fprintf(w, "%d\t%s\t%s\t%s\n", idx+1, vg.VgName, vg.VgSize, vg.VgFree)
+	}
+	w.Flush()
+
+LOOP:
+	fmt.Printf("\nEnter the volume group id to extend: ")
+	var input string
+	input, err = reader.ReadString('\n')
+	if err != nil && err.Error() != "EOF" {
+		return "", errors.Wrap(errors.WithStack(err), "read volume group id failed")
+	}
+	input = strings.TrimSpace(input)
+	if input == "" {
+		fmt.Printf("\ninvalid volume group id, please try again")
+		goto LOOP
+	}
+
+	selectedIdx, err := strconv.Atoi(input)
+	if err != nil || selectedIdx < 1 || selectedIdx > len(vgs) {
+		fmt.Printf("\ninvalid volume group id, please try again")
+		goto LOOP
+	}
+
+	return vgs[selectedIdx-1].VgName, nil
+}
+
+func selectExtendingLV(vgName string, lvs []*lvm.LvItem) (string, error) {
+	if len(lvs) == 1 {
+		return lvs[0].LvName, nil
+	}
+
+	if vgName == defaultOlaresVGName {
+		selectedLv := ""
+		for _, lv := range lvs {
+			if lv.LvName == "root" {
+				selectedLv = lv.LvName
+				continue
+			}
+
+			if lv.LvName == "data" {
+				selectedLv = lv.LvName
+				break
+			}
+		}
+
+		if selectedLv != "" {
+			return selectedLv, nil
+		}
+	}
+
+	reader, err := utils.GetBufIOReaderOfTerminalInput()
+	if err != nil {
+		return "", errors.Wrap(err, "failed to get terminal input reader")
+	}
+
+	fmt.Println("Multiple logical volumes found. Please select one to extend:")
+	fmt.Println("")
+	// print header
+	w := tabwriter.NewWriter(os.Stdout, 0, 8, 2, ' ', 0)
+
+	fmt.Fprint(w, "id\tLV\tVG\tLSize\tMountpoints\n")
+	for idx, lv := range lvs {
+		fmt.Fprintf(w, "%d\t%s\t%s\t%s\t%s\n", idx+1, lv.LvName, lv.VgName, lv.LvSize, strings.Join(lv.Mountpoints, ","))
+	}
+	w.Flush()
+
+LOOP:
+	fmt.Printf("\nEnter the logical volume id to extend: ")
+	var input string
+	input, err = reader.ReadString('\n')
+	if err != nil && err.Error() != "EOF" {
+		return "", errors.Wrap(errors.WithStack(err), "read logical volume id failed")
+	}
+	input = strings.TrimSpace(input)
+	if input == "" {
+		fmt.Printf("\ninvalid logical volume id, please try again")
+		goto LOOP
+	}
+
+	selectedIdx, err := strconv.Atoi(input)
+	if err != nil || selectedIdx < 1 || selectedIdx > len(lvs) {
+		fmt.Printf("\ninvalid logical volume id, please try again")
+		goto LOOP
+	}
+
+	return lvs[selectedIdx-1].LvName, nil
+}
+
+func selectExtendingDevices(unmountedDevices map[string]*lvm.BlkPart) (string, error) {
+	if len(unmountedDevices) == 0 {
+		return "", errors.New("no unmounted devices available for selection")
+	}
+
+	if len(unmountedDevices) == 1 {
+		for path := range unmountedDevices {
+			return path, nil
+		}
+	}
+
+	reader, err := utils.GetBufIOReaderOfTerminalInput()
+	if err != nil {
+		return "", errors.Wrap(err, "failed to get terminal input reader")
+	}
+
+	fmt.Println("Multiple unmounted devices found. Please select one to use:")
+	fmt.Println("")
+	// print header
+	w := tabwriter.NewWriter(os.Stdout, 0, 8, 2, ' ', 0)
+
+	fmt.Fprint(w, "id\tDevice\tSize\n")
+	idx := 1
+	devicePaths := make([]string, 0, len(unmountedDevices))
+	for path, device := range unmountedDevices {
+		fmt.Fprintf(w, "%d\t%s\t%s\n", idx, path, device.Size)
+		devicePaths = append(devicePaths, path)
+		idx++
+	}
+	w.Flush()
+
+LOOP:
+	fmt.Printf("\nEnter the device id to use: ")
+	var input string
+	input, err = reader.ReadString('\n')
+	if err != nil && err.Error() != "EOF" {
+		return "", errors.Wrap(errors.WithStack(err), "read device id failed")
+	}
+	input = strings.TrimSpace(input)
+	if input == "" {
+		fmt.Printf("\ninvalid device id, please try again")
+		goto LOOP
+	}
+	selectedIdx, err := strconv.Atoi(input)
+	if err != nil || selectedIdx < 1 || selectedIdx > len(devicePaths) {
+		fmt.Printf("\ninvalid device id, please try again")
+		goto LOOP
+	}
+
+	return devicePaths[selectedIdx-1], nil
+}
+
+func (o LvmExtendOptions) destroyWarning() (bool, error) {
+	reader, err := utils.GetBufIOReaderOfTerminalInput()
+	if err != nil {
+		return false, errors.Wrap(err, "failed to get terminal input reader")
+	}
+
+	fmt.Printf("WARNING: This will DESTROY all data on %s\n", o.DevicePath)
+LOOP:
+	fmt.Printf("Type 'YES' to continue, CTRL+C to abort: ")
+	var input string
+	input, err = reader.ReadString('\n')
+	if err != nil && err.Error() != "EOF" {
+		return false, errors.Wrap(errors.WithStack(err), "read confirmation input failed")
+	}
+	input = strings.ToUpper(strings.TrimSpace(input))
+	if input != "YES" {
+		goto LOOP
+	}
+	return true, nil
+}
+
+func (o LvmExtendOptions) makeDecision() (bool, error) {
+	reader, err := utils.GetBufIOReaderOfTerminalInput()
+	if err != nil {
+		return false, errors.Wrap(err, "failed to get terminal input reader")
+	}
+
+	fmt.Printf("NOTICE: Extending LVM will begin on device %s\n", o.DevicePath)
+LOOP:
+	fmt.Printf("Type 'YES' to continue, CTRL+C to abort: ")
+	var input string
+	input, err = reader.ReadString('\n')
+	if err != nil && err.Error() != "EOF" {
+		return false, errors.Wrap(errors.WithStack(err), "read confirmation input failed")
+	}
+	input = strings.ToUpper(strings.TrimSpace(input))
+	if input != "YES" {
+		goto LOOP
+	}
+	return true, nil
+}
+
+func (o LvmExtendOptions) cleanupDiskParts() (bool, error) {
+	if o.DeviceBlk == nil {
+		return false, errors.New("device block is nil")
+	}
+
+	if len(o.DeviceBlk.Children) == 0 {
+		return false, nil
+	}
+
+	return true, nil
+}
+
+func (o LvmExtendOptions) deleteDevicePartitions() error {
+	log.Printf("Selected device %s has existing partitions. Cleaning up...\n", o.DevicePath)
+	if o.DeviceBlk == nil {
+		return errors.New("device block is nil")
+	}
+
+	if len(o.DeviceBlk.Children) == 0 {
+		return nil
+	}
+
+	log.Printf("Deleting existing partitions on device %s...\n", o.DevicePath)
+	var partitions []string
+	for _, part := range o.DeviceBlk.Children {
+		partitions = append(partitions, "/dev/"+part.Name)
+	}
+
+	vgs, err := lvm.FindVgsOnDevice(partitions)
+	if err != nil {
+		return errors.Wrap(err, "failed to find volume groups on device partitions")
+	}
+
+	if len(vgs) > 0 {
+		log.Println("existing volume group on device, delete it first")
+		for _, vg := range vgs {
+			lvs, err := lvm.FindLvByVgName(vg.VgName)
+			if err != nil {
+				return errors.Wrapf(err, "failed to find logical volumes in volume group %s", vg.VgName)
+			}
+
+			err = lvm.DeactivateLv(vg.VgName)
+			if err != nil {
+				return errors.Wrapf(err, "failed to deactivate volume group %s", vg.VgName)
+			}
+
+			for _, lv := range lvs {
+				err = lvm.RemoveLv(lv.LvPath)
+				if err != nil {
+					return errors.Wrapf(err, "failed to remove logical volume %s", lv.LvPath)
+				}
+			}
+
+			err = lvm.RemoveVg(vg.VgName)
+			if err != nil {
+				return errors.Wrapf(err, "failed to remove volume group %s", vg)
+			}
+
+			err = lvm.RemovePv(vg.PvName)
+			if err != nil {
+				return errors.Wrapf(err, "failed to remove physical volume %s", vg.PvName)
+			}
+		}
+
+	}
+
+	log.Printf("Deleting partitions on device %s...\n", o.DevicePath)
+	err = lvm.DeleteDevicePartitions(o.DevicePath)
+	if err != nil {
+		return errors.Wrapf(err, "failed to delete partitions on device %s", o.DevicePath)
+	}
+
+	return nil
+}
+
+func (o LvmExtendOptions) extendLVM() error {
+	log.Printf("Creating partition on device %s...\n", o.DevicePath)
+	err := lvm.MakePartOnDevice(o.DevicePath)
+	if err != nil {
+		return errors.Wrapf(err, "failed to create partition on device %s", o.DevicePath)
+	}
+
+	log.Printf("Creating physical volume on device %s...\n", o.DevicePath)
+	err = lvm.AddNewPV(o.DevicePath, o.VgName)
+	if err != nil {
+		return errors.Wrapf(err, "failed to create physical volume on device %s", o.DevicePath)
+	}
+
+	log.Printf("Extending volume group %s with logic volume %s on  device %s...\n", o.VgName, o.LvName, o.DevicePath)
+	err = lvm.ExtendLv(o.VgName, o.LvName)
+	if err != nil {
+		return errors.Wrapf(err, "failed to extend logical volume %s in volume group %s", o.LvName, o.VgName)
+	}
+
+	return nil
+}

cli/cmd/ctl/disk/listumounted.go

@@ -0,0 +1,34 @@
+package disk
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"text/tabwriter"
+
+	"github.com/beclab/Olares/cli/pkg/utils/lvm"
+	"github.com/spf13/cobra"
+)
+
+func NewListUnmountedDisksCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "list-unmounted",
+		Short: "List unmounted disks",
+		Run: func(cmd *cobra.Command, args []string) {
+			unmountedDevices, err := lvm.FindUnmountedDevices()
+			if err != nil {
+				log.Fatalf("Error finding unmounted devices: %v\n", err)
+			}
+
+			// print header
+			w := tabwriter.NewWriter(os.Stdout, 0, 8, 2, ' ', 0)
+
+			fmt.Fprint(w, "Device\tSize\n")
+			for path, device := range unmountedDevices {
+				fmt.Fprintf(w, "%s\t%s\n", path, device.Size)
+			}
+			w.Flush()
+		},
+	}
+	return cmd
+}

cli/cmd/ctl/disk/root.go

@@ -0,0 +1,15 @@
+package disk
+
+import "github.com/spf13/cobra"
+
+func NewDiskCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "disk",
+		Short: "disk management operations",
+	}
+
+	cmd.AddCommand(NewListUnmountedDisksCommand())
+	cmd.AddCommand(NewExtendDiskCommand())
+
+	return cmd
+}

cli/cmd/ctl/gpu/disable_nouveau.go

@@ -0,0 +1,23 @@
+package gpu
+
+import (
+	"log"
+
+	"github.com/beclab/Olares/cli/pkg/pipelines"
+	"github.com/spf13/cobra"
+)
+
+func NewCmdDisableNouveau() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "disable-nouveau",
+		Short: "Blacklist and disable the nouveau kernel module",
+		Run: func(cmd *cobra.Command, args []string) {
+			if err := pipelines.DisableNouveau(); err != nil {
+				log.Fatalf("error: %v", err)
+			}
+		},
+	}
+	return cmd
+}
+
+

cli/cmd/ctl/gpu/root.go

@@ -14,7 +14,7 @@ func NewCmdGpu() *cobra.Command {
 	rootGpuCmd.AddCommand(NewCmdUninstallpu())
 	rootGpuCmd.AddCommand(NewCmdEnableGpu())
 	rootGpuCmd.AddCommand(NewCmdDisableGpu())
-	rootGpuCmd.AddCommand(NewCmdUpgradeGpu())
 	rootGpuCmd.AddCommand(NewCmdGpuStatus())
+	rootGpuCmd.AddCommand(NewCmdDisableNouveau())
 	return rootGpuCmd
 }

cli/cmd/ctl/gpu/upgrade.go

@@ -1,24 +0,0 @@
-package gpu
-
-import (
-	"log"
-
-	"github.com/beclab/Olares/cli/cmd/ctl/options"
-	"github.com/beclab/Olares/cli/pkg/pipelines"
-	"github.com/spf13/cobra"
-)
-
-func NewCmdUpgradeGpu() *cobra.Command {
-	o := options.NewInstallGpuOptions()
-	cmd := &cobra.Command{
-		Use:   "upgrade",
-		Short: "upgrade GPU drivers for Olares",
-		Run: func(cmd *cobra.Command, args []string) {
-			if err := pipelines.UpgradeGpuDrivers(o); err != nil {
-				log.Fatalf("error: %v", err)
-			}
-		},
-	}
-	o.AddFlags(cmd)
-	return cmd
-}

cli/cmd/ctl/options/cli_options.go

@@ -5,6 +5,7 @@ import (
 	cc "github.com/beclab/Olares/cli/pkg/core/common"
 	"github.com/beclab/Olares/cli/pkg/phase/cluster"
 	"github.com/spf13/cobra"
+	"k8s.io/utils/pointer"
 )
 
 type CliTerminusUninstallOptions struct {
@@ -28,19 +29,23 @@ func (o *CliTerminusUninstallOptions) AddFlags(cmd *cobra.Command) {
 }
 
 type CliTerminusInstallOptions struct {
-	Version         string
-	KubeType        string
-	WithJuiceFS     bool
-	MiniKubeProfile string
-	BaseDir         string
+	Version            string
+	KubeType           string
+	WithJuiceFS        bool
+	MiniKubeProfile    string
+	BaseDir            string
+	EnableReverseProxy *bool
 	common.SwapConfig
 }
 
 func NewCliTerminusInstallOptions() *CliTerminusInstallOptions {
-	return &CliTerminusInstallOptions{}
+	return &CliTerminusInstallOptions{
+		EnableReverseProxy: pointer.Bool(false),
+	}
 }
 
 func (o *CliTerminusInstallOptions) AddFlags(cmd *cobra.Command) {
+	cmd.Flags().BoolVar(o.EnableReverseProxy, "enable-reverse-proxy", false, "Enable reverse proxy, if not set, will be dynamically enabled if public IP is not detected, and disabled otherwise")
 	cmd.Flags().StringVarP(&o.Version, "version", "v", "", "Set Olares version, e.g., 1.10.0, 1.10.0-20241109")
 	cmd.Flags().StringVar(&o.KubeType, "kube", "k3s", "Set kube type, e.g., k3s or k8s")
 	cmd.Flags().BoolVar(&o.WithJuiceFS, "with-juicefs", false, "Use JuiceFS as the rootfs for Olares workloads, rather than the local disk.")

cli/cmd/ctl/options/download_options.go

@@ -6,12 +6,12 @@ import (
 )
 
 type CliDownloadWizardOptions struct {
-	Version        string
-	KubeType       string
-	BaseDir        string
-	DownloadCdnUrl string
-	ReleaseID      string
-	UrlOverride    string
+	Version     string
+	KubeType    string
+	BaseDir     string
+	CDNService  string
+	ReleaseID   string
+	UrlOverride string
 }
 
 func NewCliDownloadWizardOptions() *CliDownloadWizardOptions {
@@ -22,17 +22,17 @@ func (o *CliDownloadWizardOptions) AddFlags(cmd *cobra.Command) {
 	cmd.Flags().StringVarP(&o.Version, "version", "v", "", "Set Olares version, e.g., 1.10.0, 1.10.0-20241109")
 	cmd.Flags().StringVarP(&o.BaseDir, "base-dir", "b", "", "Set Olares package base dir, defaults to $HOME/"+cc.DefaultBaseDir)
 	cmd.Flags().StringVar(&o.KubeType, "kube", "k3s", "Set kube type, e.g., k3s or k8s")
-	cmd.Flags().StringVar(&o.DownloadCdnUrl, "download-cdn-url", "", "Set the CDN accelerated download address in the format https://example.cdn.com. If not set, the default download address will be used")
+	cmd.Flags().StringVar(&o.CDNService, "cdn-service", "", "Set the CDN accelerated download address in the format https://example.cdn.com. If not set, the default download address will be used")
 	cmd.Flags().StringVar(&o.UrlOverride, "url-override", "", "Set another URL for wizard download explicitly")
 	cmd.Flags().StringVar(&o.ReleaseID, "release-id", "", "Set the specific release id of the release version")
 }
 
 type CliDownloadOptions struct {
-	Version        string
-	KubeType       string
-	Manifest       string
-	BaseDir        string
-	DownloadCdnUrl string
+	Version    string
+	KubeType   string
+	Manifest   string
+	BaseDir    string
+	CDNService string
 }
 
 func NewCliDownloadOptions() *CliDownloadOptions {
@@ -44,5 +44,5 @@ func (o *CliDownloadOptions) AddFlags(cmd *cobra.Command) {
 	cmd.Flags().StringVarP(&o.BaseDir, "base-dir", "b", "", "Set Olares package base dir , defaults to $HOME/"+cc.DefaultBaseDir)
 	cmd.Flags().StringVar(&o.Manifest, "manifest", "", "Set package manifest file , defaults to {base-dir}/versions/v{version}/installation.manifest")
 	cmd.Flags().StringVar(&o.KubeType, "kube", "k3s", "Set kube type, e.g., k3s or k8s")
-	cmd.Flags().StringVar(&o.DownloadCdnUrl, "download-cdn-url", "", "Set the CDN accelerated download address in the format https://example.cdn.com. If not set, the default download address will be used")
+	cmd.Flags().StringVar(&o.CDNService, "cdn-service", "", "Set the CDN accelerated download address in the format https://example.cdn.com. If not set, the default download address will be used")
 }

cli/cmd/ctl/os/install.go

@@ -24,6 +24,9 @@ func NewCmdInstallOs() *cobra.Command {
 		Use:   "install",
 		Short: "Install Olares",
 		Run: func(cmd *cobra.Command, args []string) {
+			if !cmd.Flags().Changed("enable-reverse-proxy") {
+				o.InstallOptions.EnableReverseProxy = nil
+			}
 			if err := pipelines.CliInstallTerminusPipeline(o.InstallOptions); err != nil {
 				log.Fatalf("error: %v", err)
 			}

cli/cmd/ctl/os/release.go

@@ -49,7 +49,7 @@ func NewCmdRelease() *cobra.Command {
 			}
 
 			if version == "" {
-				version = fmt.Sprintf("1.12.2-%s", time.Now().Format("20060102150405"))
+				version = fmt.Sprintf("1.12.3-%s", time.Now().Format("20060102150405"))
 				fmt.Printf("--version unspecified, using: %s\n", version)
 				time.Sleep(1 * time.Second)
 			}
@@ -77,7 +77,7 @@ func NewCmdRelease() *cobra.Command {
 
 	cmd.Flags().StringVarP(&baseDir, "base-dir", "b", "", "base directory of Olares, where this release will be extracted to as a new version if --extract/-e is not disabled, defaults to $HOME/"+common.DefaultBaseDir)
 	cmd.Flags().StringVarP(&version, "version", "v", "", "version of this release, defaults to 0.0.0-local-dev-{yyyymmddhhmmss}")
-	cmd.Flags().StringVar(&cdn, "download-cdn-url", common.DownloadUrl, "CDN used for downloading checksums of dependencies and images")
+	cmd.Flags().StringVar(&cdn, "cdn-service", common.DefaultOlaresCDNService, "CDN used for downloading checksums of dependencies and images")
 	cmd.Flags().BoolVar(&ignoreMissingImages, "ignore-missing-images", true, "ignore missing images when downloading cheksums from CDN, only disable this if no new image is added, or the build may fail because the image is not uploaded to the CDN yet")
 	cmd.Flags().BoolVarP(&extract, "extract", "e", true, "extract this release to --base-dir after build, this can be disabled if only the release file itself is needed")
 

cli/cmd/ctl/root.go

@@ -1,6 +1,7 @@
 package ctl
 
 import (
+	"github.com/beclab/Olares/cli/cmd/ctl/disk"
 	"github.com/beclab/Olares/cli/cmd/ctl/gpu"
 	"github.com/beclab/Olares/cli/cmd/ctl/node"
 	"github.com/beclab/Olares/cli/cmd/ctl/os"
@@ -33,6 +34,7 @@ func NewDefaultCommand() *cobra.Command {
 	cmds.AddCommand(node.NewNodeCommand())
 	cmds.AddCommand(gpu.NewCmdGpu())
 	cmds.AddCommand(user.NewUserCommand())
+	cmds.AddCommand(disk.NewDiskCommand())
 
 	return cmds
 }

cli/cmd/ctl/user/activate.go

@@ -0,0 +1,122 @@
+package user
+
+import (
+	"fmt"
+	"log"
+	"strings"
+
+	"github.com/beclab/Olares/cli/pkg/wizard"
+	"github.com/spf13/cobra"
+)
+
+type activateUserOptions struct {
+	Mnemonic      string
+	BflUrl        string
+	VaultUrl      string
+	Password      string
+	OlaresId      string
+	ResetPassword string
+
+	Location     string
+	Language     string
+	EnableTunnel bool
+	Host         string
+	Jws          string
+}
+
+func NewCmdActivateUser() *cobra.Command {
+	o := &activateUserOptions{}
+	cmd := &cobra.Command{
+		Use:   "activate {Olares ID (e.g., user@example.com)}",
+		Short: "activate a new user",
+		Args:  cobra.ExactArgs(1),
+		Run: func(cmd *cobra.Command, args []string) {
+			o.OlaresId = args[0]
+			if err := o.Validate(); err != nil {
+				log.Fatal(err)
+			}
+			if err := o.Run(); err != nil {
+				log.Fatal(err)
+			}
+		},
+	}
+	o.AddFlags(cmd)
+	return cmd
+}
+
+func (o *activateUserOptions) AddFlags(cmd *cobra.Command) {
+	cmd.Flags().StringVar(&o.Mnemonic, "mnemonic", "", "12-word mnemonic phrase, required for activation")
+	cmd.Flags().StringVar(&o.BflUrl, "bfl", "http://127.0.0.1:30180", "Bfl URL (e.g., https://example.com, default: http://127.0.0.1:30180)")
+	cmd.Flags().StringVar(&o.VaultUrl, "vault", "http://127.0.0.1:30180", "Vault URL (e.g., https://example.com, default: http://127.0.0.1:30181)")
+	cmd.Flags().StringVarP(&o.Password, "password", "p", "", "OS password for authentication, required for activation")
+	cmd.Flags().StringVar(&o.Location, "location", "Asia/Shanghai", "Timezone location (default: Asia/Shanghai)")
+	cmd.Flags().StringVar(&o.Language, "language", "en-US", "System language (default: en-US)")
+	cmd.Flags().BoolVar(&o.EnableTunnel, "enable-tunnel", false, "Enable tunnel mode (default: false)")
+	cmd.Flags().StringVar(&o.Host, "host", "", "FRP host (only used when tunnel is enabled)")
+	cmd.Flags().StringVar(&o.Jws, "jws", "", "FRP JWS token (only used when tunnel is enabled)")
+	cmd.Flags().StringVar(&o.ResetPassword, "reset-password", "", "New password for resetting (required for password reset)")
+}
+
+func (o *activateUserOptions) Validate() error {
+	if o.OlaresId == "" {
+		return fmt.Errorf("Olares ID is required")
+	}
+	if o.Password == "" {
+		return fmt.Errorf("Password is required")
+	}
+	if o.Mnemonic == "" {
+		return fmt.Errorf("Mnemonic is required")
+	}
+	if o.ResetPassword == "" {
+		return fmt.Errorf("Reset password is required")
+	}
+	return nil
+}
+
+func (c *activateUserOptions) Run() error {
+	log.Println("=== TermiPass CLI - User Bind Terminus ===")
+
+	localName := c.OlaresId
+	if strings.Contains(c.OlaresId, "@") {
+		localName = strings.Split(c.OlaresId, "@")[0]
+	}
+
+	log.Printf("Parameters:")
+	log.Printf("  BflUrl: %s", c.BflUrl)
+	log.Printf("  VaultUrl: %s", c.VaultUrl)
+	log.Printf("  Terminus Name: %s", c.OlaresId)
+	log.Printf("  Local Name: %s", localName)
+
+	log.Printf("Initializing global stores with mnemonic...")
+	err := wizard.InitializeGlobalStores(c.Mnemonic, c.OlaresId)
+	if err != nil {
+		return fmt.Errorf("failed to initialize global stores: %v", err)
+	}
+
+	accessToken, err := wizard.UserBindTerminus(c.Mnemonic, c.BflUrl, c.VaultUrl, c.Password, c.OlaresId, localName)
+	if err != nil {
+		return fmt.Errorf("user bind failed: %v", err)
+	}
+
+	log.Printf("✅ Vault activation completed successfully!")
+	log.Printf("🚀 Starting system activation wizard...")
+
+	wizardConfig := wizard.CustomWizardConfig(c.Location, c.Language, c.EnableTunnel, c.Host, c.Jws, c.Password, c.ResetPassword)
+
+	log.Printf("Wizard configuration:")
+	log.Printf("  Location: %s", wizardConfig.System.Location)
+	log.Printf("  Language: %s", wizardConfig.System.Language)
+	log.Printf("  Enable Tunnel: %t", c.EnableTunnel)
+	if c.EnableTunnel && wizardConfig.System.FRP != nil {
+		log.Printf("  FRP Host: %s", wizardConfig.System.FRP.Host)
+		log.Printf("  FRP JWS: %s", wizardConfig.System.FRP.Jws)
+	}
+
+	err = wizard.RunActivationWizard(c.BflUrl, accessToken, wizardConfig)
+	if err != nil {
+		return fmt.Errorf("activation wizard failed: %v", err)
+	}
+
+	log.Printf("🎉 Complete Terminus activation finished successfully!")
+	return nil
+}

cli/cmd/ctl/user/root.go

@@ -11,6 +11,7 @@ func NewUserCommand() *cobra.Command {
 	cmd.AddCommand(NewCmdDeleteUser())
 	cmd.AddCommand(NewCmdListUsers())
 	cmd.AddCommand(NewCmdGetUser())
+	cmd.AddCommand(NewCmdActivateUser())
 	// cmd.AddCommand(NewCmdUpdateUserLimits())
 	return cmd
 }

cli/go.mod

@@ -1,11 +1,11 @@
 module github.com/beclab/Olares/cli
 
-go 1.24.0
+go 1.24.2
 
-toolchain go1.24.3
+toolchain go1.24.6
 
 replace (
-	bytetrade.io/web3os/app-service => github.com/beclab/app-service v0.2.33
+	bytetrade.io/web3os/app-service => github.com/beclab/app-service v0.4.41
 	bytetrade.io/web3os/backups-sdk => github.com/Above-Os/backups-sdk v0.1.17
 	github.com/containers/image/v5 => github.com/containers/image/v5 v5.21.1
 	github.com/containers/storage => github.com/containers/storage v1.40.0
@@ -19,7 +19,7 @@ require (
 	github.com/Masterminds/semver/v3 v3.4.0
 	github.com/PaesslerAG/jsonpath v0.1.1
 	github.com/alecthomas/assert/v2 v2.11.0
-	github.com/beclab/api v0.0.0-20250805111305-08be8f53edf0
+	github.com/beclab/api v0.0.2
 	github.com/cavaliergopher/grab/v3 v3.0.1
 	github.com/containerd/containerd v1.7.28
 	github.com/decentralized-identity/web5-go v0.25.0
@@ -44,26 +44,29 @@ require (
 	github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c
 	github.com/spf13/cobra v1.9.1
 	github.com/spf13/pflag v1.0.7
-	github.com/stretchr/testify v1.10.0
+	github.com/stretchr/testify v1.11.1
 	github.com/syndtr/goleveldb v1.0.0
+	github.com/tyler-smith/go-bip39 v1.1.0
 	go.uber.org/zap v1.27.0
-	golang.org/x/crypto v0.40.0
-	golang.org/x/sys v0.34.0
-	golang.org/x/term v0.33.0
-	golang.org/x/text v0.27.0
+	golang.org/x/crypto v0.41.0
+	golang.org/x/sys v0.35.0
+	golang.org/x/term v0.34.0
+	golang.org/x/text v0.28.0
 	gopkg.in/yaml.v2 v2.4.0
-	helm.sh/helm/v3 v3.18.5
-	k8s.io/api v0.33.3
-	k8s.io/apimachinery v0.33.3
-	k8s.io/client-go v0.33.3
+	gopkg.in/yaml.v3 v3.0.1
+	helm.sh/helm/v3 v3.18.6
+	k8s.io/api v0.34.0
+	k8s.io/apiextensions-apiserver v0.34.0
+	k8s.io/apimachinery v0.34.0
+	k8s.io/client-go v0.34.0
 	k8s.io/klog/v2 v2.130.1
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
-	sigs.k8s.io/controller-runtime v0.21.0
+	k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d
+	sigs.k8s.io/controller-runtime v0.22.0
 	sigs.k8s.io/kustomize/kyaml v0.20.1
 )
 
 require (
-	dario.cat/mergo v1.0.1 // indirect
+	dario.cat/mergo v1.0.2 // indirect
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
 	github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
@@ -73,53 +76,57 @@ require (
 	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
 	github.com/Masterminds/squirrel v1.5.4 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/Microsoft/hcsshim v0.11.7 // indirect
+	github.com/Microsoft/hcsshim v0.13.0 // indirect
 	github.com/PaesslerAG/gval v1.0.0 // indirect
 	github.com/alecthomas/repr v0.4.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/chai2010/gettext-go v1.0.2 // indirect
-	github.com/containerd/cgroups v1.1.0 // indirect
+	github.com/chai2010/gettext-go v1.0.3 // indirect
+	github.com/containerd/cgroups/v3 v3.0.5 // indirect
 	github.com/containerd/containerd/api v1.8.0 // indirect
 	github.com/containerd/continuity v0.4.4 // indirect
-	github.com/containerd/errdefs v0.3.0 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/fifo v1.1.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
 	github.com/containerd/ttrpc v1.2.7 // indirect
-	github.com/containerd/typeurl/v2 v2.1.1 // indirect
+	github.com/containerd/typeurl/v2 v2.2.3 // indirect
 	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/dgrijalva/jwt-go v3.2.0+incompatible // indirect
 	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/ebitengine/purego v0.8.4 // indirect
-	github.com/emicklei/go-restful/v3 v3.12.1 // indirect
+	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
 	github.com/evanphx/json-patch v5.9.11+incompatible // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
-	github.com/fatih/color v1.13.0 // indirect
+	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fsnotify/fsnotify v1.7.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
-	github.com/go-errors/errors v1.4.2 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/go-crypt/crypt v0.4.5 // indirect
+	github.com/go-crypt/x v0.4.7 // indirect
+	github.com/go-errors/errors v1.5.1 // indirect
 	github.com/go-gorp/gorp/v3 v3.1.0 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
-	github.com/go-openapi/jsonpointer v0.21.0 // indirect
-	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/go-openapi/jsonpointer v0.21.1 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/swag v0.23.1 // indirect
 	github.com/go-resty/resty/v2 v2.16.5 // indirect
-	github.com/gobwas/glob v0.2.3 // indirect
+	github.com/gobwas/glob v0.2.4-0.20181002190808-e7a84e9525fe // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db // indirect
 	github.com/google/btree v1.1.3 // indirect
-	github.com/google/gnostic-models v0.6.9 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/gopacket v1.1.19 // indirect
-	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/gosuri/uitable v0.0.4 // indirect
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
@@ -138,8 +145,8 @@ require (
 	github.com/lib/pq v1.10.9 // indirect
 	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mattn/go-sqlite3 v1.14.30 // indirect
@@ -149,29 +156,32 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/locker v1.0.1 // indirect
 	github.com/moby/spdystream v0.5.0 // indirect
-	github.com/moby/sys/mountinfo v0.6.2 // indirect
-	github.com/moby/sys/sequential v0.5.0 // indirect
+	github.com/moby/sys/mountinfo v0.7.2 // indirect
+	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/signal v0.7.0 // indirect
-	github.com/moby/sys/user v0.3.0 // indirect
+	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/moby/term v0.5.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
+	github.com/nats-io/nats.go v1.45.0 // indirect
+	github.com/nats-io/nkeys v0.4.11 // indirect
+	github.com/nats-io/nuid v1.0.1 // indirect
 	github.com/olekukonko/tablewriter v0.0.5 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/opencontainers/runtime-spec v1.1.0 // indirect
-	github.com/opencontainers/selinux v1.11.0 // indirect
+	github.com/opencontainers/runtime-spec v1.2.1 // indirect
+	github.com/opencontainers/selinux v1.12.0 // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
-	github.com/prometheus/client_golang v1.22.0 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.62.0 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/prometheus/client_golang v1.23.0 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.65.0 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rubenv/sql-migrate v1.8.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
@@ -179,7 +189,8 @@ require (
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/smartystreets/goconvey v1.8.1 // indirect
-	github.com/spf13/cast v1.7.0 // indirect
+	github.com/spf13/cast v1.9.2 // indirect
+	github.com/thoas/go-funk v0.9.3 // indirect
 	github.com/tklauser/go-sysconf v0.3.15 // indirect
 	github.com/tklauser/numcpus v0.10.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
@@ -187,36 +198,34 @@ require (
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
-	go.opentelemetry.io/otel v1.33.0 // indirect
-	go.opentelemetry.io/otel/metric v1.33.0 // indirect
-	go.opentelemetry.io/otel/trace v1.33.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
+	go.opentelemetry.io/otel v1.36.0 // indirect
+	go.opentelemetry.io/otel/metric v1.36.0 // indirect
+	go.opentelemetry.io/otel/trace v1.36.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	go.yaml.in/yaml/v3 v3.0.3 // indirect
-	golang.org/x/net v0.42.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/net v0.43.0 // indirect
 	golang.org/x/oauth2 v0.30.0 // indirect
 	golang.org/x/sync v0.16.0 // indirect
 	golang.org/x/time v0.12.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
-	google.golang.org/grpc v1.68.1 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
+	google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
+	google.golang.org/grpc v1.72.2 // indirect
+	google.golang.org/protobuf v1.36.8 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apiextensions-apiserver v0.33.3 // indirect
-	k8s.io/apiserver v0.33.3 // indirect
-	k8s.io/cli-runtime v0.33.3 // indirect
-	k8s.io/component-base v0.33.3 // indirect
+	k8s.io/apiserver v0.34.0 // indirect
+	k8s.io/cli-runtime v0.34.0 // indirect
+	k8s.io/component-base v0.34.0 // indirect
 	k8s.io/cri-api v0.27.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
+	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
 	k8s.io/kubectl v0.33.3 // indirect
 	oras.land/oras-go/v2 v2.6.0 // indirect
-	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
-	sigs.k8s.io/kustomize/api v0.19.0 // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	sigs.k8s.io/kustomize/api v0.20.1 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
-	sigs.k8s.io/yaml v1.5.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )

cli/go.sum

@@ -1,6 +1,6 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
-dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
+dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/Above-Os/backups-sdk v0.1.17 h1:CgqR2aQaefQ4Ur69pUoasv9ugluMi4oNTCqqJ6aqCPc=
@@ -28,8 +28,8 @@ github.com/Masterminds/squirrel v1.5.4 h1:uUcX/aBc8O7Fg9kaISIUsHXdKuqehiXAMQTYX8
 github.com/Masterminds/squirrel v1.5.4/go.mod h1:NNaOrjSoIDfDA40n7sr2tPNZRfjzjA400rg+riTZj10=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/Microsoft/hcsshim v0.11.7 h1:vl/nj3Bar/CvJSYo7gIQPyRWc9f3c6IeSNavBTSZNZQ=
-github.com/Microsoft/hcsshim v0.11.7/go.mod h1:MV8xMfmECjl5HdO7U/3/hFVnkmSBjAjmA09d4bExKcU=
+github.com/Microsoft/hcsshim v0.13.0 h1:/BcXOiS6Qi7N9XqUcv27vkIuVOkBEcWstd2pMlWSeaA=
+github.com/Microsoft/hcsshim v0.13.0/go.mod h1:9KWJ/8DgU+QzYGupX4tzMhRQE8h6w90lH6HAaclpEok=
 github.com/PaesslerAG/gval v1.0.0 h1:GEKnRwkWDdf9dOmKcNrar9EA1bz1z9DqPIO1+iLzhd8=
 github.com/PaesslerAG/gval v1.0.0/go.mod h1:y/nm5yEyTeX6av0OfKJNp9rBNj2XrGhAf5+v24IBN1I=
 github.com/PaesslerAG/jsonpath v0.1.0/go.mod h1:4BzmtoM/PI8fPO4aQGIusjGxGir2BzcV0grWtFzq1Y8=
@@ -43,10 +43,10 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/beclab/api v0.0.0-20250805111305-08be8f53edf0 h1:U8AFy37epib5ya5By0gHAWVRT+BetExFkmGTjkhZCoY=
-github.com/beclab/api v0.0.0-20250805111305-08be8f53edf0/go.mod h1:1tq7ut9hrjgYWTh6UTth0xPRa7Ags0VJvUmbr4GuJuM=
-github.com/beclab/app-service v0.2.33 h1:fsv9sTL7guTdU8z8sO5KIxxd1N5K+Rp4zORRebs+wmI=
-github.com/beclab/app-service v0.2.33/go.mod h1:Gpp5e2XPU/nHufT7ZBsRMZrYxpFbI6R4AEiKine+RhI=
+github.com/beclab/api v0.0.2 h1:aD5RcMie2uqa/FZI7aQBa1F4yVEib8/x3IIZSLiHkBM=
+github.com/beclab/api v0.0.2/go.mod h1:ESZLe8cf4934QFkU6cqbskKfiTyNk67i1qbv/ctS6js=
+github.com/beclab/app-service v0.4.41 h1:WSIXEqHSAepHweBooPkc+pedVaGGn335RugNwixkciY=
+github.com/beclab/app-service v0.4.41/go.mod h1:0vEg3rv/DbR7dYznvTlXNXyYNn+TXNMaxz03GQYRWUQ=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
@@ -60,22 +60,24 @@ github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyY
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk=
-github.com/chai2010/gettext-go v1.0.2/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA=
+github.com/chai2010/gettext-go v1.0.3 h1:9liNh8t+u26xl5ddmWLmsOsdNLwkdRTg5AG+JnTiM80=
+github.com/chai2010/gettext-go v1.0.3/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA=
 github.com/chengxilo/virtualterm v1.0.4 h1:Z6IpERbRVlfB8WkOmtbHiDbBANU7cimRIof7mk9/PwM=
 github.com/chengxilo/virtualterm v1.0.4/go.mod h1:DyxxBZz/x1iqJjFxTFcr6/x+jSpqN0iwWCOK1q10rlY=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
-github.com/containerd/cgroups v1.1.0/go.mod h1:6ppBcbh/NOOUU+dMKrykgaBnK9lCIBxHqJDGwsa1mIw=
+github.com/containerd/cgroups/v3 v3.0.5 h1:44na7Ud+VwyE7LIoJ8JTNQOa549a8543BmzaJHo6Bzo=
+github.com/containerd/cgroups/v3 v3.0.5/go.mod h1:SA5DLYnXO8pTGYiAHXz94qvLQTKfVM5GEVisn4jpins=
 github.com/containerd/containerd v1.7.28 h1:Nsgm1AtcmEh4AHAJ4gGlNSaKgXiNccU270Dnf81FQ3c=
 github.com/containerd/containerd v1.7.28/go.mod h1:azUkWcOvHrWvaiUjSQH0fjzuHIwSPg1WL5PshGP4Szs=
 github.com/containerd/containerd/api v1.8.0 h1:hVTNJKR8fMc/2Tiw60ZRijntNMd1U+JVMyTRdsD2bS0=
 github.com/containerd/containerd/api v1.8.0/go.mod h1:dFv4lt6S20wTu/hMcP4350RL87qPWLVa/OHOwmmdnYc=
 github.com/containerd/continuity v0.4.4 h1:/fNVfTJ7wIl/YPMHjf+5H32uFhl63JucB34PlCpMKII=
 github.com/containerd/continuity v0.4.4/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
-github.com/containerd/errdefs v0.3.0 h1:FSZgGOeK4yuT/+DnF07/Olde/q4KBoMsaamhXxIMDp4=
-github.com/containerd/errdefs v0.3.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/containerd/fifo v1.1.0 h1:4I2mbh5stb1u6ycIABlBw9zgtlK8viPI9QkQNRQEEmY=
 github.com/containerd/fifo v1.1.0/go.mod h1:bmC4NWMbXlt2EZ0Hc7Fx7QzTFxgPID13eH0Qu+MAb2o=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
@@ -84,12 +86,11 @@ github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpS
 github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
 github.com/containerd/ttrpc v1.2.7 h1:qIrroQvuOL9HQ1X6KHe2ohc7p+HP/0VE6XPU7elJRqQ=
 github.com/containerd/ttrpc v1.2.7/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
-github.com/containerd/typeurl/v2 v2.1.1 h1:3Q4Pt7i8nYwy2KmQWIw2+1hTvwTE/6w9FqcttATPO/4=
-github.com/containerd/typeurl/v2 v2.1.1/go.mod h1:IDp2JFvbwZ31H8dQbEIY7sDl2L3o3HZj1hsSQlywkQ0=
+github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40=
+github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
 github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
@@ -104,6 +105,8 @@ github.com/decred/dcrd/crypto/blake256 v1.1.0 h1:zPMNGQCm0g4QTY27fOCorQW7EryeQ/U
 github.com/decred/dcrd/crypto/blake256 v1.1.0/go.mod h1:2OfgNZ5wDpcsFmHmCK5gZTPcCXqlm2ArzUIkw9czNJo=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 h1:NMZiJj8QnKe1LgsbDayM4UoHwbvwDRwnI3hwNaAHRnc=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
 github.com/distribution/distribution/v3 v3.0.0 h1:q4R8wemdRQDClzoNNStftB2ZAfqOiN6UX90KJc4HjyM=
@@ -112,8 +115,8 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
 github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
-github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
+github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
+github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
@@ -122,8 +125,8 @@ github.com/dominodatalab/os-release v0.0.0-20190522011736-bcdb4a3e3c2f h1:oEt43g
 github.com/dominodatalab/os-release v0.0.0-20190522011736-bcdb4a3e3c2f/go.mod h1:RU3x9VqPvzbOGJ3wtP0pPBtUOp4yU/yzA/8qdxgi/6Q=
 github.com/ebitengine/purego v0.8.4 h1:CF7LEKg5FFOsASUj0+QwaXf8Ht6TlFxg09+S9wz0omw=
 github.com/ebitengine/purego v0.8.4/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
-github.com/emicklei/go-restful/v3 v3.12.1 h1:PJMDIM/ak7btuL8Ex0iYET9hxM3CI2sjZtzpL63nKAU=
-github.com/emicklei/go-restful/v3 v3.12.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
+github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
@@ -134,8 +137,8 @@ github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjT
 github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
 github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f h1:Wl78ApPPB2Wvf/TIe2xdyJxTlb6obmF18d8QdkxNDu4=
 github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f/go.mod h1:OSYXu++VVOHnXeitef/D8n/6y4QV8uLHSFXX4NeXMGc=
-github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w=
-github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/foxcpp/go-mockdns v1.1.0 h1:jI0rD8M0wuYAxL7r/ynTrCQQq0BVqfB99Vgk7DlmewI=
@@ -143,45 +146,47 @@ github.com/foxcpp/go-mockdns v1.1.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
-github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
-github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
-github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
-github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
-github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/go-crypt/crypt v0.4.5 h1:cCR5vVejGk1kurwoGfkLxGORY+Pc9GiE7xKCpyHZ3n4=
+github.com/go-crypt/crypt v0.4.5/go.mod h1:cQijpCkqavdF52J1bE0PObWwqKKjQCHASHQ2dtLzOJs=
+github.com/go-crypt/x v0.4.7 h1:hObjW67nhq/GI1jaD7XCv5RoiVKzF46XIbULgzH71oU=
+github.com/go-crypt/x v0.4.7/go.mod h1:K3q7VmLC0U1QFAPn0SQvXjkAtu6FJuH0rN9LNqobX6k=
+github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
+github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-gorp/gorp/v3 v3.1.0 h1:ItKF/Vbuj31dmV4jxA1qblpSwkl9g1typ24xoe70IGs=
 github.com/go-gorp/gorp/v3 v3.1.0/go.mod h1:dLEjIyyRNiXvNZ8PSmzpt1GsWAUK8kjVhEpjH8TixEw=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
 github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
 github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
-github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
-github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
-github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
-github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
-github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
-github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
-github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/go-openapi/jsonpointer v0.21.1 h1:whnzv/pNXtK2FbX/W9yJfRmE2gsmkfahjMKB0fZvcic=
+github.com/go-openapi/jsonpointer v0.21.1/go.mod h1:50I1STOfbY1ycR8jGz8DaMeLCdXiI6aDteEdRNNzpdk=
+github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
+github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
+github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
+github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
 github.com/go-resty/resty/v2 v2.16.5 h1:hBKqmWrr7uRc3euHVqmh1HTHcKn99Smr7o5spptdhTM=
 github.com/go-resty/resty/v2 v2.16.5/go.mod h1:hkJtXbA2iKHzJheXYvQ8snQES5ZLGKMwQ07xAwp/fiA=
 github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
 github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
-github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
-github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
+github.com/gobwas/glob v0.2.4-0.20181002190808-e7a84e9525fe h1:zn8tqiUbec4wR94o7Qj3LZCAT6uGobhEgnDRg6isG5U=
+github.com/gobwas/glob v0.2.4-0.20181002190808-e7a84e9525fe/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -192,24 +197,21 @@ github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:W
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
 github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db h1:woRePGFeVFfLKN/pOkfl+p/TAqKOfFu+7KPlMVpok/w=
 github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
-github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -217,10 +219,8 @@ github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
 github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
-github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
-github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -237,8 +237,8 @@ github.com/gosuri/uitable v0.0.4/go.mod h1:tKR86bXuXPZazfOTG1FIzvjIdXzd0mo4Vtn16
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 h1:TmHmbvxPmaegwhDubVz0lICL0J5Ka2vwTzhoePEXsGE=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0/go.mod h1:qztMSjm835F2bXf+5HKAPIS5qsmQDqZna/PgVt4rWtI=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -250,6 +250,7 @@ github.com/hashicorp/golang-lru/v2 v2.0.5 h1:wW7h1TG88eUIJ2i69gaE3uNVtEPIagzhGvH
 github.com/hashicorp/golang-lru/v2 v2.0.5/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
+github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
 github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
@@ -271,11 +272,8 @@ github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zt
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
@@ -294,14 +292,10 @@ github.com/lithammer/dedent v1.1.0 h1:VNzHMVCBNG1j0fh3OrsFRkVUwStdDArbgBWoPAffkt
 github.com/lithammer/dedent v1.1.0/go.mod h1:jrXYCQtgg0nJiN+StA2KgR7w6CiQNv9Fd/Z9BP0jIOc=
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
-github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
-github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
-github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
+github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
@@ -326,14 +320,14 @@ github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
 github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
-github.com/moby/sys/mountinfo v0.6.2 h1:BzJjoreD5BMFNmD9Rus6gdd1pLuecOFPt8wC+Vygl78=
-github.com/moby/sys/mountinfo v0.6.2/go.mod h1:IJb6JQeOklcdMU9F5xQ8ZALD+CUr5VlGpwtX+VE0rpI=
-github.com/moby/sys/sequential v0.5.0 h1:OPvI35Lzn9K04PBbCLW0g4LcFAJgHsvXsRyewg5lXtc=
-github.com/moby/sys/sequential v0.5.0/go.mod h1:tH2cOOs5V9MlPiXcQzRC+eEyab644PWKGRYaaV5ZZlo=
+github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
+github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
+github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
+github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
 github.com/moby/sys/signal v0.7.0 h1:25RW3d5TnQEoKvRbEKUGay6DCQ46IxAVTT9CUMgmsSI=
 github.com/moby/sys/signal v0.7.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn88Kg8Tg=
-github.com/moby/sys/user v0.3.0 h1:9ni5DlcW5an3SvRSx4MouotOygvzaXbaSrc/wGDFWPo=
-github.com/moby/sys/user v0.3.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
+github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
 github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
 github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
@@ -341,8 +335,9 @@ github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFL
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/modood/table v0.0.0-20220527013332-8d47e76dad33 h1:T5IbS9C1G2zeHb6eBy6OfIvj5tfQB23kGFpewCJuGDg=
 github.com/modood/table v0.0.0-20220527013332-8d47e76dad33/go.mod h1:41qyXVI5QH9/ObyPj27CGCVau5v/njfc3Gjj7yzr0HQ=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
@@ -355,27 +350,30 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
-github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
-github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
+github.com/nats-io/nats.go v1.45.0 h1:/wGPbnYXDM0pLKFjZTX+2JOw9TQPoIgTFrUaH97giwA=
+github.com/nats-io/nats.go v1.45.0/go.mod h1:iRWIPokVIFbVijxuMQq4y9ttaBTMe0SFdlZfMDd+33g=
+github.com/nats-io/nkeys v0.4.11 h1:q44qGV008kYd9W1b1nEBkNzvnWxtRSQ7A8BoqRrcfa0=
+github.com/nats-io/nkeys v0.4.11/go.mod h1:szDimtgmfOi9n25JpfIdGw12tZFYXqhGxjhVxsatHVE=
+github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
+github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.7.0 h1:WSHQ+IS43OoUrWtD1/bbclrwK8TTH5hzp+umCiuxHgs=
 github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
-github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
-github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg=
-github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
+github.com/onsi/ginkgo/v2 v2.25.2 h1:hepmgwx1D+llZleKQDMEvy8vIlCxMGt7W5ZxDjIEhsw=
+github.com/onsi/ginkgo/v2 v2.25.2/go.mod h1:43uiyQC4Ed2tkOzLsEYm7hnrb7UJTWHYNsuy3bG/snE=
 github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
-github.com/onsi/gomega v1.38.0 h1:c/WX+w8SLAinvuKKQFh77WEucCnPk4j2OTUr7lt7BeY=
-github.com/onsi/gomega v1.38.0/go.mod h1:OcXcwId0b9QsE7Y49u+BTrL4IdKOBOKnD6VQNTJEB6o=
+github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
+github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
 github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
-github.com/opencontainers/runtime-spec v1.1.0 h1:HHUyrt9mwHUjtasSbXSMvs4cyFxh+Bll4AjJ9odEGpg=
-github.com/opencontainers/runtime-spec v1.1.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/selinux v1.11.0 h1:+5Zbo97w3Lbmb3PeqQtpmTkMwsW5nRI3YaLpt7tQ7oU=
-github.com/opencontainers/selinux v1.11.0/go.mod h1:E5dMC3VPuVvVHDYmi78qvhJp8+M586T4DlDRYpFkyec=
+github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU8lpJfSlR0xww=
+github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/selinux v1.12.0 h1:6n5JV4Cf+4y0KNXW48TLj5DwfXpvWlxXplUkdTrmPb8=
+github.com/opencontainers/selinux v1.12.0/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
@@ -394,15 +392,15 @@ github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/poy/onpar v1.1.2 h1:QaNrNiZx0+Nar5dLgTVp5mXkyoVFIbepjyEoGSnhbAY=
 github.com/poy/onpar v1.1.2/go.mod h1:6X8FLNoxyr9kkmnlqpK6LSoiOtrO6MICtWwEuWkLjzg=
-github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
-github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
+github.com/prometheus/client_golang v1.23.0 h1:ust4zpdl9r4trLY/gSjlm07PuiBq2ynaXXlptpfy8Uc=
+github.com/prometheus/client_golang v1.23.0/go.mod h1:i/o0R9ByOnHX0McrTMTyhYvKE4haaf2mW08I+jGAjEE=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
-github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
-github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
-github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
-github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
-github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
+github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
+github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
+github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
 github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 h1:EaDatTxkdHG+U3Bk4EUr+DZ7fOGwTfezUiUJMaIcaho=
 github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5/go.mod h1:fyalQWdtzDBECAQFBJuQe5bzQ02jGd5Qcbgb97Flm7U=
 github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 h1:EfpWLLCyXw8PSM2/XNJLjI3Pb27yVE+gIAfeqp8LUCc=
@@ -440,8 +438,8 @@ github.com/smarty/assertions v1.15.0 h1:cR//PqUBUiQRakZWqBiFFQ9wb8emQGDb0HeGdqGB
 github.com/smarty/assertions v1.15.0/go.mod h1:yABtdzeQs6l1brC900WlRNwj6ZR55d7B+E8C6HtKdec=
 github.com/smartystreets/goconvey v1.8.1 h1:qGjIddxOk4grTu9JPOU31tVfq3cNdBlNa5sSznIX1xY=
 github.com/smartystreets/goconvey v1.8.1/go.mod h1:+/u4qLyY6x1jReYOp7GOM2FSt8aP9CzCZL03bI28W60=
-github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
-github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/cast v1.9.2 h1:SsGfm7M8QOFtEzumm7UZrZdLLquNdzFYfIbEXntcFbE=
+github.com/spf13/cast v1.9.2/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
 github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
 github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
@@ -460,14 +458,18 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/syndtr/goleveldb v1.0.0 h1:fBdIW9lB4Iz0n9khmH8w27SJ3QEJ7+IgjPEwGSZiFdE=
 github.com/syndtr/goleveldb v1.0.0/go.mod h1:ZVVdQEZoIme9iO1Ch2Jdy24qqXrMMOU6lpPAyBWyWuQ=
+github.com/thoas/go-funk v0.9.3 h1:7+nAEx3kn5ZJcnDm2Bh23N2yOtweO14bi//dvRtgLpw=
+github.com/thoas/go-funk v0.9.3/go.mod h1:+IWnUfUmFO1+WVYQWQtIJHeRRdaIyyYglZN7xzUPe4Q=
 github.com/tklauser/go-sysconf v0.3.15 h1:VE89k0criAymJ/Os65CSn1IXaol+1wrsFHEB8Ol49K4=
 github.com/tklauser/go-sysconf v0.3.15/go.mod h1:Dmjwr6tYFIseJw7a3dRLJfsHAMXZ3nEnL/aZY+0IuI4=
 github.com/tklauser/numcpus v0.10.0 h1:18njr6LDBk1zuna922MgdjQuJFjrdppsZG60sHGfjso=
 github.com/tklauser/numcpus v0.10.0/go.mod h1:BiTKazU708GQTYF4mB+cmlpT2Is1gLk7XVuEeem8LsQ=
+github.com/tyler-smith/go-bip39 v1.1.0 h1:5eUemwrMargf3BSLRRCalXT93Ns6pQJIjYQN2nyfOP8=
+github.com/tyler-smith/go-bip39 v1.1.0/go.mod h1:gUYDtqQw1JS3ZJ8UWVcGTGqqr6YIN3CWg+kkNaLt55U=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
@@ -484,10 +486,10 @@ go.opentelemetry.io/contrib/bridges/prometheus v0.57.0 h1:UW0+QyeyBVhn+COBec3nGh
 go.opentelemetry.io/contrib/bridges/prometheus v0.57.0/go.mod h1:ppciCHRLsyCio54qbzQv0E4Jyth/fLWDTJYfvWpcSVk=
 go.opentelemetry.io/contrib/exporters/autoexport v0.57.0 h1:jmTVJ86dP60C01K3slFQa2NQ/Aoi7zA+wy7vMOKD9H4=
 go.opentelemetry.io/contrib/exporters/autoexport v0.57.0/go.mod h1:EJBheUMttD/lABFyLXhce47Wr6DPWYReCzaZiXadH7g=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 h1:yd02MEjBdJkG3uabWP9apV+OuWRIXGDuJEUJbOHmCFU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0/go.mod h1:umTcuxiv1n/s/S6/c2AT/g2CQ7u5C59sHDNmfSwgz7Q=
-go.opentelemetry.io/otel v1.33.0 h1:/FerN9bax5LoK51X/sI0SVYrjSE0/yUL7DpxW4K3FWw=
-go.opentelemetry.io/otel v1.33.0/go.mod h1:SUUkR6csvUQl+yjReHu5uM3EtVV7MBm5FHKRlNx4I8I=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
+go.opentelemetry.io/otel v1.36.0 h1:UumtzIklRBY6cI/lllNZlALOF5nNIzJVb16APdvgTXg=
+go.opentelemetry.io/otel v1.36.0/go.mod h1:/TcFMXYjyRNh8khOAO9ybYkqaDBb/70aVwkNML4pP8E=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0 h1:WzNab7hOOLzdDF/EoWCt4glhrbMPVMOO5JYTmpz36Ls=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0/go.mod h1:hKvJwTzJdp90Vh7p6q/9PAOd55dI6WA6sWj62a/JvSs=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0 h1:S+LdBGiQXtJdowoJoQPEtI52syEP/JYBUpjO49EQhV8=
@@ -496,10 +498,10 @@ go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.32.0 h1:j7Z
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.32.0/go.mod h1:WXbYJTUaZXAbYd8lbgGuvih0yuCfOFC5RJoYnoLcGz8=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.32.0 h1:t/Qur3vKSkUCcDVaSumWF2PKHt85pc7fRvFuoVT8qFU=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.32.0/go.mod h1:Rl61tySSdcOJWoEgYZVtmnKdA0GeKrSqkHC1t+91CH8=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 h1:Vh5HayB/0HHfOQA7Ctx69E/Y/DcQSMPpKANYVMQ7fBA=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0/go.mod h1:cpgtDBaqD/6ok/UG0jT15/uKjAY8mRA53diogHBg3UI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0 h1:5pojmb1U1AogINhN3SurB+zm/nIcusopeBNp42f45QM=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0/go.mod h1:57gTHJSE5S1tqg+EKsLPlTWhpHMsWlVmer+LA926XiA=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 h1:OeNbIYk/2C15ckl7glBlOBp5+WlYsOElzTNmiPW/x60=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0/go.mod h1:7Bept48yIeqxP2OZ9/AqIpYS94h2or0aB4FypJTc8ZM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 h1:tgJ0uaNS4c98WRNUEx5U3aDlrDOI5Rs+1Vifcw4DJ8U=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0/go.mod h1:U7HYyW0zt/a9x5J1Kjs+r1f/d4ZHnYFclhYY2+YbeoE=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.32.0 h1:cMyu9O88joYEaI47CnQkxO1XZdpoTF9fEnW2duIddhw=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.32.0/go.mod h1:6Am3rn7P9TVVeXYG+wtcGE7IE1tsQ+bP3AuWcKt/gOI=
 go.opentelemetry.io/otel/exporters/prometheus v0.54.0 h1:rFwzp68QMgtzu9PgP3jm9XaMICI6TsofWWPcBDKwlsU=
@@ -512,18 +514,20 @@ go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.32.0 h1:cC2yDI3IQd0Udsu
 go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.32.0/go.mod h1:2PD5Ex6z8CFzDbTdOlwyNIUywRr1DN0ospafJM1wJ+s=
 go.opentelemetry.io/otel/log v0.8.0 h1:egZ8vV5atrUWUbnSsHn6vB8R21G2wrKqNiDt3iWertk=
 go.opentelemetry.io/otel/log v0.8.0/go.mod h1:M9qvDdUTRCopJcGRKg57+JSQ9LgLBrwwfC32epk5NX8=
-go.opentelemetry.io/otel/metric v1.33.0 h1:r+JOocAyeRVXD8lZpjdQjzMadVZp2M4WmQ+5WtEnklQ=
-go.opentelemetry.io/otel/metric v1.33.0/go.mod h1:L9+Fyctbp6HFTddIxClbQkjtubW6O9QS3Ann/M82u6M=
-go.opentelemetry.io/otel/sdk v1.33.0 h1:iax7M131HuAm9QkZotNHEfstof92xM+N8sr3uHXc2IM=
-go.opentelemetry.io/otel/sdk v1.33.0/go.mod h1:A1Q5oi7/9XaMlIWzPSxLRWOI8nG3FnzHJNbiENQuihM=
+go.opentelemetry.io/otel/metric v1.36.0 h1:MoWPKVhQvJ+eeXWHFBOPoBOi20jh6Iq2CcCREuTYufE=
+go.opentelemetry.io/otel/metric v1.36.0/go.mod h1:zC7Ks+yeyJt4xig9DEw9kuUFe5C3zLbVjV2PzT6qzbs=
+go.opentelemetry.io/otel/sdk v1.36.0 h1:b6SYIuLRs88ztox4EyrvRti80uXIFy+Sqzoh9kFULbs=
+go.opentelemetry.io/otel/sdk v1.36.0/go.mod h1:+lC+mTgD+MUWfjJubi2vvXWcVxyr9rmlshZni72pXeY=
 go.opentelemetry.io/otel/sdk/log v0.8.0 h1:zg7GUYXqxk1jnGF/dTdLPrK06xJdrXgqgFLnI4Crxvs=
 go.opentelemetry.io/otel/sdk/log v0.8.0/go.mod h1:50iXr0UVwQrYS45KbruFrEt4LvAdCaWWgIrsN3ZQggo=
-go.opentelemetry.io/otel/sdk/metric v1.32.0 h1:rZvFnvmvawYb0alrYkjraqJq0Z4ZUJAiyYCU9snn1CU=
-go.opentelemetry.io/otel/sdk/metric v1.32.0/go.mod h1:PWeZlq0zt9YkYAp3gjKZ0eicRYvOh1Gd+X99x6GHpCQ=
-go.opentelemetry.io/otel/trace v1.33.0 h1:cCJuF7LRjUFso9LPnEAHJDB2pqzp+hbO8eu1qqW2d/s=
-go.opentelemetry.io/otel/trace v1.33.0/go.mod h1:uIcdVUZMpTAmz0tI1z04GoVSezK37CbGV4fr1f2nBck=
-go.opentelemetry.io/proto/otlp v1.4.0 h1:TA9WRvW6zMwP+Ssb6fLoUIuirti1gGbP28GcKG1jgeg=
-go.opentelemetry.io/proto/otlp v1.4.0/go.mod h1:PPBWZIP98o2ElSqI35IHfu7hIhSwvc5N38Jw8pXuGFY=
+go.opentelemetry.io/otel/sdk/metric v1.36.0 h1:r0ntwwGosWGaa0CrSt8cuNuTcccMXERFwHX4dThiPis=
+go.opentelemetry.io/otel/sdk/metric v1.36.0/go.mod h1:qTNOhFDfKRwX0yXOqJYegL5WRaW376QbB7P4Pb0qva4=
+go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKrsNd4w=
+go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
+go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
+go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
+go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
+go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
@@ -532,14 +536,14 @@ go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
 go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
-go.yaml.in/yaml/v3 v3.0.3 h1:bXOww4E/J3f66rav3pX3m8w6jDE4knZjGOw8b5Y6iNE=
-go.yaml.in/yaml/v3 v3.0.3/go.mod h1:tBHosrYAkRZjRAOREWbDnBXUf08JOwYq++0QNwQiWzI=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
-golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
+golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
@@ -548,8 +552,8 @@ golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPI
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg=
-golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
+golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
+golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -560,8 +564,8 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
-golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
+golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
 golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
@@ -577,25 +581,20 @@ golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
-golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.33.0 h1:NuFncQrRcaRvVmgRkvM3j/F00gWIAlcmlB8ACEKmGIg=
-golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
+golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
-golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
 golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
 golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -607,8 +606,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
-golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -620,19 +619,19 @@ google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80 h1:KAeGQVN3M9nD0/bQXnr/ClcEMJ968gUXJQ9pwfSynuQ=
-google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80/go.mod h1:cc8bqMqtv9gMOr0zHg2Vzff5ULhhL2IXP4sbcn32Dro=
-google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 h1:CkkIfIt50+lT6NHAVoRYEyAvQGFM7xEwXUUywFvEb3Q=
-google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576/go.mod h1:1R3kvZ1dtP3+4p4d3G8uJ8rFk/fWlScl38vanWACI08=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
+google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s=
+google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 h1:oWVWY3NzT7KJppx2UKhKmzPq4SRe0LdCijVRwvGeikY=
+google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822/go.mod h1:h3c4v36UTKzUiuaOKQ6gr3S+0hovBtUrXzTG/i3+XEc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 h1:fc6jSaCT0vBduLYZHYrBBNY4dsWuvgyff9noRNDdBeE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.68.1 h1:oI5oTa11+ng8r8XMMN7jAOmWfPZWbYpCFaMUTACxkM0=
-google.golang.org/grpc v1.68.1/go.mod h1:+q1XYFJjShcqn0QZHvCyeR4CXPA+llXIeUIfIe00waw=
+google.golang.org/grpc v1.72.2 h1:TdbGzwb82ty4OusHWepvFWGLgIbNo1/SUynEN0ssqv8=
+google.golang.org/grpc v1.72.2/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -642,15 +641,14 @@ google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
 gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
@@ -663,49 +661,47 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-helm.sh/helm/v3 v3.18.5 h1:Cc3Z5vd6kDrZq9wO9KxKLNEickiTho6/H/dBNRVSos4=
-helm.sh/helm/v3 v3.18.5/go.mod h1:L/dXDR2r539oPlFP1PJqKAC1CUgqHJDLkxKpDGrWnyg=
+helm.sh/helm/v3 v3.18.6 h1:S/2CqcYnNfLckkHLI0VgQbxgcDaU3N4A/46E3n9wSNY=
+helm.sh/helm/v3 v3.18.6/go.mod h1:L/dXDR2r539oPlFP1PJqKAC1CUgqHJDLkxKpDGrWnyg=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-k8s.io/api v0.33.3 h1:SRd5t//hhkI1buzxb288fy2xvjubstenEKL9K51KBI8=
-k8s.io/api v0.33.3/go.mod h1:01Y/iLUjNBM3TAvypct7DIj0M0NIZc+PzAHCIo0CYGE=
-k8s.io/apiextensions-apiserver v0.33.3 h1:qmOcAHN6DjfD0v9kxL5udB27SRP6SG/MTopmge3MwEs=
-k8s.io/apiextensions-apiserver v0.33.3/go.mod h1:oROuctgo27mUsyp9+Obahos6CWcMISSAPzQ77CAQGz8=
-k8s.io/apimachinery v0.33.3 h1:4ZSrmNa0c/ZpZJhAgRdcsFcZOw1PQU1bALVQ0B3I5LA=
-k8s.io/apimachinery v0.33.3/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
-k8s.io/apiserver v0.33.3 h1:Wv0hGc+QFdMJB4ZSiHrCgN3zL3QRatu56+rpccKC3J4=
-k8s.io/apiserver v0.33.3/go.mod h1:05632ifFEe6TxwjdAIrwINHWE2hLwyADFk5mBsQa15E=
-k8s.io/cli-runtime v0.33.3 h1:Dgy4vPjNIu8LMJBSvs8W0LcdV0PX/8aGG1DA1W8lklA=
-k8s.io/cli-runtime v0.33.3/go.mod h1:yklhLklD4vLS8HNGgC9wGiuHWze4g7x6XQZ+8edsKEo=
-k8s.io/client-go v0.33.3 h1:M5AfDnKfYmVJif92ngN532gFqakcGi6RvaOF16efrpA=
-k8s.io/client-go v0.33.3/go.mod h1:luqKBQggEf3shbxHY4uVENAxrDISLOarxpTKMiUuujg=
-k8s.io/component-base v0.33.3 h1:mlAuyJqyPlKZM7FyaoM/LcunZaaY353RXiOd2+B5tGA=
-k8s.io/component-base v0.33.3/go.mod h1:ktBVsBzkI3imDuxYXmVxZ2zxJnYTZ4HAsVj9iF09qp4=
+k8s.io/api v0.34.0 h1:L+JtP2wDbEYPUeNGbeSa/5GwFtIA662EmT2YSLOkAVE=
+k8s.io/api v0.34.0/go.mod h1:YzgkIzOOlhl9uwWCZNqpw6RJy9L2FK4dlJeayUoydug=
+k8s.io/apiextensions-apiserver v0.34.0 h1:B3hiB32jV7BcyKcMU5fDaDxk882YrJ1KU+ZSkA9Qxoc=
+k8s.io/apiextensions-apiserver v0.34.0/go.mod h1:hLI4GxE1BDBy9adJKxUxCEHBGZtGfIg98Q+JmTD7+g0=
+k8s.io/apimachinery v0.34.0 h1:eR1WO5fo0HyoQZt1wdISpFDffnWOvFLOOeJ7MgIv4z0=
+k8s.io/apimachinery v0.34.0/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+k8s.io/apiserver v0.34.0 h1:Z51fw1iGMqN7uJ1kEaynf2Aec1Y774PqU+FVWCFV3Jg=
+k8s.io/apiserver v0.34.0/go.mod h1:52ti5YhxAvewmmpVRqlASvaqxt0gKJxvCeW7ZrwgazQ=
+k8s.io/cli-runtime v0.34.0 h1:N2/rUlJg6TMEBgtQ3SDRJwa8XyKUizwjlOknT1mB2Cw=
+k8s.io/cli-runtime v0.34.0/go.mod h1:t/skRecS73Piv+J+FmWIQA2N2/rDjdYSQzEE67LUUs8=
+k8s.io/client-go v0.34.0 h1:YoWv5r7bsBfb0Hs2jh8SOvFbKzzxyNo0nSb0zC19KZo=
+k8s.io/client-go v0.34.0/go.mod h1:ozgMnEKXkRjeMvBZdV1AijMHLTh3pbACPvK7zFR+QQY=
+k8s.io/component-base v0.34.0 h1:bS8Ua3zlJzapklsB1dZgjEJuJEeHjj8yTu1gxE2zQX8=
+k8s.io/component-base v0.34.0/go.mod h1:RSCqUdvIjjrEm81epPcjQ/DS+49fADvGSCkIP3IC6vg=
 k8s.io/cri-api v0.27.1 h1:KWO+U8MfI9drXB/P4oU9VchaWYOlwDglJZVHWMpTT3Q=
 k8s.io/cri-api v0.27.1/go.mod h1:+Ts/AVYbIo04S86XbTD73UPp/DkTiYxtsFeOFEu32L0=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUyGcf03XZEP0ZIKgKj35LS4=
-k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b h1:MloQ9/bdJyIu9lb1PzujOPolHyvO06MXG5TUIj2mNAA=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b/go.mod h1:UZ2yyWbFTpuhSbFhv24aGNOdoRdJZgsIObGBUaYVsts=
 k8s.io/kubectl v0.33.3 h1:r/phHvH1iU7gO/l7tTjQk2K01ER7/OAJi8uFHHyWSac=
 k8s.io/kubectl v0.33.3/go.mod h1:euj2bG56L6kUGOE/ckZbCoudPwuj4Kud7BR0GzyNiT0=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d h1:wAhiDyZ4Tdtt7e46e9M5ZSAJ/MnPGPs+Ki1gHw4w1R0=
+k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
 oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
-sigs.k8s.io/controller-runtime v0.21.0 h1:CYfjpEuicjUecRk+KAeyYh+ouUBn4llGyDYytIGcJS8=
-sigs.k8s.io/controller-runtime v0.21.0/go.mod h1:OSg14+F65eWqIu4DceX7k/+QRAbTTvxeQSNSOQpukWM=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
-sigs.k8s.io/kustomize/api v0.19.0 h1:F+2HB2mU1MSiR9Hp1NEgoU2q9ItNOaBJl0I4Dlus5SQ=
-sigs.k8s.io/kustomize/api v0.19.0/go.mod h1:/BbwnivGVcBh1r+8m3tH1VNxJmHSk1PzP5fkP6lbL1o=
+sigs.k8s.io/controller-runtime v0.22.0 h1:mTOfibb8Hxwpx3xEkR56i7xSjB+nH4hZG37SrlCY5e0=
+sigs.k8s.io/controller-runtime v0.22.0/go.mod h1:FwiwRjkRPbiN+zp2QRp7wlTCzbUXxZ/D4OzuQUDwBHY=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/kustomize/api v0.20.1 h1:iWP1Ydh3/lmldBnH/S5RXgT98vWYMaTUL1ADcr+Sv7I=
+sigs.k8s.io/kustomize/api v0.20.1/go.mod h1:t6hUFxO+Ph0VxIk1sKp1WS0dOjbPCtLJ4p8aADLwqjM=
 sigs.k8s.io/kustomize/kyaml v0.20.1 h1:PCMnA2mrVbRP3NIB6v9kYCAc38uvFLVs8j/CD567A78=
 sigs.k8s.io/kustomize/kyaml v0.20.1/go.mod h1:0EmkQHRUsJxY8Ug9Niig1pUMSCGHxQ5RklbpV/Ri6po=
-sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v4 v4.6.0 h1:IUA9nvMmnKWcj5jl84xn+T5MnlZKThmUW1TdblaLVAc=
-sigs.k8s.io/structured-merge-diff/v4 v4.6.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
-sigs.k8s.io/yaml v1.5.0 h1:M10b2U7aEUY6hRtU870n2VTPgR5RZiL/I6Lcc2F4NUQ=
-sigs.k8s.io/yaml v1.5.0/go.mod h1:wZs27Rbxoai4C0f8/9urLZtZtF3avA3gKvGyPdDqTO4=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=

cli/pkg/bootstrap/download/module.go

@@ -7,9 +7,9 @@ import (
 
 type PackageDownloadModule struct {
 	common.KubeModule
-	Manifest       string
-	BaseDir        string
-	DownloadCdnUrl string
+	Manifest   string
+	BaseDir    string
+	CDNService string
 }
 
 func (i *PackageDownloadModule) Init() {
@@ -18,7 +18,7 @@ func (i *PackageDownloadModule) Init() {
 	download := &task.LocalTask{
 		Name:   i.Name,
 		Desc:   i.Desc,
-		Action: &PackageDownload{Manifest: i.Manifest, BaseDir: i.BaseDir, DownloadCdnUrl: i.DownloadCdnUrl},
+		Action: &PackageDownload{Manifest: i.Manifest, BaseDir: i.BaseDir, CDNService: i.CDNService},
 	}
 
 	i.Tasks = []task.Interface{

cli/pkg/bootstrap/download/tasks.go

@@ -21,11 +21,11 @@ import (
 
 type PackageDownload struct {
 	common.KubeAction
-	Manifest       string
-	BaseDir        string
-	DownloadCdnUrl string
-	existingItems  []*manifest.ManifestItem
-	missingItems   []*manifest.ManifestItem
+	Manifest      string
+	BaseDir       string
+	CDNService    string
+	existingItems []*manifest.ManifestItem
+	missingItems  []*manifest.ManifestItem
 }
 
 type CheckDownload struct {
@@ -138,7 +138,7 @@ func (d *PackageDownload) downloadItem(runtime connector.Runtime, baseDir string
 	component.ID = item.Filename
 	component.Arch = runtime.GetSystemInfo().GetOsArch()
 	component.BaseDir = getDownloadTargetBasePath(item, baseDir)
-	component.Url = fmt.Sprintf("%s/%s", d.DownloadCdnUrl, strings.TrimPrefix(url.Url, "/"))
+	component.Url = fmt.Sprintf("%s/%s", d.CDNService, strings.TrimPrefix(url.Url, "/"))
 	component.FileName = item.Filename
 	component.CheckMd5Sum = true
 	component.Md5sum = url.Checksum

cli/pkg/bootstrap/os/tasks.go

@@ -447,6 +447,7 @@ var (
 		"/etc/kubekey",
 		"/etc/kke/version",
 		"/etc/systemd/system/olares-swap.service",
+		"/tmp/vgpulock",
 	}
 
 	networkResetCmds = []string{

cli/pkg/bootstrap/patch/tasks.go

@@ -63,6 +63,16 @@ func (t *PatchTask) Execute(runtime connector.Runtime) error {
 
 	var systemInfo = runtime.GetSystemInfo()
 	var platformFamily = systemInfo.GetOsPlatformFamily()
+	var aptToolAvailable bool
+	if _, err := util.GetCommand("add-apt-repository"); err == nil {
+		aptToolAvailable = true
+	} else {
+		if _, err := runtime.GetRunner().SudoCmd("apt install -y software-properties-common", false, true); err == nil {
+			aptToolAvailable = true
+		} else {
+			logger.Infof("software-properties-common not available, try to update apt sources ourself")
+		}
+	}
 	var pkgManager = systemInfo.GetPkgManager()
 	switch platformFamily {
 	case common.Debian:
@@ -70,16 +80,7 @@ func (t *PatchTask) Execute(runtime connector.Runtime) error {
 		repoURL := "https://deb.debian.org/debian"
 		suite := systemInfo.GetDebianVersionCode()
 		components := []string{"contrib", "non-free"}
-		var aptToolAvailable bool
-		if _, err := util.GetCommand("add-apt-repository"); err == nil {
-			aptToolAvailable = true
-		} else {
-			if _, err := runtime.GetRunner().SudoCmd("apt install -y software-properties-common", false, true); err == nil {
-				aptToolAvailable = true
-			} else {
-				logger.Infof("software-properties-common not available, try to update apt sources ourself")
-			}
-		}
+
 		if aptToolAvailable {
 			cmd := fmt.Sprintf("add-apt-repository '%s %s %s %s' -y", sourceType, repoURL, suite, strings.Join(components, " "))
 			if _, err := runtime.GetRunner().SudoCmd(cmd, false, true); err != nil {

cli/pkg/bootstrap/precheck/module.go

@@ -78,6 +78,8 @@ func (m *RunPrechecksModule) Init() {
 		new(SystemdCheck),
 		new(RequiredPortsCheck),
 		new(ConflictingContainerdCheck),
+		new(NvidiaCardArchChecker),
+		new(NouveauChecker),
 		new(CudaChecker),
 	}
 	runPreChecks := &task.LocalTask{

cli/pkg/bootstrap/precheck/tasks.go

@@ -23,6 +23,7 @@ import (
 	"fmt"
 	"net"
 	"os"
+	"slices"
 	"strings"
 	"time"
 
@@ -114,7 +115,7 @@ func (t *RequiredPortsCheck) Check(runtime connector.Runtime) error {
 		defer l.Close()
 	}
 	if len(unbindablePorts) > 0 {
-		return fmt.Errorf("port %v required by Olares cannot be bound", unbindablePorts)
+		return fmt.Errorf("port %v required by Olares cannot be bound, you can check which process using the command `sudo netstat -tlnp`", unbindablePorts)
 	}
 	return nil
 }
@@ -133,13 +134,15 @@ func (t *ConflictingContainerdCheck) Check(runtime connector.Runtime) error {
 	if kubeRuntime.Arg.IsCloudInstance {
 		return nil
 	}
+	fixMSG := "\nIf it is installed as a component of Docker, it should be uninstalled per the official doc https://docs.docker.com/engine/install/ubuntu/#uninstall-old-versions"
+	fixMSG += "\nIf it is left over from a previous installation of Olares, clean it up using the command `sudo olares-cli uninstall --all`"
 	containerdBin, err := util.GetCommand("containerd")
 	if err == nil && containerdBin != "" {
-		return fmt.Errorf("found existing containerd binary: %s, a containerd managed by Olares is required to ensure normal function", containerdBin)
+		return fmt.Errorf("found existing containerd binary: %s, a containerd managed by Olares is required to ensure normal function%s", containerdBin, fixMSG)
 	}
 	containerdSocket := "/run/containerd/containerd.sock"
 	if util.IsExist(containerdSocket) {
-		return fmt.Errorf("found existing containerd socket: %s, a containerd managed by Olares is required to ensure normal function", containerdSocket)
+		return fmt.Errorf("found existing containerd socket: %s, a containerd managed by Olares is required to ensure normal function%s", containerdSocket, fixMSG)
 	}
 	return nil
 }
@@ -269,20 +272,104 @@ func (t *ValidResolvConfCheck) Check(runtime connector.Runtime) error {
 	return nil
 }
 
-type CudaChecker struct {
-	CudaCheckTask
+type NvidiaCardArchChecker struct{}
+
+func (t *NvidiaCardArchChecker) Name() string {
+	return "NvidiaCardArch"
 }
 
-func (c *CudaChecker) Check(runtime connector.Runtime) error {
-	err := c.CudaCheckTask.Execute(runtime)
+func (t *NvidiaCardArchChecker) Check(runtime connector.Runtime) error {
+	supportedArchs := []string{"Blackwell", "Hopper", "Ada Lovelace", "Ampere", "Turing"}
+	model, arch, err := utils.DetectNvidiaModelAndArch(runtime)
+	if err != nil {
+		return err
+	}
+	if strings.TrimSpace(model) == "" {
+		return nil
+	}
+	if !slices.Contains(supportedArchs, arch) {
+		return fmt.Errorf("unsupported NVIDIA card %s of architecture: %s, Olares only supports the following architectures: %s", model, arch, strings.Join(supportedArchs, ", "))
+	}
+	return nil
+}
 
-	// the command `precheck` will check the cuda version,
-	// only if the cuda is installed and the current version is not supported, it will return an error
-	if err == ErrCudaInstalled {
+// NouveauChecker checks whether nouveau is loaded and has modeset=1 or -1.
+// This check only runs when an NVIDIA GPU is present.
+type NouveauChecker struct{}
+
+func (n *NouveauChecker) Name() string {
+	return "NouveauKernelModule"
+}
+
+func (n *NouveauChecker) Check(runtime connector.Runtime) error {
+	if !runtime.GetSystemInfo().IsLinux() {
+		return nil
+	}
+	model, _, err := utils.DetectNvidiaModelAndArch(runtime)
+	if err != nil {
+		fmt.Println("Error detecting NVIDIA card:", err)
+		os.Exit(1)
+	}
+	if strings.TrimSpace(model) == "" {
 		return nil
 	}
 
-	return err
+	if !util.IsExist("/sys/module/nouveau") {
+		return nil
+	}
+
+	const modesetPath = "/sys/module/nouveau/parameters/modeset"
+	data, err := os.ReadFile(modesetPath)
+	if err != nil {
+		fmt.Printf("Error reading modeset parameter of nouveau kernel module by reading file %s: %v", modesetPath, err)
+		os.Exit(1)
+	}
+	val := strings.TrimSpace(string(data))
+	if val == "1" || val == "-1" {
+		return fmt.Errorf("detected nouveau kernel module loaded with modeset=%s; this conflicts with the NVIDIA driver that Olares will install, please disable it by running `sudo olares-cli gpu disable-nouveau`, REBOOT your machine, and try again", val)
+	}
+	return nil
+}
+
+type CudaChecker struct{}
+
+func (c *CudaChecker) Name() string {
+	return "CUDA"
+}
+
+func (c *CudaChecker) Check(runtime connector.Runtime) error {
+	if !runtime.GetSystemInfo().IsLinux() {
+		return nil
+	}
+
+	st, err := utils.GetNvidiaStatus(runtime)
+	if err != nil {
+		return err
+	}
+	if st == nil || !st.Installed {
+		if st != nil && st.Running {
+			return ErrKernelDriverUninstalledButRunning
+		}
+		logger.Info("NVIDIA driver is not installed")
+		return nil
+	}
+	if st.Mismatch {
+		return ErrDriverLibraryVersionMismatch
+	}
+	if st.InstallMethod != utils.GPUDriverInstallMethodRunfile && !runtime.GetSystemInfo().IsWsl() {
+		return ErrNotInstalledByRunfile
+	}
+	logger.Infof("NVIDIA driver is installed, version: %s, cuda version: %s", st.DriverVersion, st.CudaVersion)
+	oldestVer := semver.MustParse(supportedCudaVersions[0])
+	newestVer := semver.MustParse(supportedCudaVersions[len(supportedCudaVersions)-1])
+	currentVer := semver.MustParse(st.CudaVersion)
+	if oldestVer.GreaterThan(currentVer) {
+		return ErrUnsupportedCudaVersion
+	}
+	if newestVer.LessThan(currentVer) {
+		logger.Info("CUDA version is too new, there might be compatibility issues with some applications, use at your own risk")
+	}
+	return nil
 }
 
 //////////////////////////////////////////////
@@ -474,44 +561,8 @@ func (t *RemoveWSLChattr) Execute(runtime connector.Runtime) error {
 	return nil
 }
 
-var ErrUnsupportedCudaVersion = errors.New("unsupported cuda version, please uninstall it, REBOOT your machine, and try again")
-var ErrCudaInstalled = errors.New("cuda is installed")
-var supportedCudaVersions = []string{"12.8", common.CurrentVerifiedCudaVersion}
-
-// CudaCheckTask checks the cuda version, if the current version is not supported, it will return an error
-// before executing the command `olares-cli gpu install`, we need to check the cuda version
-// if the cuda if not installed, it will return nil and the command can be executed.
-// if the cuda is installed and the version is unsupported, the command can not be executed,
-// or the cuda version is supported, executing the command is unnecessary.
-type CudaCheckTask struct{}
-
-func (t *CudaCheckTask) Name() string {
-	return "Cuda"
-}
-
-func (t *CudaCheckTask) Execute(runtime connector.Runtime) error {
-	if !runtime.GetSystemInfo().IsLinux() {
-		return nil
-	}
-
-	info, installed, err := utils.ExecNvidiaSmi(runtime)
-	switch {
-	case err != nil:
-		return err
-	case !installed:
-		logger.Info("NVIDIA driver is not installed")
-		return nil
-	default:
-		logger.Infof("NVIDIA driver is installed, version: %s, cuda version: %s", info.DriverVersion, info.CudaVersion)
-		oldestVer := semver.MustParse(supportedCudaVersions[0])
-		newestVer := semver.MustParse(supportedCudaVersions[len(supportedCudaVersions)-1])
-		currentVer := semver.MustParse(info.CudaVersion)
-		if oldestVer.GreaterThan(currentVer) {
-			return ErrUnsupportedCudaVersion
-		}
-		if newestVer.LessThan(currentVer) {
-			logger.Info("CUDA version is too new, there might be compatibility issues with some applications, use at your own risk")
-		}
-		return ErrCudaInstalled
-	}
-}
+var ErrUnsupportedCudaVersion = errors.New("unsupported cuda version, please uninstall it using the command `sudo olares-cli gpu uninstall`, REBOOT your machine, and try again")
+var ErrKernelDriverUninstalledButRunning = errors.New("NVIDIA driver is uninstalled, but the kernel driver is still running, please REBOOT your machine, and try again")
+var ErrNotInstalledByRunfile = errors.New("NVIDIA driver is installed, but not installed by runfile, please uninstall it using the command `sudo olares-cli gpu uninstall`, REBOOT your machine, and try again")
+var ErrDriverLibraryVersionMismatch = errors.New("NVIDIA driver is installed, but the library version with the running version is mismatched, please REBOOT your machine, and try again")
+var supportedCudaVersions = []string{common.CurrentVerifiedCudaVersion}

cli/pkg/common/common.go

@@ -18,8 +18,6 @@ package common
 
 import (
 	"os"
-
-	cc "github.com/beclab/Olares/cli/pkg/core/common"
 )
 
 const (
@@ -28,7 +26,7 @@ const (
 	DefaultKubernetesVersion   = ""
 	DefaultKubeSphereVersion   = "v3.3.0"
 	DefaultTokenMaxAge         = 31536000
-	CurrentVerifiedCudaVersion = "12.9"
+	CurrentVerifiedCudaVersion = "13.0"
 )
 
 const (
@@ -281,74 +279,41 @@ const (
 )
 
 const (
-	ENV_OLARES_BASE_DIR              = "OLARES_BASE_DIR"
-	ENV_OLARES_VERSION               = "OLARES_VERSION"
-	ENV_TERMINUS_IS_CLOUD_VERSION    = "TERMINUS_IS_CLOUD_VERSION"
-	ENV_PUBLICLY_ACCESSIBLE          = "PUBLICLY_ACCESSIBLE"
-	ENV_KUBE_TYPE                    = "KUBE_TYPE"
-	ENV_REGISTRY_MIRRORS             = "REGISTRY_MIRRORS"
-	ENV_NVIDIA_CONTAINER_REPO_MIRROR = "NVIDIA_CONTAINER_REPO_MIRROR"
-	ENV_DOWNLOAD_CDN_URL             = "DOWNLOAD_CDN_URL"
-	ENV_STORAGE                      = "STORAGE"
-	ENV_S3_BUCKET                    = "S3_BUCKET"
-	ENV_LOCAL_GPU_ENABLE             = "LOCAL_GPU_ENABLE"
-	ENV_CLOUDFLARE_ENABLE            = "CLOUDFLARE_ENABLE"
-	ENV_FRP_ENABLE                   = "FRP_ENABLE"
-	ENV_FRP_SERVER                   = "FRP_SERVER"
-	ENV_FRP_PORT                     = "FRP_PORT"
-	ENV_FRP_AUTH_METHOD              = "FRP_AUTH_METHOD"
-	ENV_FRP_AUTH_TOKEN               = "FRP_AUTH_TOKEN"
-	ENV_AWS_ACCESS_KEY_ID_SETUP      = "AWS_ACCESS_KEY_ID_SETUP"
-	ENV_AWS_SECRET_ACCESS_KEY_SETUP  = "AWS_SECRET_ACCESS_KEY_SETUP"
-	ENV_AWS_SESSION_TOKEN_SETUP      = "AWS_SESSION_TOKEN_SETUP"
-	ENV_BACKUP_KEY_PREFIX            = "BACKUP_KEY_PREFIX"
-	ENV_BACKUP_SECRET                = "BACKUP_SECRET"
-	ENV_CLUSTER_ID                   = "CLUSTER_ID"
-	ENV_BACKUP_CLUSTER_BUCKET        = "BACKUP_CLUSTER_BUCKET"
-	ENV_TOKEN_MAX_AGE                = "TOKEN_MAX_AGE"
-	ENV_MARKET_PROVIDER              = "MARKET_PROVIDER"
-	ENV_TERMINUS_CERT_SERVICE_API    = "TERMINUS_CERT_SERVICE_API"
-	ENV_TERMINUS_DNS_SERVICE_API     = "TERMINUS_DNS_SERVICE_API"
-	ENV_HOST_IP                      = "HOST_IP"
-	ENV_PREINSTALL                   = "PREINSTALL"
-	ENV_DISABLE_HOST_IP_PROMPT       = "DISABLE_HOST_IP_PROMPT"
-	ENV_AUTO_ADD_FIREWALL_RULES      = "AUTO_ADD_FIREWALL_RULES"
-	ENV_TERMINUS_OS_DOMAINNAME       = "TERMINUS_OS_DOMAINNAME"
-	ENV_DEFAULT_WSL_DISTRO_LOCATION  = "DEFAULT_WSL_DISTRO_LOCATION" // If set to 1, the default WSL distro storage will be used.
+	ENV_OLARES_BASE_DIR             = "OLARES_BASE_DIR"
+	ENV_OLARES_VERSION              = "OLARES_VERSION"
+	ENV_TERMINUS_IS_CLOUD_VERSION   = "TERMINUS_IS_CLOUD_VERSION"
+	ENV_KUBE_TYPE                   = "KUBE_TYPE"
+	ENV_REGISTRY_MIRRORS            = "REGISTRY_MIRRORS"
+	ENV_OLARES_CDN_SERVICE          = "OLARES_SYSTEM_CDN_SERVICE"
+	ENV_STORAGE                     = "STORAGE"
+	ENV_S3_BUCKET                   = "S3_BUCKET"
+	ENV_LOCAL_GPU_ENABLE            = "LOCAL_GPU_ENABLE"
+	ENV_AWS_ACCESS_KEY_ID_SETUP     = "AWS_ACCESS_KEY_ID_SETUP"
+	ENV_AWS_SECRET_ACCESS_KEY_SETUP = "AWS_SECRET_ACCESS_KEY_SETUP"
+	ENV_AWS_SESSION_TOKEN_SETUP     = "AWS_SESSION_TOKEN_SETUP"
+	ENV_BACKUP_KEY_PREFIX           = "BACKUP_KEY_PREFIX"
+	ENV_BACKUP_SECRET               = "BACKUP_SECRET"
+	ENV_CLUSTER_ID                  = "CLUSTER_ID"
+	ENV_BACKUP_CLUSTER_BUCKET       = "BACKUP_CLUSTER_BUCKET"
+	ENV_TOKEN_MAX_AGE               = "TOKEN_MAX_AGE"
+	ENV_HOST_IP                     = "HOST_IP"
+	ENV_PREINSTALL                  = "PREINSTALL"
+	ENV_DISABLE_HOST_IP_PROMPT      = "DISABLE_HOST_IP_PROMPT"
+	ENV_AUTO_ADD_FIREWALL_RULES     = "AUTO_ADD_FIREWALL_RULES"
+	ENV_TERMINUS_OS_DOMAINNAME      = "TERMINUS_OS_DOMAINNAME"
+	ENV_DEFAULT_WSL_DISTRO_LOCATION = "DEFAULT_WSL_DISTRO_LOCATION" // If set to 1, the default WSL distro storage will be used.
 
 	ENV_CONTAINER      = "container"
 	ENV_CONTAINER_MODE = "CONTAINER_MODE" // running in docker container
+
+	OLARES_SYSTEM_ENV_FILENAME = "system-env.yaml"
+	OLARES_USER_ENV_FILENAME   = "user-env.yaml"
 )
 
-// TerminusGlobalEnvs holds a group of general environment variables
-// which are used for many components
-// along with their default values
-// if they are set in the execution environment
-// the default values are override
-// note that we declare the key type as interface{} on purpose
-// to avoid Helm bug when merging values
-var TerminusGlobalEnvs = map[string]interface{}{
-	"DID_GATE_URL":               "https://did-gate-v3.bttcdn.com/",
-	"OLARES_SPACE_URL":           "https://cloud-api.bttcdn.com/",
-	"FIREBASE_PUSH_URL":          "https://firebase-push-test.bttcdn.com/v1/api/push",
-	"FRP_LIST_URL":               "https://terminus-frp.snowinning.com",
-	"TAILSCALE_CONTROLPLANE_URL": "https://controlplane.snowinning.com",
-	"OLARES_ROOT_DIR":            "/olares",
-	// the default value used by kubeadm
-	"COREDNS_SVC":        "10.96.0.10",
-	ENV_DOWNLOAD_CDN_URL: cc.DownloadUrl,
-	ENV_MARKET_PROVIDER:  "appstore-server-prod.bttcdn.com",
+func SetSystemEnv(key, value string) {
+	os.Setenv(key, value)
 }
 
 const (
-	HelmValuesKeyTerminusGlobalEnvs = "terminusGlobalEnvs"
-	HelmValuesKeyOlaresRootFSPath   = "rootPath"
+	HelmValuesKeyOlaresRootFSPath = "rootPath"
 )
-
-func init() {
-	for envKey, _ := range TerminusGlobalEnvs {
-		if val := os.Getenv(envKey); val != "" {
-			TerminusGlobalEnvs[envKey] = val
-		}
-	}
-}

cli/pkg/common/kube_runtime.go

@@ -76,9 +76,9 @@ type Argument struct {
 	SystemInfo       connector.Systems
 
 	// Extra args
-	ExtraAddon      string `json:"extra_addon"` // addon yaml config
-	RegistryMirrors string `json:"registry_mirrors"`
-	DownloadCdnUrl  string `json:"download_cdn_url"`
+	ExtraAddon       string `json:"extra_addon"` // addon yaml config
+	RegistryMirrors  string `json:"registry_mirrors"`
+	OlaresCDNService string `json:"olares_cdn_service"`
 
 	// Swap config
 	*SwapConfig
@@ -98,15 +98,10 @@ type Argument struct {
 	// to avoid wrong information given by user
 	WithJuiceFS bool `json:"with_juicefs"`
 	// the object storage service used as backend for JuiceFS
-	Storage                *Storage           `json:"storage"`
-	PublicNetworkInfo      *PublicNetworkInfo `json:"public_network_info"`
-	GPU                    *GPU               `json:"gpu"`
-	Cloudflare             *Cloudflare        `json:"cloudflare"`
-	Frp                    *Frp               `json:"frp"`
-	TokenMaxAge            int64              `json:"token_max_age"` // nanosecond
-	MarketProvider         string             `json:"market_provider"`
-	TerminusCertServiceAPI string             `json:"terminus_cert_service_api"`
-	TerminusDNSServiceAPI  string             `json:"terminus_dns_service_api"`
+	Storage         *Storage         `json:"storage"`
+	NetworkSettings *NetworkSettings `json:"network_settings"`
+	GPU             *GPU             `json:"gpu"`
+	TokenMaxAge     int64            `json:"token_max_age"` // nanosecond
 
 	Request any `json:"-"`
 
@@ -189,15 +184,15 @@ func (cfg *MasterHostConfig) Validate() error {
 	return nil
 }
 
-type PublicNetworkInfo struct {
+type NetworkSettings struct {
 	// OSPublicIPs contains a list of public ip(s)
 	// by looking at local network interfaces
 	// if any
 	OSPublicIPs []net.IP `json:"os_public_ips"`
 
-	// AWS contains the info retrieved from the AWS instance metadata service
+	// CloudProviderPublicIP contains the info retrieved from the cloud provider instance metadata service
 	// if any
-	AWSPublicIP net.IP `json:"aws"`
+	CloudProviderPublicIP net.IP `json:"cloud_provider_public_ip"`
 
 	// ExternalPublicIP is the IP address seen by others on the internet
 	// it may not be an IP address
@@ -209,7 +204,7 @@ type PublicNetworkInfo struct {
 	// but the user explicitly specifies that the machine is publicly accessible
 	ExternalPublicIP net.IP `json:"external_public_ip"`
 
-	PubliclyAccessible bool `json:"publicly_accessible"`
+	EnableReverseProxy *bool `json:"enable_reverse_proxy"`
 }
 
 type User struct {
@@ -238,18 +233,6 @@ type GPU struct {
 	Enable bool `json:"gpu_enable"`
 }
 
-type Cloudflare struct {
-	Enable string `json:"cloudflare_enable"`
-}
-
-type Frp struct {
-	Enable     string `json:"frp_enable"`
-	Server     string `json:"frp_server"`
-	Port       string `json:"frp_port"`
-	AuthMethod string `json:"frp_auth_method"`
-	AuthToken  string `json:"frp_auth_token"`
-}
-
 func NewArgument() *Argument {
 	si := connector.GetSystemInfo()
 	arg := &Argument{
@@ -265,22 +248,16 @@ func NewArgument() *Argument {
 		GPU: &GPU{
 			Enable: !strings.EqualFold(os.Getenv(ENV_LOCAL_GPU_ENABLE), "0"), // default enable GPU, not set or 1 means enable
 		},
-		Cloudflare:             &Cloudflare{},
-		Frp:                    &Frp{},
-		User:                   &User{},
-		PublicNetworkInfo:      &PublicNetworkInfo{},
-		RegistryMirrors:        os.Getenv(ENV_REGISTRY_MIRRORS),
-		DownloadCdnUrl:         os.Getenv(ENV_DOWNLOAD_CDN_URL),
-		MarketProvider:         os.Getenv(ENV_MARKET_PROVIDER),
-		TerminusCertServiceAPI: os.Getenv(ENV_TERMINUS_CERT_SERVICE_API),
-		TerminusDNSServiceAPI:  os.Getenv(ENV_TERMINUS_DNS_SERVICE_API),
-		HostIP:                 os.Getenv(ENV_HOST_IP),
-		Environment:            os.Environ(),
-		MasterHostConfig:       &MasterHostConfig{},
-		SwapConfig:             &SwapConfig{},
+		User:             &User{},
+		NetworkSettings:  &NetworkSettings{},
+		RegistryMirrors:  os.Getenv(ENV_REGISTRY_MIRRORS),
+		OlaresCDNService: os.Getenv(ENV_OLARES_CDN_SERVICE),
+		HostIP:           os.Getenv(ENV_HOST_IP),
+		Environment:      os.Environ(),
+		MasterHostConfig: &MasterHostConfig{},
+		SwapConfig:       &SwapConfig{},
 	}
 	arg.IsCloudInstance, _ = strconv.ParseBool(os.Getenv(ENV_TERMINUS_IS_CLOUD_VERSION))
-	arg.PublicNetworkInfo.PubliclyAccessible, _ = strconv.ParseBool(os.Getenv(ENV_PUBLICLY_ACCESSIBLE))
 	arg.IsOlaresInContainer = os.Getenv("CONTAINER_MODE") == "oic"
 	si.IsOIC = arg.IsOlaresInContainer
 
@@ -368,12 +345,12 @@ func (a *Argument) GetWslUserPath() string {
 	return res
 }
 
-func (a *Argument) SetDownloadCdnUrl(downloadCdnUrl string) {
-	u := strings.TrimSuffix(downloadCdnUrl, "/")
+func (a *Argument) SetOlaresCDNService(url string) {
+	u := strings.TrimSuffix(url, "/")
 	if u == "" {
-		u = common.DownloadUrl
+		u = common.DefaultOlaresCDNService
 	}
-	a.DownloadCdnUrl = u
+	a.OlaresCDNService = u
 }
 
 func (a *Argument) SetTokenMaxAge() {
@@ -433,36 +410,6 @@ func (a *Argument) SetWSLDistribution(distribution string) {
 	}
 }
 
-func (a *Argument) SetReverseProxy() {
-	var enableCloudflare = os.Getenv("CLOUDFLARE_ENABLE")
-	var enableFrp = "0"
-	var frpServer = ""
-	var frpPort = "0"
-	var frpAuthMethod = ""
-	var frpAuthToken = ""
-
-	if enableCloudflare == "" {
-		enableCloudflare = "1"
-	}
-	if a.PublicNetworkInfo.PubliclyAccessible {
-		enableCloudflare = "0"
-	} else if os.Getenv("FRP_ENABLE") == "1" {
-		enableCloudflare = "0"
-		enableFrp = "1"
-		frpServer = os.Getenv("FRP_SERVER")
-		frpPort = os.Getenv("FRP_PORT")
-		frpAuthMethod = os.Getenv("FRP_AUTH_METHOD")
-		frpAuthToken = os.Getenv("FRP_AUTH_TOKEN")
-	}
-
-	a.Cloudflare.Enable = enableCloudflare
-	a.Frp.Enable = enableFrp
-	a.Frp.Server = util.RemoveHTTPPrefix(frpServer)
-	a.Frp.Port = frpPort
-	a.Frp.AuthMethod = frpAuthMethod
-	a.Frp.AuthToken = frpAuthToken
-}
-
 func (a *Argument) SetKubeVersion(kubeType string) {
 	var kubeVersion = DefaultK3sVersion
 	if kubeType == K8s {

cli/pkg/common/local_runtime.go

@@ -58,7 +58,7 @@ func NewLocalRuntime(debug, ingoreErr bool) (LocalRuntime, error) {
 	host.Address = ""
 	host.InternalAddress = ""
 	host.Port = 22
-	host.User = u.Name
+	host.User = u.Username
 	host.Password = ""
 	host.PrivateKeyPath = fmt.Sprintf("%s/.ssh/id_rsa", u.HomeDir)
 	host.Arch = ""

cli/pkg/core/common/common.go

@@ -92,8 +92,8 @@ const (
 )
 
 const (
-	DownloadUrl    = "https://dc3p1870nn3cj.cloudfront.net"
-	DefaultBashUrl = "olares.sh"
+	DefaultOlaresCDNService = "https://cdn.olares.com"
+	DefaultBashUrl          = "olares.sh"
 )
 
 const (

cli/pkg/core/connector/system.go

@@ -54,6 +54,7 @@ const (
 	Ubuntu20 UbuntuVersion = "20."
 	Ubuntu22 UbuntuVersion = "22."
 	Ubuntu24 UbuntuVersion = "24."
+	Ubuntu25 UbuntuVersion = "25."
 
 	Debian9  DebianVersion = "9"
 	Debian10 DebianVersion = "10"
@@ -134,7 +135,7 @@ func (s *SystemInfo) IsSupport() error {
 	//}
 
 	if s.IsUbuntu() {
-		if !s.IsUbuntuVersionEqual(Ubuntu22) && !s.IsUbuntuVersionEqual(Ubuntu24) {
+		if !s.IsUbuntuVersionEqual(Ubuntu22) && !s.IsUbuntuVersionEqual(Ubuntu24) && !s.IsUbuntuVersionEqual(Ubuntu25) {
 			return fmt.Errorf("unsupported ubuntu os version '%s'", s.GetOsVersion())
 		}
 	}

cli/pkg/core/util/ip.go

@@ -312,3 +312,22 @@ func GetTokenFROMAWSIMDS() (string, error) {
 	}
 	return strings.TrimSpace(string(body)), nil
 }
+
+func GetPublicIPFromTencentIMDS() (net.IP, error) {
+	url := "http://metadata.tencentyun.com/latest/meta-data/public-ipv4"
+	req, err := http.NewRequest(http.MethodGet, url, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to build http request: %v", err)
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to reach Tencent metadata service")
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to read response from Tencent metadata service")
+	}
+	logger.Debugf("retrieved public IP info from Tencent metadata service: %s", string(body))
+	return net.ParseIP(strings.TrimSpace(string(body))), nil
+}

cli/pkg/core/util/util.go

@@ -18,9 +18,11 @@ package util
 
 import (
 	"bytes"
+	"context"
 	"fmt"
 	"io"
 	"math"
+	"net"
 	"net/http"
 	"os"
 	"os/exec"
@@ -29,6 +31,7 @@ import (
 	"sort"
 	"strings"
 	"text/template"
+	"time"
 
 	"github.com/beclab/Olares/cli/pkg/core/logger"
 
@@ -227,3 +230,37 @@ func IsOnAWSEC2() bool {
 	}
 	return false
 }
+
+func IsOnTencentCVM() bool {
+	vendorFiles := []string{
+		"/sys/class/dmi/id/sys_vendor",
+		"/sys/class/dmi/id/board_vendor",
+		"/sys/class/dmi/id/bios_vendor",
+		"/sys/class/dmi/id/product_name",
+	}
+	for _, p := range vendorFiles {
+		if b, err := os.ReadFile(p); err == nil {
+			s := strings.ToLower(strings.TrimSpace(string(b)))
+			if strings.Contains(s, "tencent") {
+				return true
+			}
+		}
+	}
+
+	reqCtx, cancel := context.WithTimeout(context.Background(), 400*time.Millisecond)
+	defer cancel()
+	req, _ := http.NewRequestWithContext(reqCtx, http.MethodGet, "http://metadata.tencentyun.com/latest/meta-data/instance-id", nil)
+
+	tr := &http.Transport{
+		Proxy: nil,
+		DialContext: (&net.Dialer{
+			Timeout: 250 * time.Millisecond,
+		}).DialContext,
+	}
+	resp, err := (&http.Client{Transport: tr}).Do(req)
+	if err != nil {
+		return false
+	}
+	defer resp.Body.Close()
+	return resp.StatusCode == http.StatusOK
+}

cli/pkg/daemon/task.go

@@ -69,22 +69,12 @@ func (g *GenerateTerminusdServiceEnv) Execute(runtime connector.Runtime) error {
 		Template: templates.TerminusdEnv,
 		Dst:      filepath.Join("/etc/systemd/system/", templates.TerminusdEnv.Name()),
 		Data: util.Data{
-			"Version":                g.KubeConf.Arg.OlaresVersion,
-			"KubeType":               g.KubeConf.Arg.Kubetype,
-			"RegistryMirrors":        g.KubeConf.Arg.RegistryMirrors,
-			"BaseDir":                baseDir,
-			"GpuEnable":              utils.FormatBoolToInt(g.KubeConf.Arg.GPU.Enable),
-			"PubliclyAccessible":     g.KubeConf.Arg.PublicNetworkInfo.PubliclyAccessible,
-			"CloudflareEnable":       g.KubeConf.Arg.Cloudflare.Enable,
-			"FrpEnable":              g.KubeConf.Arg.Frp.Enable,
-			"FrpServer":              g.KubeConf.Arg.Frp.Server,
-			"FrpPort":                g.KubeConf.Arg.Frp.Port,
-			"FrpAuthMethod":          g.KubeConf.Arg.Frp.AuthMethod,
-			"TokenMaxAge":            g.KubeConf.Arg.TokenMaxAge,
-			"MarketProvider":         g.KubeConf.Arg.MarketProvider,
-			"TerminusCertServiceAPI": g.KubeConf.Arg.TerminusCertServiceAPI,
-			"TerminusDNSServiceAPI":  g.KubeConf.Arg.TerminusDNSServiceAPI,
-			"TerminusGlobalEnvs":     common.TerminusGlobalEnvs,
+			"Version":         g.KubeConf.Arg.OlaresVersion,
+			"KubeType":        g.KubeConf.Arg.Kubetype,
+			"RegistryMirrors": g.KubeConf.Arg.RegistryMirrors,
+			"BaseDir":         baseDir,
+			"GpuEnable":       utils.FormatBoolToInt(g.KubeConf.Arg.GPU.Enable),
+			"TokenMaxAge":     g.KubeConf.Arg.TokenMaxAge,
 		},
 		PrintContent: true,
 	}

cli/pkg/daemon/templates/terminusd_env.go

@@ -14,18 +14,5 @@ KUBE_TYPE={{ .KubeType }}
 REGISTRY_MIRRORS={{ .RegistryMirrors }}
 BASE_DIR={{ .BaseDir }}
 LOCAL_GPU_ENABLE={{ .GpuEnable }}
-PUBLICLY_ACCESSIBLE={{ .PubliclyAccessible }}
-CLOUDFLARE_ENABLE={{ .CloudflareEnable }}
-FRP_ENABLE={{ .FrpEnable }}
-FRP_SERVER={{ .FrpServer }}
-FRP_PORT={{ .FrpPort }}
-FRP_AUTH_METHOD={{ .FrpAuthMethod }}
-FRP_AUTH_TOKEN=
 TOKEN_MAX_AGE={{ .TokenMaxAge }}
-MARKET_PROVIDER={{ .MarketProvider }}
-TERMINUS_CERT_SERVICE_API={{ .TerminusCertServiceAPI }}
-TERMINUS_DNS_SERVICE_API={{ .TerminusDNSServiceAPI }}
-{{- range $key, $val := .TerminusGlobalEnvs }}
-{{ $key }}={{ $val }}
-{{- end }}
     `)))

cli/pkg/files/file.go

@@ -274,7 +274,7 @@ func NewKubeBinary(name, arch, osType, osVersion, osPlatformFamily, version, pre
 		component.Type = COMPONENT
 		component.FileName = fmt.Sprintf("redis-%s.tar.gz", version)
 		component.FileNameHash = utils.MD5(component.FileName)
-		component.Url = fmt.Sprintf(RedisUrl, common.DownloadUrl, component.FileNameHash)
+		component.Url = fmt.Sprintf(RedisUrl, common.DefaultOlaresCDNService, component.FileNameHash)
 		component.CheckSum = false
 		component.BaseDir = filepath.Join(prePath, component.Type)
 	case juicefs:
@@ -330,21 +330,21 @@ func NewKubeBinary(name, arch, osType, osVersion, osPlatformFamily, version, pre
 		component.Type = GPU
 		component.FileName = fmt.Sprintf("%s_%s_cuda-keyring_%s-1_all.deb", osPlatformFamily, osVersion, version)
 		component.FileNameHash = utils.MD5(component.FileName)
-		component.Url = fmt.Sprintf(CudaKeyringCNDUrl, common.DownloadUrl, getGpuCDNPrefix(arch, component.FileNameHash)) //getCudaKeyringUrl(arch, constants.OsVersion, version)
+		component.Url = fmt.Sprintf(CudaKeyringCNDUrl, common.DefaultOlaresCDNService, getGpuCDNPrefix(arch, component.FileNameHash)) //getCudaKeyringUrl(arch, constants.OsVersion, version)
 		component.CheckSum = false
 		component.BaseDir = filepath.Join(prePath, component.Type)
 	case gpgkey:
 		component.Type = GPU
 		component.FileName = "gpgkey"
 		component.FileNameHash = utils.MD5(component.FileName)
-		component.Url = fmt.Sprintf(CudaKeyringCNDUrl, common.DownloadUrl, getGpuCDNPrefix(arch, component.FileNameHash))
+		component.Url = fmt.Sprintf(CudaKeyringCNDUrl, common.DefaultOlaresCDNService, getGpuCDNPrefix(arch, component.FileNameHash))
 		component.CheckSum = false
 		component.BaseDir = filepath.Join(prePath, component.Type)
 	case libnvidia:
 		component.Type = GPU
 		component.FileName = fmt.Sprintf("%s_%s_libnvidia-container.list", osPlatformFamily, osVersion)
 		component.FileNameHash = utils.MD5(component.FileName)
-		component.Url = fmt.Sprintf(CudaKeyringCNDUrl, common.DownloadUrl, getGpuCDNPrefix(arch, component.FileNameHash))
+		component.Url = fmt.Sprintf(CudaKeyringCNDUrl, common.DefaultOlaresCDNService, getGpuCDNPrefix(arch, component.FileNameHash))
 		component.CheckSum = false
 		component.BaseDir = filepath.Join(prePath, component.Type)
 	case wsl: // + wsl
@@ -377,7 +377,7 @@ func NewKubeBinary(name, arch, osType, osVersion, osPlatformFamily, version, pre
 
 func (b *KubeBinary) GetDownloadMirrors(downloadMirrors string) string {
 	if downloadMirrors == "" {
-		return common.DownloadUrl
+		return common.DefaultOlaresCDNService
 	}
 	return downloadMirrors
 }

cli/pkg/gpu/module.go

@@ -1,9 +1,10 @@
 package gpu
 
 import (
-	"github.com/beclab/Olares/cli/pkg/container"
 	"time"
 
+	"github.com/beclab/Olares/cli/pkg/container"
+
 	"github.com/beclab/Olares/cli/pkg/common"
 	"github.com/beclab/Olares/cli/pkg/core/prepare"
 	"github.com/beclab/Olares/cli/pkg/core/task"
@@ -20,11 +21,6 @@ type InstallDriversModule struct {
 	// 1. no card is found (which skips the driver installation)
 	// 2. no driver is found (which skips the container toolkit installation)
 	FailOnNoInstallation bool
-
-	// currently, this is only used to skip the nvidia-smi check after driver upgrade
-	// because the nvidia-smi will not work after upgrade (Failed to initialize NVML: Driver/library version mismatch)
-	// otherwise, always check the driver is running properly after installation to fail early and avoid other issues
-	SkipNVMLCheckAfterInstall bool
 }
 
 func (m *InstallDriversModule) IsSkip() bool {
@@ -34,14 +30,14 @@ func (m *InstallDriversModule) IsSkip() bool {
 func (m *InstallDriversModule) Init() {
 	m.Name = "InstallGPUDriver"
 
-	installCudaDeps := &task.RemoteTask{
-		Name:  "InstallCudaKeyRing",
+	installCudaDriver := &task.RemoteTask{ // not for WSL
+		Name:  "InstallNvidiaDriver",
 		Hosts: m.Runtime.GetHostsByRole(common.Master),
 		Prepare: &prepare.PrepareCollection{
 			new(CudaNotInstalled),
 			&NvidiaGraphicsCard{ExitOnNotFound: m.FailOnNoInstallation},
 		},
-		Action: &InstallCudaDeps{
+		Action: &InstallCudaDriver{
 			ManifestAction: manifest.ManifestAction{
 				Manifest: m.Manifest,
 				BaseDir:  m.BaseDir,
@@ -51,20 +47,7 @@ func (m *InstallDriversModule) Init() {
 		Retry:    1,
 	}
 
-	installCudaDriver := &task.RemoteTask{ // not for WSL
-		Name:  "InstallNvidiaDriver",
-		Hosts: m.Runtime.GetHostsByRole(common.Master),
-		Prepare: &prepare.PrepareCollection{
-			new(CudaNotInstalled),
-			&NvidiaGraphicsCard{ExitOnNotFound: m.FailOnNoInstallation},
-		},
-		Action:   &InstallCudaDriver{SkipNVMLCheckAfterInstall: m.SkipNVMLCheckAfterInstall},
-		Parallel: false,
-		Retry:    1,
-	}
-
 	m.Tasks = []task.Interface{
-		installCudaDeps,
 		installCudaDriver,
 	}
 }
@@ -364,13 +347,20 @@ func (l *UninstallCudaModule) Init() {
 
 }
 
-type ExitIfNoDriverUpgradeNeededModule struct {
+type DisableNouveauModule struct {
 	common.KubeModule
 }
 
-func (l *ExitIfNoDriverUpgradeNeededModule) Init() {
-	l.Tasks = append(l.Tasks, &task.LocalTask{
-		Action: new(ExitIfNoDriverUpgradeNeeded),
-	})
+func (m *DisableNouveauModule) Init() {
+	m.Name = "DisableNouveau"
 
+	writeBlacklist := &task.LocalTask{
+		Name:   "WriteNouveauBlacklist",
+		Action: new(WriteNouveauBlacklist),
+		Retry:  1,
+	}
+
+	m.Tasks = []task.Interface{
+		writeBlacklist,
+	}
 }

cli/pkg/gpu/prepares.go

@@ -3,12 +3,14 @@ package gpu
 import (
 	"context"
 	"os"
+	"strings"
 
 	"github.com/beclab/Olares/cli/pkg/bootstrap/precheck"
 	"github.com/beclab/Olares/cli/pkg/clientset"
 	"github.com/beclab/Olares/cli/pkg/common"
 	"github.com/beclab/Olares/cli/pkg/core/connector"
 	"github.com/beclab/Olares/cli/pkg/core/logger"
+	"github.com/beclab/Olares/cli/pkg/utils"
 	"github.com/pkg/errors"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -32,35 +34,33 @@ func (p *GPUEnablePrepare) PreCheck(runtime connector.Runtime) (bool, error) {
 
 type CudaInstalled struct {
 	common.KubePrepare
-	precheck.CudaCheckTask
-	FailOnNoInstallation bool
 }
 
 func (p *CudaInstalled) PreCheck(runtime connector.Runtime) (bool, error) {
-	err := p.CudaCheckTask.Execute(runtime)
+	st, err := utils.GetNvidiaStatus(runtime)
 	if err != nil {
-		if err == precheck.ErrCudaInstalled {
-			return true, nil
-		}
 		return false, err
 	}
-	return false, nil
+	if st == nil || !st.Installed {
+		return false, nil
+	}
+
+	return true, nil
 }
 
 type CudaNotInstalled struct {
 	common.KubePrepare
-	precheck.CudaCheckTask
 }
 
 func (p *CudaNotInstalled) PreCheck(runtime connector.Runtime) (bool, error) {
-	err := p.CudaCheckTask.Execute(runtime)
+	st, err := utils.GetNvidiaStatus(runtime)
 	if err != nil {
-		if err == precheck.ErrCudaInstalled {
-			return false, nil
-		}
 		return false, err
 	}
-	return true, nil
+	if st == nil || !st.Installed {
+		return true, nil
+	}
+	return false, nil
 }
 
 type K8sNodeInstalled struct {
@@ -97,9 +97,6 @@ type NvidiaGraphicsCard struct {
 }
 
 func (p *NvidiaGraphicsCard) PreCheck(runtime connector.Runtime) (found bool, err error) {
-	if runtime.RemoteHost().GetOs() == common.Darwin {
-		return false, nil
-	}
 	defer func() {
 		if !p.ExitOnNotFound {
 			return
@@ -109,20 +106,15 @@ func (p *NvidiaGraphicsCard) PreCheck(runtime connector.Runtime) (found bool, er
 			os.Exit(1)
 		}
 	}()
-	output, err := runtime.GetRunner().SudoCmd(
-		"lspci | grep -i -e vga -e 3d | grep -i nvidia", false, false)
-	// an empty grep also results in the exit code to be 1
-	// and thus a non-nil err
+	model, _, err := utils.DetectNvidiaModelAndArch(runtime)
 	if err != nil {
-		logger.Debug("try to find nvidia graphics card error ", err)
-		logger.Debug("ignore card driver installation")
+		logger.Debugf("detect NVIDIA GPU error: %v", err)
+	}
+	if strings.TrimSpace(model) == "" {
 		return false, nil
 	}
-
-	if output != "" {
-		logger.Info("found nvidia graphics card: ", output)
-	}
-	return output != "", nil
+	logger.Infof("found NVIDIA GPU: %s", model)
+	return true, nil
 }
 
 type ContainerdInstalled struct {

cli/pkg/gpu/tasks.go

@@ -10,11 +10,8 @@ import (
 	"strings"
 	"time"
 
-	"github.com/Masterminds/semver/v3"
-	"github.com/beclab/Olares/cli/apis/kubekey/v1alpha2"
 	ctrl "sigs.k8s.io/controller-runtime"
 
-	"github.com/beclab/Olares/cli/pkg/bootstrap/precheck"
 	"github.com/beclab/Olares/cli/pkg/clientset"
 	"github.com/beclab/Olares/cli/pkg/common"
 	cc "github.com/beclab/Olares/cli/pkg/core/common"
@@ -39,10 +36,7 @@ type CheckWslGPU struct {
 
 func (t *CheckWslGPU) CheckNvidiaSmiFileExists() bool {
 	var nvidiaSmiFile = "/usr/lib/wsl/lib/nvidia-smi"
-	if !util.IsExist(nvidiaSmiFile) {
-		return false
-	}
-	return true
+	return util.IsExist(nvidiaSmiFile)
 }
 
 func (t *CheckWslGPU) Execute(runtime *common.KubeRuntime) {
@@ -66,88 +60,41 @@ func (t *CheckWslGPU) Execute(runtime *common.KubeRuntime) {
 	runtime.Arg.SetGPU(true)
 }
 
-type InstallCudaDeps struct {
+type InstallCudaDriver struct {
 	common.KubeAction
 	manifest.ManifestAction
 }
 
-func (t *InstallCudaDeps) Execute(runtime connector.Runtime) error {
-	var systemInfo = runtime.GetSystemInfo()
-	var cudaKeyringVersion string
-	var osVersion string
-	switch {
-	case systemInfo.IsUbuntu():
-		cudaKeyringVersion = v1alpha2.CudaKeyringVersion1_0
-		if systemInfo.IsUbuntuVersionEqual(connector.Ubuntu24) {
-			cudaKeyringVersion = v1alpha2.CudaKeyringVersion1_1
-			osVersion = "24.04"
-		} else if systemInfo.IsUbuntuVersionEqual(connector.Ubuntu22) {
-			osVersion = "22.04"
-		} else {
-			osVersion = "20.04"
-		}
-	case systemInfo.IsDebian():
-		cudaKeyringVersion = v1alpha2.CudaKeyringVersion1_1
-		if systemInfo.IsDebianVersionEqual(connector.Debian12) {
-			osVersion = connector.Debian12.String()
-		} else {
-			osVersion = connector.Debian11.String()
-		}
+func (t *InstallCudaDriver) Execute(runtime connector.Runtime) error {
+	_, _ = runtime.GetRunner().SudoCmd("apt-get update", false, true)
+	// install build deps for dkms
+	if _, err := runtime.GetRunner().SudoCmd("DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends dkms build-essential linux-headers-$(uname -r)", false, true); err != nil {
+		return errors.Wrap(errors.WithStack(err), "failed to install kernel build dependencies for nvidia runfile")
 	}
-	var fileId = fmt.Sprintf("%s-%s_cuda-keyring_%s-1",
-		strings.ToLower(systemInfo.GetOsPlatformFamily()), osVersion, cudaKeyringVersion)
 
-	cudakeyring, err := t.Manifest.Get(fileId)
+	// fetch runfile from manifest
+	item, err := t.Manifest.Get("cuda-driver")
 	if err != nil {
 		return err
 	}
-
-	path := cudakeyring.FilePath(t.BaseDir)
-	var exists = util.IsExist(path)
-	if !exists {
-		return fmt.Errorf("Failed to find %s binary in %s", cudakeyring.Filename, path)
+	runfile := item.FilePath(t.BaseDir)
+	if !util.IsExist(runfile) {
+		return fmt.Errorf("failed to find %s binary in %s", item.Filename, runfile)
 	}
-
-	if _, err := runtime.GetRunner().SudoCmd(fmt.Sprintf("dpkg -i --force all %s", path), false, true); err != nil {
-		return err
+	if _, err := runtime.GetRunner().SudoCmd(fmt.Sprintf("chmod +x %s", runfile), false, true); err != nil {
+		return errors.Wrap(errors.WithStack(err), "failed to chmod +x runfile")
 	}
-
-	return nil
-}
-
-type InstallCudaDriver struct {
-	common.KubeAction
-
-	SkipNVMLCheckAfterInstall bool
-}
-
-func (t *InstallCudaDriver) Execute(runtime connector.Runtime) error {
-	if _, err := runtime.GetRunner().SudoCmd("apt-get update", false, true); err != nil {
-		return errors.Wrap(errors.WithStack(err), "Failed to apt-get update")
-	}
-
-	if runtime.GetSystemInfo().IsDebian() {
-		_, err := runtime.GetRunner().SudoCmd("apt-get -y install nvidia-open", false, true)
-		return errors.Wrap(err, "failed to apt-get install nvidia-open")
-	}
-
-	if _, err := runtime.GetRunner().SudoCmd("apt-get -y install nvidia-kernel-open-575", false, true); err != nil {
-		return errors.Wrap(errors.WithStack(err), "Failed to apt-get install nvidia-kernel-open-575")
-	}
-
-	if t.SkipNVMLCheckAfterInstall {
-		return nil
+	// execute runfile with required flags
+	cmd := fmt.Sprintf("sh %s -z --no-x-check --allow-installation-with-running-driver --no-check-for-alternate-installs --dkms --rebuild-initramfs -s", runfile)
+	if _, err := runtime.GetRunner().SudoCmd(cmd, false, true); err != nil {
+		return errors.Wrap(errors.WithStack(err), "failed to install nvidia driver via runfile")
 	}
 
 	// now that the nvidia driver is installed,
 	// the nvidia-smi should work correctly,
 	// if not, a manual reboot is needed by the user
-	_, installed, err := utils.ExecNvidiaSmi(runtime)
-	if err != nil {
-		return fmt.Errorf("failed to check nvidia driver status by executing nvidia-smi: %v", err)
-	}
-
-	if !installed {
+	st, err := utils.GetNvidiaStatus(runtime)
+	if err != nil || st == nil || !st.Installed || st.Mismatch {
 		logger.Error("ERROR: nvidia driver has been installed, but is not running properly, please reboot the machine and try again")
 		os.Exit(1)
 	}
@@ -170,10 +117,14 @@ func (t *UpdateNvidiaContainerToolkitSource) Execute(runtime connector.Runtime)
 	keyPath := gpgkey.FilePath(t.BaseDir)
 
 	if !util.IsExist(keyPath) {
-		return fmt.Errorf("Failed to find %s binary in %s", gpgkey.Filename, keyPath)
+		return fmt.Errorf("failed to find %s binary in %s", gpgkey.Filename, keyPath)
 	}
 
-	cmd = fmt.Sprintf("apt-key add %s", keyPath)
+	if _, err := runtime.GetRunner().SudoCmd("install -d -m 0755 /usr/share/keyrings", false, true); err != nil {
+		return err
+	}
+	keyringPath := "/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg"
+	cmd = fmt.Sprintf("gpg --batch --yes --dearmor -o %s %s", keyringPath, keyPath)
 	if _, err := runtime.GetRunner().SudoCmd(cmd, false, true); err != nil {
 		return err
 	}
@@ -186,7 +137,7 @@ func (t *UpdateNvidiaContainerToolkitSource) Execute(runtime connector.Runtime)
 	libPath := libnvidia.FilePath(t.BaseDir)
 
 	if !util.IsExist(libPath) {
-		return fmt.Errorf("Failed to find %s binary in %s", libnvidia.Filename, libPath)
+		return fmt.Errorf("failed to find %s binary in %s", libnvidia.Filename, libPath)
 	}
 
 	// remove any conflicting libnvidia-container.list
@@ -201,19 +152,34 @@ func (t *UpdateNvidiaContainerToolkitSource) Execute(runtime connector.Runtime)
 		return err
 	}
 
-	mirrorRepo := os.Getenv(common.ENV_NVIDIA_CONTAINER_REPO_MIRROR)
-	if mirrorRepo == "" {
+	if _, err := runtime.GetRunner().SudoCmd(fmt.Sprintf("sed -i 's#^deb https://#deb [signed-by=%s] https://#' %s", keyringPath, dstPath), false, true); err != nil {
+		return err
+	}
+
+	// decide mirror based on OLARES_SYSTEM_CDN_SERVICE
+	var mirrorHost string
+	cdnService := os.Getenv(common.ENV_OLARES_CDN_SERVICE)
+	if cdnService != "" {
+		cdnRaw := cdnService
+		if !strings.HasPrefix(cdnRaw, "http") {
+			cdnRaw = "https://" + cdnRaw
+		}
+		if cdnURL, err := url.Parse(cdnRaw); err == nil {
+			host := cdnURL.Host
+			if host == "" {
+				host = cdnService
+			}
+			if strings.HasSuffix(host, "olares.cn") {
+				mirrorHost = "mirrors.ustc.edu.cn"
+			}
+		} else if strings.HasSuffix(cdnService, "olares.cn") {
+			mirrorHost = "mirrors.ustc.edu.cn"
+		}
+	}
+	if mirrorHost == "" {
 		return nil
 	}
-	mirrorRepoRawURL := mirrorRepo
-	if !strings.HasPrefix(mirrorRepoRawURL, "http") {
-		mirrorRepoRawURL = "https://" + mirrorRepoRawURL
-	}
-	mirrorRepoURL, err := url.Parse(mirrorRepoRawURL)
-	if err != nil || mirrorRepoURL.Host == "" {
-		return fmt.Errorf("invalid mirror for nvidia container: %s", mirrorRepo)
-	}
-	cmd = fmt.Sprintf("sed -i 's#nvidia.github.io#%s#g' %s", mirrorRepoURL.Host, dstPath)
+	cmd = fmt.Sprintf("sed -i 's#nvidia.github.io#%s#g' %s", mirrorHost, dstPath)
 	if _, err := runtime.GetRunner().SudoCmd(cmd, false, false); err != nil {
 		return errors.Wrap(errors.WithStack(err), "failed to switch nvidia container repo to mirror site")
 	}
@@ -225,9 +191,21 @@ type InstallNvidiaContainerToolkit struct {
 }
 
 func (t *InstallNvidiaContainerToolkit) Execute(runtime connector.Runtime) error {
+	containerdDropInDir := "/etc/containerd/config.d"
+	containerdConfigFile := "/etc/containerd/config.toml"
+	if util.IsExist(containerdDropInDir) {
+		if err := os.RemoveAll(containerdDropInDir); err != nil {
+			return errors.Wrap(errors.WithStack(err), "Failed to remove containerd drop-in directory")
+		}
+	}
+	if util.IsExist(containerdConfigFile) {
+		if _, err := runtime.GetRunner().SudoCmd(fmt.Sprintf("sed -i '/^import/d' %s", containerdConfigFile), false, false); err != nil {
+			return errors.Wrap(errors.WithStack(err), "Failed to remove import section from containerd config file")
+		}
+	}
 	logger.Debugf("install nvidia-container-toolkit")
-	if _, err := runtime.GetRunner().SudoCmd("apt-get update && sudo apt-get install -y nvidia-container-toolkit jq", false, true); err != nil {
-		return errors.Wrap(errors.WithStack(err), "Failed to apt-get install nvidia-container-toolkit")
+	if _, err := runtime.GetRunner().SudoCmd("apt-get update && sudo apt-get install -y --allow-downgrades nvidia-container-toolkit=1.17.9-1 nvidia-container-toolkit-base=1.17.9-1 jq", false, true); err != nil {
+		return errors.Wrap(errors.WithStack(err), "failed to apt-get install nvidia-container-toolkit")
 	}
 	return nil
 }
@@ -374,7 +352,7 @@ func (g *GetCudaVersion) Execute(runtime connector.Runtime) error {
 
 	lines := strings.Split(res, "\n")
 
-	if lines == nil || len(lines) == 0 {
+	if len(lines) == 0 {
 		return nil
 	}
 	for _, line := range lines {
@@ -387,7 +365,7 @@ func (g *GetCudaVersion) Execute(runtime connector.Runtime) error {
 		}
 	}
 	if cudaVersion != "" {
-		common.TerminusGlobalEnvs["CUDA_VERSION"] = cudaVersion
+		common.SetSystemEnv("OLARES_SYSTEM_CUDA_VERSION", cudaVersion)
 	}
 
 	return nil
@@ -395,7 +373,6 @@ func (g *GetCudaVersion) Execute(runtime connector.Runtime) error {
 
 type UpdateNodeLabels struct {
 	common.KubeAction
-	precheck.CudaCheckTask
 }
 
 func (u *UpdateNodeLabels) Execute(runtime connector.Runtime) error {
@@ -404,32 +381,26 @@ func (u *UpdateNodeLabels) Execute(runtime connector.Runtime) error {
 		return errors.Wrap(errors.WithStack(err), "kubeclient create error")
 	}
 
-	gpuInfo, installed, err := utils.ExecNvidiaSmi(runtime)
+	st, err := utils.GetNvidiaStatus(runtime)
 	if err != nil {
 		return err
 	}
-
-	if !installed {
-		logger.Info("nvidia-smi not exists")
+	if st == nil || !st.Installed {
+		logger.Info("NVIDIA driver is not installed")
 		return nil
 	}
 
 	supported := "false"
-
-	err = u.CudaCheckTask.Execute(runtime)
-	switch {
-	case err == precheck.ErrCudaInstalled:
+	if st.Installed {
 		supported = "true"
-	case err == precheck.ErrUnsupportedCudaVersion:
-		// bypass
-	case err != nil:
-		return err
-	case err == nil:
-		// impossible
-		logger.Warn("check impossible")
 	}
 
-	return UpdateNodeGpuLabel(context.Background(), client.Kubernetes(), &gpuInfo.DriverVersion, &gpuInfo.CudaVersion, &supported)
+	driverVersion := st.DriverVersion
+	if st.Mismatch && st.LibraryVersion != "" {
+		driverVersion = st.LibraryVersion
+	}
+
+	return UpdateNodeGpuLabel(context.Background(), client.Kubernetes(), &driverVersion, &st.CudaVersion, &supported)
 }
 
 type RemoveNodeLabels struct {
@@ -578,16 +549,44 @@ type UninstallNvidiaDrivers struct {
 }
 
 func (t *UninstallNvidiaDrivers) Execute(runtime connector.Runtime) error {
-
-	if _, err := runtime.GetRunner().SudoCmd("apt-get -y remove nvidia*", false, true); err != nil {
-		return errors.Wrap(errors.WithStack(err), "Failed to apt-get remove nvidia*")
+	_, _ = runtime.GetRunner().SudoCmd("DEBIAN_FRONTEND=noninteractive apt-get -y autoremove --purge", false, true)
+	_, _ = runtime.GetRunner().SudoCmd("dpkg --configure -a || true", false, true)
+	listCmd := "dpkg -l | awk '/^(ii|i[UuFHWt]|rc|..R)/ {print $2}' | grep nvidia | grep -v container"
+	pkgs, _ := runtime.GetRunner().SudoCmd(listCmd, false, false)
+	pkgs = strings.ReplaceAll(pkgs, "\n", " ")
+	pkgs = strings.TrimSpace(pkgs)
+	if pkgs != "" {
+		removeCmd := fmt.Sprintf("DEBIAN_FRONTEND=noninteractive apt-get -y --auto-remove --purge remove %s", pkgs)
+		if _, err := runtime.GetRunner().SudoCmd(removeCmd, false, true); err != nil {
+			return errors.Wrap(errors.WithStack(err), "failed to remove nvidia packages via apt-get")
+		}
+		_, _ = runtime.GetRunner().SudoCmd("DEBIAN_FRONTEND=noninteractive apt-get -y autoremove --purge", false, true)
 	}
 
-	if _, err := runtime.GetRunner().SudoCmd("apt-get -y remove libnvidia*", false, true); err != nil {
-		return errors.Wrap(errors.WithStack(err), "Failed to apt-get remove libnvidia*")
+	// also try to uninstall runfile-installed drivers if present
+	if out, _ := runtime.GetRunner().SudoCmd("test -x /usr/bin/nvidia-uninstall && echo yes || true", false, false); strings.TrimSpace(out) == "yes" {
+		if _, err := runtime.GetRunner().SudoCmd("/usr/bin/nvidia-uninstall -s", false, true); err != nil {
+			return errors.Wrap(errors.WithStack(err), "failed to uninstall NVIDIA driver via nvidia-uninstall")
+		}
+	} else if out2, _ := runtime.GetRunner().SudoCmd("test -x /usr/bin/nvidia-installer && echo yes || true", false, false); strings.TrimSpace(out2) == "yes" {
+		if _, err := runtime.GetRunner().SudoCmd("/usr/bin/nvidia-installer --uninstall -s", false, true); err != nil {
+			return errors.Wrap(errors.WithStack(err), "failed to uninstall NVIDIA driver via nvidia-installer --uninstall")
+		}
+	}
+
+	// clean up any leftover dkms-installed kernel modules for nvidia if present
+	// only remove .ko files under updates/dkms to avoid removing other modules
+	checkLeftoverCmd := "sh -c 'test -d /lib/modules/$(uname -r)/updates/dkms && find /lib/modules/$(uname -r)/updates/dkms -maxdepth 1 -type f -name \"nvidia*.ko\" -print -quit | grep -q . && echo yes || true'"
+	if out, _ := runtime.GetRunner().SudoCmd(checkLeftoverCmd, false, false); strings.TrimSpace(out) == "yes" {
+		if _, err := runtime.GetRunner().SudoCmd("find /lib/modules/$(uname -r)/updates/dkms -maxdepth 1 -type f -name 'nvidia*.ko' -print -delete", false, true); err != nil {
+			return errors.Wrap(errors.WithStack(err), "Failed to remove leftover nvidia dkms kernel modules")
+		}
+		// refresh module dependency maps
+		if _, err := runtime.GetRunner().SudoCmd("depmod -a $(uname -r)", false, true); err != nil {
+			logger.Error("Failed to refresh module dependency maps: ", err)
+		}
 	}
 
-	logger.Infof("uninstall nvidia drivers success, please reboot the system to take effect if you reinstall the new nvidia drivers")
 	return nil
 }
 
@@ -596,19 +595,43 @@ type PrintGpuStatus struct {
 }
 
 func (t *PrintGpuStatus) Execute(runtime connector.Runtime) error {
-	gpuInfo, installed, err := utils.ExecNvidiaSmi(runtime)
+	st, err := utils.GetNvidiaStatus(runtime)
 	if err != nil {
 		return err
 	}
-
-	if !installed {
-		logger.Info("cuda not exists")
+	if st == nil {
+		logger.Info("no NVIDIA GPU status available")
 		return nil
 	}
-
-	logger.Infof("GPU Driver Version: %s", gpuInfo.DriverVersion)
-	logger.Infof("CUDA Version: %s", gpuInfo.CudaVersion)
-
+	// basic status
+	logger.Infof("Installed: %t", st.Installed)
+	if st.Installed {
+		logger.Infof("Install method: %s", st.InstallMethod)
+	}
+	logger.Infof("Running: %t", st.Running)
+	// running (kernel) driver version
+	if st.Running && strings.TrimSpace(st.DriverVersion) != "" {
+		logger.Infof("Running driver version (kernel): %s", st.DriverVersion)
+	}
+	// userland info from nvidia-smi (when available)
+	if st.Installed {
+		if st.Info != nil && strings.TrimSpace(st.Info.DriverVersion) != "" {
+			logger.Infof("Installed driver version (nvidia-smi): %s", st.Info.DriverVersion)
+		}
+		if strings.TrimSpace(st.CudaVersion) != "" {
+			logger.Infof("CUDA version (nvidia-smi): %s", st.CudaVersion)
+		}
+		if st.Mismatch {
+			if strings.TrimSpace(st.LibraryVersion) != "" {
+				logger.Warnf("Driver/library version mismatch, NVML library version: %s", st.LibraryVersion)
+			} else {
+				logger.Warn("Driver/library version mismatch detected")
+			}
+		}
+	}
+	if !st.Installed && !st.Running {
+		logger.Info("no NVIDIA driver detected (neither installed nor running)")
+	}
 	return nil
 }
 
@@ -680,31 +703,35 @@ func (t *RestartPlugin) Execute(runtime connector.Runtime) error {
 	return nil
 }
 
-type ExitIfNoDriverUpgradeNeeded struct {
+type WriteNouveauBlacklist struct {
 	common.KubeAction
 }
 
-func (t *ExitIfNoDriverUpgradeNeeded) Execute(runtime connector.Runtime) error {
-	gpuInfo, installed, err := utils.ExecNvidiaSmi(runtime)
-	if err != nil {
-		logger.Warn("error checking whether the GPU need upgrade:")
-		logger.Warn(err.Error())
-		logger.Warn("assuming an upgrade is needed and continue upgrading")
+func (t *WriteNouveauBlacklist) Execute(runtime connector.Runtime) error {
+	if !runtime.GetSystemInfo().IsLinux() {
 		return nil
 	}
-	if !installed {
-		logger.Info("GPU driver not installed, will just install it")
-		return nil
+	const dir = "/usr/lib/modprobe.d"
+	const dst = "/usr/lib/modprobe.d/olares-disable-nouveau.conf"
+	const content = "blacklist nouveau\nblacklist lbm-nouveau\nalias nouveau off\nalias lbm-nouveau off\n"
+
+	if _, err := runtime.GetRunner().SudoCmd("install -d -m 0755 "+dir, false, true); err != nil {
+		return errors.Wrap(errors.WithStack(err), "failed to ensure /usr/lib/modprobe.d exists")
 	}
-	installedVersion, err := semver.NewVersion(gpuInfo.CudaVersion)
-	if err != nil {
-		logger.Warn("error parsing the current CUDA version of GPU driver \"%s\": %v", gpuInfo.CudaVersion, err)
-		logger.Warn("assuming an upgrade is needed and continue installing")
-		return nil
+
+	tmpPath := path.Join(runtime.GetBaseDir(), cc.PackageCacheDir, "gpu", "olares-disable-nouveau.conf")
+	if err := os.MkdirAll(path.Dir(tmpPath), 0755); err != nil {
+		return errors.Wrap(errors.WithStack(err), "failed to create temp dir for nouveau blacklist")
 	}
-	targetVersion, _ := semver.NewVersion(common.CurrentVerifiedCudaVersion)
-	if !targetVersion.GreaterThan(installedVersion) {
-		logger.Info("current GPU driver version is up to date, no need to upgrade")
+	if err := util.WriteFile(tmpPath, []byte(content), 0644); err != nil {
+		return errors.Wrap(errors.WithStack(err), "failed to write temp nouveau blacklist file")
+	}
+	if err := runtime.GetRunner().SudoScp(tmpPath, dst); err != nil {
+		return errors.Wrap(errors.WithStack(err), "failed to install nouveau blacklist file")
+	}
+
+	if out, _ := runtime.GetRunner().SudoCmd("test -d /sys/module/nouveau && echo loaded || true", false, false); strings.TrimSpace(out) == "loaded" {
+		logger.Infof("the disable file for nouveau kernel module has been written, but the nouveau kernel module is currently loaded. Please REBOOT your machine to make the disabling effective.")
 		os.Exit(0)
 	}
 	return nil

cli/pkg/k3s/tasks.go

@@ -202,12 +202,17 @@ func (g *GenerateK3sService) Execute(runtime connector.Runtime) error {
 		"runtime-request-timeout": "5m",
 		"image-gc-high-threshold": "91",
 		"image-gc-low-threshold":  "90",
+		"housekeeping_interval":   "5s",
 	}
 	defaultKubeProxyArgs := map[string]string{
 		"proxy-mode": "ipvs",
 	}
 
-	kubeApiserverArgs, _ := util.GetArgs(map[string]string{}, g.KubeConf.Cluster.Kubernetes.ApiServerArgs)
+	defaultKubeApiServerArgs := map[string]string{
+		"service-node-port-range": "445-32767",
+	}
+
+	kubeApiserverArgs, _ := util.GetArgs(defaultKubeApiServerArgs, g.KubeConf.Cluster.Kubernetes.ApiServerArgs)
 	kubeControllerManager, _ := util.GetArgs(map[string]string{
 		"terminated-pod-gc-threshold": "1",
 	}, g.KubeConf.Cluster.Kubernetes.ControllerManagerArgs)

cli/pkg/kubernetes/templates/v1beta2/kubeadm_config.go

@@ -162,17 +162,19 @@ var (
 	}
 
 	ApiServerArgs = map[string]string{
-		"bind-address":        "0.0.0.0",
-		"audit-log-maxage":    "30",
-		"audit-log-maxbackup": "10",
-		"audit-log-maxsize":   "100",
+		"bind-address":            "0.0.0.0",
+		"audit-log-maxage":        "30",
+		"audit-log-maxbackup":     "10",
+		"audit-log-maxsize":       "100",
+		"service-node-port-range": "445-32767",
 	}
 	ApiServerSecurityArgs = map[string]string{
-		"bind-address":        "0.0.0.0",
-		"audit-log-maxage":    "30",
-		"audit-log-maxbackup": "10",
-		"audit-log-maxsize":   "100",
-		"authorization-mode":  "Node,RBAC",
+		"bind-address":            "0.0.0.0",
+		"audit-log-maxage":        "30",
+		"audit-log-maxbackup":     "10",
+		"audit-log-maxsize":       "100",
+		"service-node-port-range": "445-32767",
+		"authorization-mode":      "Node,RBAC",
 		// --enable-admission-plugins=EventRateLimit must have a configuration file
 		"enable-admission-plugins": "AlwaysPullImages,ServiceAccount,NamespaceLifecycle,NodeRestriction,LimitRanger,ResourceQuota,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,PodNodeSelector,PodSecurity",
 		// "audit-log-path":      "/var/log/apiserver/audit.log", // need audit policy

cli/pkg/kubesphere/plugins/assets_vfsdata.go

@@ -44,14 +44,14 @@ var assets = func() http.FileSystem {
 		},
 		"/build/ks-config/templates": &vfsgen۰DirInfo{
 			name:    "templates",
-			modTime: time.Date(2025, 7, 31, 8, 50, 53, 949729535, time.UTC),
+			modTime: time.Date(2025, 11, 17, 9, 8, 56, 269518280, time.UTC),
 		},
 		"/build/ks-config/templates/kubesphere-config.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "kubesphere-config.yaml",
-			modTime:          time.Date(2025, 7, 31, 8, 50, 53, 949762785, time.UTC),
-			uncompressedSize: 418,
+			modTime:          time.Date(2025, 11, 17, 9, 8, 56, 269634566, time.UTC),
+			uncompressedSize: 419,
 
-			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\x84\x90\xb1\x6a\xc3\x30\x10\x86\x77\x3d\xc5\xbd\x80\x1d\x87\x94\x82\x6f\xed\xd0\x29\xd0\xa5\xdd\x2f\xf6\xd9\x3e\x22\x9d\x84\x74\x36\x04\xfa\xf0\xa5\xc6\xa9\xd3\xa1\x74\x14\xdf\xaf\xff\xfb\x39\x4a\xf2\xc1\xb9\x48\x54\x84\xe5\xe8\xae\xa2\x3d\xc2\x4b\xd4\x41\xc6\x33\x25\x17\xd8\xa8\x27\x23\x74\x00\x4a\x81\x11\xae\xf3\x85\x4b\x9a\x38\x73\xd5\xad\xb1\x8d\x94\x44\xdd\x6f\x5c\x6e\xc5\x38\xb8\xfb\xf7\x9d\xd4\x37\x0a\x1e\xe1\xd3\x01\x00\x84\xa8\x62\x31\x8b\x8e\xb8\xbe\x01\x58\xfb\x14\x45\x0d\x61\x32\x4b\x78\x38\xa4\x1c\x03\xdb\xc4\x73\xa9\x62\xe2\x4c\xc6\x7d\xfd\xe0\xd9\x1b\x36\x65\x5d\x96\x0e\xdb\xa6\x6d\x7e\x0a\xe9\xe2\xf9\xf5\xed\xfd\xbc\xbb\x60\x20\x5f\x78\x0d\x68\x34\x19\xa4\x23\xfb\x3e\xc2\x5f\x1b\x1e\x43\x55\x20\xa5\x91\x73\x55\x96\xee\xff\x21\xc7\xb6\x69\x4f\x6b\xad\x71\x0e\xa2\xe4\xef\x12\x09\x34\x32\x02\xf9\x24\xca\x78\xaa\x8f\x4f\x1b\x30\x09\x1c\x67\x43\x78\x6e\x1a\xf7\x15\x00\x00\xff\xff\xa8\x81\xab\xba\xa2\x01\x00\x00"),
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\x84\x90\xc1\x6a\x83\x40\x10\x86\xef\xfb\x14\xf3\x02\x1a\x6d\x0a\xc5\xb9\xf6\xd0\x53\xa0\x97\xf6\x3e\xd1\x51\x87\xb8\xb3\xcb\xee\x28\x04\xfa\xf0\xa5\x62\x6a\x7a\x28\x39\x2e\xdf\xbf\xff\xf7\x33\x14\xe5\x93\x53\x96\xa0\x08\x4b\xed\x2e\xa2\x1d\xc2\x6b\xd0\x5e\x86\x13\x45\xe7\xd9\xa8\x23\x23\x74\x00\x4a\x9e\x11\x2e\xf3\x99\x73\x1c\x39\x71\xd1\xae\xb1\x8d\xe4\x48\xed\x5f\x9c\xaf\xd9\xd8\xbb\xdb\xf7\x9d\x94\x57\xf2\x13\xc2\x97\x03\x00\xf0\x41\xc5\x42\x12\x1d\x70\x7d\x03\xb0\x76\x31\x88\x1a\xc2\x68\x16\xf1\x70\x88\x29\x78\xb6\x91\xe7\x5c\x84\xc8\x89\x8c\xbb\xf2\xce\xb3\x37\x6c\xca\x32\x2f\x2d\x36\x55\x53\xfd\x16\xd2\x79\xe2\xb7\xf7\x8f\xd3\xee\x82\x9e\xa6\xcc\x6b\x40\x83\x49\x2f\x2d\xd9\xcf\x11\xfe\xdb\x70\x1f\x2a\x3c\x29\x0d\x9c\x8a\xbc\xb4\x8f\x87\xd4\x4d\xd5\x1c\xd7\x5a\xe3\xe4\x45\x69\xba\x49\xc4\xd3\xc0\x08\x34\x45\x51\xc6\x63\x59\x3f\x6f\xc0\xc4\x73\x98\x0d\xe1\xe5\xa9\xaa\xdc\x77\x00\x00\x00\xff\xff\x8a\xb9\xa0\x58\xa3\x01\x00\x00"),
 		},
 		"/build/ks-config/values.yaml": &vfsgen۰FileInfo{
 			name:    "values.yaml",
@@ -78,7 +78,7 @@ var assets = func() http.FileSystem {
 		},
 		"/build/ks-core/templates": &vfsgen۰DirInfo{
 			name:    "templates",
-			modTime: time.Date(2025, 9, 1, 13, 42, 27, 989256018, time.UTC),
+			modTime: time.Date(2025, 11, 20, 6, 44, 5, 165722497, time.UTC),
 		},
 		"/build/ks-core/templates/NOTES.txt": &vfsgen۰FileInfo{
 			name:    "NOTES.txt",
@@ -94,10 +94,10 @@ var assets = func() http.FileSystem {
 		},
 		"/build/ks-core/templates/ks-apiserver.yml": &vfsgen۰CompressedFileInfo{
 			name:             "ks-apiserver.yml",
-			modTime:          time.Date(2025, 9, 1, 13, 42, 27, 989212726, time.UTC),
-			uncompressedSize: 3060,
+			modTime:          time.Date(2025, 11, 20, 6, 44, 5, 165886081, time.UTC),
+			uncompressedSize: 3111,
 
-			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xbc\x56\x4d\x6f\xe3\x36\x13\xbe\xeb\x57\x0c\xf2\x9e\x25\x3b\xc1\xbe\x45\x96\x40\x0f\x41\xb2\x68\x83\x36\xad\x11\xa7\x01\x7a\xa4\xc9\xb1\x44\x98\x22\x59\x72\xe4\x46\x70\xf7\xbf\x17\xb4\x6c\x99\xb2\x94\xd4\xc5\x02\xd5\x49\x98\xe1\x7c\x3d\x33\xf3\x90\xdc\xa9\x57\xf4\x41\x59\xc3\x80\x3b\x17\x66\xdb\xeb\x6c\xa3\x8c\x64\xf0\x80\x4e\xdb\xb6\x46\x43\x59\x8d\xc4\x25\x27\xce\x32\x00\xcd\x57\xa8\x43\xfc\x83\x68\xc0\x60\x13\x72\xee\x54\x40\xbf\x45\xbf\x97\x92\x42\xcf\x60\xc5\xc5\x06\x8d\xdc\x4b\xb6\xc7\x08\xbb\x1d\x14\xf7\x15\xf7\x54\xdc\x39\x77\x88\x0b\x5f\xbf\x66\x00\x86\xd7\x78\xe6\x2b\x38\x14\x31\x4e\x20\xcf\x09\xcb\xb6\x8b\xe9\xad\xd6\xca\x94\xbf\x39\xc9\x09\x3b\x11\x40\xcd\xdf\x96\x8d\x2f\x91\xc1\xbc\x4b\xa1\x75\xc8\xe0\x39\x3d\x9a\x01\x78\x74\x5a\x09\x1e\xba\x3c\x9e\x51\x23\x0f\x58\x3c\x77\xd2\x7b\xdb\x18\xea\x72\x09\xa8\x51\x90\xf5\x9d\xf7\x9a\x93\xa8\x7e\x4e\xaa\x7e\xaf\xee\xa9\xca\x01\xfe\x77\x49\xf5\x84\xb5\xd3\x7d\x3d\x29\xdc\xf1\xd3\x83\xe0\xef\x87\x9f\x4e\xe0\xc2\x14\x00\x8e\x78\xc7\x6f\xb7\xcb\xe1\x4f\x45\x15\x14\xaf\x5c\x37\x18\x0a\x55\xf3\x12\x17\x8d\xd6\x4b\x14\x1e\x29\x1c\x8d\x00\xce\x35\xa7\x3c\xa3\x13\xb2\xbf\xf3\x5a\x43\x01\x7f\x81\x51\x46\xa2\x21\xb8\x3d\xd9\xc6\x13\x68\xe4\x49\x20\xac\x21\xae\x0c\xfa\xde\x4d\x0e\xc2\xd6\x35\x37\xf2\xe4\x37\x9f\x2e\x3e\x87\x3c\xd7\xb6\x24\x1b\x48\xa2\xf7\xdf\x93\x6f\xb0\x57\xee\xb3\x64\xb0\x42\xa1\xf9\x6a\x96\xda\xb3\x79\x31\x2f\x6e\x3e\x0d\x4f\xc6\x7a\x16\x56\x2b\xd1\x76\x98\xa5\x28\x14\xae\x57\x9e\x12\x9f\x9c\xe0\xa3\xca\x59\x9f\xe2\x92\x9f\xca\x5c\x58\x4f\x0c\x3e\xcf\x3f\xcf\x7b\x2d\x80\xf3\x96\xac\xb0\x9a\xc1\xcb\xfd\xa2\x97\x7b\x0c\xb6\xf1\x02\x13\x47\x43\x88\x0f\x39\xf6\xe1\x8b\xde\x22\x01\xff\xfa\x26\xcd\x79\x6b\x75\x53\xe3\x53\x1c\xfd\x41\x7e\x75\x94\x2c\x38\x55\x0c\x66\x48\x62\xb6\x69\x56\x18\x5c\x85\x1e\x67\x49\xf0\x43\xc5\xbd\x2e\x17\xd6\xac\x55\xf9\x81\x1f\x6d\x05\xd7\xa4\x6a\x1c\x79\xa9\x6c\xa0\xfc\x4c\xe3\x91\xcb\x5f\x8d\x6e\x19\x0c\x5a\x19\x6b\x56\xeb\x89\x7a\xf1\x8d\x3c\x7f\x4d\x4a\x4a\x4b\xfd\x07\xac\xc6\xb6\x93\x03\x3b\x31\xb2\x00\x5a\x6d\xd1\x60\x08\x0b\x6f\x57\x98\x76\x67\xcd\x95\x6e\x3c\xbe\x54\x1e\x43\x65\xb5\x64\x70\x9b\x68\x2b\x22\xf7\x03\x52\x6a\x00\xe0\x3a\xb0\x36\x31\xb3\xd9\x61\x6d\x87\x07\xa6\x26\x06\x20\x88\x0a\x23\x8e\x3f\xbe\xbc\x2c\x12\x85\x32\x8a\x14\xd7\x0f\xa8\x79\xbb\x44\x61\x8d\x0c\x0c\xae\xff\x9f\x9c\x88\x98\xdb\x86\xc6\xca\x08\x8c\x12\x78\x27\x44\xc4\xe3\x97\x7d\x97\x76\x3b\x50\x46\xe8\x46\x22\x5c\x6d\x42\x2e\xac\xc7\x62\x7c\xee\x0a\x8a\xe1\x8a\x0f\x98\x84\xac\x46\xcf\x49\x59\x93\xf4\x27\x11\x7e\x13\x7f\x8c\xa2\x19\x2b\x71\x79\xe0\xf3\xd3\xb1\x54\xfa\x4d\xf1\xf8\x7a\x1d\x21\x6e\x59\xb2\xeb\xf2\xce\x90\xba\x1b\x29\xe2\x3c\xff\xd1\x28\x8f\xf2\xa1\xf1\xca\x94\x4b\x51\xa1\x6c\xe2\x05\xf5\x58\x1a\xdb\x8b\xbf\xbc\xa1\x68\x22\x10\xa9\x65\xcc\xcb\x59\x6d\xcb\xf6\x27\x6c\xbb\x95\xf3\x06\x29\x32\x92\x9d\xc5\xd5\x89\x4b\x34\x98\x87\xfd\x9d\x31\x2e\xf1\x78\x5d\x92\xa8\xbe\xbc\x39\x8f\x21\x0c\x21\xef\x09\x36\x86\xe1\xce\x9d\x29\x00\xac\x8b\x7d\xb2\x9e\xc1\xa3\x19\x29\xb7\x7b\xcc\xd9\x48\xfe\x0e\x61\x1f\xb7\x3f\x38\x2e\xce\xcd\xf2\x94\x57\x42\x1b\x08\xeb\x6c\xb2\xb9\x47\xa0\x07\x54\x9c\xc8\x59\xb6\xdb\xa5\x5d\x3d\xf2\xe0\x3c\x1a\x8c\xfa\xd9\x11\xe2\xe0\xf2\x89\x94\xf6\xc4\x5d\x9a\x9e\xc4\x35\x6f\x34\x3d\x59\x89\x0c\x3e\xdd\xcc\xff\x05\x27\x7e\xac\xcf\xf7\x3c\xb8\x27\xcc\x6c\xc4\x09\xef\x11\x68\xf7\xd8\xb9\xba\xca\x3e\x66\xd4\x4b\x68\x33\x0c\x99\xee\x22\xba\x4c\x99\xf2\xbb\xc9\x55\xc9\xf3\x3c\xcb\xd2\x87\x66\xff\xc6\x5c\x76\xdc\x31\x78\x60\x72\x63\x2c\xa5\x54\x30\x9c\x76\xe1\x91\x13\xca\x7c\xd5\xa6\x30\x46\xcd\xd9\x8c\xfd\xf7\x0f\xd5\xfe\x9a\xcf\x0f\x2c\x7d\xdb\x4d\xc6\xf8\x3e\x27\xee\x4b\xa4\xc1\xe5\x3f\x7c\x74\x5e\x9a\xf0\x65\xaf\xcb\xfd\x80\xdc\xeb\x26\x10\xfa\xc7\x45\xf6\x77\x00\x00\x00\xff\xff\x30\xa7\xa6\x88\xf4\x0b\x00\x00"),
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xbc\x56\xd1\x6e\xeb\x36\x0f\xbe\xf7\x53\x10\xf9\xaf\xed\xa4\xc5\xf9\x87\x1e\x03\xbb\x28\xd2\x83\xad\xd8\xba\x05\x4d\x57\x60\x97\x8c\xcc\xc4\x42\x64\x49\x93\xe8\xac\x46\x76\xde\x7d\x50\x9c\x38\x72\xec\x76\x19\x0e\x30\x5f\x19\xa4\x28\x92\x1f\xc9\x8f\x42\x2b\x5f\xc9\x79\x69\x74\x0e\x68\xad\x9f\xee\x6e\x92\xad\xd4\x45\x0e\x0f\x64\x95\x69\x2a\xd2\x9c\x54\xc4\x58\x20\x63\x9e\x00\x28\x5c\x91\xf2\xe1\x0f\x82\x41\x0e\x5b\x9f\xa2\x95\x9e\xdc\x8e\xdc\x41\xca\x92\x5c\x0e\x2b\x14\x5b\xd2\xc5\x41\xb2\x3b\x79\xd8\xef\x21\x9b\x97\xe8\x38\xbb\xb7\xf6\xe8\x17\xbe\x7e\x4d\x00\x34\x56\x74\x71\x97\xb7\x24\x82\x1f\xcf\x0e\x99\x36\x4d\xeb\xd3\x19\xa5\xa4\xde\xfc\x66\x0b\x64\x6a\x45\x00\x15\xbe\x2d\x6b\xb7\xa1\x1c\x66\x6d\x08\x8d\xa5\x1c\x9e\xe3\xa3\x09\x80\x23\xab\xa4\x40\xdf\xc6\xf1\x4c\x8a\xd0\x53\xf6\xdc\x4a\xe7\xa6\xd6\xdc\xc6\xe2\x49\x91\x60\xe3\xda\xdb\x2b\x64\x51\xfe\x1c\x65\xfd\x5e\xde\x63\x99\x03\xfc\xef\x9a\xec\x99\x2a\xab\xba\x7c\x62\xb8\xc3\xa7\x7a\xce\xdf\x77\x3f\x1e\xc0\x95\x21\x00\x9c\xf0\x0e\xdf\x7e\x9f\xc2\x9f\x92\x4b\xc8\x5e\x51\xd5\xe4\x33\x59\xe1\x86\x16\xb5\x52\x4b\x12\x8e\xd8\x9f\x8c\x00\x2e\x35\xe7\x38\xc3\x25\x6c\x7e\xc7\x4a\x41\x06\x7f\x81\x96\xba\x20\xcd\x70\x77\xb6\x0d\x27\x48\x17\x67\x81\x75\xd2\x38\xc9\xcd\x5c\xa1\xf7\xbf\x1c\x7a\x62\xe2\x1b\xcf\x54\xa5\x42\xd5\x9e\xc9\xa5\xc2\x49\x96\x02\xd5\xe4\x68\x22\x8c\x66\x94\x9a\x5c\xe7\x39\x05\x61\xaa\x0a\x75\x71\x0e\x25\x1d\xc7\x2b\x85\x34\x55\x66\xc3\xc6\x73\x41\xce\x7d\xcf\xae\xa6\x4e\x79\x48\x2c\x87\x15\x09\x85\xab\x69\x6c\x9f\xcf\xb2\x59\x76\xfb\xa9\x7f\x32\x40\xb0\x30\x4a\x8a\xa6\x85\x39\x06\x2e\xb3\x9d\xf2\x9c\xeb\x68\xd3\x9f\x54\xd6\xb8\x18\xca\xf4\x9c\xe6\xc2\x38\xce\xe1\xf3\xec\xf3\xac\xd3\x06\xdc\x0c\x1b\x61\x54\x0e\x2f\xf3\x45\x27\x77\xe4\x4d\xed\x04\x45\x17\xf5\xab\x72\x8c\xb1\x73\x9f\x75\x16\x51\xbd\x6e\x6e\xe3\x98\x77\x46\xd5\x15\x3d\x85\x69\xe9\xc5\x57\x05\xc9\x02\xb9\xcc\x61\x4a\x2c\xa6\xdb\x7a\x45\xde\x96\xe4\x68\x1a\x39\x3f\x66\xdc\xe9\x52\x61\xf4\x5a\x6e\x3e\xb8\x47\x19\x81\x8a\x65\x45\x83\x5b\x4a\xe3\x39\xbd\xd0\x38\xc2\xe2\x57\xad\x9a\x1c\x7a\xa5\x0c\x39\xcb\xf5\x48\xbe\xf4\xc6\x0e\x5f\xa3\x94\xe2\x54\xff\x01\xab\xa1\xed\x68\x8f\x8f\x74\x39\x80\x92\x3b\xd2\xe4\xfd\xc2\x99\x15\xc5\xd5\x59\xa3\x54\xb5\xa3\x97\xd2\x91\x2f\x8d\x2a\x72\xb8\x8b\xb4\x25\xb3\xfd\x81\x38\x36\x00\xb0\x2d\x58\xdb\x10\xd9\xf4\x38\xe9\xfd\x03\x63\x1d\x03\xe0\x45\x49\x01\xc7\x1f\x5f\x5e\x16\x91\x42\x6a\xc9\x12\xd5\x03\x29\x6c\x96\x24\x8c\x2e\x7c\x0e\x37\xff\x8f\x4e\x04\xcc\x4d\xcd\x43\x65\x00\x46\x0a\xba\x17\x22\xe0\xd1\x8e\xef\x7e\x0f\x52\x0b\x55\x17\x04\x93\xad\x4f\x85\x71\x94\x0d\xcf\x4d\x20\xeb\xb3\x42\x8f\x7c\xd8\x28\x72\xc8\xd2\xe8\xa8\x3e\x91\xf0\x9b\x28\x67\xe0\x4d\x9b\x82\x96\xc7\x15\x70\x3e\x16\x4b\xbf\xc9\x1f\xae\xd7\x01\xe2\x26\x8f\x66\xbd\xb8\xd7\x2c\xef\x07\x8a\xd0\xcf\x7f\xd4\xd2\x51\xf1\x50\x3b\xa9\x37\x4b\x51\x52\x51\x87\x9d\xf6\xb8\xd1\xa6\x13\x7f\x79\x23\x51\x07\x20\x62\xcb\x10\x97\x35\xca\x6c\x9a\x9f\xa8\x69\x47\xce\x69\xe2\xc0\x48\x66\x1a\x46\x27\x0c\x51\xaf\x1f\x0e\x6b\x66\x98\xe2\x69\xc3\xb2\x28\xbf\xbc\x59\x47\xde\xf7\x21\xef\x08\x36\xb8\x41\x6b\x2f\x14\x00\xc6\x86\x3a\x19\x97\xc3\xa3\x1e\x28\x77\x07\xcc\xf3\x81\xfc\x1d\xc2\x3e\x4d\xbf\xb7\x28\x2e\xcd\xd2\x98\x57\xda\xa5\x91\x8c\x16\xf7\x04\x74\x8f\x8a\x23\x79\x9e\xec\xf7\x71\x55\x4f\x3c\x38\x0b\x06\x83\x7a\xb6\x84\xd8\x5b\x3e\x81\xd2\x9e\xd0\xc6\xe1\x15\xb4\xc6\x5a\xf1\x93\x29\x28\x87\x4f\xb7\xb3\x7f\xc1\x89\x1f\xeb\xd3\x03\x0f\x1e\x08\x33\x19\x70\xc2\x7b\x04\xda\xbe\x8f\x26\x93\xe4\x63\x46\xbd\x86\x36\x7d\x9f\xe9\xae\xa2\xcb\x98\x29\xbf\x1b\x1d\x95\x34\x4d\x93\x24\x7e\x9b\x76\xcf\xd2\x65\xcb\x1d\xbd\x37\x29\x6a\x6d\x38\xa6\x82\x7e\xb7\x0b\x47\xc8\x54\xa4\xab\x26\x86\x31\x68\x2e\x7a\xec\xbf\x7f\xdb\x76\x6b\x3e\x3d\xb2\xf4\x5d\xdb\x19\xc3\x7d\xce\xe8\x36\xc4\xbd\xe5\xdf\x7f\xa7\x5e\x1b\xf0\x75\x0f\xd2\x43\x83\xcc\xdb\x27\xd7\xe3\x22\xf9\x3b\x00\x00\xff\xff\x06\x39\x6d\x22\x27\x0c\x00\x00"),
 		},
 		"/build/ks-core/values.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "values.yaml",
@@ -239,7 +239,7 @@ var assets = func() http.FileSystem {
 		},
 		"/build/prometheus/kube-state-metrics": &vfsgen۰DirInfo{
 			name:    "kube-state-metrics",
-			modTime: time.Date(2025, 7, 31, 8, 50, 53, 952817269, time.UTC),
+			modTime: time.Date(2025, 11, 20, 6, 44, 5, 166070457, time.UTC),
 		},
 		"/build/prometheus/kube-state-metrics/kube-state-metrics-clusterRole.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "kube-state-metrics-clusterRole.yaml",
@@ -257,10 +257,10 @@ var assets = func() http.FileSystem {
 		},
 		"/build/prometheus/kube-state-metrics/kube-state-metrics-deployment.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "kube-state-metrics-deployment.yaml",
-			modTime:          time.Date(2025, 7, 31, 8, 50, 53, 952594309, time.UTC),
-			uncompressedSize: 4126,
+			modTime:          time.Date(2025, 11, 20, 6, 44, 5, 166198083, time.UTC),
+			uncompressedSize: 4175,
 
-			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xec\x57\x5b\x6f\xdb\x46\x13\x7d\xd7\xaf\x58\xf8\xc3\x07\xc8\x75\x48\x5d\x12\xa7\x0e\x01\xa1\x70\x15\x23\x0e\x10\xbb\x82\x15\xb7\x0f\x45\x41\xac\x96\x23\x69\xeb\xbd\x75\x77\x28\x8b\x80\x7e\x7c\xb1\xbc\x8a\xb6\x24\x47\x46\x80\x3e\xb4\x7a\x12\x67\x66\xcf\xce\x9e\x99\x33\x4b\x52\xc3\x7f\x05\xeb\xb8\x56\x11\xa1\xc6\xb8\xde\x6a\xd0\x79\xe0\x2a\x89\xc8\x47\x30\x42\x67\x12\x14\x76\x24\x20\x4d\x28\xd2\xa8\x43\x88\xa0\x33\x10\xce\xff\x23\x7e\x41\xf8\x90\xce\xc0\x2a\x40\x70\x21\xd7\x3d\xa6\xa5\xd1\x0a\x14\x46\x04\xd6\x46\x5b\x04\xbb\x27\x52\x51\x09\x11\xf1\xb6\xc0\x21\x45\x08\x24\xa0\xe5\xcc\xed\x09\x37\xd4\x62\xa0\xe7\xe5\x0a\x63\xb5\x04\x5c\x42\xba\x2f\x7c\x55\x9d\x69\x18\xbe\x0d\xfb\x01\xac\x31\x1c\x90\xff\x11\xd4\x89\xee\x10\x72\x60\x6f\xef\x72\x86\xb2\xd2\xef\xcc\x12\x2c\x04\x52\x2b\x8e\xda\x72\xb5\x08\x5c\xe6\x10\x64\xc7\x19\x60\x9e\x04\x0b\x46\x70\x46\x5d\x44\x06\x1d\x42\x1c\x08\x60\xa8\x6d\x41\x8f\xa4\xc8\x96\x5f\xb6\xf8\x3a\x86\xb1\xa3\x39\x3b\x92\x35\x87\x96\x22\x2c\xb2\xa8\xa4\x85\xfc\x94\xa3\x58\x2d\x04\x57\x8b\x7b\x93\x50\x84\x2a\x6b\x49\xd7\xd3\xd4\x2e\x20\x22\xc3\xf3\xff\x37\xb6\x7b\x45\x57\x94\x0b\x3a\x13\x5b\x1e\xcc\x0c\x44\xe4\x6e\x1b\xa6\x43\x08\x82\x34\xa2\x46\xdc\xee\xa7\x3c\x71\xa5\x34\x52\xe4\x5a\xd5\x44\x91\x3c\x65\x86\xe2\xc9\x89\x12\x98\xd3\x54\x60\xc0\xb4\x42\xca\x15\xd8\x03\x7c\x88\x16\xf5\xc7\x91\xff\x0a\xfa\x8f\x6e\xdb\xd7\xb4\x2e\x21\x55\xe7\xf9\xdf\x4a\x8b\x54\x42\x7d\xc4\xa0\xec\xec\xa5\x76\x18\x20\x97\x50\x6f\xe3\x2d\x13\x8a\xcb\x86\x0c\x42\x8c\x7f\x26\x3d\x40\xd6\x13\x9a\x51\xd1\x5a\x50\x15\xf2\xe4\xa4\x34\xd5\x84\x6f\xed\x46\xed\x62\x8b\xde\x80\x04\x81\xdf\x67\x34\x18\xfe\x18\xf6\xc3\x7e\x38\x68\xb9\x3c\xbd\xa3\x8b\xfe\x45\xdb\x8a\x20\xc0\xd3\x98\x1d\x5a\xda\x04\x55\x20\xc3\x96\xbf\xa8\x43\x90\x80\xca\x04\x77\x38\xf2\x84\xc6\x46\x27\x71\x9d\x74\xec\x0b\x96\xba\x38\xfc\x01\xc1\x4a\xae\x28\x42\x12\x5b\xa0\x4e\xab\x37\x79\x74\x78\x16\x97\xc4\xd7\xcf\xcc\x82\x0f\x2b\x9e\x93\x7a\x1a\xc6\x5d\x5f\x81\xd8\xd0\xd4\x41\xb2\xc9\xff\x57\x5a\x8a\x4b\xf5\xa4\x79\xdb\xc7\xe1\xd9\x69\xb1\x18\x54\x62\x34\xf7\x4b\xb9\x9a\xeb\x0d\x4d\x12\x0b\xce\x35\xfe\x3f\xf5\xac\x74\xe9\x47\x05\xb6\x00\xed\x1a\x6a\xa9\x10\x20\xb8\x93\x1b\xca\x90\xaf\x7c\x16\x34\x11\x5c\x41\xec\x80\x69\x95\xb8\xd3\x4d\x79\xae\x6e\x11\xb0\x09\xcf\x62\x5f\xc6\xd3\x12\x98\x59\xad\x1a\xf0\x8a\x83\xb3\x62\x83\x7a\xfb\x7a\xe6\xc5\xdd\x32\xc4\x2c\xa9\x83\xd2\x6b\x3c\x2d\x0e\x41\x61\xd1\x6d\x25\x18\xa3\x86\x32\x8e\x59\x03\xf3\x34\x90\x09\xca\x65\xdc\xb5\xe0\x74\x6a\x99\xa7\x63\x43\x19\x6b\x1d\xdc\x01\xb3\x80\x71\xd7\xf7\x5a\x6d\xb2\x2b\x9e\xa7\x52\xe4\xd8\x64\x5d\x06\x70\xb5\xc8\xd9\x2b\xd2\xf0\x4d\xbc\x41\xe1\x4a\x67\x35\x8e\x3d\xe8\xb3\xe3\x16\xec\x56\xd9\xea\x24\xe1\xce\xa6\xc6\x8f\x9d\x59\x9a\x2c\x00\xeb\x26\x39\x6b\x81\xf9\x00\xdf\x48\xbe\xb8\x60\x6b\xaf\xd2\x89\x4f\x66\xae\x8b\xc7\xee\xd2\xd0\x4d\xb3\xfd\x66\xe7\xe2\x53\xdf\x57\x0b\x50\x60\x73\xc7\xae\x26\x2e\x86\x56\x40\x85\xd0\x8f\x79\x33\xd7\xd5\x71\xa3\xdf\x9b\x2b\xc9\x4f\x8a\x47\x6d\x1f\x72\xcf\x9b\x59\x86\x80\x96\x26\xb9\x59\xb9\x20\x3f\xe8\x1f\x35\x3c\x97\xd4\x0f\xef\x99\x2f\xc9\xac\xf7\x7c\x80\x45\xab\xad\x59\xd3\x5e\x35\x49\x85\x98\x68\xc1\x59\x16\x91\xcf\xf3\x5b\x8d\x13\x0b\xce\xbf\x13\x54\x51\x2f\x0e\xc5\xaa\xfe\x6e\x7b\xf6\x08\x2e\x39\xb6\x2c\x84\x30\x93\x46\xe4\x64\x70\xd2\x32\x4a\x90\xda\x66\x11\xb9\xf8\xc4\xb7\xec\x16\xfe\x4a\xc1\xed\x04\x18\xf4\xfb\x72\x27\xc2\xe0\xbc\x7f\xd3\x60\x38\x60\xa9\xe5\x98\x8d\xb5\x42\x58\xe3\x36\x90\x4d\xd5\xa5\xbb\x77\xfe\x6a\x79\x7f\x7e\xfe\xf6\x5d\xed\x2a\xda\xfa\x46\xa7\x0a\x5b\x63\x4f\x7a\xcb\xe4\xf0\x34\xdd\x37\x98\xfd\x59\x68\xf2\x8b\x12\x59\x44\xd0\xa6\x70\x60\xb6\x0a\xbd\x40\xed\x30\x01\x6b\x5b\xf6\xfc\x28\x10\x88\x5c\x7b\x41\x39\x5c\x46\xd1\xc5\xbb\x77\x6f\xdb\x53\x54\xb8\x80\x71\xdf\x3d\x81\x4b\x39\x82\x1b\x7d\xfd\x32\x8d\xaf\xc6\x1f\xaf\xaf\xe2\xbb\xe9\x65\xfc\xdb\xe7\xaf\xd7\xf1\xe5\xd5\x34\x1e\x0c\x2f\xe2\x4f\xe3\x9b\x78\x7a\x7d\x39\x3c\x7f\xff\xa6\x89\xba\x1a\x7f\x7c\x21\xee\x19\xce\xf8\xe7\xf1\x37\xe1\xec\x8c\x3b\x80\xd6\x3a\x59\x6a\x1c\x5a\xa0\x72\xb4\x44\x34\x51\xaf\x57\xdf\x22\x91\xbf\x6f\x7a\xcf\x74\xc0\x51\x51\xc9\x0b\x21\xd8\x19\x65\xfe\x62\x5e\x67\x51\x3f\x1c\x7c\x08\xfb\xaf\xef\xff\x06\x2a\x90\x94\x37\xea\xf6\x97\x56\xab\x96\xf5\xb5\x34\xd1\x16\x23\xd2\xaa\x54\xdd\x2a\x88\xc6\xb5\x71\xbe\x8f\x92\x06\xfd\x6d\x1d\xbc\xa0\xa5\xdd\x52\x1a\x1e\xa3\xa4\x4f\x56\xa7\xa6\x90\xd2\xf0\xa9\xef\x56\xab\x3b\xad\xb1\xd5\xfa\x3b\x24\x38\xfc\x7e\xaa\xf8\xf0\x9f\x2a\x72\x55\x0c\xff\x09\x55\x38\x10\xf3\x6f\x56\xc5\x87\xfd\xaa\x68\xe1\xfc\xeb\x55\xe1\x5f\x44\xa6\xad\x0f\xcf\xea\xf3\xa9\xf9\xa8\xd0\x2e\x22\x82\xab\x74\xdd\xa9\xd2\xcb\xdf\xb2\x2e\x19\xf3\x77\xd7\xed\xbe\x3b\xfc\xef\x00\x00\x00\xff\xff\x3a\xb0\x97\x97\x1e\x10\x00\x00"),
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xec\x57\x6f\x6f\xdb\xb6\x13\x7e\xef\x4f\x41\xe4\x87\x1f\xe0\x2c\x95\xfc\xa7\x4d\x97\x0a\x30\x86\x2c\x0d\xda\x02\x6d\x16\x34\xed\xf6\x62\x18\x04\x9a\xba\xd8\x5c\x29\x1e\xc7\x3b\xb9\x11\xe0\x0f\x3f\x50\x7f\xad\xd6\x71\x9b\xa2\xc0\x5e\x6c\x7e\x65\xdd\x1d\x1f\x1e\x9f\xbb\xe7\x28\x49\xa7\x7f\x05\x4f\x1a\x6d\x22\xa4\x73\x34\xd9\xcc\x46\x1f\xb4\xcd\x12\xf1\x1c\x9c\xc1\x32\x07\xcb\xa3\x1c\x58\x66\x92\x65\x32\x12\xc2\xc8\x25\x18\x0a\xff\x44\x58\x10\x7f\x28\x96\xe0\x2d\x30\x50\xac\x71\xa2\x30\x77\x68\xc1\x72\x22\xe0\xce\xa1\x67\xf0\xf7\x44\x5a\x99\x43\x22\x82\x2d\x22\x96\x0c\x51\x0e\xec\xb5\xa2\x7b\xc2\x9d\xf4\x1c\xe1\x6d\xb3\xc2\x79\xcc\x81\xd7\x50\xdc\x17\xbe\x69\xcf\x34\x8f\x1f\xc7\xd3\x08\xee\x38\x9e\x89\xff\x09\xc6\x0c\x47\x42\x1c\xd8\x3b\xb8\xc8\x49\xd5\xf8\xc9\xad\xc1\x43\x94\xa3\xd5\x8c\x5e\xdb\x55\x44\x25\x31\xe4\x23\x72\xa0\x02\x09\x1e\x9c\xd1\x4a\x52\x22\x66\x23\x21\x08\x0c\x28\x46\x5f\xd3\x93\x4b\x56\xeb\xd7\x3b\x7c\x3d\x84\xb1\x07\x73\xf6\x40\xd6\x88\xbd\x64\x58\x95\x49\x43\x8b\xf8\xa9\x42\xf1\x68\x8c\xb6\xab\xf7\x2e\x93\x0c\x6d\xd6\xb9\xbc\xbb\x29\xfc\x0a\x12\x31\x3f\xfd\x7f\x6f\x7b\x6f\xe5\x46\x6a\x23\x97\x66\xc7\xc3\xa5\x83\x44\xbc\xdd\x85\x19\x09\xc1\x90\x3b\xd3\x21\xee\xf6\x53\x95\xb8\xb5\xc8\x92\x35\xda\x8e\x28\x51\xa5\xac\xd8\x7c\x72\xa2\x0c\x6e\x65\x61\x38\x52\x68\x59\x6a\x0b\xfe\x00\x1f\x66\x40\xfd\xc3\xc8\xff\x06\xfa\x1f\xdc\xb6\xdf\xd2\xba\x42\xb4\x9d\x17\x7e\x1b\x34\x45\x0e\xdd\x11\xa3\xa6\xb3\xd7\x48\x1c\xb1\xce\xa1\xdb\x26\x58\xae\x25\xaf\x7b\x32\x84\x70\xe1\x59\x4c\x80\xd5\xc4\xa0\x92\x66\xb0\xa0\x2d\xe4\xd1\x51\x63\x72\x5e\xa3\xd7\x5c\x5e\x18\x49\x74\x55\x6d\x73\x54\x6b\x21\x52\xa6\x20\x06\x1f\x29\xaf\x59\x2b\x69\xda\x25\x5d\x8d\x76\x12\x94\x7e\xb5\x53\x91\x48\x44\x51\x48\x6d\x31\x9b\xff\x18\x4f\xe3\x69\x3c\x1b\xb8\x42\x45\x16\x67\xd3\xb3\xa1\x95\xc1\x40\x60\xbe\x3c\xb4\xb4\x0f\x6a\x41\xe6\x03\x7f\x5d\xba\x28\x03\x5b\x1a\x4d\xbc\x08\x35\x48\x1d\x66\x69\x97\x74\x1a\x6a\x5c\x50\x1a\xff\xc0\xe0\x73\x6d\x25\x43\x96\x7a\x90\x84\xf6\x51\x15\x1d\x9f\xa4\x4d\xad\xba\x67\xe5\x21\x84\xd5\xcf\x59\x37\x40\xd3\x71\x28\x5a\xea\x64\x41\x90\x6d\xab\xff\xad\xfc\xd2\x46\x70\x45\xa5\x94\x34\x3e\x39\xae\x17\x83\xcd\x1c\xea\xb0\x54\xdb\x5b\xdc\xca\x2c\xf3\x40\xd4\xfb\xff\xc4\x65\xe3\xc2\x8f\x16\x7c\x0d\x3a\x76\xd2\x4b\x63\xc0\x68\xca\xb7\x52\xb1\xde\x84\x2c\x64\x66\xb4\x85\x94\x40\xa1\xcd\xe8\x78\xdb\x9c\x6b\x5c\x07\x6c\xe3\x93\x34\x54\xfe\xb8\x01\x56\x1e\x6d\x0f\xde\x72\x70\x52\x6f\xd0\x6d\xdf\x8d\xc9\x74\xdc\x84\xb8\xb5\x24\x68\xbc\x2e\xd0\x42\x0c\x96\xeb\x06\x6d\xc0\x94\x74\x52\x69\x2e\x7b\x98\x4f\x03\x95\x91\x3a\x4f\xc7\x1e\x08\x0b\xaf\x02\x1d\x5b\xa9\xd4\xe0\xe0\x04\xca\x03\xa7\xe3\xd0\x9e\x9d\xc9\x6f\x74\x95\x4a\x9d\x63\x9f\x75\x13\xa0\xed\xaa\x62\xaf\x4e\x23\xf4\xfd\x96\x0d\x35\xce\x76\x82\x07\xd0\xcf\x8e\x5b\xb3\xdb\x66\x8b\x59\xa6\xc9\x17\x2e\x4c\xaa\x65\x91\xad\x80\xbb\x26\x39\x19\x80\x85\x80\xd0\x48\xa1\xb8\xe0\x3b\xaf\xc5\x2c\x24\x73\x8b\xf5\xe3\x78\xed\xe4\xb6\xdf\x7e\xbb\x77\xf1\x71\xe8\xab\x15\x58\xf0\x95\x63\x5f\x13\xd7\x73\x2e\x92\xc6\xe0\xc7\xaa\x99\xbb\xea\xd0\xe2\xf7\xfe\x16\x0b\xc3\xe5\x23\xfa\x0f\x95\xe7\xd1\xb2\x64\x60\x2f\xb3\xca\x6c\x29\xaa\x0e\xfa\x47\x07\xaf\x73\x19\xe6\xfd\x32\x94\x64\x39\xf9\x7c\xe6\x25\x9b\x9d\xf1\x34\x5c\x75\x5d\x18\x73\x8d\x46\xab\x32\x11\xaf\x6e\xaf\x90\xaf\x3d\x50\x78\x8d\x68\xa3\xbe\x38\x47\xdb\xfa\xd3\xee\xb8\x32\x3a\xd7\x3c\xb0\x08\xa1\x5c\x91\x88\xa3\xd9\xd1\xc0\x98\x43\x8e\xbe\x4c\xc4\xd9\x0b\xbd\x63\xf7\xf0\x57\x01\xb4\x17\x60\x36\x9d\xe6\x7b\x11\x66\xa7\xd3\x37\x3d\x06\x81\x2a\xaa\x09\x88\x96\xe1\x8e\x77\x81\x7c\x61\xcf\xe9\x3d\x85\xdb\xe8\xe9\xe9\xe9\xe3\x27\x9d\xab\x6e\xeb\x37\x58\x58\x1e\x8c\xbd\x3c\x58\xae\x0f\x0f\xe0\xfb\x66\x79\x38\x8b\xcc\x7e\xb1\xa6\x4c\x04\xfb\x02\x0e\xcc\x56\x83\x2b\x46\xe2\x0c\xbc\x1f\xd8\xab\xa3\x40\x64\x2a\xed\x45\xcd\x70\x59\x24\x67\x4f\x9e\x3c\x1e\x4e\x51\x43\x91\xd2\xa1\x7b\x22\x2a\x34\x03\x2d\xde\xbd\xbe\x49\x2f\x2f\x9e\xbf\xbc\x4c\xdf\xde\x9c\xa7\xbf\xbd\x7a\xf7\x32\x3d\xbf\xbc\x49\x67\xf3\xb3\xf4\xc5\xc5\x9b\xf4\xe6\xe5\xf9\xfc\xf4\xe9\xa3\x3e\xea\xf2\xe2\xf9\x17\xe2\x3e\xc3\xb9\xf8\xf9\xe2\xab\x70\xf6\xc6\x1d\x40\x1b\x9c\xac\x70\xc4\x1e\x64\xbe\x58\x33\xbb\x64\x32\xe9\x6e\x91\x24\xdc\x37\x93\x43\x3a\xf0\x4b\xa9\xc2\x55\x7e\x57\x26\xd3\x78\xf6\x2c\x9e\x7e\x7b\xfb\xf7\x50\x51\x2e\x75\x2f\xee\x70\x67\x0d\x4a\xd9\xdd\x4a\xd7\xe8\x39\x11\x83\x42\x75\x9d\xc2\xec\x68\x88\xf3\x7d\x84\x34\x9b\xee\xca\xe0\x0b\x52\xda\xaf\xa4\xf9\x43\x84\xf4\xc2\x63\xe1\x6a\x25\xcd\x3f\xf5\x5d\xa1\x7d\x8b\xc8\x83\xce\xdf\xa3\xc0\xf9\xf7\x13\xc5\xb3\xff\x44\x51\x89\x62\xfe\x0f\x88\x82\xc0\xdc\x7e\xb5\x28\x9e\xdd\x2f\x8a\x01\xce\xbf\x5e\x14\xe1\x35\xe4\x66\xf0\xa5\xda\x7e\x6f\xf5\x5f\x21\x48\x89\x30\xda\x16\x77\xa3\x36\xbd\xea\x1d\xeb\x5c\xa9\x70\x73\x5d\xdd\x77\x83\xff\x1d\x00\x00\xff\xff\x16\xa9\x3b\xd7\x4f\x10\x00\x00"),
 		},
 		"/build/prometheus/kube-state-metrics/kube-state-metrics-prometheusRule.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "kube-state-metrics-prometheusRule.yaml",
@@ -292,7 +292,7 @@ var assets = func() http.FileSystem {
 		},
 		"/build/prometheus/kubernetes": &vfsgen۰DirInfo{
 			name:    "kubernetes",
-			modTime: time.Date(2025, 7, 31, 8, 50, 53, 953644484, time.UTC),
+			modTime: time.Date(2025, 11, 17, 9, 8, 56, 269747477, time.UTC),
 		},
 		"/build/prometheus/kubernetes/kubernetes-prometheusRule.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "kubernetes-prometheusRule.yaml",
@@ -345,14 +345,14 @@ var assets = func() http.FileSystem {
 		},
 		"/build/prometheus/kubernetes/kubernetes-serviceMonitorKubelet.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "kubernetes-serviceMonitorKubelet.yaml",
-			modTime:          time.Date(2025, 7, 31, 8, 50, 53, 953683110, time.UTC),
-			uncompressedSize: 1717,
+			modTime:          time.Date(2025, 11, 17, 9, 8, 56, 269943343, time.UTC),
+			uncompressedSize: 1718,
 
-			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xe4\x55\xb1\x6e\xdb\x30\x10\xdd\xfd\x15\x1c\xdb\x04\x96\x90\x55\x6b\x81\x4e\x69\x87\xa6\xc8\x4a\xd0\xd4\xb3\xc4\x5a\xe2\x11\x77\x27\xb7\x06\xf2\xf1\x05\x29\xd9\x71\xec\x18\x45\xc7\xa2\x9b\xfd\xee\xf1\xf8\xee\xdd\x03\xe5\x52\x78\x06\x4b\xa0\xd8\x98\x91\x62\x50\xe2\x10\xbb\xca\x13\x83\xa4\xf2\x34\xd6\xfb\x87\xd5\x2e\xc4\xb6\x31\x4f\xe0\x7d\xf0\xf8\x32\xb3\x56\x23\xd4\xb5\x4e\x5d\xb3\x32\x66\x70\x1b\x0c\x92\x7f\x19\xe3\x52\xaa\x76\xd3\x06\x1c\xa1\x90\x2a\x50\x1d\xdd\x88\xc6\x64\x6c\x80\xde\xe0\x24\xc7\xba\xa6\xed\x4c\x5b\x27\xa6\x11\xda\x63\x92\x1b\xf4\x3d\x62\x4b\x3c\xb3\x25\xf5\x60\xac\x8c\xb9\xbc\x27\xff\x97\xe4\x3c\xce\x79\xeb\xd7\x29\xd7\x72\x10\xc5\xb8\x92\x04\x9f\xb5\x23\xb6\x89\x42\xd4\x32\xc8\xda\x6c\xe0\x18\xfc\x9d\x76\x88\x9f\xc3\x80\xc6\xd4\x7b\xc7\x35\x4f\xb1\x16\x78\x86\x4a\xfd\x56\x93\xcc\xfe\x38\xef\x69\x8a\x5a\x6b\x3e\x58\xe4\xf7\x14\x89\x1f\x67\x8b\x8c\xf2\x84\x82\x86\xa8\xe0\xbd\x1b\x1a\xf3\x30\x16\x60\x84\x72\xf0\xdf\x50\xcc\x0c\xb1\x5b\xfc\x5c\x1b\xe7\xb5\xec\x67\x07\xa4\x02\x19\xc3\xe8\xf0\xeb\x34\xab\x8d\xd4\xc2\xe6\x71\x5f\x8e\x08\x4f\x31\x86\xd8\x59\x4f\x51\x5d\x88\x60\x5b\x54\x5d\xd5\x13\xb5\x17\x95\x3d\x0d\xd3\x08\x2b\xea\x54\xaa\xbb\x13\x9c\x06\x74\x96\x31\x04\x51\xdb\x4e\xec\xb2\x24\x2b\xf0\x14\x5b\xb1\xd5\xfd\xa2\x4b\x68\x62\x8f\xc7\xb3\x38\xe4\x01\x6c\xd1\x66\x6d\x01\x12\xb1\x36\xa6\x57\x4d\xb2\x9e\x47\x9e\x97\xcc\xd7\x83\xdf\xea\xb6\x1c\xb3\xc9\x69\xbf\x74\x35\x46\x1d\x77\xd0\x42\x6e\xcc\x39\xe3\xc2\xc5\x72\x4b\xcb\x74\x61\xe5\x87\x65\x7d\x2f\xc7\x14\x7c\x2c\x75\xf1\x3d\x72\xaa\x8a\xde\x82\xe8\x20\x9f\x28\x6e\x43\x77\x54\x14\xa2\xc0\x4f\x8c\xa7\x5d\x48\xcf\xe0\xb0\x3d\x9c\xb6\xfc\x4f\x84\xe8\x2c\x22\x69\xb2\x93\xb8\x0e\xa7\xc5\x2a\xa9\x1b\x5e\x5e\x19\x23\x46\xe2\xc3\x42\xda\x1c\x14\x72\x5d\xf4\xce\xf7\x38\x83\x23\xf4\x27\xf1\xce\x56\xf7\xf3\x89\x5b\x4d\x33\x29\x47\x52\xa0\x57\xad\xb3\x32\xbf\x15\x5b\xdd\x25\x70\xa0\x77\x94\x25\x26\x0f\x11\xe4\xcc\xbe\xa2\xda\x33\x5c\x2b\xd5\xdd\x5f\xe4\xd3\x69\xdf\x98\x7a\x49\x50\xed\x5d\xbb\x0f\x42\xfc\xdf\x65\xf7\x07\x6d\x16\x41\xef\xbf\xe8\xe7\x0f\xec\x13\x06\x78\x25\x9e\xdb\x8e\x4e\x7d\xff\x35\xd7\x8e\x66\x94\x47\x7d\x79\x6d\x8d\x91\x6b\xf6\x5b\x9f\xfe\xf4\x09\xf9\x1d\x00\x00\xff\xff\xff\x8d\xbb\xd9\xb5\x06\x00\x00"),
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xe4\x55\xb1\x8e\xdb\x3a\x10\xec\xfd\x15\x2c\xdf\xbb\x83\xa5\x77\xad\xda\x07\xa4\xba\xa4\xc8\x05\xd7\x12\x34\x35\x96\x18\x4b\x5c\x62\x77\xe5\xc4\xc0\x7d\x7c\x40\x4a\xf6\xf9\xec\x33\x82\xa4\x48\x93\xce\x9e\x1d\x2e\x67\x67\x07\x94\x4b\xe1\x19\x2c\x81\x62\x63\x46\x8a\x41\x89\x43\xec\x2a\x4f\x0c\x92\xca\xd3\x58\xef\x1f\x56\xbb\x10\xdb\xc6\x3c\x81\xf7\xc1\xe3\xe3\xcc\x5a\x8d\x50\xd7\x3a\x75\xcd\xca\x98\xc1\x6d\x30\x48\xfe\x65\x8c\x4b\xa9\xda\x4d\x1b\x70\x84\x42\xaa\x40\x75\x74\x23\x1a\x93\xb1\x01\x7a\x83\x93\x1c\xeb\x9a\xb6\x33\x6d\x9d\x98\x46\x68\x8f\x49\x6e\xd0\xf7\x88\x2d\xf1\xcc\x96\xd4\x83\xb1\x32\xe6\xf2\x9e\xfc\x5f\x92\xf3\x38\xe7\xad\x5f\xa7\x5c\xcb\x41\x14\xe3\x4a\x12\x7c\xd6\x8e\xd8\x26\x0a\x51\xcb\x20\x6b\xb3\x81\x63\xf0\x17\xda\x21\x7e\x08\x03\x1a\x53\xef\x1d\xd7\x3c\xc5\x5a\xe0\x19\x2a\xf5\x5b\x4d\x32\xfb\xe3\xbc\xa7\x29\x6a\xad\xf9\x60\x91\xdf\x53\x24\x7e\x9c\x2d\x32\xca\x13\x0a\x1a\xa2\x82\xf7\x6e\x68\xcc\xc3\x58\x80\x11\xca\xc1\x7f\x46\x31\x33\xc4\x6e\xf1\x73\x6d\x9c\xd7\xb2\x9f\x1d\x90\x0a\x64\x0c\xa3\xc3\xf7\xd3\xac\x36\x52\x0b\x9b\xc7\x7d\x39\x22\x3c\xc5\x18\x62\x67\x3d\x45\x75\x21\x82\x6d\x51\x75\x55\x4f\xd4\x5e\x54\xf6\x34\x4c\x23\xac\xa8\x53\xa9\xee\x4e\x70\x1a\xd0\x59\xc6\x10\x44\x6d\x3b\xb1\xcb\x92\xac\xc0\x53\x6c\xc5\x56\xf7\x8b\x2e\xa1\x89\x3d\x1e\xcf\xe2\x90\x07\xb0\x45\x9b\xb5\x05\x48\xc4\xda\x98\x5e\x35\xc9\x7a\x1e\x79\x5e\x32\x5f\x0f\x7e\xab\xdb\x72\xcc\x26\xa7\xfd\xd2\xd5\x18\x75\xdc\x41\x0b\xb9\x31\xe7\x8c\x0b\x17\xcb\x2d\x2d\xd3\x85\x95\xff\x2c\xeb\x7b\x39\xa6\xe0\xdf\x52\x17\xdf\x23\xa7\xaa\xe8\x2d\x88\x0e\xf2\x3f\xc5\x6d\xe8\x8e\x8a\x42\x14\xf8\x89\xf1\xb4\x0b\xe9\x19\x1c\xb6\x87\xd3\x96\xff\x64\x88\xfe\x93\xdf\x4d\xd1\x59\x46\xd2\x64\x27\x71\x1d\x4e\x9b\x55\x52\x37\xbc\xbc\x32\x46\x8c\xc4\x87\x85\xb4\x39\x28\xe4\xba\xe8\x9d\xef\x71\x06\x47\xe8\x37\xe2\x9d\xad\xee\xe7\x13\xb7\x9a\x66\x52\xce\xa4\x40\xaf\x5a\x67\x65\x7e\x2b\xb6\xba\x4b\xe0\x40\xef\x28\x4b\x4c\x1e\x22\xc8\xa1\x7d\x45\xb5\x67\xb8\x56\xaa\xbb\x5f\x08\xa8\xd3\xbe\x31\xf5\x12\xa1\xda\xbb\x76\x1f\x84\xf8\xaf\x0b\xef\x57\xda\x2c\x82\xde\x7f\xd2\xcf\x5f\xd8\x27\x0c\xf0\x4a\x3c\xb7\x1d\x9d\xfa\xfe\x53\xae\x1d\xcd\x28\xaf\xfa\xf2\xdc\x1a\x23\xd7\xec\xb7\x3e\xfd\xec\x1b\xf2\x23\x00\x00\xff\xff\xa4\x9b\xbc\x26\xb6\x06\x00\x00"),
 		},
 		"/build/prometheus/node-exporter": &vfsgen۰DirInfo{
 			name:    "node-exporter",
-			modTime: time.Date(2025, 7, 31, 8, 50, 53, 954119155, time.UTC),
+			modTime: time.Date(2025, 12, 3, 13, 36, 55, 20776255, time.UTC),
 		},
 		"/build/prometheus/node-exporter/node-exporter-clusterRole.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "node-exporter-clusterRole.yaml",
@@ -370,10 +370,10 @@ var assets = func() http.FileSystem {
 		},
 		"/build/prometheus/node-exporter/node-exporter-daemonset.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "node-exporter-daemonset.yaml",
-			modTime:          time.Date(2025, 7, 31, 8, 50, 53, 953913612, time.UTC),
-			uncompressedSize: 3537,
+			modTime:          time.Date(2025, 12, 3, 13, 36, 55, 20659302, time.UTC),
+			uncompressedSize: 3587,
 
-			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xac\x56\x51\x6f\xdb\x38\x12\x7e\xcf\xaf\x20\x8a\x3e\x24\xb8\x93\x64\xa7\x4d\xaf\x15\x90\x87\x5c\x92\x6b\x02\xb4\xb9\xa0\xce\xee\x3e\x2c\xb6\x06\x4d\x8d\x6c\x22\x14\x87\xe5\x0c\x5d\x1b\xd0\x8f\x5f\xd0\x8a\x1d\x49\x76\xdc\x18\xd8\x97\x58\x19\x0e\x3f\x72\x66\xbe\xf9\x86\xd2\xe9\xdf\xc1\x93\x46\x9b\x0b\xe9\x1c\x65\xf3\xe1\xd1\xa3\xb6\x45\x2e\xae\x24\x54\x68\x47\xc0\x47\x15\xb0\x2c\x24\xcb\xfc\x48\x08\x23\x27\x60\x28\x7e\x89\xe8\x9f\x3e\x86\x09\x78\x0b\x0c\x94\x6a\xcc\x14\x56\x0e\x2d\x58\xce\x05\x2c\x1c\x7a\x06\xff\x82\xa7\x95\x15\xe4\xc2\x62\x01\xc9\x2f\x3c\x9d\xf4\x9c\x60\x99\x8b\x68\x4e\x9c\xc7\x0a\x78\x06\x81\x5e\x70\x9f\xaf\xa3\x19\xa6\xef\xd2\xe1\x91\x10\xbb\x4f\x8a\x56\x72\x52\x41\x83\x4b\x6e\x06\x1e\x92\x0a\xad\x66\xf4\xda\x4e\x13\x5a\x12\x43\x75\x44\x0e\x54\x8c\x96\xc0\x80\x62\xf4\x4d\xe4\x95\x64\x35\xfb\xd2\x4a\xc5\x21\xc9\x38\x24\x1d\x07\x26\x84\xa1\x72\x46\x32\x3c\xdd\xb2\x55\xb7\x15\x94\xb5\xc8\x92\x35\xda\xcd\xad\xc5\x0a\x44\xb1\xe9\x9d\x51\x40\x29\x83\xe1\x44\xa1\x65\xa9\x2d\xf8\xdd\x97\x33\x9d\x14\x1c\x96\x84\xc3\xd2\x70\x30\x33\x5e\xc9\x0e\x21\xd6\x15\x5e\x6d\x28\x4b\x6d\x35\x2f\x9f\x23\x8a\x77\xb9\xd8\xb2\x0a\xe1\xe1\x47\xd0\x1e\x8a\xab\x10\xd9\x32\x52\x33\x28\x82\xd1\x76\x7a\x3b\xb5\xb8\x31\x5f\x2f\x40\x85\x98\xef\xf6\xce\x06\x73\xf4\xc4\xa7\x07\xf0\x15\x75\x97\x93\x86\x5e\xd7\x0b\xe7\x81\xa8\x5b\xad\xb5\xc7\x23\x2c\x9f\xf2\xe4\xd1\x40\x2f\x48\x28\xa6\xd0\xdb\x21\x04\x3a\xf0\x32\x12\x58\x5c\x21\xd0\x1d\xf2\xf5\x42\x13\x3f\xb9\x6d\xca\xbc\x39\x2a\x11\xd2\x4f\x5b\x07\x27\x22\x49\x7e\xc2\x24\x35\x9a\x18\x6c\x22\x8b\x22\x5e\xee\x7c\x78\xfa\x9f\x74\x90\x0e\xd2\x61\xfe\x69\x38\x18\x74\xbc\x9d\xe4\x59\x4a\x4b\x2a\xe9\x3c\x9b\x21\x71\x46\x4b\xda\x76\xf0\x88\xbc\xf1\x88\xff\x74\x5c\x2c\x26\x0a\x4d\x93\xa9\xf4\xa7\x2e\x75\x67\xf5\x79\x49\xb9\x90\x6a\x5b\xe2\x0b\xcb\x16\xf8\x27\xfa\xc7\xb1\xc7\xc0\xf0\xb2\x4f\x01\xf3\xf4\x29\xb0\x64\x0f\x5a\xa9\x0d\x34\xea\x90\xea\xa6\xda\x49\x85\xc1\x72\xe2\x50\x5b\xa6\xf3\xef\xd9\x71\x01\xf3\xda\x79\x54\x35\x2d\xa9\x9e\x4b\x9f\x19\x3d\xc9\x0a\x54\x8f\xe0\xb3\xf4\x5f\x27\xc7\x6f\xeb\xec\xe4\xf5\xe8\x25\x25\xbc\x74\x40\xe7\xdf\x8f\x65\x60\x2c\xa9\x9e\x68\x5b\x56\x3c\xae\x34\xa9\x5a\x4d\x3d\x06\x57\x2b\xb4\xa5\x9e\x96\x54\x17\x30\x09\xcd\xef\xdc\xf1\xea\x87\x2b\x57\x52\x5d\x06\x8a\x8d\x5e\xcf\xc2\x14\xd8\x4c\x4a\xaa\xab\x1f\x01\x02\xd4\x38\x07\x6f\xe4\xb2\xb9\x70\xfc\x53\x52\xed\x88\xd1\x43\xed\x9d\x1a\x3b\xed\xa0\xa4\x9a\x40\x05\xaf\x79\x19\x3f\x63\x51\x6b\xf6\x52\x41\x49\x27\x6f\x37\x81\xe8\x4a\x4e\x21\x17\x13\x50\x46\x4e\xb2\x4e\x17\xe7\x91\x24\xef\x9f\xbb\x6a\x4f\x9f\xaf\x0f\xba\x44\xcb\xb0\xe0\x36\xf7\x9d\xd7\x73\x6d\x60\x0a\x45\x2e\xd8\x87\x36\xc9\x7d\xb0\x17\xf4\x1b\x45\xa1\x7a\xa6\xa1\x07\xc2\xe0\x15\x74\x1a\xc8\xe8\x4a\x73\xaf\xa5\x94\x0b\xb9\x78\x33\x7c\xd3\x31\x56\x50\xa1\x5f\xe6\xe2\x6c\x30\xf8\xaa\x7b\xad\x0f\xb4\x13\x62\x38\x38\xad\x76\x62\x0c\x3f\xb6\x31\xe6\x68\x42\x05\x5f\x23\x69\x3a\x2d\xb6\xa2\xd1\xbd\xe4\x59\x2e\x9a\x86\x88\xd5\x68\xe1\x35\x69\xeb\x19\x3d\xc8\xe2\xff\xd6\x2c\x7b\x29\xd9\x81\xd6\x6e\xc0\x35\x58\xd7\xf6\x7a\xac\x4e\xab\x8a\xa7\x75\x8f\x4e\x4e\x57\x03\x26\x17\x37\x48\xfc\x80\x97\x6b\x61\xd9\x3a\xb8\x07\xb0\xf3\xe4\x5d\x22\x64\x70\xca\x48\x5c\x80\xf7\x1d\xfb\x8a\x36\x90\xf4\xf4\xe9\xcf\xb7\xc7\xb7\xf7\x27\x7f\x6d\xab\x13\x1b\x4a\x94\x8e\x53\x3f\xa1\xa0\x19\xe8\xfc\xe1\xcb\x68\x7c\x7d\x79\x75\x73\x3d\xfe\x36\xba\x18\xff\x71\xfb\x70\x33\xbe\xb8\x1e\x8d\x87\xa7\x1f\xc7\x9f\x2f\xbf\x8e\x47\x37\x17\xa7\x67\x1f\xfe\xfd\xec\x75\x7d\x79\xf5\x0b\xbf\x2d\x9c\xcb\xff\x5e\xbe\x0a\x67\xa7\xdf\x1e\xb4\x4e\x64\xc1\x11\x7b\x90\xd5\xf9\x8c\xd9\xe5\x59\xd6\x95\xe8\x6c\xe3\x0b\x76\xde\xce\x6c\x53\x95\xdb\xfb\x56\x4d\xe6\xd2\x04\xf8\x9f\xc7\xaa\xcb\xf4\x52\x83\x29\xbe\x41\xd9\x9f\x4a\x2b\x7b\xc3\x11\x62\xc9\x81\x52\x87\x45\x0b\x70\x2d\x0f\x9a\xad\xac\x74\xb6\x1a\xda\x7e\x22\x55\x9c\xdc\x8b\x65\x3e\x48\x87\x9f\xd2\x41\xd7\xfb\x3e\x18\x73\x8f\x46\xab\x65\x2e\x6e\xcb\x3b\xe4\x7b\x0f\x04\x96\x7b\x42\xd2\x83\xda\xac\x46\x65\xe9\xd0\x67\x33\xe7\xee\xd1\x73\x2e\x3a\xac\x10\x22\x12\x7b\xe7\x42\x73\x4a\xcc\x27\xfd\xc3\xda\x32\x3c\x44\x5b\x76\x4b\xcb\x69\x1b\x61\x8f\x78\xae\x14\xf2\x73\x9c\x15\xb9\xf8\x70\x76\xf6\xee\xb4\xbf\x76\x87\xf6\x1b\x22\xef\x93\xd6\xf6\xbe\x98\xad\xbb\x66\xb0\x76\xb6\xac\xb2\x78\x7b\xd5\xb1\xb5\x5f\x3c\xdd\xa7\xe7\xf3\xab\x05\x29\x17\x46\xdb\xb0\x38\xfa\x45\x28\xbd\xfb\xbc\xdf\xf8\xfb\xb9\x56\x70\xa1\x54\xd4\xa2\xbb\x17\x27\x0c\xa3\x89\x2f\xa1\xf6\xbb\x2a\x69\xbd\x8e\x56\xcf\xa2\x75\x99\x1b\xa1\x6e\xf9\xad\x82\x8b\x14\x6f\x4f\xa5\x46\x16\x3b\xb2\xbc\xa5\xd4\x7b\xb7\xb6\x45\xb8\x2f\xcb\x7b\x37\x1e\x6d\x6b\xea\xdf\x01\x00\x00\xff\xff\x3c\x3d\xdc\x1b\xd1\x0d\x00\x00"),
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xac\x56\x51\x6f\xdb\x36\x10\x7e\xcf\xaf\x20\x82\x3e\x24\xd8\x24\xdb\xe9\xd2\xb5\x02\xf2\x90\x39\x59\x13\xa0\xcd\x82\x26\xdb\x1e\x86\xd5\xa0\xa9\x93\x4d\x84\xe2\xb1\xbc\xa3\x1b\x03\xfa\xf1\x03\xa5\xd8\x91\x64\xc7\x8d\x81\xbd\xc4\xca\xf1\xe3\x47\xde\xf1\xbb\x8f\x94\x4e\xff\x05\x9e\x34\xda\x4c\x48\xe7\x68\xb0\x18\x1d\x3c\x68\x9b\x67\xe2\x42\x42\x89\xf6\x0e\xf8\xa0\x04\x96\xb9\x64\x99\x1d\x08\x61\xe4\x14\x0c\xc5\x2f\x11\xf1\xe9\x43\x98\x82\xb7\xc0\x40\xa9\xc6\x81\xc2\xd2\xa1\x05\xcb\x99\x80\x47\x87\x9e\xc1\xbf\x80\xb4\xb2\x84\x4c\x58\xcc\x21\xf9\x01\xd2\x49\xcf\x09\x16\x99\x88\xe1\xc4\x79\x2c\x81\xe7\x10\xe8\x05\xf8\x62\x95\xcd\x28\x7d\x9b\x8e\x0e\x84\xd8\xbe\x52\x8c\x92\x93\x0a\x1a\x5e\x72\x73\xf0\x90\x94\x68\x35\xa3\xd7\x76\x96\xd0\x92\x18\xca\x03\x72\xa0\x62\xb6\x04\x06\x14\xa3\x6f\x32\x2f\x25\xab\xf9\xa7\x56\x29\xf6\x29\xc6\x3e\xe5\xd8\xb3\x20\x0c\xa5\x33\x92\xe1\x69\x97\xad\x73\xab\xa9\xac\x45\x96\xac\xd1\xae\x77\x2d\x6a\x12\xc5\xa6\xb7\x46\x0e\x85\x0c\x86\x13\x85\x96\xa5\xb6\xe0\xb7\x6f\xce\x74\x4a\xb0\x5f\x11\xf6\x2b\xc3\xde\xca\x78\xa5\x3a\x84\x58\x9d\x70\x3d\xa1\x28\xb4\xd5\xbc\x7c\xce\x28\xee\xe5\x7c\x23\x2a\x84\x87\x6f\x41\x7b\xc8\x2f\x42\x54\xcb\x9d\x9a\x43\x1e\x8c\xb6\xb3\xeb\x99\xc5\x75\xf8\xf2\x11\x54\x88\xf5\x6e\xcf\x6c\x38\xef\x9e\xf4\x74\x0f\xbe\xa4\xee\x70\xd2\xc8\xeb\xf2\xd1\x79\x20\xea\x9e\xd6\x0a\xf1\x00\xcb\xa7\x3a\x79\x34\xd0\x4b\x12\xf2\x19\xf4\x66\x08\x81\x0e\xbc\x8c\x02\x16\x17\x08\x74\x83\x7c\xf9\xa8\x89\x9f\x60\xce\x6b\xf4\x9a\x97\x63\x23\x89\x6e\xea\x43\x38\x6c\x1a\x20\x51\x26\x10\x83\x4f\x94\xd7\xac\x95\x34\x87\x4f\x53\xd6\xca\x58\xef\x2e\x11\xd2\xcf\x5a\x7b\x4d\x44\x92\x7c\x87\x69\x6a\x34\x31\xd8\x44\xe6\x79\xcc\xe7\x6c\x74\xf2\x6b\x3a\x4c\x87\xe9\x28\xfb\x30\x1a\x0e\x3b\x68\x27\x79\x9e\xd2\x92\x0a\x3a\x1b\xcc\x91\x78\x40\x4b\xda\x04\x78\x44\x5e\x23\xe2\x3f\x1d\x88\xc5\x44\xa1\x69\x8a\x9b\x7e\xd7\x85\xee\x8c\x3e\x0f\x29\x17\x52\x6d\x0b\x7c\x61\xd8\x02\x7f\x47\xff\x30\xf1\x18\x18\x5e\xc6\xe4\xb0\x48\x9f\x12\x4b\x76\xb0\x15\xda\x40\x53\xcf\x54\x37\x02\x49\x4a\x0c\x96\x13\x87\xda\x32\x9d\x7d\x1d\x1c\xe5\xb0\xa8\x9c\x47\x55\xd1\x92\xaa\x85\xf4\x03\xa3\xa7\x83\x1c\xd5\x03\xf8\x41\xfa\xd3\xf1\xd1\x9b\x6a\x70\xfc\x7a\xf6\x82\x12\x5e\x3a\xa0\xb3\xaf\x47\x32\x30\x16\x54\x4d\xb5\x2d\x4a\x9e\x94\x9a\x54\xa5\x66\x1e\x83\xab\x14\xda\x42\xcf\x0a\xaa\x72\x98\x86\xe6\x77\xe1\xb8\xfe\xe1\xd2\x15\x54\x15\x81\xa2\x37\x54\xf3\x30\x03\x36\xd3\x82\xaa\xf2\x5b\x80\x00\x15\x2e\xc0\x1b\xb9\x6c\x36\x1c\xff\x14\x54\x39\x62\xf4\x50\x79\xa7\x26\x4e\x3b\x28\xa8\x22\x50\x21\xaa\x2a\x7e\xc6\x43\xad\xd8\x4b\x05\x05\x1d\xbf\x59\x27\xa2\x4b\x39\x83\x4c\x4c\x41\x19\x39\x1d\x74\x1a\x3f\x8b\x22\x39\x7d\x6e\xc4\x1d\xd6\xb0\x5a\x68\x8c\x96\xe1\x91\xdb\xed\xe2\xbc\x5e\x68\x03\x33\xc8\x33\xc1\x3e\xb4\xfb\xc2\x07\x7b\x4e\x7f\x52\xf4\xb6\x67\x19\x7a\x20\x0c\x5e\x41\xa7\xe7\x8c\x2e\x35\xf7\xba\x50\xb9\x90\x89\xc3\xd1\x61\x27\x58\x42\x89\x7e\x99\x89\xd3\xe1\xf0\xb3\xee\xb9\x05\xd0\x56\x8a\xd1\xf0\xa4\xdc\xca\x31\x7a\xdf\xe6\x58\xa0\x09\x25\x7c\x8e\xa2\xe9\xb4\x58\x2d\xa3\x5b\xc9\xf3\x4c\x34\x0d\x11\x4f\xa3\xc5\xd7\x94\xad\x17\xf4\x20\xf3\x3f\xac\x59\xf6\x4a\xb2\x85\xad\xdd\x80\x2b\xb2\x6e\xec\xf5\x5c\x9d\x56\x15\x4f\xe3\x1e\x9d\x9c\xd5\x77\x52\x26\xae\x90\xf8\x1e\xc7\x2b\x63\xd9\x58\xb8\x47\xb0\x75\xe5\x6d\x26\x64\x70\xc6\x48\x9c\x83\xf7\x9d\x78\x2d\x1b\x48\x7a\xfe\xf4\xcf\x9b\xa3\xeb\xdb\xe3\x7f\x37\xdd\x89\x0d\x25\x4a\xc7\x87\x42\x42\x41\x33\xd0\xd9\xfd\xa7\xbb\xc9\xe5\xf8\xe2\xea\x72\xf2\xe5\xee\x7c\xf2\xf7\xf5\xfd\xd5\xe4\xfc\xf2\x6e\x32\x3a\x79\x3f\xf9\x38\xfe\x3c\xb9\xbb\x3a\x3f\x39\x7d\xf7\xf3\x33\xea\x72\x7c\xf1\x03\xdc\x06\xcf\xf8\xb7\xf1\xab\x78\xb6\xe2\x76\xb0\x75\x32\x0b\x8e\xd8\x83\x2c\xcf\xe6\xcc\x2e\x1b\x0c\xba\x16\x3d\x58\x63\xc1\x2e\xda\x95\x6d\x4e\xe5\xfa\xb6\x75\x26\x0b\x69\x02\xfc\xee\xb1\xec\x2a\xbd\xd0\x60\xf2\x2f\x50\xf4\x2f\xb2\x3a\xde\x68\x84\x58\x72\xa0\xd4\x61\xde\x22\xec\xda\x43\x7d\xcd\xfb\xa9\x54\xf1\xae\x7f\x5c\x66\xc3\x74\xf4\x21\x1d\x76\xc1\xb7\xc1\x98\x5b\x34\x5a\x2d\x33\x71\x5d\xdc\x20\xdf\x7a\x20\xb0\xdc\xf3\x91\x1e\xd5\x7a\x34\x1a\x4b\x47\x3d\xeb\x6b\xee\x16\x3d\x67\xa2\x23\x0a\x21\xa2\xae\xb7\x0e\x34\xab\xc4\x72\xd2\xff\x6c\x2d\xa3\x7d\xac\x65\xbb\xb3\x9c\xb4\x19\x76\x78\x67\x6d\x90\x1f\xe3\x55\x91\x89\x77\xa7\xa7\x6f\x4f\xfa\x63\x37\x68\xbf\x20\xf2\x2e\x67\x6d\xcf\x8b\xd5\xba\x69\xee\xd5\xce\x94\xba\x8a\xd7\x17\x9d\x58\xfb\x8d\xd4\x7d\xac\x3e\xbf\x73\x90\x32\x61\xb4\x0d\x8f\x07\x3f\x48\xa5\xb7\x9f\x5f\xd6\x78\xbf\xd0\x0a\xce\x95\x8a\x56\x74\xf3\xe2\x05\xc3\x68\xe2\xdb\xa9\xfd\x12\x4b\x5a\xef\xa9\xfa\x21\xb5\x3a\xe6\xc6\xa7\x5b\xb8\x3a\xb9\xa8\xf0\xf6\xa5\xd4\xb8\x62\xc7\x95\x37\x8c\x7a\xe7\xd4\xb6\x07\xf7\x5d\x79\xe7\xc4\x83\x4d\x4b\xfd\x2f\x00\x00\xff\xff\x16\xe8\xae\x25\x03\x0e\x00\x00"),
 		},
 		"/build/prometheus/node-exporter/node-exporter-prometheusRule.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "node-exporter-prometheusRule.yaml",
@@ -405,7 +405,7 @@ var assets = func() http.FileSystem {
 		},
 		"/build/prometheus/prometheus": &vfsgen۰DirInfo{
 			name:    "prometheus",
-			modTime: time.Date(2025, 7, 31, 8, 50, 53, 956818053, time.UTC),
+			modTime: time.Date(2025, 11, 20, 6, 44, 5, 168147675, time.UTC),
 		},
 		"/build/prometheus/prometheus/prometheus-clusterRole.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "prometheus-clusterRole.yaml",
@@ -430,10 +430,10 @@ var assets = func() http.FileSystem {
 		},
 		"/build/prometheus/prometheus/prometheus-prometheus.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "prometheus-prometheus.yaml",
-			modTime:          time.Date(2025, 7, 31, 8, 50, 53, 956443425, time.UTC),
-			uncompressedSize: 2390,
+			modTime:          time.Date(2025, 11, 20, 6, 44, 5, 168271717, time.UTC),
+			uncompressedSize: 2437,
 
-			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xac\x95\x5f\x6f\xe3\x36\x0c\xc0\xdf\xfd\x29\x88\xdb\xb3\xd3\xa4\x3b\x60\x83\xde\x8a\xae\x38\x1c\xb6\x2b\x86\xdd\x6d\xef\x8a\xcc\x24\x42\x25\x51\xa5\xa8\x5c\x82\x61\xdf\x7d\x90\xed\xc4\x7f\xd6\xa6\x29\x30\x3f\xd9\x14\x49\xf3\xcf\x8f\x94\x8e\xf6\x2f\xe4\x64\x29\x28\xf0\x14\xac\x10\xdb\xb0\x5d\x18\x62\xa4\xb4\x30\xe4\x6f\xf6\xab\xea\xc9\x86\x46\xc1\xef\x4c\x1e\x65\x87\x39\x55\x1e\x45\x37\x5a\xb4\xaa\x00\x9c\x5e\xa3\x4b\xe5\x0d\x40\xc7\xb8\x78\xca\x6b\xe4\x80\x82\x69\x61\xe9\xc6\x90\x8f\x14\x30\x88\x82\x38\xd8\xbf\xac\x6b\x43\x12\x1d\x0c\x2a\x78\xfa\xf9\x35\x9d\xa0\x3d\x5e\xe1\x2a\x6a\x96\x9a\x36\x0a\x8a\xb8\x7e\x53\x7d\x7f\x2a\xc1\xed\xe2\xc7\x8f\x8b\x65\x05\xd0\xfd\xa7\x8b\xa3\xbc\xa7\xa8\xdb\xc0\xf2\x1a\x53\xdc\x21\x63\x3d\x54\xab\x4e\xc7\x24\xe8\xab\x14\xd1\x94\x3a\xe8\xcd\xc6\x06\x2b\xc7\xae\x26\x81\x1a\xbc\x9b\x48\x00\x22\xe3\x06\x99\xb1\xf9\x25\x17\x07\x5f\xcd\x0e\x9b\xec\x6c\xd8\x7e\xde\x06\x3a\x8b\x1f\x0e\x68\xb2\x94\xb8\x7a\xb3\xba\x37\xc4\x52\xa4\x5e\x56\x1e\xaf\xc5\xec\x1e\x0e\x91\x31\x95\x34\xd2\xf8\xac\x86\x27\x3c\xaa\x36\x8a\x9a\xc9\xe1\x2c\xf3\x21\x8b\x91\x0d\x00\x45\x64\x2d\xc4\x0a\x1e\x0e\x36\x49\x3a\x1f\x7e\x47\xbb\xdd\x89\x82\xd5\x72\xd9\xca\x22\x35\x77\x41\xec\xff\x97\x20\x35\x27\x5f\xdf\x90\xfd\x38\x93\x16\xb4\xaf\xe8\xd0\x94\xc0\x26\xe1\xb6\x05\xf8\x6d\x04\xe2\xf0\xbc\x07\xc9\x4b\x56\xff\x85\xf3\x92\xf6\x8b\x98\x5e\x32\xb8\x08\x6c\xf7\x9c\x31\x9c\xf7\xf7\x12\x93\x83\xa2\x50\x24\x47\xdb\xe3\xaf\x05\x87\xe9\xcf\x77\x94\xa4\x78\x7f\xa5\xcb\xda\x21\x8b\x0d\xdb\x7e\xc6\xcb\x97\xd7\x41\x6f\x91\xfb\x48\x6a\x18\xaf\x91\xfd\x6d\x35\x04\xac\x26\xfa\xb5\xd7\x36\x54\xb3\x74\xd4\x35\x19\x44\x62\x51\xf0\x1d\xd7\x15\x00\xee\xb5\xcb\xba\x70\xf3\x39\x08\xf2\x5e\x3b\x05\xab\xa2\x88\x07\x41\x0e\xda\xf5\x24\xc0\xdf\xff\x54\x00\xd6\xeb\x6d\xdf\x8b\x9b\xa1\xae\x6a\x3f\x8c\x3a\x35\x38\xc5\x6a\x5a\x1d\x4a\x0a\x9c\x0d\xf9\x50\xb5\xb8\x7f\x19\xed\xbe\xe9\xf6\x7b\x2f\x6c\xd7\x41\x76\x35\x5c\xef\x86\xea\x9a\x3d\x28\xe4\xca\x26\x38\x6d\x95\x1a\x70\xb3\x41\x23\x0a\x1e\xa9\x1f\xea\x8e\x9a\x76\xc9\x34\xd8\x58\xa3\x05\x9b\x6a\xb6\x43\x9e\xb3\x76\xad\xac\x74\x0e\xc7\x37\x4d\x5f\xd3\xee\xfb\xf1\x84\xc4\xb9\x1d\x5d\x0b\x07\x8d\xf9\x01\xd3\x1a\x5f\xb5\x2a\x87\x33\xd9\x73\x46\xee\x97\x94\xd7\x87\x7b\x0a\x26\x73\x59\xa7\xc7\x96\xf5\x92\x30\x63\x74\xd6\xe8\xa4\x60\x05\x3f\x80\x50\x43\xad\x30\x51\xe6\xf3\xe4\x39\xeb\xad\x9c\x9b\x6e\x62\x56\xf0\x61\xf5\xa1\xff\xf4\xe8\x89\x8f\x0a\x3e\x7e\xb2\xad\x84\xf1\x39\x63\x9a\xa9\xdf\x2e\x97\x7e\xae\xbf\x5c\x7e\x29\x16\x9c\xdd\xab\x29\x95\xb3\x29\xaa\x2f\x6c\xbe\x11\xe4\x23\x8c\xca\xee\xef\x87\xb1\x2e\x6e\x8a\x3c\x19\xd6\x11\x67\x43\x94\xd0\x64\xb6\x72\xbc\xa7\x20\x78\x90\xce\xeb\x26\x7d\x62\xca\x51\x41\xb7\xf5\x39\x87\xbb\xf4\x48\xe1\x0f\x22\x51\xb0\xd1\x2e\xe1\x20\xff\x33\x21\x77\x8a\x09\x79\x6f\x0d\xde\x19\x43\x39\xc8\xe3\x0c\xdb\xba\x0b\xae\x57\x7a\x03\x81\xa9\xd6\xbc\x2c\x28\x18\xda\x7b\x04\x7e\x2a\xec\x25\x21\x2e\x43\xdf\x21\x47\x2e\x7b\xbc\x77\xda\xfa\x6f\xe8\xa3\xd3\x72\xbe\x3b\x4f\x17\x76\x5f\xa1\x69\x93\x4f\xc2\x69\xf7\x7a\xc3\xfe\x07\x70\xbb\x6c\xbb\x3c\x9f\x9b\x7f\x03\x00\x00\xff\xff\xf1\x72\x17\xdb\x56\x09\x00\x00"),
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xac\x55\x4d\x6f\xe3\x36\x10\xbd\xeb\x57\x0c\xd2\xb3\x1c\x27\x5d\xa0\x05\x6f\x41\x1a\x2c\x16\xed\x1a\x45\x77\xdb\x3b\x4d\x8d\x6d\x22\x24\x87\x19\x0e\xbd\x36\x8a\xfe\xf7\x82\x92\x6c\x7d\x34\xf1\x3a\x40\x75\x12\x87\x6f\x86\xf3\xf1\xf8\xa8\xa3\xfd\x0b\x39\x59\x0a\x0a\x3c\x05\x2b\xc4\x36\x6c\x17\x86\x18\x29\x2d\x0c\xf9\xdb\xfd\x5d\xf5\x6c\x43\xa3\xe0\x77\x26\x8f\xb2\xc3\x9c\x2a\x8f\xa2\x1b\x2d\x5a\x55\x00\x4e\xaf\xd1\xa5\xf2\x07\xa0\x63\x5c\x3c\xe7\x35\x72\x40\xc1\xb4\xb0\x74\x6b\xc8\x47\x0a\x18\x44\x41\x1c\xfc\x5f\xc7\xda\x90\x44\x07\x83\x0a\x9e\x7f\x7e\x0b\x13\xb4\xc7\x2b\x42\x45\xcd\x52\xd3\x46\x41\x31\xd7\xdf\x85\xef\x4f\x2d\xb8\x5f\xfc\xf8\x61\xb1\xac\x00\xba\x73\xba\x3c\xca\x7f\x8a\xba\x4d\x2c\xaf\x31\xc5\x1d\x32\xd6\x43\xb7\xea\x74\x4c\x82\xbe\x4a\x11\x4d\xe9\x43\x64\x4b\x6c\xe5\xf8\xe8\x74\x4a\xab\x36\xd0\x4d\x07\xa9\x8d\xcb\x49\x90\x6b\xc3\x56\xac\xd1\xee\xa6\x02\xd0\x9b\x8d\x0d\x56\x8e\x5d\x0b\x03\x35\xf8\x30\xb1\x94\x80\xb8\x41\x66\x6c\x7e\xc9\xe5\xbc\x2f\x66\x87\x4d\x76\x36\x6c\x3f\x6d\x03\x9d\xcd\x4f\x07\x34\x59\x4a\x19\xbd\x5b\xdd\x3b\x62\xe9\x69\x6f\x2b\x9f\xd7\x62\x76\x4f\x87\xc8\x98\x4a\xd5\x69\xbc\x57\xc3\x33\x1e\x55\x9b\x45\xcd\xe4\x70\xd6\xa8\xa1\xe8\x91\x0f\x00\x45\x64\x2d\xc4\x0a\x9e\x0e\x36\x49\x3a\x6f\x7e\x43\xbb\xdd\x89\x82\xbb\xe5\xb2\xb5\x45\x6a\x1e\x82\xd8\xff\xaf\x40\x6a\x4e\xb1\xbe\x22\xfb\x71\x25\x2d\x2f\xbf\xa0\x43\x53\x12\x9b\xa4\xdb\x36\xe0\xb7\x11\x6f\x87\xef\x3d\x0c\xbe\xe4\xf5\x5f\x2e\x5f\x42\xbf\xca\xea\x4b\x0e\x17\xf9\xdd\x7d\x67\xd6\xce\xe7\x7b\x89\xc2\x03\x50\x28\x92\xa3\xed\xf1\xd7\x42\x87\xe9\xe1\x3b\x4a\x52\xa2\xbf\x31\x65\xed\x90\xc5\x86\x6d\x2f\x09\x65\xe5\x75\xd0\x5b\xe4\x3e\x93\x1a\xc6\xaa\xb3\xbf\xaf\x86\x84\xd5\x04\x5f\x7b\x6d\x43\x35\x2b\x47\x5d\x53\x41\x24\x16\x05\xdf\x70\x5d\x01\xe0\x5e\xbb\xac\x0b\x6f\x3e\x05\x41\xde\x6b\xa7\xe0\xae\x00\xf1\x20\xc8\x41\xbb\x9e\x09\xf0\xf7\x3f\x15\x80\xf5\x7a\xdb\xcf\xe2\x76\xe8\xab\xda\x0f\xca\x40\x0d\x4e\x69\x35\xed\x0e\x25\x05\xce\x86\x7c\xa8\x5a\xba\x7f\x1e\x49\xe5\x54\x2c\xdf\x4b\xb6\xeb\x48\x76\x35\xb9\xde\x4d\xaa\x6b\x64\x53\xc8\x15\x25\x38\xa9\x4a\x0d\xb8\xd9\xa0\x11\x05\x2b\xea\x2f\x75\xc7\x9a\x56\x64\x1a\x6c\xac\xd1\x82\x4d\x35\xd3\x90\x97\xac\x5d\x6b\x2b\x93\xc3\xf1\xc3\xd4\xf7\xb4\x5b\xaf\x4e\x94\x38\x8f\xa3\x1b\xe1\x80\x98\x6f\x30\xad\xf1\x4d\xaf\xb2\x39\xb3\xbd\x64\xe4\x5e\xa4\xbc\x3e\x3c\x52\x30\x99\x8b\x9c\x1e\x5b\xae\x97\x82\x19\xa3\xb3\x46\x27\x05\x77\xf0\x03\x08\x35\xd4\x1a\x13\x65\x3e\xdf\x3c\x67\xbd\x95\xf3\xd0\x4d\xcc\x0a\x6e\xee\x6e\xfa\xa5\x47\x4f\x7c\x54\xf0\xe1\xa3\x6d\x2d\x8c\x2f\x19\xd3\x0c\x7e\xbf\x5c\xfa\x39\x7e\xb9\xfc\x5c\x3c\x38\xbb\x37\x4b\x2a\x7b\x53\xaa\xbe\xa2\x7c\x23\x92\x8f\x68\x54\xb4\xbf\xbf\x8c\x75\x09\x53\xec\xc9\xb0\x8e\x38\xbb\x44\x09\x4d\x6e\x1f\x3b\x0a\x82\x07\xe9\xa2\x6e\xd2\x47\xa6\x1c\x15\x74\xaa\xcf\x39\x3c\xa4\x15\x85\x3f\x88\x44\xc1\x46\xbb\x84\x83\xfd\xcf\x84\xdc\x01\x13\xf2\xde\x1a\x7c\x30\x86\x72\x90\xd5\x8c\xb6\x75\x97\x5c\x0f\xfa\x0e\x05\xa6\xa8\x79\x5b\x50\x30\xb4\xef\x08\xfc\x54\xb8\x97\x84\xb8\x5c\xfa\x8e\x72\xe4\xb2\xc7\x47\xa7\xad\xff\x8a\x3e\x3a\x2d\xe7\xb7\xf3\xf4\xbe\xf7\x1d\x9a\x0e\xf9\x64\x9c\x4e\xaf\x77\xec\x0f\x80\xfb\x65\x3b\xe5\xf9\xbd\xf9\x37\x00\x00\xff\xff\xf9\x77\x43\xb8\x85\x09\x00\x00"),
 		},
 		"/build/prometheus/prometheus/prometheus-prometheusRule.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "prometheus-prometheusRule.yaml",
@@ -479,7 +479,7 @@ var assets = func() http.FileSystem {
 		},
 		"/build/prometheus/prometheus-operator": &vfsgen۰DirInfo{
 			name:    "prometheus-operator",
-			modTime: time.Date(2025, 7, 31, 8, 50, 53, 956105380, time.UTC),
+			modTime: time.Date(2025, 9, 30, 6, 56, 49, 644205868, time.UTC),
 		},
 		"/build/prometheus/prometheus-operator/prometheus-operator-0alertmanagerConfigCustomResourceDefinition.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "prometheus-operator-0alertmanagerConfigCustomResourceDefinition.yaml",
@@ -553,10 +553,10 @@ var assets = func() http.FileSystem {
 		},
 		"/build/prometheus/prometheus-operator/prometheus-operator-deployment.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "prometheus-operator-deployment.yaml",
-			modTime:          time.Date(2025, 7, 31, 8, 50, 53, 955873212, time.UTC),
-			uncompressedSize: 2302,
+			modTime:          time.Date(2025, 9, 30, 6, 56, 49, 644555649, time.UTC),
+			uncompressedSize: 2301,
 
-			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\x9c\x55\x4d\x6f\x1b\x37\x10\xbd\xeb\x57\x10\x39\x97\xfb\xa1\x58\xa9\x4b\x40\x07\x55\x16\xe2\x02\x49\x10\x44\x69\x7b\x14\x68\xee\x48\x26\x42\x72\xd8\xe1\xac\x6a\xa1\xe8\x7f\x0f\x76\x1d\x49\xbb\x8a\xf5\x65\x9d\x84\x99\xc7\xc7\x79\x6f\x1f\x49\x1d\xed\x5f\x40\xc9\x62\x50\x42\xc7\x98\xf2\x75\x39\xf8\x66\x43\xa5\xc4\x1d\x44\x87\x1b\x0f\x81\x07\x1e\x58\x57\x9a\xb5\x1a\x08\xe1\xf4\x03\xb8\xd4\xfc\x13\xcd\x82\xec\x5b\xfd\x00\x14\x80\x21\x65\x16\x73\x83\x3e\x62\x80\xc0\x4a\x18\x0c\x4c\xe8\x1c\xd0\x11\x6c\xd0\x1e\x94\x88\x84\x1e\xf8\x11\xea\x24\x31\x02\x69\xc6\x63\xf8\xa8\x89\x25\x2e\x95\x68\xca\x72\xbf\xee\x08\x7c\xbd\x95\x55\x64\xa3\x51\x56\x0e\x84\x38\xb5\x61\xd3\x4b\x51\x1b\x78\xa6\x4f\xf1\x11\x08\xa4\xc7\x60\x19\xc9\x86\x95\x4c\x9b\xc4\xe0\x07\x29\x82\x69\xc4\x13\x44\x67\x8d\x4e\x4a\x34\xcc\x09\x1c\x18\x46\x7a\xb6\xc5\x6b\x36\x8f\x1f\x3a\x3e\x5d\xe7\xd4\xf5\x5e\x5d\xe9\x16\x83\x8f\x4e\x33\xfc\x98\xb6\xf3\x71\x5b\xaa\x10\x90\x35\x5b\x0c\xbb\xe9\x45\x4b\x62\xd8\x1d\xec\x51\xc1\x52\xd7\x8e\x65\x23\x40\xdb\x00\x74\x6a\x44\xd7\x33\xe4\x5a\x4b\x5e\x63\xca\xd5\x21\xba\x34\x48\x42\x6c\x63\xd0\xfc\x76\xea\x77\xe2\xa4\xd0\xb4\xea\x48\x95\x42\xca\x86\xd3\x01\xcb\x04\xb4\xb6\x06\xc6\xed\xfe\xcf\xa1\xca\x7f\xf4\x7a\xf8\x8e\x2c\x83\x61\x69\x57\x92\xc0\xa1\xae\x80\xc6\xfb\x80\xe6\xc7\x51\x6a\xdd\x19\xb7\xf9\x59\xaf\x57\xbd\x74\xe7\x2f\x38\xf7\xd3\xaa\xf3\x1e\x47\x24\xee\x69\xdd\xf9\xf1\x19\x89\x95\xb8\x2d\x6e\x8b\x5d\x77\x4b\xf8\xc8\x1c\x77\x45\x82\x84\x35\x19\xe8\xb0\x08\xe1\xac\xb7\xdc\xab\x08\x61\x62\xad\xc4\xb0\x28\x7c\xaf\xea\xc1\x23\x6d\xda\xc6\x47\xdb\xe9\x10\xfc\x53\x43\x7a\x91\xa3\x3c\xc6\x51\xf6\x38\x12\x98\x9a\x2c\x6f\xa6\x18\x18\x9e\xb8\x4b\xa4\x9d\xc3\x7f\x3f\x93\x5d\x5b\x07\x2b\x98\x25\xa3\x5d\x7b\x66\x94\x58\x6a\x97\xe0\x44\x10\x1c\xae\x18\x13\x57\x40\xd4\xab\xb7\x9b\x81\x74\x36\x31\x04\xa9\xab\x8a\x20\xa5\xb1\xba\xbd\xb9\x79\xdb\xc3\xb1\x4b\xd2\xd8\xe6\x0b\xca\x54\x5b\x86\x34\xfe\xfa\x61\xbe\x98\x4d\xef\xee\x67\x8b\x2f\xf3\xc9\xe2\xef\x3f\xbe\xde\x2f\x26\xb3\xf9\xa2\x1c\xde\x2e\xde\x4f\x3f\x2e\xe6\xf7\x93\xe1\xe8\xdd\x2f\x7b\xd4\x6c\x7a\x77\x06\xf7\x13\xcf\xf4\xf7\xe9\x45\x3c\x2f\xe2\x4e\xb0\xf5\x94\xd5\x31\x31\x81\xf6\xe3\x26\x1d\x2a\xcf\xcb\xe1\xaf\x59\x91\x15\x59\xa9\x9a\x0c\xe5\x87\x49\x7e\xb0\x1c\xb4\xb7\xed\xe9\x91\xf4\xa0\x4d\x73\x66\x9e\x36\xaa\xc8\xca\xdf\xb2\xe2\x20\xc1\x07\xa0\xcb\xd3\xdb\xb5\xbf\x9b\xde\xf4\xca\xf8\xbe\x29\xdf\x5c\x90\xbc\x33\xe9\x3d\x76\x00\x2e\xcb\x2e\xd5\x61\x92\xde\x13\xd6\x51\x89\x77\xa3\xd1\xdb\xe1\x61\xef\x13\x86\x2f\x88\xac\x04\x53\x0d\x87\xcd\x3f\x53\x73\xcf\x77\xd7\x05\xac\x60\xde\x7b\x01\xb7\x4f\xc6\xfe\x12\xc5\xa4\x84\xb3\xa1\x7e\xda\xbe\x32\xcb\xa5\x0d\x96\x37\x4a\xfc\xf7\xff\xe0\xcc\xc4\x27\x66\x3a\x98\xe8\x66\x47\xd5\x5e\xb2\x13\x63\xb0\x0e\xfc\xe9\xe8\x1d\xf6\x3d\x00\x00\xff\xff\xa0\xe0\x3e\x3f\xfe\x08\x00\x00"),
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\x9c\x55\x5d\x8f\x1a\x37\x14\x7d\xe7\x57\x58\x79\xae\xe7\x83\x2c\x29\xb5\xc4\x03\x65\x51\xb6\x52\x12\x45\x21\x6d\x1f\x91\xf1\x5c\xc0\x8a\xc7\xd7\xbd\xbe\x43\x17\x55\xfd\xef\xd1\xcc\x2e\x30\xc3\x2e\x5f\xcb\x13\xba\xf7\xf8\xf8\x9e\x33\xc7\xb6\x0e\xf6\x2f\xa0\x68\xd1\x2b\xa1\x43\x88\xe9\x26\xef\xfd\xb0\xbe\x50\xe2\x1e\x82\xc3\x6d\x09\x9e\x7b\x25\xb0\x2e\x34\x6b\xd5\x13\xc2\xe9\x05\xb8\x58\xff\x13\xf5\x82\xe4\x47\xb5\x00\xf2\xc0\x10\x13\x8b\xa9\xc1\x32\xa0\x07\xcf\x4a\x18\xf4\x4c\xe8\x1c\xd0\x09\xac\xd7\x25\x28\x11\x08\x4b\xe0\x35\x54\x51\x62\x00\xd2\x8c\xa7\xf0\x41\x13\x4b\x5c\x2a\x51\x97\xe5\x61\xdd\x09\xf8\x66\x27\x2b\x4b\x06\x83\x24\xef\x09\x71\x6e\xc3\xba\x17\x83\x36\xf0\x44\x1f\xc3\x1a\x08\x64\x89\xde\x32\x92\xf5\x2b\x19\xb7\x91\xa1\xec\xc5\x00\xa6\x16\x4f\x10\x9c\x35\x3a\x2a\x51\x33\x47\x70\x60\x18\xe9\xc9\x96\x52\xb3\x59\x7f\x6a\xf9\x74\x9b\x53\xb7\x7b\x75\xa3\x5b\x0c\x65\x70\x9a\xe1\x79\xda\xd6\xc7\x6d\xa8\xbc\x47\xd6\x6c\xd1\xef\xa7\x17\x0d\x89\x61\x77\xb4\x47\x01\x4b\x5d\x39\x96\xb5\x00\x6d\x3d\xd0\xb9\x11\x5d\xc7\x90\x5b\x2d\x79\x8b\x29\x37\x87\xe8\xda\x20\x09\xb1\x8b\x41\xfd\xdb\xab\xdf\x8b\x93\x42\xd3\xaa\x25\x55\x0a\x29\x6b\x4e\x07\x2c\x23\xd0\xc6\x1a\x18\x35\xfb\x3f\x85\x2a\x7d\xee\x75\xf0\x2d\x59\x06\xfd\xd2\xae\x24\x81\x43\x5d\x00\x8d\x0e\x01\x4d\x4f\xa3\xd4\xa6\x35\x6e\xfd\xb3\xa5\x5e\x75\xd2\x9d\xbe\xe2\xdc\x8b\x55\x97\x3d\x0e\x48\xdc\xd1\xba\xf7\xe3\x2b\x12\x2b\x31\xcc\x86\xd9\xbe\xbb\x23\x5c\x33\x87\x7d\x91\x20\x62\x45\x06\x5a\x2c\x42\x38\x5b\x5a\xee\x54\x84\x30\xa1\x52\xa2\x9f\x65\x65\xa7\x5a\x42\x89\xb4\x6d\x1a\x9f\x6d\xab\x43\xf0\x4f\x05\xf1\x55\x8e\xfc\x14\x47\xde\xe1\x88\x60\x2a\xb2\xbc\x9d\xa0\x67\x78\xe4\x36\x91\x76\x0e\xff\xfd\x4a\x76\x63\x1d\xac\x60\x1a\x8d\x76\xcd\x99\x51\x62\xa9\x5d\x84\x33\x41\x70\xb8\x62\x8c\x5c\x00\x51\xa7\xde\x6c\x06\xd2\xd9\xc8\xe0\xa5\x2e\x0a\x82\x18\x47\x6a\x78\x77\xf7\xbe\x83\x63\x17\xa5\xb1\xf5\x17\x94\xb1\xb2\x0c\x71\xf4\xfd\xd3\x6c\x3e\x9d\xdc\x3f\x4c\xe7\xdf\x66\xe3\xf9\xdf\x7f\x7c\x7f\x98\x8f\xa7\xb3\x79\xde\x1f\xce\x3f\x4e\x3e\xcf\x67\x0f\xe3\xfe\xe0\xc3\x2f\x07\xd4\x74\x72\x7f\x01\xf7\x82\x67\xf2\xfb\xe4\x2a\x9e\x57\x71\x67\xd8\x3a\xca\xaa\x10\x99\x40\x97\xa3\x3a\x1d\x2a\x4d\xf3\xfe\xaf\x49\x96\x64\x49\xae\xea\x0c\xa5\xc7\x49\x5e\x80\x71\x7a\xd1\x1c\x1e\x49\x0b\x6d\xea\x23\xf3\xb8\x55\x59\x92\xff\x96\x64\x47\x01\x3e\x02\x5d\x1f\xde\xb6\xfb\xed\xf0\xc6\x37\xa6\xf7\x5d\xfe\xee\x8a\xe0\x5d\x08\xef\xa9\xfc\x5f\x17\x5d\xaa\xfc\x38\x7e\x24\xac\x82\x12\x1f\x06\x83\xf7\xfd\xe3\xde\x17\xf4\xdf\x10\x59\x09\xa6\x0a\x8e\x9b\x7f\xc6\xfa\x9a\x6f\xaf\xf3\x58\xc0\xac\xf3\x00\xee\x5e\x8c\xc3\x1d\x8a\x51\x09\x67\x7d\xf5\xb8\x7b\x64\x96\x4b\xeb\x2d\x6f\x95\xf8\xef\xff\xde\x85\x89\xcf\xcc\x74\x34\xd1\xdd\x9e\xaa\xb9\x63\xc7\xc6\x60\xe5\xf9\xcb\xc9\x2b\xec\x67\x00\x00\x00\xff\xff\x85\x45\x13\x4e\xfd\x08\x00\x00"),
 		},
 		"/build/prometheus/prometheus-operator/prometheus-operator-prometheusRule.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "prometheus-operator-prometheusRule.yaml",

cli/pkg/kubesphere/plugins/files/build/ks-config/templates/kubesphere-config.yaml

@@ -11,5 +11,5 @@ data:
     notification:
       endpoint: http://notification-manager-svc.kubesphere-monitoring-system.svc:19093
     terminal:
-      image: alpine:3.14
-      timeout: 600
+      image: beclab/alpine:3.14
+      timeout: 7200

cli/pkg/kubesphere/plugins/files/build/ks-core/templates/ks-apiserver.yml

@@ -28,6 +28,7 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      priorityClassName: "system-cluster-critical"
       containers:
       - command:
         - ks-apiserver

cli/pkg/kubesphere/plugins/files/build/prometheus/kube-state-metrics/kube-state-metrics-deployment.yaml

@@ -35,6 +35,7 @@ spec:
         hostPath:
           path: /etc/localtime
           type: ""
+      priorityClassName: "system-cluster-critical"
       containers:
       - args:
         - --host=127.0.0.1
@@ -64,7 +65,7 @@ spec:
         - --secure-listen-address=:8443
         - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
         - --upstream=http://127.0.0.1:8081/
-        image: bitnami/kube-rbac-proxy:0.19.0
+        image: beclab/kube-rbac-proxy:0.19.0
         imagePullPolicy: IfNotPresent
         name: kube-rbac-proxy-main
         ports:
@@ -86,7 +87,7 @@ spec:
         - --secure-listen-address=:9443
         - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
         - --upstream=http://127.0.0.1:8082/
-        image: bitnami/kube-rbac-proxy:0.19.0
+        image: beclab/kube-rbac-proxy:0.19.0
         imagePullPolicy: IfNotPresent
         name: kube-rbac-proxy-self
         ports:

cli/pkg/kubesphere/plugins/files/build/prometheus/kubernetes/kubernetes-serviceMonitorKubelet.yaml

@@ -29,7 +29,7 @@ spec:
       insecureSkipVerify: true
   - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
     honorLabels: true
-    interval: 1m
+    interval: 10s
     metricRelabelings:
     - action: keep
       regex: container_cpu_usage_seconds_total|container_memory_usage_bytes|container_memory_cache|container_network_.+_bytes_total|container_memory_working_set_bytes|container_cpu_cfs_.*periods_total|container_processes.*|container_threads.*

cli/pkg/kubesphere/plugins/files/build/prometheus/node-exporter/node-exporter-daemonset.yaml

@@ -31,6 +31,7 @@ spec:
             - matchExpressions:
               - key: node-role.kubernetes.io/edge
                 operator: DoesNotExist
+      priorityClassName: "system-cluster-critical"
       containers:
       - args:
         - --web.listen-address=127.0.0.1:9100
@@ -42,7 +43,7 @@ spec:
         - --collector.netdev.address-info
         - --collector.filesystem.ignored-mount-points=^/(dev|proc|sys|var/lib/docker/.+)($|/)
         - --collector.filesystem.ignored-fs-types=^(autofs|binfmt_misc|cgroup|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|mqueue|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|sysfs|tracefs)$
-        image: beclab/node-exporter:0.0.4
+        image: beclab/node-exporter:0.0.5
         name: node-exporter
         securityContext:
           privileged: true
@@ -75,7 +76,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.podIP
-        image: bitnami/kube-rbac-proxy:0.19.0
+        image: beclab/kube-rbac-proxy:0.19.0
         imagePullPolicy: IfNotPresent
         name: kube-rbac-proxy
         ports:

cli/pkg/kubesphere/plugins/files/build/prometheus/prometheus-operator/prometheus-operator-deployment.yaml

@@ -48,7 +48,7 @@ spec:
         - --secure-listen-address=:8443
         - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
         - --upstream=http://127.0.0.1:8080/
-        image: bitnami/kube-rbac-proxy:0.19.0
+        image: beclab/kube-rbac-proxy:0.19.0
         name: kube-rbac-proxy
         ports:
         - containerPort: 8443

cli/pkg/kubesphere/plugins/files/build/prometheus/prometheus/prometheus-prometheus.yaml

@@ -10,6 +10,7 @@ metadata:
   name: k8s
   namespace: kubesphere-monitoring-system
 spec:
+  priorityClassName: "system-cluster-critical"
   affinity:
     nodeAffinity:
       preferredDuringSchedulingIgnoredDuringExecution:

cli/pkg/kubesphere/plugins/ks_config.go

@@ -0,0 +1,41 @@
+package plugins
+
+import (
+	"context"
+	"path"
+
+	"github.com/beclab/Olares/cli/pkg/common"
+	cc "github.com/beclab/Olares/cli/pkg/core/common"
+	"github.com/beclab/Olares/cli/pkg/core/connector"
+	"github.com/beclab/Olares/cli/pkg/core/logger"
+	"github.com/beclab/Olares/cli/pkg/utils"
+
+	ctrl "sigs.k8s.io/controller-runtime"
+)
+
+type ApplyKsConfigManifests struct {
+	common.KubeAction
+}
+
+func (t *ApplyKsConfigManifests) Execute(runtime connector.Runtime) error {
+	config, err := ctrl.GetConfig()
+	if err != nil {
+		return err
+	}
+
+	var appKsConfigName = common.ChartNameKsConfig
+	var appPath = path.Join(runtime.GetInstallerDir(), cc.BuildFilesCacheDir, cc.BuildDir, appKsConfigName)
+
+	actionConfig, settings, err := utils.InitConfig(config, common.NamespaceKubesphereSystem)
+	if err != nil {
+		return err
+	}
+
+	var values = make(map[string]interface{})
+	if err := utils.UpgradeCharts(context.Background(), actionConfig, settings, appKsConfigName,
+		appPath, "", common.NamespaceKubesphereSystem, values, false); err != nil {
+		logger.Errorf("failed to install %s chart: %v", appKsConfigName, err)
+		return err
+	}
+	return nil
+}

cli/pkg/phase/download/download_package.go

@@ -12,7 +12,7 @@ func NewDownloadPackage(mainifest string, runtime *common.KubeRuntime) *pipeline
 
 	m := []module.Module{
 		&precheck.GreetingsModule{},
-		&download.PackageDownloadModule{Manifest: mainifest, BaseDir: runtime.GetBaseDir(), DownloadCdnUrl: runtime.Arg.DownloadCdnUrl},
+		&download.PackageDownloadModule{Manifest: mainifest, BaseDir: runtime.GetBaseDir(), CDNService: runtime.Arg.OlaresCDNService},
 	}
 
 	return &pipeline.Pipeline{

cli/pkg/phase/download/download_wizard.go

@@ -12,7 +12,7 @@ func NewDownloadWizard(runtime *common.KubeRuntime, urlOverride, releaseID strin
 
 	m := []module.Module{
 		&precheck.GreetingsModule{},
-		&terminus.InstallWizardDownloadModule{Version: runtime.Arg.OlaresVersion, DownloadCdnUrl: runtime.Arg.DownloadCdnUrl, UrlOverride: urlOverride, ReleaseID: releaseID},
+		&terminus.InstallWizardDownloadModule{Version: runtime.Arg.OlaresVersion, CDNService: runtime.Arg.OlaresCDNService, UrlOverride: urlOverride, ReleaseID: releaseID},
 	}
 
 	return &pipeline.Pipeline{

cli/pkg/pipelines/download_package.go

@@ -16,15 +16,15 @@ func DownloadInstallationPackage(opts *options.CliDownloadOptions) error {
 	arg.SetBaseDir(opts.BaseDir)
 	arg.SetKubeVersion(opts.KubeType)
 	arg.SetOlaresVersion(opts.Version)
-	arg.SetDownloadCdnUrl(opts.DownloadCdnUrl)
+	arg.SetOlaresCDNService(opts.CDNService)
 
 	runtime, err := common.NewKubeRuntime(common.AllInOne, *arg)
 	if err != nil {
 		return err
 	}
 
-	if ok := utils.CheckUrl(arg.DownloadCdnUrl); !ok {
-		return fmt.Errorf("--download-cdn-url invalid")
+	if ok := utils.CheckUrl(arg.OlaresCDNService); !ok {
+		return fmt.Errorf("--cdn-service invalid")
 	}
 
 	manifest := opts.Manifest

cli/pkg/pipelines/download_wizard.go

@@ -15,15 +15,15 @@ func DownloadInstallationWizard(opts *options.CliDownloadWizardOptions) error {
 	arg.SetKubeVersion(opts.KubeType)
 	arg.SetOlaresVersion(opts.Version)
 	arg.SetBaseDir(opts.BaseDir)
-	arg.SetDownloadCdnUrl(opts.DownloadCdnUrl)
+	arg.SetOlaresCDNService(opts.CDNService)
 
 	runtime, err := common.NewKubeRuntime(common.AllInOne, *arg)
 	if err != nil {
 		return err
 	}
 
-	if ok := utils.CheckUrl(arg.DownloadCdnUrl); !ok {
-		return fmt.Errorf("--download-cdn-url invalid")
+	if ok := utils.CheckUrl(arg.OlaresCDNService); !ok {
+		return fmt.Errorf("--cdn-service invalid")
 	}
 
 	p := download.NewDownloadWizard(runtime, opts.UrlOverride, opts.ReleaseID)

cli/pkg/pipelines/gpu_disable_nouveau.go

@@ -0,0 +1,30 @@
+package pipelines
+
+import (
+	"github.com/beclab/Olares/cli/pkg/common"
+	"github.com/beclab/Olares/cli/pkg/core/module"
+	"github.com/beclab/Olares/cli/pkg/core/pipeline"
+	"github.com/beclab/Olares/cli/pkg/gpu"
+)
+
+func DisableNouveau() error {
+	arg := common.NewArgument()
+	arg.SetConsoleLog("gpudisable-nouveau.log", true)
+
+	runtime, err := common.NewKubeRuntime(common.AllInOne, *arg)
+	if err != nil {
+		return err
+	}
+
+	p := &pipeline.Pipeline{
+		Name: "DisableNouveau",
+		Modules: []module.Module{
+			&gpu.DisableNouveauModule{},
+		},
+		Runtime: runtime,
+	}
+
+	return p.Start()
+}
+
+

cli/pkg/pipelines/gpu_upgrade.go

@@ -1,103 +0,0 @@
-package pipelines
-
-import (
-	"fmt"
-	"io"
-	"os/exec"
-	"path"
-	"strings"
-
-	"github.com/beclab/Olares/cli/cmd/ctl/options"
-	"github.com/beclab/Olares/cli/pkg/common"
-	"github.com/beclab/Olares/cli/pkg/core/logger"
-	"github.com/beclab/Olares/cli/pkg/core/module"
-	"github.com/beclab/Olares/cli/pkg/core/pipeline"
-	"github.com/beclab/Olares/cli/pkg/gpu"
-	"github.com/beclab/Olares/cli/pkg/manifest"
-	"github.com/beclab/Olares/cli/pkg/utils"
-)
-
-func UpgradeGpuDrivers(opt *options.InstallGpuOptions) error {
-	arg := common.NewArgument()
-	arg.SetOlaresVersion(opt.Version)
-	arg.SetCudaVersion(opt.Cuda)
-	arg.SetBaseDir(opt.BaseDir)
-	arg.SetConsoleLog("gpuupgrade.log", true)
-	runtime, err := common.NewKubeRuntime(common.AllInOne, *arg)
-	if err != nil {
-		return err
-	}
-
-	manifestFile := path.Join(runtime.GetInstallerDir(), "installation.manifest")
-
-	runtime.Arg.SetManifest(manifestFile)
-
-	manifestMap, err := manifest.ReadAll(runtime.Arg.Manifest)
-	if err != nil {
-		logger.Fatal(err)
-	}
-
-	p := &pipeline.Pipeline{
-		Name: "UpgradeGpuDrivers",
-		Modules: []module.Module{
-			&gpu.ExitIfNoDriverUpgradeNeededModule{},
-			&gpu.UninstallCudaModule{},
-			&gpu.InstallDriversModule{
-				ManifestModule: manifest.ManifestModule{
-					Manifest: manifestMap,
-					BaseDir:  runtime.Arg.BaseDir,
-				},
-				FailOnNoInstallation:      true,
-				SkipNVMLCheckAfterInstall: true,
-			},
-			&gpu.InstallContainerToolkitModule{
-				ManifestModule: manifest.ManifestModule{
-					Manifest: manifestMap,
-					BaseDir:  runtime.Arg.BaseDir,
-				},
-				// when nvidia driver is just upgraded
-				// nvidia-smi will fail to execute
-				SkipCudaCheck: true,
-			},
-			&gpu.RestartContainerdModule{},
-			&gpu.NodeLabelingModule{},
-		},
-		Runtime: runtime,
-	}
-
-	if err := p.Start(); err != nil {
-		return err
-	}
-
-	fmt.Println()
-	fmt.Println("The GPU driver has been upgraded, for it to work properly, the machine needs to be rebooted.")
-	reader, err := utils.GetBufIOReaderOfTerminalInput()
-	if err != nil {
-		return nil
-	}
-	for {
-		fmt.Printf("Reboot now? [yes/no]: ")
-		input, err := reader.ReadString('\n')
-		if err != nil {
-			if err == io.EOF {
-				return nil
-			}
-			return fmt.Errorf("failed to read user input for reboot confirmation: %v", err)
-		}
-		input = strings.ToLower(strings.TrimSpace(input))
-		if input == "" {
-			continue
-		}
-		if strings.HasPrefix("yes", input) {
-			output, err := exec.Command("reboot").CombinedOutput()
-			if err != nil {
-				return fmt.Errorf("failed to reboot: %v", err)
-			}
-			fmt.Println(string(output))
-			return nil
-		} else if strings.HasPrefix("no", input) {
-			return nil
-		}
-	}
-
-}

cli/pkg/pipelines/install_terminus.go

@@ -2,9 +2,10 @@ package pipelines
 
 import (
 	"fmt"
-	"github.com/pkg/errors"
 	"path"
 
+	"github.com/pkg/errors"
+
 	"github.com/beclab/Olares/cli/cmd/ctl/options"
 	"github.com/beclab/Olares/cli/pkg/common"
 	"github.com/beclab/Olares/cli/pkg/core/logger"
@@ -24,7 +25,6 @@ func CliInstallTerminusPipeline(opts *options.CliTerminusInstallOptions) error {
 	arg.SetOlaresVersion(opts.Version)
 	arg.SetMinikubeProfile(opts.MiniKubeProfile)
 	arg.SetStorage(getStorageValueFromEnv())
-	arg.SetReverseProxy()
 	arg.SetTokenMaxAge()
 	arg.SetSwapConfig(opts.SwapConfig)
 	if err := arg.SwapConfig.Validate(); err != nil {
@@ -33,6 +33,9 @@ func CliInstallTerminusPipeline(opts *options.CliTerminusInstallOptions) error {
 	if opts.WithJuiceFS {
 		arg.WithJuiceFS = true
 	}
+	if opts.EnableReverseProxy != nil {
+		arg.NetworkSettings.EnableReverseProxy = opts.EnableReverseProxy
+	}
 	runtime, err := common.NewKubeRuntime(common.AllInOne, *arg)
 	if err != nil {
 		return fmt.Errorf("error creating runtime: %v", err)

cli/pkg/pipelines/prepare_system.go

@@ -36,7 +36,6 @@ func PrepareSystemPipeline(opts *options.CliPrepareSystemOptions, components []s
 	arg.SetRegistryMirrors(opts.RegistryMirrors)
 	arg.SetStorage(getStorageValueFromEnv())
 	arg.SetTokenMaxAge()
-	arg.SetReverseProxy()
 
 	runtime, err := common.NewKubeRuntime(common.AllInOne, *arg)
 	if err != nil {

cli/pkg/plugins/dns/module.go

@@ -43,9 +43,6 @@ type ClusterDNSModule struct {
 func (c *ClusterDNSModule) Init() {
 	c.Name = "ClusterDNSModule"
 
-	// inject coredns svc ip to the global envs before other relative components are created
-	common.TerminusGlobalEnvs["COREDNS_SVC"] = c.KubeConf.Cluster.CorednsClusterIP()
-
 	generateCoreDNDService := &task.RemoteTask{
 		Name:  "GenerateCoreDNSService",
 		Hosts: c.Runtime.GetHostsByRole(common.Master),

cli/pkg/storage/juicefs.go

@@ -9,7 +9,6 @@ import (
 
 	"github.com/beclab/Olares/cli/pkg/common"
 	cc "github.com/beclab/Olares/cli/pkg/core/common"
-	corecommon "github.com/beclab/Olares/cli/pkg/core/common"
 	"github.com/beclab/Olares/cli/pkg/core/connector"
 	"github.com/beclab/Olares/cli/pkg/core/task"
 	"github.com/beclab/Olares/cli/pkg/manifest"
@@ -145,7 +144,7 @@ func (t *EnableJuiceFsService) Execute(runtime connector.Runtime) error {
 		if err != nil {
 			return errors.Wrap(errors.WithStack(err), "render juicefs service template failed")
 		}
-		if err := util.WriteFile(JuiceFsServiceFile, []byte(juiceFsServiceStr), corecommon.FileMode0644); err != nil {
+		if err := util.WriteFile(JuiceFsServiceFile, []byte(juiceFsServiceStr), cc.FileMode0644); err != nil {
 			return errors.Wrap(errors.WithStack(err), fmt.Sprintf("write juicefs service %s failed", JuiceFsServiceFile))
 		}
 	}
@@ -278,5 +277,5 @@ func GetRootFSType() string {
 }
 
 func init() {
-	common.TerminusGlobalEnvs["OLARES_FS_TYPE"] = GetRootFSType()
+	common.SetSystemEnv("OLARES_SYSTEM_ROOTFS_TYPE", GetRootFSType())
 }

cli/pkg/terminus/apps.go

@@ -98,7 +98,7 @@ func (u *PrepareAppValues) Execute(runtime connector.Runtime) error {
 	}
 	fsType := storage.GetRootFSType()
 	gpuType := getGpuType(u.KubeConf.Arg.GPU.Enable)
-	appValues := getAppSecrets(getAppPatches())
+	appValues := getAppSecrets()
 
 	var values = map[string]interface{}{
 		"bfl": map[string]interface{}{
@@ -134,8 +134,7 @@ func (u *PrepareAppValues) Execute(runtime connector.Runtime) error {
 		//"kubesphere": map[string]interface{}{
 		//	"redis_password": redisPassword,
 		//},
-		common.HelmValuesKeyTerminusGlobalEnvs: common.TerminusGlobalEnvs,
-		common.HelmValuesKeyOlaresRootFSPath:   storage.OlaresRootDir,
+		common.HelmValuesKeyOlaresRootFSPath: storage.OlaresRootDir,
 	}
 
 	u.ModuleCache.Set(common.CacheAppValues, values)
@@ -276,7 +275,7 @@ func getBflAnnotation(ctx context.Context, ns string, client clientset.Client, r
 	return sts.Annotations, nil
 }
 
-func getAppSecrets(patches map[string]map[string]interface{}) map[string]interface{} {
+func getAppSecrets() map[string]interface{} {
 	var secrets = make(map[string]interface{})
 	for _, app := range BuiltInApps {
 		s, _ := utils.GeneratePassword(16)
@@ -284,23 +283,8 @@ func getAppSecrets(patches map[string]map[string]interface{}) map[string]interfa
 		v["appKey"] = fmt.Sprintf("bytetrade_%s_%d", app, utils.Random())
 		v["appSecret"] = s
 
-		p, ok := patches[app]
-		if ok && p != nil {
-			for pk, pv := range p {
-				v[pk] = pv
-			}
-		}
-
 		secrets[app] = v
 	}
 
 	return secrets
 }
-
-func getAppPatches() map[string]map[string]interface{} {
-	var patches = make(map[string]map[string]interface{})
-	var value = make(map[string]interface{})
-	value["marketProvider"] = os.Getenv("MARKET_PROVIDER")
-	patches["appstore"] = value
-	return patches
-}

cli/pkg/terminus/launcher.go

@@ -6,12 +6,8 @@ import (
 	"path"
 	"time"
 
-	cc "github.com/beclab/Olares/cli/pkg/core/common"
 	"github.com/beclab/Olares/cli/pkg/core/logger"
-	"github.com/beclab/Olares/cli/pkg/core/util"
 	"github.com/beclab/Olares/cli/pkg/storage"
-	"github.com/beclab/Olares/cli/pkg/terminus/templates"
-	"github.com/pkg/errors"
 
 	"github.com/beclab/Olares/cli/pkg/common"
 	"github.com/beclab/Olares/cli/pkg/core/connector"
@@ -20,28 +16,6 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 )
 
-type GenerateBFLDefaultValues struct {
-	common.KubeAction
-}
-
-func (t *GenerateBFLDefaultValues) Execute(runtime connector.Runtime) error {
-	bflValuesFilePath := path.Join(runtime.GetInstallerDir(), "wizard/config/launcher/values.yaml")
-	data := util.Data{
-		"TerminusCertServiceAPI": t.KubeConf.Arg.TerminusCertServiceAPI,
-		"TerminusDNSServiceAPI":  t.KubeConf.Arg.TerminusDNSServiceAPI,
-	}
-	bflValuesFileContent, err := util.Render(templates.BFLValues, data)
-	if err != nil {
-		return errors.Wrap(errors.WithStack(err), "render BFL default values.yaml failed")
-	}
-
-	if err := util.WriteFile(bflValuesFilePath, []byte(bflValuesFileContent), cc.FileMode0644); err != nil {
-		return errors.Wrap(errors.WithStack(err), fmt.Sprintf("write account %s failed", bflValuesFilePath))
-	}
-
-	return nil
-}
-
 type ClearBFLValues struct {
 	common.KubeAction
 }
@@ -104,12 +78,6 @@ func (m *InstallLauncherModule) Init() {
 	logger.InfoInstallationProgress("Installing launcher ...")
 	m.Name = "InstallLauncher"
 
-	generateBFLDefaultValues := &task.LocalTask{
-		Name:   "GenerateBFLDefaultValues",
-		Action: new(GenerateBFLDefaultValues),
-		Retry:  1,
-	}
-
 	installBFL := &task.LocalTask{
 		Name:   "InstallLauncher",
 		Desc:   "InstallLauncher",
@@ -130,7 +98,6 @@ func (m *InstallLauncherModule) Init() {
 	}
 
 	m.Tasks = []task.Interface{
-		generateBFLDefaultValues,
 		installBFL,
 		checkBFLRunning,
 	}

cli/pkg/terminus/modules.go

@@ -31,10 +31,10 @@ import (
 
 type InstallWizardDownloadModule struct {
 	common.KubeModule
-	Version        string
-	DownloadCdnUrl string
-	UrlOverride    string
-	ReleaseID      string
+	Version     string
+	CDNService  string
+	UrlOverride string
+	ReleaseID   string
 }
 
 func (m *InstallWizardDownloadModule) Init() {
@@ -42,10 +42,10 @@ func (m *InstallWizardDownloadModule) Init() {
 	download := &task.LocalTask{
 		Name: "DownloadInstallWizard",
 		Action: &Download{
-			Version:        m.Version,
-			DownloadCdnUrl: m.DownloadCdnUrl,
-			UrlOverride:    m.UrlOverride,
-			ReleaseID:      m.ReleaseID,
+			Version:     m.Version,
+			CDNService:  m.CDNService,
+			UrlOverride: m.UrlOverride,
+			ReleaseID:   m.ReleaseID,
 		},
 		Retry: 1,
 	}
@@ -675,7 +675,7 @@ func (m *ChangeIPModule) addKubernetesTasks() {
 			},
 			&task.LocalTask{
 				Name:   "RegenerateK8sFilesWithKubeadm",
-				Action: new(RegenerateFilesForK8sIPChange),
+				Action: new(RegenerateFilesForK8s),
 			},
 			&task.LocalTask{
 				Name:   "CopyNewKubeConfig",

cli/pkg/terminus/ossystem.go

@@ -3,9 +3,16 @@ package terminus
 import (
 	"context"
 	"fmt"
+	"os"
 	"path"
+	"path/filepath"
 	"time"
 
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+
+	"bytetrade.io/web3os/app-service/api/sys.bytetrade.io/v1alpha1"
+	apputils "bytetrade.io/web3os/app-service/pkg/utils"
+
 	"github.com/beclab/Olares/cli/pkg/core/logger"
 	"github.com/beclab/Olares/cli/pkg/storage"
 
@@ -18,8 +25,13 @@ import (
 	configmaptemplates "github.com/beclab/Olares/cli/pkg/terminus/templates"
 	"github.com/beclab/Olares/cli/pkg/utils"
 	"github.com/pkg/errors"
+	"gopkg.in/yaml.v3"
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kruntime "k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 type InstallOsSystem struct {
@@ -52,12 +64,11 @@ func (t *InstallOsSystem) Execute(runtime connector.Runtime) error {
 			"is_cloud_version": cloudValue(t.KubeConf.Arg.IsCloudInstance),
 			"sync_secret":      t.KubeConf.Arg.Storage.StorageSyncSecret,
 		},
-		"gpu":                                  getGpuType(t.KubeConf.Arg.GPU.Enable),
-		"s3_bucket":                            t.KubeConf.Arg.Storage.StorageBucket,
-		"fs_type":                              storage.GetRootFSType(),
-		common.HelmValuesKeyTerminusGlobalEnvs: common.TerminusGlobalEnvs,
-		common.HelmValuesKeyOlaresRootFSPath:   storage.OlaresRootDir,
-		"sharedlib":                            storage.OlaresSharedLibDir,
+		"gpu":                                getGpuType(t.KubeConf.Arg.GPU.Enable),
+		"s3_bucket":                          t.KubeConf.Arg.Storage.StorageBucket,
+		"fs_type":                            storage.GetRootFSType(),
+		common.HelmValuesKeyOlaresRootFSPath: storage.OlaresRootDir,
+		"sharedlib":                          storage.OlaresSharedLibDir,
 	}
 
 	var platformPath = path.Join(runtime.GetInstallerDir(), "wizard", "config", "os-platform")
@@ -110,34 +121,105 @@ func (t *CreateBackupConfigMap) Execute(runtime connector.Runtime) error {
 	return nil
 }
 
-type CreateReverseProxyConfigMap struct {
+type CreateUserEnvConfigMap struct {
 	common.KubeAction
 }
 
-func (c *CreateReverseProxyConfigMap) Execute(runtime connector.Runtime) error {
-	var defaultReverseProxyConfigMapFile = path.Join(runtime.GetInstallerDir(), "deploy", configmaptemplates.ReverseProxyConfigMap.Name())
-	var data = util.Data{
-		"EnableCloudflare": c.KubeConf.Arg.Cloudflare.Enable,
-		"EnableFrp":        c.KubeConf.Arg.Frp.Enable,
-		"FrpServer":        c.KubeConf.Arg.Frp.Server,
-		"FrpPort":          c.KubeConf.Arg.Frp.Port,
-		"FrpAuthMethod":    c.KubeConf.Arg.Frp.AuthMethod,
-		"FrpAuthToken":     c.KubeConf.Arg.Frp.AuthToken,
+func (t *CreateUserEnvConfigMap) Execute(runtime connector.Runtime) error {
+	userEnvPath := filepath.Join(runtime.GetInstallerDir(), common.OLARES_USER_ENV_FILENAME)
+	if !util.IsExist(userEnvPath) {
+		logger.Info("user env config file not found, skipping user env configmap apply")
+		return nil
 	}
 
-	reverseProxyConfigStr, err := util.Render(configmaptemplates.ReverseProxyConfigMap, data)
+	configK8s, err := ctrl.GetConfig()
 	if err != nil {
-		return errors.Wrap(errors.WithStack(err), "render default reverse proxy configmap template failed")
-	}
-	if err := util.WriteFile(defaultReverseProxyConfigMapFile, []byte(reverseProxyConfigStr), cc.FileMode0644); err != nil {
-		return errors.Wrap(errors.WithStack(err), fmt.Sprintf("write default reverse proxy configmap %s failed", defaultReverseProxyConfigMapFile))
+		return errors.Wrap(err, "failed to get kubernetes config")
 	}
 
-	var kubectl, _ = util.GetCommand(common.CommandKubectl)
-	if _, err := runtime.GetRunner().SudoCmd(fmt.Sprintf("%s apply -f %s", kubectl, defaultReverseProxyConfigMapFile), false, true); err != nil {
-		return err
+	scheme := kruntime.NewScheme()
+	if err := corev1.AddToScheme(scheme); err != nil {
+		return errors.Wrap(err, "failed to add corev1 to scheme")
 	}
 
+	ctrlclient, err := client.New(configK8s, client.Options{Scheme: scheme})
+	if err != nil {
+		return errors.Wrap(err, "failed to create kubernetes client")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+
+	name := "user-env"
+	cm := &corev1.ConfigMap{}
+	err = ctrlclient.Get(ctx, types.NamespacedName{Name: name, Namespace: common.NamespaceOsFramework}, cm)
+	if apierrors.IsNotFound(err) {
+		// create via kubectl from file
+		kubectl, _ := util.GetCommand(common.CommandKubectl)
+		cmd := fmt.Sprintf("%s -n %s create configmap %s --from-file=%s=%s",
+			kubectl, common.NamespaceOsFramework, name, common.OLARES_USER_ENV_FILENAME, userEnvPath,
+		)
+		if _, cerr := runtime.GetRunner().SudoCmd(cmd, false, true); cerr != nil {
+			return errors.Wrap(errors.WithStack(cerr), "failed to create user-env configmap")
+		}
+		logger.Infof("Created user env configmap from %s", userEnvPath)
+		return nil
+	}
+	if err != nil {
+		return errors.Wrap(err, "failed to get user-env configmap")
+	}
+
+	// If exists, merge missing envs and update via client
+	newDataBytes, err := os.ReadFile(userEnvPath)
+	if err != nil {
+		return errors.Wrap(err, "failed to read user env config file")
+	}
+
+	var newCfg UserEnvConfig
+	if err := yaml.Unmarshal(newDataBytes, &newCfg); err != nil {
+		return errors.Wrap(err, "failed to parse user env config file")
+	}
+
+	var existingCfg UserEnvConfig
+	existingContent := cm.Data[common.OLARES_USER_ENV_FILENAME]
+	if existingContent != "" {
+		if err := yaml.Unmarshal([]byte(existingContent), &existingCfg); err != nil {
+			return errors.Wrap(err, "failed to parse existing user env configmap data")
+		}
+	}
+
+	existingSet := make(map[string]struct{}, len(existingCfg.UserEnvs))
+	for _, e := range existingCfg.UserEnvs {
+		existingSet[e.EnvName] = struct{}{}
+	}
+
+	missing := 0
+	for _, e := range newCfg.UserEnvs {
+		if _, ok := existingSet[e.EnvName]; !ok {
+			existingCfg.UserEnvs = append(existingCfg.UserEnvs, e)
+			missing++
+		}
+	}
+
+	if missing == 0 {
+		logger.Infof("No new user envs to add; configmap up to date")
+		return nil
+	}
+
+	updatedBytes, err := yaml.Marshal(existingCfg)
+	if err != nil {
+		return errors.Wrap(err, "failed to marshal updated user env config")
+	}
+	if cm.Data == nil {
+		cm.Data = map[string]string{}
+	}
+	cm.Data[common.OLARES_USER_ENV_FILENAME] = string(updatedBytes)
+
+	if err := ctrlclient.Update(ctx, cm); err != nil {
+		return errors.Wrap(err, "failed to update user-env configmap")
+	}
+
+	logger.Infof("Appended %d missing user env(s) and updated configmap", missing)
 	return nil
 }
 
@@ -211,6 +293,105 @@ func (p *Patch) Execute(runtime connector.Runtime) error {
 	return nil
 }
 
+type ApplySystemEnv struct {
+	common.KubeAction
+}
+
+// SystemEnvConfig represents the structure of the config.yaml file
+type SystemEnvConfig struct {
+	APIVersion string                `yaml:"apiVersion"`
+	SystemEnvs []v1alpha1.EnvVarSpec `yaml:"systemEnvs"`
+}
+
+func (a *ApplySystemEnv) Execute(runtime connector.Runtime) error {
+	configPath := filepath.Join(runtime.GetInstallerDir(), common.OLARES_SYSTEM_ENV_FILENAME)
+	if !util.IsExist(configPath) {
+		logger.Info("system env config file not found, skipping system env apply")
+		return nil
+	}
+
+	configData, err := os.ReadFile(configPath)
+	if err != nil {
+		return errors.Wrap(err, "failed to read system env config file")
+	}
+
+	var config SystemEnvConfig
+	if err := yaml.Unmarshal(configData, &config); err != nil {
+		return errors.Wrap(err, "failed to parse system env config file")
+	}
+
+	logger.Debugf("parsed system env config file %s: %#v", configPath, config.SystemEnvs)
+
+	configK8s, err := ctrl.GetConfig()
+	if err != nil {
+		return errors.Wrap(err, "failed to get kubernetes config")
+	}
+
+	scheme := kruntime.NewScheme()
+	if err := v1alpha1.AddToScheme(scheme); err != nil {
+		return errors.Wrap(err, "failed to add system scheme")
+	}
+
+	ctrlclient, err := client.New(configK8s, client.Options{Scheme: scheme})
+	if err != nil {
+		return errors.Wrap(err, "failed to create kubernetes client")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	defer cancel()
+
+	for _, envItem := range config.SystemEnvs {
+		resourceName, err := apputils.EnvNameToResourceName(envItem.EnvName)
+		if err != nil {
+			return fmt.Errorf("invalid system env name: %s", envItem.EnvName)
+		}
+
+		var existingSystemEnv v1alpha1.SystemEnv
+		err = ctrlclient.Get(ctx, types.NamespacedName{Name: resourceName}, &existingSystemEnv)
+
+		if err == nil {
+			logger.Debugf("SystemEnv %s already exists, skipping", resourceName)
+			continue
+		}
+
+		if !apierrors.IsNotFound(err) {
+			return fmt.Errorf("failed to get system env")
+		}
+
+		// before applying, if process env has the new name set, override Default with that value
+		// we do not set the value because this is a default system value from installation
+		// and can be reset
+		// wheras the value is managed by user
+		if procVal := os.Getenv(envItem.EnvName); procVal != "" {
+			envItem.Default = procVal
+		}
+
+		err = envItem.ValidateValue(envItem.Value)
+		if err != nil {
+			return fmt.Errorf("invalid system env value: %s", envItem.Value)
+		}
+		err = envItem.ValidateValue(envItem.Default)
+		if err != nil {
+			return fmt.Errorf("invalid system env default value: %s", envItem.Value)
+		}
+
+		systemEnv := &v1alpha1.SystemEnv{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: resourceName,
+			},
+			EnvVarSpec: envItem,
+		}
+
+		if err := ctrlclient.Create(ctx, systemEnv); err != nil && !apierrors.IsAlreadyExists(err) {
+			return fmt.Errorf("failed to create system env %s: %v", resourceName, err)
+		}
+
+		logger.Infof("Created SystemEnv: %s", systemEnv.EnvName)
+	}
+
+	return nil
+}
+
 type InstallOsSystemModule struct {
 	common.KubeModule
 }
@@ -219,6 +400,18 @@ func (m *InstallOsSystemModule) Init() {
 	logger.InfoInstallationProgress("Installing appservice ...")
 	m.Name = "InstallOsSystemModule"
 
+	applySystemEnv := &task.LocalTask{
+		Name:   "ApplySystemEnv",
+		Action: new(ApplySystemEnv),
+		Retry:  5,
+		Delay:  15 * time.Second,
+	}
+
+	createUserEnvConfigMap := &task.LocalTask{
+		Name:   "CreateUserEnvConfigMap",
+		Action: &CreateUserEnvConfigMap{},
+	}
+
 	installOsSystem := &task.LocalTask{
 		Name:   "InstallOsSystem",
 		Action: &InstallOsSystem{},
@@ -230,11 +423,6 @@ func (m *InstallOsSystemModule) Init() {
 		Action: &CreateBackupConfigMap{},
 	}
 
-	createReverseProxyConfigMap := &task.LocalTask{
-		Name:   "CreateReverseProxyConfigMap",
-		Action: &CreateReverseProxyConfigMap{},
-	}
-
 	checkSystemService := &task.LocalTask{
 		Name: "CheckSystemServiceStatus",
 		Action: &CheckPodsRunning{
@@ -254,9 +442,10 @@ func (m *InstallOsSystemModule) Init() {
 	}
 
 	m.Tasks = []task.Interface{
+		applySystemEnv,
+		createUserEnvConfigMap,
 		installOsSystem,
 		createBackupConfigMap,
-		createReverseProxyConfigMap,
 		checkSystemService,
 		patchOs,
 	}
@@ -289,3 +478,8 @@ func getRedisPassword(client clientset.Client, runtime connector.Runtime) (strin
 	return string(secret.Data["auth"]), nil
 
 }
+
+type UserEnvConfig struct {
+	APIVersion string                `yaml:"apiVersion"`
+	UserEnvs   []v1alpha1.EnvVarSpec `yaml:"userEnvs"`
+}

cli/pkg/terminus/settings.go

@@ -39,13 +39,12 @@ func (p *SetSettingsValues) Execute(runtime connector.Runtime) error {
 	}
 
 	selfhosted := true
-	if p.KubeConf.Arg.PublicNetworkInfo.PubliclyAccessible {
-		selfhosted = false
-	}
-
-	publicNetworkInfo := p.KubeConf.Arg.PublicNetworkInfo
-	if publicNetworkInfo.AWSPublicIP != nil {
-		selfhosted = false
+	if p.KubeConf.Arg.NetworkSettings.EnableReverseProxy != nil {
+		selfhosted = *p.KubeConf.Arg.NetworkSettings.EnableReverseProxy
+	} else {
+		if p.KubeConf.Arg.NetworkSettings.CloudProviderPublicIP != nil {
+			selfhosted = false
+		}
 	}
 
 	terminusdInstalled := "0"
@@ -115,9 +114,9 @@ func (m *InstallSettingsModule) Init() {
 	logger.InfoInstallationProgress("Installing settings ...")
 	m.Name = "InstallSettings"
 
-	getPublicNetworkInfo := &task.LocalTask{
-		Name:   "GetPublicNetworkInfo",
-		Action: new(GetPublicNetworkInfo),
+	detectPublicIPAddress := &task.LocalTask{
+		Name:   "DetectPublicIPAddress",
+		Action: new(DetectPublicIPAddress),
 		Retry:  3,
 	}
 
@@ -134,7 +133,7 @@ func (m *InstallSettingsModule) Init() {
 	}
 
 	m.Tasks = []task.Interface{
-		getPublicNetworkInfo,
+		detectPublicIPAddress,
 		setSettingsValues,
 		installSettings,
 	}