Import manifests from kapitan reference

README.md

@@ -74,48 +74,35 @@ Tesoro is a Kubernetes Admission Controller [Mutating Webhook](https://kubernete
 
 You'll find the predefined example config in the [k8s/](./k8s) directory. Please make sure you read about setting up Mutating Webhooks [here](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#configure-admission-webhooks-on-the-fly)!
 
-#### 1 - ClusterRole and ClusterRoleBinding
-
-```shell
-$ kubectl apply -f k8s/clusterrole.yaml
-$ kubectl apply -f k8s/clusterrolebinding.yaml
-```
-
-#### 2 - Tesoro Namespace
+#### 1 - Tesoro Namespace
 
 We will be running the webhook in the `tesoro` namespace
 
 ```shell
-$ kubectl apply -f k8s/tesoro_namespace.yaml
+$ kubectl apply -f k8s/tesoro-namespace.yaml
 ```
 
-#### 3 - Tesoro Webhook Config & Certs
+#### 2 - Tesoro Config & Certs
 
-For convenience, you'll find valid certificates in `tesoro_mutatingwebhook.yaml` and `tesoro_secret.yaml` for testing purposes only.
+For convenience, this setup includes snake-oil certificates for EVALUATION PURPOSES ONLY.
 
 Security advice: FOR PROD, PLEASE SETUP YOUR OWN.
 
 ```shell
-$ kubectl -n tesoro apply -f k8s/tesoro_secret.yaml
-$ kubectl -n tesoro apply -f k8s/tesoro_service.yaml
-$ kubectl -n tesoro apply -f k8s/tesoro_deployment.yaml
+$ kubectl -n tesoro apply -f k8s/tesoro-secret.yaml
+$ kubectl -n tesoro apply -f k8s/tesoro-sa.yaml
+$ kubectl -n tesoro apply -f k8s/tesoro-bundle.yaml
 ```
 
 Verify the tesoro pod is up and running:
 
 ```shell
 $ kubectl -n tesoro get pods
 NAME                                           READY   STATUS    RESTARTS   AGE
-tesoro-admission-controller-584b9d87c6-p69bx   1/1     Running   0          1m
-```
-
-And finally apply the MutatingWebhookConfiguration:
-
-```shell
-$ kubectl apply -f k8s/tesoro_mutatingwebhook.yaml
+tesoro-584b9d87c6-p69bx                        1/1     Running   0          1m
 ```
 
-#### 4 - Try a Kubernetes Manifest with Secret Refs
+#### 3 - Try a Kubernetes Manifest with Secret Refs
 
 This manifest with a valid ref, should work:
 
@@ -129,7 +116,7 @@ The following manifest with a bogus ref, should fail:
 
 ```shell
 kubectl apply -f tests/k8s/nginx_deployment_bad.yml
-Error from server: error when creating "nginx_deployment_bad.yml": admission webhook "tesoro-admission-controller.tesoro.svc" denied the request: Kapitan reveal failed
+Error from server: error when creating "nginx_deployment_bad.yml": admission webhook "tesoro.tesoro.svc" denied the request: Kapitan reveal failed
 ```
 
 ### Helm chart

k8s/tesoro-bundle.yml

@@ -0,0 +1,159 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    manifests.kapicorp.com/generated: 'true'
+  labels:
+    name: tesoro
+  name: tesoro
+  namespace: tesoro
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      name: tesoro
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        name: tesoro
+    spec:
+      containers:
+        - args:
+            - --ca-file=/certs/cacert.pem
+            - --cert-file=/certs/cert.pem
+            - --key-file=/certs/cert.key
+            - --port=443
+          image: kapicorp/tesoro
+          imagePullPolicy: IfNotPresent
+          name: tesoro
+          ports:
+            - containerPort: 443
+              name: tesoro-api
+              protocol: TCP
+            - containerPort: 9095
+              name: tesoro-metrics
+              protocol: TCP
+          securityContext:
+            capabilities:
+              add:
+                - NET_BIND_SERVICE
+              drop:
+                - all
+          volumeMounts:
+            - mountPath: /certs
+              name: secrets
+              readOnly: true
+      restartPolicy: Always
+      serviceAccountName: tesoro
+      terminationGracePeriodSeconds: 30
+      volumes:
+        - name: secrets
+          secret:
+            defaultMode: 420
+            secretName: tesoro
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    name: tesoro
+  name: tesoro
+  namespace: tesoro
+spec:
+  ports:
+    - name: tesoro-api
+      port: 443
+      protocol: TCP
+      targetPort: tesoro-api
+    - name: tesoro-metrics
+      port: 9095
+      protocol: TCP
+      targetPort: tesoro-metrics
+  selector:
+    name: tesoro
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: MutatingWebhookConfiguration
+metadata:
+  labels:
+    name: tesoro
+  name: tesoro
+webhooks:
+  - clientConfig:
+      caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUV1akNDQXFJQ0NRRDZIdzJDZld6ZVp6QU5CZ2txaGtpRzl3MEJBUXNGQURBZk1SMHdHd1lEVlFRRERCUkQKUVMxMFpYTnZjbTh1ZEdWemIzSnZMbk4yWXpBZUZ3MHlNREV4TWpFeU1ERTVNemhhRncweU16QTVNVEV5TURFNQpNemhhTUI4eEhUQWJCZ05WQkFNTUZFTkJMWFJsYzI5eWJ5NTBaWE52Y204dWMzWmpNSUlDSWpBTkJna3Foa2lHCjl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQ0FnRUEzbVlZNXIvTVYrSU9hMy9DZGxuRGVrdk9yQnVpeUd5MXUwZUYKOHU2RGQzdkNRcnp3MytLUmZrSXlHOW1lcDl3NW16bm5IMjdDZzVDN0t5Y040NVRaTnE3cHFESmhHVXVMWC9uRwpqNmxvM01qdnVpS0dtTG5JaHlEVjQyS1hDamxnbWVRaGhOdjFScFQ0cTFZeWhBWlF5RDU1a2FHUHQ0UmtQd21pCnkxMU04TTBXTUZDeW50OFhYZUNqcHVYVXdTV1V3cVE2ZVNJRFFnM1d1cnp6V1dJbVVwWTNPUDVTVWNYSHhFd2UKakFaT1hqSEJkZzJwWHVFK2hYN2VwektJUXMwbkpnbmFtakVPRlZhNnMxNDlEWkpjOU82VTg4dmVJMTNyZ3A4QwpPVUphdUlDOHBQNDdyZ2xadkNadEo2YmRPSDhaK1E2SEl1UGRic2tUM2JkS1dlTmMzTnBZSGI5U0tRNW82M3NqCmhBWUNpU3Q4YUVjbEtLdDF6U0xXMm5qZkU5NVhjZndyU25BRlNvU1pFdyt6RnNZbkxwMEdmWDlaWllPM1kzRzYKM2lPUjM4alRzMkpuamU0R1RxQ0Y1V1JMVUpZdU1jNTMwZTlDOWxjaTFYZ21WdkVtbCsrNUpkalN5dkdtSnBDQwpEMitKemR4WlJ4dE9tRkdVWnJKQVBsR2hqK0hXNGpEUHBDTnJ4VlhJdjJQSWhIWVdiTEhqNU9CVFNUM2xaTk0xCjY0ZFV6a3ZveDhBOThzcUlQM0JYdEVOU21qSDJkK25jYjREcTJsVWhwbWs2ZmE1WWN6YXpET3lESHRPa3pZSlMKRmtQaHMwOHFSTTZPclc5WlVPUGJMVmcvSllKUHB3NVRtZ3dNTUVLVXFtNzhob3drK1B3ejRxYUVyanNzb3djZwpqaDdudkdNQ0F3RUFBVEFOQmdrcWhraUc5dzBCQVFzRkFBT0NBZ0VBUEJMWEcvREZ3U3JYV1pGMU9nNGpVWnlXCjV4NTUxT1NNbVNJOUc0ZllhaGY5dEYrME9aTFpBYUxCdlhCNUNNK1lWajRDWDl1V3Y0NGlDZW5EZDY1T1l0dkoKTU1nM2tyWGV2dWFVOUEyeVVSMEdZWHhSWHJ2ZTFQY1JBK1V3bE1ldkd5aHpHR1hMSjg0dHRka2I5OGZad3VlTwp2aG0wOWl3RDcxTmtMeGJKVGVSQk5DUFZVcmVBZUQ1SVYvUjlJZTE5akhIOU5STzFMZ1l0SDNhODRvNTYzUXR1CkNpcGtNZ0s2L1pFSFlVZnZMOVo4MjlyYkFqM1hWVXdOSGsvTk5CR2czZDFWcHpPenNZMFBRa01aTitGU0NTYkcKdWhSbHdvc2N6R09qclBDcDlpbWVPT0llQlZJY0NBcUpuSnE1ZlVCSzF2OSs3RDRFMGdSR3hXbXVrV2xxYTQ2KwozcHg1RUdZajN4c1AveTVnWDg3cGsrQnRBcVBJUGJtOGQ4MWo3dTVGYUVScTViaEcwQkplNG83U25Ed0VNWkRKCnJPdlMxZWh6N29XM2RxYmxNODNLRjM3b0xzNFlDSURXckp3SFYwVThHa0hWQTZMdU1lM05Sc3Y1WGRZL2QydEoKSlhLNFFYL082WWlHRFpCeGtlZVJDVzMwWFhMTWw1REJWTUFGK2o2WUg1M3BjSnE4R2NHdkVDUk8zSGxCSmJVMwp2a3FFVFV0L1Q3ZE5LRFFISzM2azhuMWdlTEhJVndqRm16NHIzdkVieWdZZUlNVGRaZTQ3c2hTcjhTajNITm4rCklWRnhSZlV4anpuTXdSNjB3bm5JVk5lM2t0YmFMM1lFMFFmdnJiV2xaanAwZG1zQWh6UE5qYWJob0JBVFVCVWUKd0NpMk5vQzVJRU5pSU1MY1VjUT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+      service:
+        name: tesoro
+        namespace: tesoro
+        path: /mutate
+    failurePolicy: Fail
+    name: tesoro.kapicorp.com
+    objectSelector:
+      matchLabels:
+        tesoro.kapicorp.com: enabled
+    rules:
+      - apiGroups:
+          - ''
+        apiVersions:
+          - '*'
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - '*'
+      - apiGroups:
+          - apps
+        apiVersions:
+          - '*'
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - deployments
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  labels:
+    name: tesoro
+  name: tesoro
+rules:
+  - apiGroups:
+      - ''
+    resources:
+      - pods
+      - events
+      - secrets
+      - configmaps
+    verbs:
+      - '*'
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+      - replicasets
+      - statefulsets
+    verbs:
+      - '*'
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    name: tesoro
+  name: tesoro
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: tesoro
+subjects:
+  - kind: ServiceAccount
+    name: tesoro
+    namespace: tesoro

k8s/tesoro_namespace.yaml → k8s/tesoro-namespace.yml

@@ -1,5 +1,6 @@
 apiVersion: v1
 kind: Namespace
 metadata:
+  labels:
+    name: tesoro
   name: tesoro
-

k8s/tesoro-sa.yml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    name: tesoro
+  name: tesoro
+  namespace: tesoro

k8s/tesoro-secret.yml

@@ -0,0 +1,12 @@
+apiVersion: v1
+data:
+  cacert.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUV1akNDQXFJQ0NRRDZIdzJDZld6ZVp6QU5CZ2txaGtpRzl3MEJBUXNGQURBZk1SMHdHd1lEVlFRRERCUkQKUVMxMFpYTnZjbTh1ZEdWemIzSnZMbk4yWXpBZUZ3MHlNREV4TWpFeU1ERTVNemhhRncweU16QTVNVEV5TURFNQpNemhhTUI4eEhUQWJCZ05WQkFNTUZFTkJMWFJsYzI5eWJ5NTBaWE52Y204dWMzWmpNSUlDSWpBTkJna3Foa2lHCjl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQ0FnRUEzbVlZNXIvTVYrSU9hMy9DZGxuRGVrdk9yQnVpeUd5MXUwZUYKOHU2RGQzdkNRcnp3MytLUmZrSXlHOW1lcDl3NW16bm5IMjdDZzVDN0t5Y040NVRaTnE3cHFESmhHVXVMWC9uRwpqNmxvM01qdnVpS0dtTG5JaHlEVjQyS1hDamxnbWVRaGhOdjFScFQ0cTFZeWhBWlF5RDU1a2FHUHQ0UmtQd21pCnkxMU04TTBXTUZDeW50OFhYZUNqcHVYVXdTV1V3cVE2ZVNJRFFnM1d1cnp6V1dJbVVwWTNPUDVTVWNYSHhFd2UKakFaT1hqSEJkZzJwWHVFK2hYN2VwektJUXMwbkpnbmFtakVPRlZhNnMxNDlEWkpjOU82VTg4dmVJMTNyZ3A4QwpPVUphdUlDOHBQNDdyZ2xadkNadEo2YmRPSDhaK1E2SEl1UGRic2tUM2JkS1dlTmMzTnBZSGI5U0tRNW82M3NqCmhBWUNpU3Q4YUVjbEtLdDF6U0xXMm5qZkU5NVhjZndyU25BRlNvU1pFdyt6RnNZbkxwMEdmWDlaWllPM1kzRzYKM2lPUjM4alRzMkpuamU0R1RxQ0Y1V1JMVUpZdU1jNTMwZTlDOWxjaTFYZ21WdkVtbCsrNUpkalN5dkdtSnBDQwpEMitKemR4WlJ4dE9tRkdVWnJKQVBsR2hqK0hXNGpEUHBDTnJ4VlhJdjJQSWhIWVdiTEhqNU9CVFNUM2xaTk0xCjY0ZFV6a3ZveDhBOThzcUlQM0JYdEVOU21qSDJkK25jYjREcTJsVWhwbWs2ZmE1WWN6YXpET3lESHRPa3pZSlMKRmtQaHMwOHFSTTZPclc5WlVPUGJMVmcvSllKUHB3NVRtZ3dNTUVLVXFtNzhob3drK1B3ejRxYUVyanNzb3djZwpqaDdudkdNQ0F3RUFBVEFOQmdrcWhraUc5dzBCQVFzRkFBT0NBZ0VBUEJMWEcvREZ3U3JYV1pGMU9nNGpVWnlXCjV4NTUxT1NNbVNJOUc0ZllhaGY5dEYrME9aTFpBYUxCdlhCNUNNK1lWajRDWDl1V3Y0NGlDZW5EZDY1T1l0dkoKTU1nM2tyWGV2dWFVOUEyeVVSMEdZWHhSWHJ2ZTFQY1JBK1V3bE1ldkd5aHpHR1hMSjg0dHRka2I5OGZad3VlTwp2aG0wOWl3RDcxTmtMeGJKVGVSQk5DUFZVcmVBZUQ1SVYvUjlJZTE5akhIOU5STzFMZ1l0SDNhODRvNTYzUXR1CkNpcGtNZ0s2L1pFSFlVZnZMOVo4MjlyYkFqM1hWVXdOSGsvTk5CR2czZDFWcHpPenNZMFBRa01aTitGU0NTYkcKdWhSbHdvc2N6R09qclBDcDlpbWVPT0llQlZJY0NBcUpuSnE1ZlVCSzF2OSs3RDRFMGdSR3hXbXVrV2xxYTQ2KwozcHg1RUdZajN4c1AveTVnWDg3cGsrQnRBcVBJUGJtOGQ4MWo3dTVGYUVScTViaEcwQkplNG83U25Ed0VNWkRKCnJPdlMxZWh6N29XM2RxYmxNODNLRjM3b0xzNFlDSURXckp3SFYwVThHa0hWQTZMdU1lM05Sc3Y1WGRZL2QydEoKSlhLNFFYL082WWlHRFpCeGtlZVJDVzMwWFhMTWw1REJWTUFGK2o2WUg1M3BjSnE4R2NHdkVDUk8zSGxCSmJVMwp2a3FFVFV0L1Q3ZE5LRFFISzM2azhuMWdlTEhJVndqRm16NHIzdkVieWdZZUlNVGRaZTQ3c2hTcjhTajNITm4rCklWRnhSZlV4anpuTXdSNjB3bm5JVk5lM2t0YmFMM1lFMFFmdnJiV2xaanAwZG1zQWh6UE5qYWJob0JBVFVCVWUKd0NpMk5vQzVJRU5pSU1MY1VjUT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+  cert.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBdjRLUWNBdjdvMVFnaGs1TTlpR2FFd0daM3Vyc25sNmJmOHF5NjJRaDZhMDdWU2JNCjRIbFI2bHpRQVpUdmNzdVNmY1lIbm5iTEF6SEhkOWZ6aFFFcXhsMS9sM3RHTld6RkZYMWFMQW1nbmZRVVlINVYKajBkbXpoYjlNVXFJY3NiTXRqQUN6OVJINTFKVFQwK3p2WlpCWFRKOW5kL3BKTnlZb1pkUmRiZEN0Y1hMOTlPWApGY3RXQVNuSnVDOUxrTy9ONTluVXM2Sk9MVjlSOEllZ2V3NFQrQzZFTk5meXVmbS9vMWVhak5jMkRYT3JuUkZ2CnpvenF6UFZnb3pRcU9TdERMTGt3UHRnbG5JZzFWT1dNOTJvZ0tmc0t2RjRVTEt0d3pKcXBNSVVtSWxmcEs5SWIKLzkwbVlrb1VEdzEzZnpCVEtIVzlsa2tYQlhHdlV4SjZ4ZlpNZVFJREFRQUJBb0lCQUYwbkh5YkJUV2VHMWtNOQo5d1dLRnEzRUM1cDQzeHV4blNXdDdSVytvUmhQSVJzc1FsKzE0M2lDS05OOEpIVE1QTGRkQ2Z1MGdNOU8rVjE3Cjk0SHNyV2ZMdHZKeURoYVNqOU1DSkVoamJuTW1kSHJ6T0o3MjlqU3N6ZitaNTRFYzNocUlnL1dmcGxJSW8ybGkKdFdVMG54cThJb29Xamd0V0doQVAwSm5YeUdVdHQ3UWVsUDY1NFBzWlZVWUJIUDVobDdYcFRHc2QvZElMYTQ1MQpnSGtsL1Z6Q2JPeDBUZkxiZzB4S1dJUDhlVG1yVFVMTkkvamZiaFVnS0RqZzhydExnZlZvQ2xjbFk2QUhXZWVsCkR0ZVFiRHEvUTE2TGpVZ2dMT1YrZmVDeXl3RHlMaVlUYmNJZFBpc2MzdjFROG84YzFXc0M2Nm8rV1RFUkxRK2UKd2N4a2YrRUNnWUVBNGVyV3BCVVN1cVJ1ajRBQVhhM0Rodnk0VmwxZno4TGxLeklLZ2owYTBlL1BJaHdVcXd3dgpUWTdZYmUwL0NzOGx5dXVaQ3FNeG11eXNHc0V0RFYyNEZMNjVZcWZTY0s4ZDFqaTJyTGtXanJLLzVqVHpaSTBvCndZV1pXZzNQR1dBMDJsRVh5OWx3WityN0ZBbkM5aEIxbTFoNHJtSnZDNlo2UUlWeFJsQ29idDBDZ1lFQTJRTFYKeUhJejZVeXZCSlNNWWExSVprWWtTUmN6TmtqZCthRUtQWjdUN3pjSVBNdWttWXk1bkxsbWUxSWZoZlRCYmtuSwpzK3JnS2JHd3p4WHh3U0VyZVZUNTBIU1N0OXJ2Ny9FNlJvaFBkVTBPN05paGlWb016Wlpxc1NHMXZ6KzU3YStYCk9IckJHR2YyTm5kOHBsYzhsYnRVdjQvRkl5RldMVkN3Mm16L2hFMENnWUVBclJVZ2NRRjhJZWFNbGdCNVIwd3oKZXgzdmxLdGhGbW00N2NrZTUvMHNxUjdUVU15MndQMUsyRjdTVGhYdnNMWlh2QW1ZYk4vdXgwVC83bGVGenJHNApzSndXcUJEdlYwbXkwRWNQSFhHSWFMZGw4bGNyQ2lSanp6QXQ5eUtSUWwzRTRHWTBsd2IxNllmTDZPUTVyQStjCkt2SXpNMWRTd0ZoQlhXRmZFWUlHS1RrQ2dZRUFzNDNOOXZEUEZOeVcveEl0Nk8rb05MOGFiTU5lWXk3OVF2dEUKN3VGSWQrZ3Z6NldyUmtVU21xTW9NU2NzMy9nNFI1bVV0ekxDVUowdUx0bjRVcFN3Vk03RGQvL01HWVZ6K3pLNwp4Zm9vekdSNjBlc1lGUDVHRTZDK0hGdEk5cm15akFBNS9jaExsbmNHVitDYmFVSks1WlMvTlZTdWh6ZWhCeE41CmtQQ1lwZzBDZ1lFQW8xV1ZiNlFPbGp0RldYMWxEdjc5WUp5M3lYcmsyYllZdVJoVHJqNVg5R1RQTWNNSTV3SGEKRXVaM3piR2pOS2VRMHF1RHFQVURHN1E2Q0M5aERHUVN6anhFV0hOaUJzTXZjQzhVY211MU9ZSW5JQ2ZHdlFVRApicGFxbERST09paHZRNW9vSlE5MlIyV3ZIZ2NIdE9FeFF4TjVJei93eU5Sa2dTNUh5VXkvWG5VPQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
+  cert.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQzakNDQWNhZ0F3SUJBZ0lKQU11dkFFSjkrRnJJTUEwR0NTcUdTSWIzRFFFQkN3VUFNQjh4SFRBYkJnTlYKQkFNTUZFTkJMWFJsYzI5eWJ5NTBaWE52Y204dWMzWmpNQjRYRFRJd01URXlNVEl3TVRrek9Gb1hEVEl5TURRdwpOVEl3TVRrek9Gb3dIREVhTUJnR0ExVUVBd3dSZEdWemIzSnZMblJsYzI5eWJ5NXpkbU13Z2dFaU1BMEdDU3FHClNJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUUMvZ3BCd0MvdWpWQ0NHVGt6Mklab1RBWm5lNnV5ZVhwdC8KeXJMclpDSHByVHRWSnN6Z2VWSHFYTkFCbE85eXk1Sjl4Z2VlZHNzRE1jZDMxL09GQVNyR1hYK1hlMFkxYk1VVgpmVm9zQ2FDZDlCUmdmbFdQUjJiT0Z2MHhTb2h5eHN5Mk1BTFAxRWZuVWxOUFQ3Tzlsa0ZkTW4yZDMra2szSmloCmwxRjF0MEsxeGN2MzA1Y1Z5MVlCS2NtNEwwdVE3ODNuMmRTem9rNHRYMUh3aDZCN0RoUDRMb1EwMS9LNStiK2oKVjVxTTF6WU5jNnVkRVcvT2pPck05V0NqTkNvNUswTXN1VEErMkNXY2lEVlU1WXozYWlBcCt3cThYaFFzcTNETQptcWt3aFNZaVYra3IwaHYvM1NaaVNoUVBEWGQvTUZNb2RiMldTUmNGY2E5VEVuckY5a3g1QWdNQkFBR2pJREFlCk1Cd0dBMVVkRVFRVk1CT0NFWFJsYzI5eWJ5NTBaWE52Y204dWMzWmpNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUMKQVFDMXpTZWpCSGNhNWsrbnFkS3VqN2dqUDB3MWhid0FMeE8wK1ZkYkVmZUdqYldmL3p3Y0FtdE03bXlsNkEyUwpyeFBaUXJBQkhxOEhGVWJrcFNKWXRaeEFwcEJKMEl6ZU5YdjN2U3hpWE9WdC9DdmNnL0tHTlZpNG1KSGFRY2cxCk5iajk1WWdsRzRnSU1vaGNYbmREMmJpV0wyeFpUbzREaTROYUJzZjJuU1d2em04L2l2ZVAzODVNYlNVd29yd24KcE5CYzltQVFlV2Eya2hHTmF0TlNnb3FuVlhlMG1OQWI4SWl0b2xJMWJNSVUyMVNKODJvM1QrNkdhRkNtVzNWTgp3c2hjTU5BUjhvRkxFM2V5L01xZEM3NUVHSWpDWEhKZDEyTnp5WDZIVXBWSzZoekJwKzFWVTF2WWJqbEtYVngvCkpOZkxjR0wrV3ZvdnJOSkJLNlRuSjlHdzBuTVpTRE01Mnc4N2NsbGFZVTY3aGNoVlAwNTlFWENrZnUxMjVua0kKeDRYUzg2L0RhVXU1OUE5eEw3akp6aUhHVjhBRGJna25rckE4UmpLZG01eFJhRGEvQ1ltck95blBSNzYvNFBpcQovTWZYdWIxTGJNYVJlN1gyZy9aODFPajBESFdiVmZCMVB1Mmdkd2t5Vk1lZ1lRTUZYRVNFQ2I3S0pVcGxjUFNiCmdmb2I0S3ZqS1Y2Qlc5NmpTTVJtQlUwS01kL1RaM0wrcnFtQmFwZnFpclJoMm4zcVZIVmx4Tjg3YUdmdjNHdy8KTDdmaUZFcDI4ay9PWVU2ZmFQbXVlN0YvcW1Fa1crMUp6ZU9IK1pQVER5N3lsbm85bWJlYnVUNjBNbUVjbldDZwpsSGhkWWFkR2tRTGRVakhhUWRNaXB2VVlPbmZhVm5iQkE0ZUN3UzRZb1RqZUxnPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+kind: Secret
+metadata:
+  labels:
+    name: tesoro
+  name: tesoro
+  namespace: tesoro
+type: Opaque