Squashed 'cluster-config/' content from commit 654f2390

git-subtree-dir: cluster-config git-subtree-split: 654f23903bd1f9a27a4810bd289d165b6cfdbb0c
2025-03-30 15:46:16 -05:00
commit fe564d7227
346 changed files with 11754 additions and 0 deletions
--- a/.github/workflows/validate-manifests.yaml
+++ b/.github/workflows/validate-manifests.yaml
@@ -0,0 +1,31 @@
+name: Validate Manifests
+on:
+  push:
+    branches:
+      - "*"
+  pull_request:
+    branches:
+      - "*"
+
+jobs:
+  lint-yaml:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Code Checkout
+        uses: actions/checkout@v3
+      - name: Validate YAML
+        uses: ibiqlik/action-yamllint@v3
+        with:
+          format: github
+  lint-kustomize:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Code Checkout
+        uses: actions/checkout@v3
+      - name: Verify Kustomize CLI Installation
+        run: |
+          which kustomize
+          kustomize version
+      - name: Validate Manifests
+        run: |
+          ./scripts/validate_manifests.sh
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,8 @@
+sealed-secrets-secret.yaml
+cloud-dns-credentials.yaml
+alertmanager.yaml
+google-secret.yaml
+*-private.yaml
+*-private.yml
+charts
+qnap-tls
--- a/.yamllint
+++ b/.yamllint
@@ -0,0 +1,9 @@
+extends: default
+
+rules:
+  document-start: disable
+  indentation:
+    indent-sequences: whatever
+  line-length: disable
+  truthy:
+    ignore: .github/workflows/
--- a/README.md
+++ b/README.md
@@ -0,0 +1,136 @@
+# GitOps Cluster Configuration
+
+This repo contains the cluster configuration I use for my personal OpenShift clusters. Like my other GitOps repos it leverages ArgoCD heavily. This repo originally followed the folder structure defined in the [Standards](https://github.com/gnunn-gitops/standards) repository but there has been some tweaks that need to be reflected back in that document.
+
+# Structure
+
+Similar to my standards document, the repo consists of four high level folders:
+
+* _bootstrap_  - the minimal yaml needed to bootstrap the cluster-config into argocd. It deploys a known sealed-secret private key along with an "app of app" `cluster-config-manager` that deploys the entirety of the cluster configuration.
+* _components_ - a base set of kustomize manifests and yaml for applications, operators, configuration and ArgoCD app/project definitions. Everything is inherited from here
+* _clusters_ - Cluster specific configuration, this inherits and kustomizes from the components folder and uses an identical structure.
+* _tenants_ - Tenant specific artifacts required by different teams using the cluster. For example, a team will likely need a set of namespaces with quotas, there own gitops-operator installation, etc in order to deploy their work.
+
+While this structure follows the basic principles in my standards document I am in the process of re-factoring the naming as well as attempting to simplify the level of nesting.
+
+![alt text](https://raw.githubusercontent.com/gnunn-gitops/cluster-config/main/docs/img/argocd.png)
+
+Finally note that I deliberately have everything in the same repository for demo purposes. Folks dealing with a lot of clusters and tenants will likely want to split things out into multiple repositories.
+
+## App-Of-App Helm Chart and Layers
+
+This repository is based on kustomize, and as a result the _bootstrap_ folder consists of a _base_ and _overlays_. The _base_ is the configuration that is required on all clusters whereas the _overlays_ consist of groupings of
+clusters as well as specific clusters.
+
+A helm chart managed by kustomize is used to generate the list of Argo CD Applications using the [App of App](https://argo-cd.readthedocs.io/en/stable/operator-manual/cluster-bootstrapping/#app-of-apps-pattern) pattern as well as a cluster-config AppProject. I had originally used kustomize to manage the Argo CD Applications directly but this generated a lot of yaml and made overriding applications for specific clusters much more verbose then necessary. This is an example of where templating is a more optimum solution then patching.
+
+In the bootstrap _base_ and cluster _overlays_ (`bootstrap/overlays/<cluster-name>`) there is a `kustomization.yaml` file along with a `values.yaml` file where we use kustomize to generate the Application manifests from a `helm template`.
+
+This helm chart is run independently at each layer and is aggregated by higher levels. So for example my `local.home` cluster, which is one of my bare-metal servers in my homelab, has an application tree that aggregatesm Applications as follows:
+
+`base` > `local` > `local.home`
+
+At each layer the helm chart is run for that layer and generates the Application manifests for that specific layer. The nice thing with this approach is group or cluster specific changes is easy, kustomize can be used to override a lower level layer's Application(s) and point it to a cluster specific version simply by patching it's path and/or repo.
+
+The `clusters/overlays/<cluster-name>/components` consists of components that are specific to this cluster or is cluster-specific overriden version of manifests from the _components_ folder. So at the bootstrap level, if the _base_ has an application pointing to manfiests in _components_, this can be overriden in the cluster specific bootstrap by patching it to point to a version in `clusters/overlays/<cluster-name>/components/<component-name>/`.
+
+I've opted to use a dot notation to separate groups, i.e `local`, from specific clusters, `local.home` however in the future it may be worth considering seperating this into distinct `groups` and `clusters` folders.
+
+## Why not ApplicationSet instead of App-of-App Helm Chart?
+
+Some folks may be wondering why I do not use an ApplicationSet instead of this App-of-App Helm chart. The primary reason is that the Helm chart allows for easily post-processing the generated Applications to enable cluster overrides. While having an ApplicationSet with a list generator delivered by kustomize could also accomplish this, the list generator is simply a list which is challenging to patch correctly with JSON semantics (i.e. you can only reference items by ordinal rather then name. As a result trying to manage patching this would be error-prone if ordering ever changes in the list.
+
+Other generator types don't allow any post-processing meaning overriding for specific clusters needs to be packaged into the ApplicationSet which I felt was overly cumbersome.
+
+Having said, the new ApplicationSet feature supporting creating custom generator plugins may make it more amenable for this use case but I have not explored this as of yet.
+
+## Argo CD Plugin
+
+From a GitOps purist point of view there is a desire to have everything in git regardless of how many manifests need to be maintained. Thus with
+kustomize this can make for a significant number of overlays to account for cluster differences in endpoints (each cluster has its own DNS domain) and other
+internal cluster details like cluster name, cluster id, infrastructure id, etc.
+
+I'm more a pragmatist then a purist, as a result I use a Argo CD Configuration Management Plugin (CMP) to template some per cluster static items as environment
+variables to minimize the amount of individual cluster overlays.
+
+I am using ACM's ability to template in policies to automatically populate the required environment variables, you can see that [here](https://github.com/gnunn-gitops/acm-hub-bootstrap/blob/main/components/policies/gitops/base/manifests/gitops-instance/base/argocd.yaml#L54).
+
+Note this works because I am using the distributed topology so the Argo CD sitting on each cluster can have unique environment variables. In a centralized topology you could look at adding labels/annotations to cluster secrets and then use the ApplicationSet cluster generator to pass these into Applications as possibly one way to accomplish the same.
+
+# Usage
+
+As detailed in the layers section, cluster specific configuration is stored in the bootstrap/overlays folder. To deploy a specific cluster configuration, simply create an application in Argo CD that points to the appropriate cluster folder, i.e. `bootstrap/overlays/{clustername}`.
+
+Note that in order for kustomize to be able to generate manifests from a helm chart you do need to have Argo CD pass the `--enable-helm` flag to kustomize. You can do this via setting the `kustomizeBuildOptions` in the ArgoCD CR:
+
+```
+apiVersion: argoproj.io/v1alpha1
+kind: ArgoCD
+metadata:
+  name: openshift-gitops
+  namespace: openshift-gitops
+spec:
+  kustomizeBuildOptions: "--enable-helm"
+  ...
+```
+
+How this bootstrap application gets generated and managed can happen in a variety of different ways:
+
+* [Red Hat Advanced Cluster Manager](https://www.redhat.com/en/technologies/management/advanced-cluster-management) can use a policy to deploy OpenShift GitOps plus a cluster specific bootstrap application across a fleet of clusters. This is my preferred approach and the [acm-bootstrap-hub](https://github.com/gnunn-gitops/acm-hub-bootstrap) is the repo where I have this policy along with other things I use to bootstrap the ACM Hub cluster.
+* Ansible. If you use Ansible for cluster provisioning you can have it deploy the OpenShift GitOps operator plus the bootstrap application
+* Other. If you use other automation tools to provision clusters they could do the same as Ansible.
+
+# Secret Management
+
+I am currently using the [External Secrets Operator](https://external-secrets.io/latest/) to manage secrets, I am using ACM to automatically bootstrap the token secret needed by ESO to interact with my secrets provider [Doppler](doppler.com) from the Hub cluster. I wrote a blog on this setup [here](https://cloud.redhat.com/blog/external-secrets-operator-and-doppler-with-openshift-gitops).
+
+I have used Sealed Secrets in the past but as I have expanded my homelab into multiple clusters, plus the occasional ephemeral cloud cluster, I found external secrets easier to manage.
+
+# Managing Promotion
+
+A common requirement is for a cluster configuration to be promoted across one or more clusters, i.e a change starts in the lab cluster, gets promoted to non-production and then finally production.
+
+I am currently trying this and so far commit pinning works well in this scenario, i.e. the lab cluster is pinned to HEAD and always gets the latest and greatest. The other clusters are pinned to specific commits, when you want to promote you simply move the pin forward to the desired commit.
+
+In cases where a configuration spans multiple repositories you may need to have different commit pins based on the repo. This could be accomplished by labelling the Application objects with the repo and then using a kustomize patch targetted by label. Some improvements to the helm chart would be needed so that labels can be merged between default and specific applications to make this easier to manage.
+
+Commit pinning for specific applications is also straightforward, either by overriding the default `targetRevision` in the App-of-App Helm chart for a specific application or patching it via kustomize.
+
+See the repo [cluster-config-pins](https://github.com/gnunn-gitops/cluster-config-pins) for more information on how commit pinning is being used here.
+
+# Sequence
+
+This repo uses Argo CD sync waves to configure the configuration in an ordered manner. The following waves are used:
+
+1. External Secrets Operator
+2. Storage (if needed)
+3. cert-manager
+11. Cluster Configuration (Authentication, AlertManager, etc)
+21. Operators (Pipelines, CSO, Compliance, Namespace Operator, etc)
+31. Common Apps (Developer Tools)
+41. OpenShift Console plugins
+51. Tenants
+
+# Topology
+
+A note on Argo CD topology preferences. I am a fan of distributed Argo CD for cluster configuration, my preference is to use the default `openshift-gitops` instance for cluster configuration and have an ACM Policy deploy OpenShift GitOps on each cluster. My preference for distributed Argo CD versus centralized Argo CD is to remove the Single-Point-Of-Failure (SPOF) as well mitigate any scalability issues when dealing with hundreds of clusters.
+
+I am also a big fan of separating the cluster configuration use case from application deployment (i.e the stuff Application teams push out) into separate Argo CD instances for the following reasons:
+
+* Argo CD uses a single serviceaccount for the application-controller which must have enough k8s permissions to pusn out the manifests. By it's nature the cluster configuration use case requires near cluster-admin level permissions at the SA level and while you can remove access to this for App teams using Argo RBAC I prefer a more isolated approach.
+* As mentioned I prefer a distributed Argo CD topology for cluster configuration, however a more centralized model with respect to Argo CD instance(s)for application teams provides them with a single pane of glass. This can be very useful to them when a team's applications are distributed across multiple clusters. For cluster-configuration we can achieve the single pane of glass with ACM which is ideal for Ops teams.
+
+# Tenant Configuration
+
+Tenants are managed via a helm chart and an ApplicationSet with the git generator, it basically follows the high level approach laid out in this [blog](https://cloud.redhat.com/blog/project-onboarding-using-gitops-and-helm) from Thomas Jungbauer.
+
+I am using my own Helm chart and this chart is wrapped in kustomize and leverages the helm inflator feature in kustomize. The benefit of this approach is that using kustomize makes it easy to add additional, tenant specific resources and avoids
+the helm chart having to be an all singing all dancing sort of thing.
+
+As an example, you can set the quota size (small, medium, large) you want in the chart but if you want a custom quota you just create your own quota object versus the helm chart having to support a custom quota.
+
+Finally note that tenant configuration is exempted from commit pinning, it doesn't make much sense to have promotions for individual tenants and structural promotion is handled already by versioning the helm chart.
+
+# Other Notes
+
+I am using annotation tracking with Argo CD and as result am not using IgnoreExtraneous (though I may still have some historical examples in the repo). Annotation tracking provides more capabilities then the default label tracking and should always be used to mitigate false positives from operator created resources.
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -0,0 +1,10 @@
+if [ $# -lt 1 ]; then
+    echo "No overlay specified, please specify an overlay from bootstrap/overlays"
+    exit 1
+else
+    OVERLAY=$1
+    echo "Configuring cluster ${OVERLAY}"
+fi
+
+oc project openshift-gitops
+kustomize build bootstrap/overlays/${OVERLAY} --enable-helm | oc apply -f -
--- a/bootstrap/base/kustomization.yaml
+++ b/bootstrap/base/kustomization.yaml
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+helmCharts:
+- name: argocd-app-of-app
+  version: 0.4.1
+  repo: https://gnunn-gitops.github.io/helm-charts
+  valuesFile: values.yaml
+  namespace: openshift-gitops
--- a/bootstrap/base/values.yaml
+++ b/bootstrap/base/values.yaml
@@ -0,0 +1,108 @@
+default:
+  app:
+    enabled: true
+    enableAutoSync: true
+    autoSyncPrune: false
+    project: cluster-config
+    labels:
+      app-source: base
+      repo: cluster-config
+    destination:
+      namespace: openshift-gitops
+      server: https://kubernetes.default.svc
+    source:
+      repoURL: https://github.com/gnunn-gitops/cluster-config.git
+      targetRevision: HEAD
+
+projects:
+
+  cluster-config:
+    annotations:
+      notifications.argoproj.io/subscribe.on-sync-failed.slack: cluster-gitops
+      notifications.argoproj.io/subscribe.on-health-degraded.slack: cluster-gitops
+    description: Project for overall cluster configuration
+    namespace: openshift-gitops
+    sourceRepos:
+    - https://github.com/gnunn-gitops/cluster-config
+    - https://github.com/redhat-cop/gitops-catalog
+    - https://github.com/gnunn-gitops/acm-hub-bootstrap
+    destinations: |
+      - namespace: '*'
+        server: https://kubernetes.default.svc
+    extraFields: |
+      clusterResourceWhitelist:
+      - group: '*'
+        kind: '*'
+
+applications:
+
+  banner:
+    annotations:
+      argocd.argoproj.io/sync-wave: '11'
+    source:
+      path: components/banner/base
+      extraSourceFields: |
+        plugin:
+          name: setenv-cmp-plugin
+
+  compliance-operator:
+    annotations:
+      argocd.argoproj.io/compare-options: IgnoreExtraneous
+      argocd.argoproj.io/sync-wave: '21'
+    destination:
+      namespace: openshift-compliance
+    source:
+      path: components/compliance-operator/overlays/cis-compliance
+
+  container-security:
+    annotations:
+      argocd.argoproj.io/compare-options: IgnoreExtraneous
+      argocd.argoproj.io/sync-wave: '21'
+    destination:
+      namespace: openshift-operators
+    source:
+      path: components/container-security-operator/overlays/stable-3.13
+
+  external-secrets:
+    annotations:
+      argocd.argoproj.io/sync-wave: '1'
+    destination:
+      namespace: openshift-operators
+    source:
+      path: components/eso/overlays/aggregate
+
+  helm-repos:
+    annotations:
+      argocd.argoproj.io/compare-options: IgnoreExtraneous
+      argocd.argoproj.io/sync-wave: '11'
+    source:
+      path: components/helm-repos/base
+
+  pipeline-operator:
+    annotations:
+      argocd.argoproj.io/sync-wave: "21"
+      argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    destination:
+      namespace: openshift-operators
+    source:
+      path: components/pipelines-operator/overlays/chains
+    syncPolicyRetry:
+      limit: 5
+      backoff:
+        duration: 5s
+        factor: 2
+        maxDuration: 3m
+
+  dev-console-plugin:
+    destination:
+      namespace: dev-console-plugin
+      argocd.argoproj.io/sync-wave: '41'
+    source:
+      path: components/dev-console-plugin/base
+
+  gitops-admin-plugin:
+    destination:
+      namespace: gitops-admin-plugin
+      argocd.argoproj.io/sync-wave: '41'
+    source:
+      path: components/gitops-admin-plugin/base
--- a/bootstrap/components/acm-hub/kustomization.yaml
+++ b/bootstrap/components/acm-hub/kustomization.yaml
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+helmCharts:
+- name: argocd-app-of-app
+  version: 0.4.1
+  repo: https://gnunn-gitops.github.io/helm-charts
+  valuesFile: values.yaml
+  namespace: openshift-gitops
--- a/bootstrap/components/acm-hub/values.yaml
+++ b/bootstrap/components/acm-hub/values.yaml
@@ -0,0 +1,54 @@
+default:
+  app:
+    enabled: true
+    enableAutoSync: true
+    autoSyncPrune: false
+    project: cluster-config
+    labels:
+      app-source: local.hub
+      repo: cluster-config
+    destination:
+      namespace: openshift-gitops
+      server: https://kubernetes.default.svc
+    source:
+      repoURL: https://github.com/gnunn-gitops/cluster-config.git
+      targetRevision: HEAD
+
+applications:
+
+  acm-hub:
+    annotations:
+      argocd.argoproj.io/sync-wave: '21'
+    labels:
+      repo: acm-hub-bootstrap
+    destinations:
+      namespace: open-cluster-management
+    source:
+      repoURL: https://github.com/gnunn-gitops/acm-hub-bootstrap.git
+      path: components/apps/acm/overlays/hub
+
+  acm-observability:
+    annotations:
+      argocd.argoproj.io/sync-wave: '31'
+    labels:
+      repo: acm-hub-bootstrap
+    destinations:
+      namespace: open-cluster-management-observability
+    source:
+      repoURL: https://github.com/gnunn-gitops/acm-hub-bootstrap.git
+      path: components/apps/acm/overlays/observability
+
+  acm-policies:
+    enableAutoSync: false
+    annotations:
+      argocd.argoproj.io/sync-wave: '31'
+    labels:
+      repo: acm-hub-bootstrap
+    destinations:
+      namespace: acm-policies
+    source:
+      repoURL: https://github.com/gnunn-gitops/acm-hub-bootstrap.git
+      path: bootstrap/policies/overlays/default
+      extraSourceFields: |
+        plugin:
+          name: setenv-cmp-plugin
--- a/bootstrap/components/kyverno/kustomization.yaml
+++ b/bootstrap/components/kyverno/kustomization.yaml
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+helmCharts:
+- name: argocd-app-of-app
+  version: 0.4.1
+  repo: https://gnunn-gitops.github.io/helm-charts
+  valuesFile: values.yaml
+  namespace: openshift-gitops
--- a/bootstrap/components/kyverno/values.yaml
+++ b/bootstrap/components/kyverno/values.yaml
@@ -0,0 +1,43 @@
+default:
+  app:
+    enabled: true
+    enableAutoSync: true
+    autoSyncPrune: false
+    project: cluster-config
+    labels:
+      app-source: local.hub
+      repo: cluster-config
+    destination:
+      namespace: openshift-gitops
+      server: https://kubernetes.default.svc
+    source:
+      repoURL: https://github.com/gnunn-gitops/cluster-config.git
+      targetRevision: HEAD
+
+applications:
+
+  kyverno:
+    enabled: false
+    annotations:
+      argocd.argoproj.io/compare-options: IgnoreExtraneous
+      argocd.argoproj.io/sync-wave: '21'
+    destination:
+      namespace: kyverno
+    source:
+      path: components/kyverno/overlays/policies
+    syncPolicyRetry:
+      limit: 5
+      backoff:
+        duration: 5s
+        factor: 2
+        maxDuration: 3m
+    extraFields: |
+      ignoreDifferences:
+        - group: kyverno.io
+          kind: ClusterPolicy
+          jsonPointers:
+          - /spec/rules
+        - group: kyverno.io
+          kind: Policy
+          jsonPointers:
+          - /spec/rules
--- a/bootstrap/components/sno/kustomization.yaml
+++ b/bootstrap/components/sno/kustomization.yaml
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+helmCharts:
+- name: argocd-app-of-app
+  version: 0.4.1
+  repo: https://gnunn-gitops.github.io/helm-charts
+  valuesFile: values.yaml
+  namespace: openshift-gitops
--- a/bootstrap/components/sno/values.yaml
+++ b/bootstrap/components/sno/values.yaml
@@ -0,0 +1,41 @@
+default:
+  app:
+    enabled: true
+    enableAutoSync: true
+    autoSyncPrune: false
+    project: cluster-config
+    labels:
+      app-source: local.hub
+      repo: cluster-config
+    destination:
+      namespace: openshift-gitops
+      server: https://kubernetes.default.svc
+    source:
+      repoURL: https://github.com/gnunn-gitops/cluster-config.git
+      targetRevision: HEAD
+
+applications:
+
+  registry:
+    annotations:
+      argocd.argoproj.io/sync-wave: '5'
+    destination:
+      namespace: openshift-image-registry
+    source:
+      path: components/registry-sno/base
+
+  defrag-etcd:
+    annotations:
+      argocd.argoproj.io/sync-wave: '99'
+    destination:
+      namespace: openshift-etcd
+    source:
+      path: components/defrag-etcd/base
+
+  cleanup-completed-pods:
+    annotations:
+      argocd.argoproj.io/sync-wave: '99'
+    destination:
+      namespace: clean-completed-pods
+    source:
+      path: components/clean-completed-pods/base
--- a/bootstrap/overlays/local.aws/kustomization.yaml
+++ b/bootstrap/overlays/local.aws/kustomization.yaml
@@ -0,0 +1,25 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+helmCharts:
+- name: argocd-app-of-app
+  version: 0.2.4
+  repo: https://gnunn-gitops.github.io/helm-charts
+  valuesFile: values.yaml
+  namespace: openshift-gitops
+  releaseName: argocd-app-of-app-0.2.4
+
+resources:
+- ../local
+
+patches:
+  - target:
+      kind: Application
+      name: compliance-operator
+    patch: |-
+      - op: replace
+        path: /spec/source/path
+        value: 'components/apps/compliance-operator/overlays/cis-compliance'
+      - op: replace
+        path: /spec/source/repoURL
+        value: 'https://github.com/gnunn-gitops/cluster-config'
--- a/bootstrap/overlays/local.aws/values.yaml
+++ b/bootstrap/overlays/local.aws/values.yaml
@@ -0,0 +1,14 @@
+default:
+  app:
+    enabled: true
+    enableAutoSync: true
+    autoSyncPrune: false
+    project: cluster-config
+    destination:
+      namespace: openshift-gitops
+      server: https://kubernetes.default.svc
+    source:
+      repoURL: https://github.com/gnunn-gitops/cluster-config.git
+      targetRevision: HEAD
+
+applications:
--- a/bootstrap/overlays/local.home/kustomization.yaml
+++ b/bootstrap/overlays/local.home/kustomization.yaml
@@ -0,0 +1,24 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+helmCharts:
+- name: argocd-app-of-app
+  version: 0.4.1
+  repo: https://gnunn-gitops.github.io/helm-charts
+  valuesFile: values.yaml
+  namespace: openshift-gitops
+
+components:
+- ../../components/sno
+
+resources:
+- ../local
+
+patches:
+  - target:
+      kind: Application
+      name: compliance-operator
+    patch: |-
+      - op: replace
+        path: /spec/source/path
+        value: 'components/compliance-operator/overlays/cis-compliance-master-only'
--- a/bootstrap/overlays/local.home/values.yaml
+++ b/bootstrap/overlays/local.home/values.yaml
@@ -0,0 +1,122 @@
+default:
+  app:
+    enabled: true
+    enableAutoSync: true
+    autoSyncPrune: false
+    project: cluster-config
+    labels:
+      app-source: local.home
+      repo: cluster-config
+    destination:
+      namespace: openshift-gitops
+      server: https://kubernetes.default.svc
+    source:
+      repoURL: https://github.com/gnunn-gitops/cluster-config.git
+      targetRevision: HEAD
+
+projects:
+
+  demo:
+    description: Project for ad-hoc demos and testing
+    sourceRepos:
+    - "*"
+    destinations: |
+      - namespace: '*'
+        server: https://kubernetes.default.svc
+    extraFields: |
+      clusterResourceWhitelist:
+      - group: '*'
+        kind: '*'
+
+applications:
+
+  lvm-operator:
+    annotations:
+      argocd.argoproj.io/sync-wave: '2'
+    destination:
+      namespace: openshift-storage
+    source:
+      path: clusters/overlays/local.home/components/lvm-operator
+
+  acs-secured-cluster:
+    annotations:
+      argocd.argoproj.io/sync-wave: '21'
+    destination:
+      namespace: rhacs-operator
+    source:
+      path: components/acs-operator/overlays/secured-cluster
+      extraSourceFields: |
+        plugin:
+          name: setenv-cmp-plugin
+
+  console-links:
+    annotations:
+      argocd.argoproj.io/sync-wave: '11'
+    source:
+      path: clusters/overlays/local.home/components/consolelinks
+
+  cost-management:
+    annotations:
+      argocd.argoproj.io/sync-wave: '21'
+    destination:
+      namespace: costmanagement-metrics-operator
+    source:
+      path: clusters/overlays/local.home/components/cost-management-operator
+
+  lokistack:
+    enabled: false
+    annotations:
+      argocd.argoproj.io/sync-wave: '21'
+    source:
+      path: clusters/overlays/local.home/components/lokistack
+    syncPolicyRetry:
+      limit: 5
+      backoff:
+        duration: 5s
+        factor: 2
+        maxDuration: 3m
+
+  node-config:
+    annotations:
+      argocd.argoproj.io/sync-wave: '99'
+    source:
+      path: clusters/overlays/local.home/components/node-config
+
+  rollout-manager:
+    annotations:
+      argocd.argoproj.io/sync-wave: '31'
+    source:
+      path: components/rollout-manager/base
+
+# Tenants
+  gitops:
+    project: cluster-config
+    annotations:
+      argocd.argoproj.io/sync-wave: '50'
+    destination:
+      namespace: gitops
+    source:
+      path: components/gitops-operator/overlays/shared
+      extraSourceFields: |
+        plugin:
+          name: setenv-cmp-plugin
+
+  tenant-secrets:
+    project: cluster-config
+    labels:
+      repo: use-head
+    annotations:
+      argocd.argoproj.io/sync-wave: '50'
+    destination:
+      namespace: tenant-secrets
+    source:
+      path: components/tenant-secrets/base
+
+  tenants:
+    project: cluster-config
+    labels:
+      repo: use-head
+    annotations:
+      argocd.argoproj.io/sync-wave: '51'
+    source:
+      path: clusters/overlays/local.home/components/tenants
--- a/bootstrap/overlays/local.hub/kustomization.yaml
+++ b/bootstrap/overlays/local.hub/kustomization.yaml
@@ -0,0 +1,32 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+helmCharts:
+- name: argocd-app-of-app
+  version: 0.4.1
+  repo: https://gnunn-gitops.github.io/helm-charts
+  valuesFile: values.yaml
+  namespace: openshift-gitops
+
+components:
+- ../../components/acm-hub
+- ../../components/sno
+
+resources:
+- ../local
+
+patches:
+  - target:
+      kind: Application
+      name: compliance-operator
+    patch: |-
+      - op: replace
+        path: /spec/source/path
+        value: 'components/compliance-operator/overlays/cis-compliance-master-only'
+  - target:
+      kind: Application
+      name: external-secrets
+    patch: |-
+      - op: replace
+        path: /spec/source/path
+        value: 'clusters/overlays/local.hub/components/eso'
--- a/bootstrap/overlays/local.hub/values.yaml
+++ b/bootstrap/overlays/local.hub/values.yaml
@@ -0,0 +1,160 @@
+default:
+  app:
+    enabled: true
+    enableAutoSync: true
+    autoSyncPrune: false
+    project: cluster-config
+    labels:
+      app-source: local.hub
+      repo: cluster-config
+    destination:
+      namespace: openshift-gitops
+      server: https://kubernetes.default.svc
+    source:
+      repoURL: https://github.com/gnunn-gitops/cluster-config.git
+      targetRevision: HEAD
+
+applications:
+
+  node-config:
+    annotations:
+      argocd.argoproj.io/sync-wave: '0'
+    source:
+      path: clusters/overlays/local.hub/components/node-config
+
+  odf-operator:
+    annotations:
+      argocd.argoproj.io/sync-wave: '1'
+    source:
+      path: components/odf-operator/operator/overlays/no-registry
+
+  lvm-operator:
+    annotations:
+      argocd.argoproj.io/sync-wave: '2'
+    destination:
+      namespace: openshift-storage
+    source:
+      path: clusters/overlays/local.hub/components/lvm-operator
+
+  odf-instance:
+    annotations:
+      argocd.argoproj.io/sync-wave: '2'
+    destination:
+      namespace: openshift-storage
+    source:
+      path: components/odf-operator/instance/base
+
+  acs:
+    annotations:
+      argocd.argoproj.io/sync-wave: '21'
+    destination:
+      namespace: stackrox
+    source:
+      path: clusters/overlays/local.hub/components/acs-operator
+
+  acs-config:
+    annotations:
+      argocd.argoproj.io/sync-wave: '31'
+    destination:
+      namespace: stackrox
+    source:
+      path: components/acs-config/base
+      extraSourceFields: |
+        plugin:
+          name: setenv-cmp-plugin
+
+  amq-streams:
+    enabled: false
+    annotations:
+      argocd.argoproj.io/sync-wave: '21'
+    destination:
+      namespace: openshift-gitops
+    source:
+      path: components/amq-streams/overlays/amq-streams-2.7.x/
+
+  trusted-profile-analyzer-prereqs:
+    enabled: false
+    annotations:
+      argocd.argoproj.io/sync-wave: '31'
+    destination:
+      namespace: openshift-gitops
+    source:
+      path: components/trusted-profile-analyzer/prereqs/base
+
+  # acm-clusters:
+  #   annotations:
+  #     argocd.argoproj.io/sync-wave: '31'
+  #   labels:
+  #     repo: acm-hub-bootstrap
+  #   destinations:
+  #     namespace: openshift-gitops
+  #   source:
+  #     repoURL: https://github.com/gnunn-gitops/acm-hub-bootstrap.git
+  #     path: components/clusters/base
+
+  # Disable while we work this out
+  nmstate:
+    enabled: true
+    source:
+      path: clusters/overlays/local.hub/components/nmstate
+
+  console-links:
+    annotations:
+      argocd.argoproj.io/sync-wave: '11'
+    source:
+      path: clusters/overlays/local.hub/components/consolelinks
+
+  dev-tools:
+    annotations:
+      argocd.argoproj.io/sync-wave: '31'
+    destination:
+      namespace: dev-tools
+    source:
+      path: components/dev-tools/overlays/default
+
+  quay-registry:
+    # leave disabled unless needed for demo
+    enabled: false
+    annotations:
+      argocd.argoproj.io/sync-wave: '21'
+    source:
+      path: clusters/overlays/local.hub/components/quay-registry-operator
+
+  cost-management:
+    annotations:
+      argocd.argoproj.io/sync-wave: '21'
+    destination:
+      namespace: costmanagement-metrics-operator
+    source:
+      path: clusters/overlays/local.hub/components/cost-management-operator
+
+  lokistack:
+    enabled: false
+    annotations:
+      argocd.argoproj.io/sync-wave: '21'
+    source:
+      path: clusters/overlays/local.hub/components/lokistack
+    syncPolicyRetry:
+      limit: 5
+      backoff:
+        duration: 5s
+        factor: 2
+        maxDuration: 3m
+
+  kyverno-acm:
+    enabled: false
+    annotations:
+      argocd.argoproj.io/compare-options: IgnoreExtraneous
+      argocd.argoproj.io/sync-wave: '21'
+    destination:
+      namespace: acm-policies
+    source:
+      path: components/kyverno-acm/base
+
+  rhtas-operator:
+    annotations:
+      argocd.argoproj.io/sync-wave: '21'
+    destination:
+      namespace: trusted-artifact-signer
+    source:
+      path: clusters/overlays/local.hub/components/rhtas-operator
--- a/bootstrap/overlays/local/README.md
+++ b/bootstrap/overlays/local/README.md
@@ -0,0 +1,3 @@
+Applications to support my local home lab environment. This isn't limited to my
+on-prem environment but can also include cloud clusters. This overlay
+includes items for consistency in my homelab setup such as RBAC, authentication (Keycloak), etc.
--- a/bootstrap/overlays/local/kustomization.yaml
+++ b/bootstrap/overlays/local/kustomization.yaml
@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+helmCharts:
+- name: argocd-app-of-app
+  version: 0.4.1
+  repo: https://gnunn-gitops.github.io/helm-charts
+  valuesFile: values.yaml
+  namespace: openshift-gitops
+
+resources:
+- ../../base
--- a/bootstrap/overlays/local/values.yaml
+++ b/bootstrap/overlays/local/values.yaml
@@ -0,0 +1,83 @@
+default:
+  app:
+    enabled: true
+    enableAutoSync: true
+    autoSyncPrune: false
+    project: cluster-config
+    labels:
+      app-source: local.hub
+      repo: cluster-config
+    destination:
+      namespace: openshift-gitops
+      server: https://kubernetes.default.svc
+    source:
+      repoURL: https://github.com/gnunn-gitops/cluster-config.git
+      targetRevision: HEAD
+
+applications:
+
+  authentication:
+    annotations:
+      argocd.argoproj.io/sync-wave: '4'
+    destination:
+      namespace: openshift-config
+    source:
+      path: components/oauth/overlays/homelab
+      extraSourceFields: |
+        plugin:
+          name: setenv-cmp-plugin
+
+  cert-manager-operator:
+    annotations:
+      argocd.argoproj.io/sync-wave: "2"
+    destination:
+      namespace: cert-manager-operator
+    source:
+      path: components/cert-manager-operator/aggregate/overlays/letsencrypt
+
+  certificates:
+    annotations:
+      argocd.argoproj.io/sync-wave: "3"
+    destination:
+      namespace: cert-manager-operator
+    source:
+      path: components/certificates/base
+      extraSourceFields: |
+        plugin:
+          name: setenv-cmp-plugin
+
+  alertmanager:
+    annotations:
+      argocd.argoproj.io/sync-wave: '11'
+    destination:
+      namespace: openshift-monitoring
+    source:
+      path: components/alertmanager/base
+
+  openshift-monitoring:
+    annotations:
+      argocd.argoproj.io/sync-wave: '11'
+    destination:
+      namespace: openshift-monitoring
+    source:
+      path: components/openshift-monitoring/base
+      extraSourceFields: |
+        plugin:
+          name: setenv-cmp-plugin
+    # syncOptions:
+    #   - RespectIgnoreDifferences=true
+    # extraFields: |
+    #   ignoreDifferences:
+    #   - group: ""
+    #     kind: ConfigMap
+    #     jsonPointers:
+    #     - /data/config.yaml/prometheusK8s/externalLabels/managed-cluster
+    #     name: cluster-monitoring-config
+    #     namespace: openshift-monitoring
+
+  rbac:
+    annotations:
+      argocd.argoproj.io/compare-options: IgnoreExtraneous
+      argocd.argoproj.io/sync-wave: '11'
+    source:
+      path: components/rbac/base
--- a/bootstrap/overlays/rhdp/kustomization.yaml
+++ b/bootstrap/overlays/rhdp/kustomization.yaml
@@ -0,0 +1,21 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+helmCharts:
+- name: argocd-app-of-app
+  version: 0.4.1
+  repo: https://gnunn-gitops.github.io/helm-charts
+  valuesFile: values.yaml
+  namespace: openshift-gitops
+
+resources:
+- ../../base
+
+patches:
+  - target:
+      kind: Application
+      name: compliance-operator
+    patch: |-
+      - op: replace
+        path: /spec/source/path
+        value: 'components/compliance-operator/overlays/cis-compliance-master-only'
--- a/bootstrap/overlays/rhdp/values.yaml
+++ b/bootstrap/overlays/rhdp/values.yaml
@@ -0,0 +1,92 @@
+default:
+  app:
+    enabled: true
+    enableAutoSync: true
+    autoSyncPrune: false
+    project: cluster-config
+    destination:
+      namespace: openshift-gitops
+      server: https://kubernetes.default.svc
+    source:
+      repoURL: https://github.com/gnunn-gitops/cluster-config.git
+      targetRevision: HEAD
+    labels:
+      app-source: rhdp
+
+applications:
+
+  # acs:
+  #   annotations:
+  #     argocd.argoproj.io/compare-options: IgnoreExtraneous
+  #     argocd.argoproj.io/sync-wave: '21'
+  #   source:
+  #     path: components/acs-operator/overlays/oauth
+
+  # acs-tokens:
+  #   annotations:
+  #     argocd.argoproj.io/compare-options: IgnoreExtraneous
+  #     argocd.argoproj.io/sync-wave: '61'
+  #   source:
+  #     path: tenants/acs-tokens/base
+
+  authentication:
+    annotations:
+      argocd.argoproj.io/sync-wave: '4'
+    destination:
+      namespace: openshift-config
+    source:
+      path: components/oauth/overlays/homelab
+      extraSourceFields: |
+        plugin:
+          name: setenv-cmp-plugin
+
+  rbac:
+    annotations:
+      argocd.argoproj.io/compare-options: IgnoreExtraneous
+      argocd.argoproj.io/sync-wave: '11'
+    source:
+      path: components/rbac/base
+
+  openshift-monitoring:
+    annotations:
+      argocd.argoproj.io/sync-wave: '11'
+    destination:
+      namespace: openshift-monitoring
+    source:
+      path: components/openshift-monitoring/base
+      extraSourceFields: |
+        plugin:
+          name: setenv-cmp-plugin
+
+  # product-catalog-root:
+  #   project: cluster-config
+  #   annotations:
+  #     argocd.argoproj.io/compare-options: IgnoreExtraneous
+  #     argocd.argoproj.io/sync-wave: '51'
+  #   source:
+  #     path: tenants/product-catalog/argocd/root/base
+
+  # kyverno:
+  #   annotations:
+  #     argocd.argoproj.io/compare-options: IgnoreExtraneous
+  #     argocd.argoproj.io/sync-wave: '21'
+  #   destination:
+  #     namespace: kyverno
+  #   source:
+  #     path: components/kyverno/overlays/policies
+  #   syncPolicyRetry:
+  #     limit: 5
+  #     backoff:
+  #       duration: 5s
+  #       factor: 2
+  #       maxDuration: 3m
+  #   extraFields: |
+  #     ignoreDifferences:
+  #       - group: kyverno.io
+  #         kind: ClusterPolicy
+  #         jsonPointers:
+  #         - /spec/rules
+  #       - group: kyverno.io
+  #         kind: Policy
+  #         jsonPointers:
+  #         - /spec/rules
--- a/clusters/README.md
+++ b/clusters/README.md
@@ -0,0 +1 @@
+Cluster specific overlays go here, typically each cluster will have a list of ArgoCD apps required for the configuration managed by the "app of app" pattern expressed in a corresponding overlay in the `/bootstrap/overlays` directory.
--- a/clusters/overlays/local.aws/README.md
+++ b/clusters/overlays/local.aws/README.md
@@ -0,0 +1,3 @@
+#### Home (local) Cluster
+
+This is a cluster deployed in AWS using cluster.ocplab-aws.com for base DNS.
--- a/clusters/overlays/local.aws/components/cost-management-operator/kustomization.yaml
+++ b/clusters/overlays/local.aws/components/cost-management-operator/kustomization.yaml
@@ -0,0 +1,13 @@
+kind: Kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+
+resources:
+  - https://github.com/redhat-cop/gitops-catalog/cost-management-operator/overlays/aggregate
+
+patchesJson6902:
+  - path: patch-source-and-name.yaml
+    target:
+      group: koku-metrics-cfg.openshift.io
+      kind: KokuMetricsConfig
+      name: instance
+      version: v1beta1
--- a/clusters/overlays/local.aws/components/cost-management-operator/patch-source-and-name.yaml
+++ b/clusters/overlays/local.aws/components/cost-management-operator/patch-source-and-name.yaml
@@ -0,0 +1,6 @@
+- op: replace
+  path: /spec/source/name
+  value: aws.cluster
+- op: replace
+  path: /metadata/name
+  value: aws-cluster
--- a/clusters/overlays/local.aws/components/openshift-monitoring/cluster-monitoring-config-cm.yaml
+++ b/clusters/overlays/local.aws/components/openshift-monitoring/cluster-monitoring-config-cm.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cluster-monitoring-config
+  namespace: openshift-monitoring
+data:
+  config.yaml: |
+    enableUserWorkload: true
+    prometheusK8s:
+      volumeClaimTemplate:
+       spec:
+         accessModes:
+         - ReadWriteOnce
+         storageClassName: gp3-csi
+         volumeMode: Filesystem
+         resources:
+           requests:
+             storage: 40Gi
--- a/clusters/overlays/local.aws/components/openshift-monitoring/kustomization.yaml
+++ b/clusters/overlays/local.aws/components/openshift-monitoring/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- cluster-monitoring-config-cm.yaml
--- a/clusters/overlays/local.home/README.md
+++ b/clusters/overlays/local.home/README.md
@@ -0,0 +1,3 @@
+#### Home (local) Cluster
+
+This is my home cluster which runs on a server under my desk and uses the highly original cluster name of 'home'. It runs in libvirt on a Ryzen 3900x server with 128 GB of memory. It is typically configured as three combined master/worker nodes with 7 vCPU and 35 GB per node.
--- a/clusters/overlays/local.home/components/clusterversion/base/clusterversion.yaml
+++ b/clusters/overlays/local.home/components/clusterversion/base/clusterversion.yaml
@@ -0,0 +1,11 @@
+# apiVersion: config.openshift.io/v1
+# kind: ClusterVersion
+# metadata:
+#   name: version
+# spec:
+#   channel: fast-4.8
+#   clusterID: 4d11acb7-286f-42e1-868c-55f1e15687c7
+#   desiredUpdate:
+#     image: quay.io/openshift-release-dev/ocp-release@sha256:bf48faa639523b73131ec7c91637d5c94d33a4afe09ac8bdad672862f5e86ccb
+#     version: 4.8.14
+#   upstream: https://api.openshift.com/api/upgrades_info/v1/graph
--- a/clusters/overlays/local.home/components/clusterversion/base/kustomization.yaml
+++ b/clusters/overlays/local.home/components/clusterversion/base/kustomization.yaml
@@ -0,0 +1,5 @@
+kind: Kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+
+resources:
+  - clusterversion.yaml
--- a/clusters/overlays/local.home/components/consolelinks/acs-consolelink.yaml
+++ b/clusters/overlays/local.home/components/consolelinks/acs-consolelink.yaml
@@ -0,0 +1,11 @@
+apiVersion: console.openshift.io/v1
+kind: ConsoleLink
+metadata:
+  name: acs
+spec:
+  href: 'https://central-stackrox.apps.hub.ocplab.com'
+  location: ApplicationMenu
+  text: Advanced Cluster Security
+  applicationMenu:
+    section: Red Hat Applications
+    imageURL: https://central-stackrox.apps.hub.ocplab.com/static/media/rh-favicon.0110fdfc5cab55416acf.ico
--- a/clusters/overlays/local.home/components/consolelinks/kustomization.yaml
+++ b/clusters/overlays/local.home/components/consolelinks/kustomization.yaml
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../../../components/consolelinks/base
+  - acs-consolelink.yaml
+  - nexus-consolelink.yaml
+  - sonarqube-consolelink.yaml
+  - tekton-hub-link.yaml
--- a/clusters/overlays/local.home/components/consolelinks/nexus-consolelink.yaml
+++ b/clusters/overlays/local.home/components/consolelinks/nexus-consolelink.yaml
@@ -0,0 +1,11 @@
+apiVersion: console.openshift.io/v1
+kind: ConsoleLink
+metadata:
+  name: nexus
+spec:
+  href: 'https://nexus-dev-tools.apps.hub.ocplab.com'
+  location: ApplicationMenu
+  text: Nexus
+  applicationMenu:
+    section: Tools
+    imageURL: https://nexus-dev-tools.apps.hub.ocplab.com/favicon.png
--- a/clusters/overlays/local.home/components/consolelinks/sonarqube-consolelink.yaml
+++ b/clusters/overlays/local.home/components/consolelinks/sonarqube-consolelink.yaml
@@ -0,0 +1,11 @@
+apiVersion: console.openshift.io/v1
+kind: ConsoleLink
+metadata:
+  name: sonarqube
+spec:
+  href: 'https://sonarqube-dev-tools.apps.hub.ocplab.com'
+  location: ApplicationMenu
+  text: SonarQube
+  applicationMenu:
+    section: Tools
+    imageURL: https://sonarqube-dev-tools.apps.hub.ocplab.com/favicon.ico
--- a/clusters/overlays/local.home/components/consolelinks/tekton-hub-link.yaml
+++ b/clusters/overlays/local.home/components/consolelinks/tekton-hub-link.yaml
@@ -0,0 +1,211 @@
+apiVersion: console.openshift.io/v1
+kind: ConsoleLink
+metadata:
+  name: tekton-hub
+spec:
+  href: 'https://tekton-hub-ui-openshift-pipelines.apps.hub.ocplab.com'
+  location: ApplicationMenu
+  text: Tekton Hub
+  applicationMenu:
+    section: Red Hat Applications
+    imageURL: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAXwAAAF8CAYAAADM5wDKAAAACXBIWXMAAG66AABuugHW3rEXAAAg
+      AElEQVR4nO3dbVYcx9nG8WpZlt+SSFkBaAXgFQArAK8AWIHRCoS+5ZvQCkArCHx8PglWYLQCwQoi
+      4rc4UtzPuVpd8ggD03VXVU919/93zhznOJ6Znp7hmpq77qqu6rp2AIDxu8d7DADTQOADwEQQ+AAw
+      EQQ+AEwEgQ8AE0HgA8BEEPgAMBEEPgBMBIEPABNxnzc6j6qqlp1zuq065x7N/FPWxvZ6AYOz9i5v
+      nXPnM/+8qOv6ghOaHlsrJFBV1Xob6P62MvgXBSzea/8F4Jw7rev6lPckDoEfqKoqjdLXZ26EO9Af
+      fQmc+ltd1285990R+B1UVaVR+1Z7I+CBcugL4Fi3uq7PeV/uRuDfog35nTbkl4o8SACzLtvwPyL8
+      b0bgz2gnWnfaGyEPDJfC/6gNfyaAWwT+h6D3IU/3DDA+Z23wH039vZ1s4LeTr3uM5oHJ8KP+g6lO
+      9k4u8NuyjQ/6hwUcEoB+Xc0E/6TKPZMJ/Dbo951z2wUcDoAyvFQuTCX4Rx/4M6WbpwUcDoAyPZtC
+      qWfUgV9V1V47qqd0A2Ceq3a0fzDWMzXKwG+3OjgqdTL24cOHbnV19cb/b319vffjAXI5Pb15N4Tz
+      83N3dXVV6nnX5O7OGLdyGFXgt+UbBf3moo9lZWXFLS8vN8Gu26NHjz7+E8AHb9++bcLf/1O3i4sL
+      9/r16xLO0Ekb/KMp84wm8BdZvllaWmpG5j7cGaUD8fTrwH8J6H9fXl4u4qyOqswz+MBvR/XHfS+a
+      2tzcbIJ9a2urGckDyEsj/+Pj4yb8T05O+j7bWry1NfTR/qADv6qqrbaEk31Ur7q7wt3fACyWwt/f
+      epoPuGpLPMdDfesHGfjtqF7lm+9zP5dG8gr4nZ2d3E8FwOjo6KgJ/p5G/i/aMs/gRvuDC/x2AdVx
+      zm2KNZrf29trQp5yDTAcKvso/A8ODnKP+l+3JZ5BLdgaVODnLuFo8nV/f5/RPDACCn79PWec7B1c
+      iWcwgd924TzP8dhra2vNiJ7aPDA+KvVoxH92dpbrtT0ZShfPIAK/qqqjHHvgaESvUQBtlMD4qbtH
+      v94zjfhf1nVdfGngXgHHcCtNzlZVdZo67FWjPzw8bOp9hD0wDfpb19+8/vaVAYltK6vahpJiFTvC
+      b0/caerJ2adPnzblG1a8AtOllb0q8zx79iz1OdBk7nqpHTxFBn6OThzV6fUG37aHDYDp0SpeDQAT
+      1/eL7eAprqTTXjz8PFXY66fb8+fPm/odYQ9gljJB2aCMSFjmUXadt1lWlKJG+O0JOk3VdqkNzDRD
+      Ty89gHlU31enXsKN267a8s55KSe/mBF+W8ZJFvaq1evnGmEPoAtlhTJD2ZGIsuy0zbYiFDHCTzlB
+      q59lGtXTfQPASmUejfYTrdYtZiJ34YGfMuxVwtEbRQcOgFjq5NHAMVGJp4jQL6Gkk6QbZ3t7u/k5
+      RtgDSEFZokxRtiSw0mbdQi008NsVtNH72KvmphWzAJCasiVRXX+tzbyFWVhJJ9XeOFo1x2ZnAHJT
+      8O/u7qZ4loXtvbOQEX6762VU2PvtEQh7AH1Q1iTaluF5m4G9632E37Yonce0X+qEs5AKwCKorq/J
+      3MgOHt15te/VuL2O8GeuP0vYAxgkvzo3cqSvOx/3vdla3yWd/ZiOHMIeQAkShf5Km4m96S3w25pV
+      1DVo2fwMQCmURcqkSN/3Wc/vpYbf/my5iCnlMEELoEQJundUz1/uY1FWXyP8qLq9emAJewAlUjZF
+      9uk/7GtRVvYRfmy/vVa5sagKQOkU/C9fvow5yuz9+VkDP7aUo71x1AIFAEOgun7E3jvZSzu5SzpH
+      1rD3HTkAMBSRnTsP28zMJlvgV1Wl/Yk3rffXFsdshAZgSJRZyq4Im212ZpFzhG/+ptIECPvZAxgi
+      ZVfkJG62UX6WGn7MRC11ewBjEFnPzzKBmzzwYyZqVfvisoQAxkDXyFXoG/fcyTKBm6Oks2edqN3f
+      3yfsAYyCskyZZvSwzdKkko7w250w31juu7a2RlcOgNFRTf/s7Mz6sh6n3FEz9Qjf/HWWYE8KAChO
+      ZLYl3VwtWeC3o3vTxR81o82maADGSNkW0bWz3WZrEslKOlVVHVh2w9RErSY36LkHMFZv375tavrG
+      CdwXdV0nqecnGeG3nTmm3c30c4ewBzBmyriI0s5OqgulJBnhV1WlOlPwb5alpaVmdA8AU6BR/uXl
+      peWVPqvrOrqen6qGbxrdswsmgCmJyLwk+8NHB35VVTqQpdD7qQ2T7RMATIkyT9lnsNRmbZQUI3zT
+      QeztJV9TAADFi8i+6MCPquFbF1pRuwcwZRG1/KiFWLEjfNM3TsRyYwAYvIgMjBrlx47wL0Lr9+q7
+      V08qAEyZWjUNffmXdV2bF2KZR/hVVa1aJmup3QOAOQuX2uw1iSnpmH5a6EK/ADB1EVlovmNM4G+F
+      3mFzc5PtjwGgnbhVJhoEZ69333Inazlna8t8nEAUXVjntrkj1VLZvA+LoEw8OTkJfeamrFPXdfCl
+      AU2TtpatFJisRV/0OdO1Ffyt62XmdHlNLYzxN/Z4Qh+Mk7emrRasga9vlpWQ+2xvb7OVArJSuOsz
+      9vLlyyRPo8+s6qysCEdO+owZPrOv67oO/lkaXMNvd20LCntHOQcZKegVyhsbG8nCXvRYekw9Nldj
+      Qy7GbFyx7KAZPMKvqkpH98/QJ0p9sXRAq7U1Ooq4fFwQ7YGiXxA0HiC1qqosj/hdXdfHIXewdOkE
+      /741zkQDt1LwaqK1r7AXPZeek9IkUjNmZHAW9xL41ECRkkb1u7u71qsHRdFz6rlZT4KUjBkZfCdL
+      SSe4NvPmzRt+BiOaum/0h9G16yY3dfWotk83D2KpPPn48ePgR6nrOqgWFDTCr6oq+BtFO2MS9ohV
+      WtiLjkXHRLsxYikjlZWhQjM5tKRDOQcLUVrYez70gVjGz1FQa2Zo4AcP1VnBiFiql5cY9p6OjZo+
+      YhmzMmvgBx8RgY8YKRdS5aRjpHsHMfoI/KBJW8uELf33sNJElv4IFtGNY6HtQ7RnD3NWsLL044dM
+      3HbePK29nGEQdTEAViqTpAp7TYipRno9jPWlok4b4+XmPqFj1TGzKhdWyszQ8qWyuetlD0N2ywwO
+      fEY6sFJoplhUpf1wdKGJeT+XNTI/ODiILh/pmP1WD0AoZaZhvkpB2ynwQ2r41O/Rm9jrHmvlotZ/
+      +BW58/gVtLpP7MpwrtkMq9x1/JDAD15dQuDDInZ0//z5c3d8fGz6han76L56DCs/ygdCGTOzczZn
+      HeGzAhEWMd0uh4eHSa6brMfQY1nRsQMLY2Z2zubOXTpVVWnIshZyFP/6178IfQTRqtW///3vppOm
+      UXnqi+Srrv/kyZPg+6ljRxPCfP4Rwvj5P6vrutOkUcw1befiw45Q1lKI6u6pw961I31LTV8dO5R1
+      ECp3ZoYEftDoXiMcIJQ1JDUSz8X62AQ+LAzZ2Tmbs43wmbCFhSUk1XqZswVYj63nCEXgwyJndmYt
+      6QChLHvm5CjlpHiOkvf/wTQR+CiGFj+F0graPn5N6jks29daXhOQC4GPYlj2le9zRavludgrHyUh
+      8DFofW7fwVYhGLpsgU9LJvrA5wzoji4dDBolE4wNXToAMBE5f7US+Bg0bV/Qlz6fC8iBwEcS9du3
+      7v3pqfvt4MC9Oz52/zO0I1pGNn0ubrI8V9fXpPP3y96eu1pedv+qquam/61/9ztfNEiEwEeU2aD6
+      cWPD/fLkifvpu+/cv7/91v24vt58CXRlqV3qSlV99LrrOSxXxerymvTlqPP324sX7veZ59D/1r+7
+      evzY/bq/35xrIAaBDxOFj0LIB1V9w6UI35+dNV8C/w3YKthyWcyc++jEPEeX16Kw1xfjTedv1n+e
+      PWvONcGPGAQ+ginA/7262oTQvKCSkLKEZXGTLkuYs76ux7Zc+rDLa9G56XIORf+dzrnOfciXKOAR
+      +OjMj0Z/3t39pPQwj4Lq146X/bOunM25n471see9Fn0Jvjdc2UvnXu+B3gvLXAmmi8DHXL58o7q8
+      JaBEE7ldWAP/5OQkS2lHj6nHtugS+DH0Xug9aX4lUOZBBwQ+7qRJV1++idG1bKGuFstWxKIrU6W8
+      tKAey3K1K9du2dzXKmDNoeg9CpkgxzQR+LiVRo6adA0p36Sws7NjfpTd3d0kI309hh7LKuY1WOg9
+      arqkGO3jDgQ+/kR1YY0YNXJMpQq4io9KIWtrQRdY+4RG5VtbW6aJXN1H97WO7EXH3qU09VmGJfR+
+      tE9tHzch8PEJdX80k4GJL97x+dZW0H+/33GS9zaquz9+/LgZaXfp09d/o/9W97HW7EOPvXr0yH3x
+      /fdRz3UTjfZV2/+th3ZVDMt93i+4mQVU/zW0H86j0f1XgQHuR/lnxkliT+2UuuniJXpMbXGs2rrf
+      dE0jeq2gtSyquknX0b2n86Lae+ovWNEiuHenp+6bo6PmywUg8NF0i/y0tZUldOTrgwN3z7CXvCZN
+      tVL1quOE710U6JZe+hC6+HTopLGC+K+np835t3ZA3eXdyUlT4vnL8XGWEhKGhZLOxPkunBxhf39t
+      zf3thx/cA+MEpkbjfayiTUXHarlIig/9v7561Zyz1JoJ3fV1FmuBwJ+ypl6/sdG5ZbKre0tL7i//
+      /GcTYrGjStXVrW2afdIxxnbm3F9fb86Zzt09w/Vz76L3WIu1ui6AwzgR+BOlev3PEW2HN1Gt/uvn
+      z93Di4vgSdq7qExi2WOnLzq2lP3/Onc6hzqXId1NXWg9xc89t4yiHAT+BOkPPmXLpTzY3m5C6otM
+      WxxoYrXE0Ncx5dqiWedS5/RB4l84mphXGY9+/ekh8CdEf+CaHEzZiaPSg2rPuTtB1FlTWuj7sM+5
+      olbnVOdW5/izhK9dczbNLp2E/qQQ+BOhP2z9gb+L7DGfpR7yv52fN7XnPihY1S9fQk1fx6Bj6Wv7
+      BJ1jnesvnz5N9piE/vQQ+BPgwz5VJ44f1avdchH93aqXHx4eNm2QfdNz6rlT1uxDqG9fnU+pJnUJ
+      /Wkh8Ecuddh/vrnZ66j+Nn4FbcwWDKH0XH5F7iKp80nvQaraPqE/HQT+iKUOe3WNaAFPKas21fOu
+      GvqrV6+yBr8eW8+h57L02efga/vfHB4m6eQh9KeBwB8xdeOkCHsFisoIuTpwYmkrAx/8qer7Kt3o
+      sXzQW/fpz02L2pr1DgkmdAn98WNrhZFS2KeYoFWQKFCGsBeLQlk3rXhVSPvb645feuq68Y+hW18T
+      srFU4km1PYMP/aG85whD4I9Qqk3QVCNe1MRsDAW1tjjemln8pdr721tGrvrvVwe+z4zfnkFf9LHv
+      vUJfn6Fv2IphdAj8kdF2CSkWVSnsx/QHP/RA70rv2eftdYdj6EtDXyJfs8XyqFDDHxFthJZiuwRN
+      BDK6Gy7V9fUextLAgQ3XxoXAHwm/xXEsBYV1d0uUw4d+bAePBhBcPWs8CPwR8FsmxO56SdiPi+/g
+      iQ19OnfGg8AfAU2wxbZfEvbj5Dt4YkJfA4kUvx6xeAT+wKnGGtuVQdiPm0I/dk5G7Z7spT98BP6A
+      qbb6S+RiKMJ+GrTHfuxErvbSf59pK2j0g8AfMPVcx9Tt1XpJ2E9Hiu6dZq6Iev5gEfgDFVu3H1uf
+      PbpR6Gtba6vmUokMEgaLwB8g/ayOWVyl7RJYUDNdeu+166mVtux4d3w89dM4SAT+AMWMsNStwT4p
+      0K+7mA3XmnIipZ3BIfAHRp0Sv19emg+asIdr995ptro2tmuqtBPbMID+EfgDoq4cdUpYaT/7zyay
+      pwzmu7e8HDWPo3ZgunaGhcAfkJgRlWq2pe5nj8VRu2bMJC4TuMNC4A+EFlhZ9zrX9U/pyMFtNIlr
+      reervMiCrOEg8AdAk2Mxf1QKe+r2uEvzGTHW8387OGACdyAI/AH4z8GBeaJWP9cXfcFxlE9zO18Z
+      BxWawGWUPwwEfuE0cvrN2DOvUo71jxjTozme+8aLwWtdiLboRtkI/MJpdG/dPoFSDkLFLMhjlF8+
+      Ar9gGjFZ2zC1dQKlHIRSaefLp09N501tmozyy0bgF+w/xtGWJt/YOgFWX+7tNeVAC0b5ZSPwC2bd
+      r0R1e0o5sNJnxzr3wyi/bAR+wSydORqZscAKsbSrpnUCl1F+uQj8kaGUg1RiRvn05ZeJwC9YaB1V
+      I7LPufYoEtGkv3WUb51/Ql4EfsFCw5uee6RmHuWzlUeRCPyCNZOvHZe7ayRGGyZSs47yNf9E6JeH
+      wC+YuiWa/evnhL42vvoLVyBCJuZRPp/J4hD4hdNCGIX+bZek0145XNQEOVlH+boUIi2aZbk/9RMw
+      BAp9P4LXRVB8B4T+PUGPPnyxs2PanltrSWgTLgcj/IFRyDcjrvV1wh69UV++ZfUt3TplIfABdPLA
+      cHUrTd7qVynKQOAD6OQL4+UMf6NbpxgEPoBOdNHz25oH7mLdEwrpEfgAOntgWMmtsg7dOmUg8AF0
+      ptXflmvfMsovA22ZC3Z+fu7e3rLR1KNHj9zq6uqEzgZKp84whb42SAvxX9ozi0Dg90jBfnp6+vH2
+      +vXrTk++srLi1tfXP94e0Y6JBXpgCHz18Gv9CK3Ei0Xg90DhfnR05F4G/pF4+mLQ7cWLF82/2d7e
+      djs7O034A32z7tn0XivG2c11oajhZ6SgVyhvbGyYw/4meiw9ph5bzwH0qSnrWLp1+KwuHIGfwcXF
+      xcegPzMsR+9Kj+2D/4IuCPToc8MonwVYi0fgJ6bSjSZacwb9dXouPecRC1zQE0tZx7IXD9Ii8BNS
+      XX13d9ddXV31/tx6Tj33jnE1JBCi2bjP0J75nrLOQhH4Caj7RiPslHV6Kx2DjuW2Vk8gFcson7LO
+      YhH4kRSsqqF3bbHsg45Fx0ToIydLHf89gb9QBH6k0sLe86EP5PKZYVEgI/zFog8/gurlJYa9p2PT
+      MTKZi3mu19a7lGtMJR3j34vl+PBnjPCNYhZS9UnHSODjNrrQ+NXysvtxY+OTm/5dl4uQ63rKoUJG
+      +bHHh08R+Abqed8b0L4gOlb69HHdzzs77ufd3WY3y+v07/T//Tyn68tS1qk7zi2lOD58ipKOgcok
+      qVovl5aWmlr78vLyJ/9eAa1VtJc3fNhD6Vh1zKzKhafRcZf9cPx/880to+l71z63XWjF7bySjIK8
+      6/Fp8thyNa4pIvADKTRTLKrSfjgaec/bDVO7aR4cHESXj3TMfqsH4Nf9/c7n4K7QV9j+59mzoPM5
+      b4TfNew9vRYCvxtKOoH2A/5QbrK5uenevHnzcUXuPH4Fre6zadi/ZFbssWMcVEO/qUxyFwXwTeUT
+      y+6Xd9XwQ8Pecd3cIAR+gNjR/fPnz93x8fGfyjdd6D66rx7Dyo/yMW1da+jX3RT6lhr+bSxh71lf
+      09QQ+AFiul0ODw+TTPTqMfRYVnTsIMZtI/0QN+2pExP26I7A70irVq11dI3KU+5xo8eyjvT1K4EV
+      uNMWexGS66F/f20t6vFShD0XVumGwO/IWgpR3T1HC6ce01LTV8cOZZ1pUxnm3tJS1DmIHen7EkyK
+      sNdrSVlaGjMCvyNrSKrDJhfrYxP4+CrBBL4PfUtrpiZZU5VxUryWqSDwO7KEpFovLRO0Xemx9Rx9
+      vBaMi9oYHxg+O9cpsC0dMr/+4x9Jwl6vgZbM7gj8jix75vSxGtfyHCXv/4P+qK8+Rehb9sd5/3//
+      F/28OvbbFoThZgR+B+eGEYxW0Hbps4+l51gy1GMtrwnjkyr0+0bY2xD4HVi6Wvpc0Wp5Ljp14A0t
+      9Al7OwI/k5y1++v6fC6M01BCn7CPQ+Bn8oi+YAxM6aFP2Mcj8DOhZIIhKjX0Cfs0CHwAnygt9An7
+      dAj8TPq84AgXN0FqpYQ+YZ8Wgd+BpR7f5+Imy3Mxx4B5Fh36hH16BH4Hln56Xamqj153PYflqlh9
+      rBHA8C0q9An7PAj8jlYMF2vOuY9OzHNYXgumq+/QJ+zzIfA7sixu0nbKOevremzLls1c5hCh+gp9
+      wj4vAr8ja0jm3E/H+tgEPixyhz5hnx+B35E1JE9OTrKUdvSYemwLAh9WuUKfsO8Hgd+RulosWxHL
+      kydPkl5aUI+lx7TQa6BDBzFShz5h3x8CP0DMZQp3d3eTjPT1GHosq5SXWsR0pQp9wr5fBH4AlULW
+      Iq7fqVH51taWaSJX99F9rSN70bFTzkEqsaFP2PePwA+0H3k5NdXdHz9+3Iy0u/Tp67/Rf6v7WGv2
+      XuyxA9dZQ5+wX4z7U3zRMfwo/+zsLOpx1E6pmy5eosfUFseqrftN1zSi1wpay6KqmzC6Ry4+uLte
+      spCwXxwC30CTplqpenV1Ff1YCnRLL32Ihw8fJp00Bq7rGvqE/WJR0jHQaLyPVbSp6Fi5SApyU5B/
+      c3jo7t1wyU39O/1/hP1iMcI3Ul1dJZfco/NYasOkMwd9ebCz09zeX9vQ7z7lxCIQ+BFUJtGk6mvD
+      Vfv7oD1zKOVgEQj4MlHSiaRRfombkemY+tyiGUD5CPxI6qwpLfR92LOiFsAsAj8BBatKO9atF1LS
+      MehYCHsA1xH4Calefnh42LRB9k3PqeemZg/gNgR+Yn4FbcwWDKH0XH5FLgDchsDPQD3vqqG/evUq
+      a/DrsfUcei767AHMQ+BnpK0MfPCnqu+rdKPH8kHPdgkAuqIPvwcKZd204lUh7W9d+/fVdeMfQzcm
+      ZAFYEPg9UlBri2PdPNXe/YZp1+m/1549AJACgb9gBDqAvlDDB4CJIPABYCIIfACYCAIfACaCwAeA
+      iaBLZ0B+v7hobt5nq6uuoicfParfvnX/m7n4/r3l5eaGYSDwB0B/YL/s7bn3N1w4/Yvvv3df7e8T
+      /MhKQa/P4E3XrL2/tua+PjhoBiAoGyWdwinsf1xfvzHs5bcXL5r/v75l8RYQS58tfcZuu0C5Ppv6
+      /2dH/igTgV8w/4dWX13deZD/e/3a/TSzehdISZ+t/83ZBkSfUQYe5SPwC/br/v7csPc0yrp+4Wgg
+      lj5Tt/26vE6fVX1mUS4Cv2Dvjo+DDo4/NqQW+pkK/cyiXwR+wX6/vAw6OI3E+INDKvosdR3de6Gf
+      WfSLwB8ZdVIAKfBZGh8Cv2D3lpaCD04jrN8ODiZ0lpCDPkOW0brlM4v+EPgF+9zYedNM9tItASN9
+      dqzzQdbPLPpB4BfsS+NPanVL8HMcVvrsdO0Ou876mUU/CPyCacn6l0+fmg5Qi2Ro00QofWZuW2A1
+      jz6rbLNQNgK/cBoxVQ8fmg7y550dSjvoTJ8VfWYs9BlldF8+Ar9w2iPnC+Mfkibd6M1HV/qsWNsq
+      9RllP6fyEfgDoJGTtftBe+1Q2sE8+ozos2Khzyaj+2Eg8AdAI6evIkbqlHZwl5hSjrBb63AQ+APx
+      YGen2YbWQj/TY/6gMW76bFhLOfpMPuCzNRgE/oB8HbGg6t3JCQuy8Cf6TOizYRXzmUT/CPwB0QUm
+      rG2a8suTJ+xZjo+aC+s8eWI+IfosctGTYSHwB0b10pjl6+xZDjdzrQUrfQZj5pWwGAT+AH1zdGQ+
+      aH+hCkxX1wvr3CXmM4jFIfAH6P76enMtWytdvYhJ3OnS1gnzrmB1F3327jNoGCQCf6Cai0avrJgP
+      Xsvn2W9nevRFb906QfSZY6J2uAj8AdPPauu2C65dlPVffppPht7rmLDXZ41SzrAR+AOmDonY0dbP
+      u7uE/gToPdZ7HaP5VUlXzqAR+AOnRS8PtrejXgShP24pwl6fMRZYDR+BPwKx9XxH6I9WirCnbj8e
+      BP4IaB+TvxwfR9XzHaE/OinCXp+p5rPFXjmjQOCPhC48oT/MWIT+OKQIe9FniouajAeBPyLqjf7m
+      8DD6BSkoaNkcLrVepgh7fZbotx+X+1M/AWOjibX35+fmvc093V8rMlW7HcPP+fPzc/f2li0lHj16
+      5FZH0H2i90tf1DGtl54WVzFJOz4E/ggppPXHH/uHr/trg62/np4OKvQV7Kenpx9vrzuuKl1ZWXHr
+      6+sfb48G9Jr9dgkxK2g9deQwSTtOBP5IaYGMQiBm61vXbsNwtbzchH7pPdgK96OjI/fS+EWnLwbd
+      XrS/jra3t93Ozk4T/iXTl3Ls3jje55ubLK4aMWr4I6Y/3Nh2TdduuPbvb78tdj99Bb1CeWNjwxz2
+      N9Fj6TH12KeFXiZS74nemxRhr88KYT9uBP6IqQzTjMwThL5r99P/aWurmO2VLy4uPgb92dlZtufR
+      Y/vg13OWQO+B3ouY/exn6TMytNIdwhH4I5c69FUi+vfq6sIvjK7SjSZacwb9dXouPefRgkfBOvd6
+      D2LLdR5hPx0E/gSkDn1d//THjY2mI2QRo33V1Xd3d91VgjJGKD2nnntnAR0svgtH5956DdrrCPtp
+      IfAnwoe+JuVSUetmn6N9dd9ohJ2yTm+lY9Cx3NbqmZof1ce2287SZ4GwnxYCf0L8Fgyxm63N8qN9
+      LfbJOdpXsKqG3rXFsg86Fh1TztDXOdW5TTmqd23rJVsmTA+BP0HqxIi5YtZN1LOv9s1cnTylhb3n
+      Qz8HnUud0xQLqWbpvacbZ5oI/InSwpoU2zDMUmugukYUUu8S7OvjqV5eYth7OraUNX2dO51DncsU
+      7Zaz9J6zqGq6CPwJ09L5v756Fb3L5nUqPfz03XfNYqDY+n7MQqo+6Rhju3f8Aiqdu5TlG9fueqn3
+      mu0Spo3AnzhtjvW38/NkHTyz3p+dNbXnZhWooc6tnve9AW3ipmO19ulrd0stoHqfoc1U763eYzZC
+      A1sroNn+Vt0aqTbeuq4J/vX14I4QlUlStV4uLS01tfbla1v9KqC1ivYywYhax6pjDl2V+/vFRbbd
+      Sf2+OEzOwhH48BQImsj7fH39Q3994tqx9uT5dX+/c/1YoZliUZX2w9HIe95umNpN8+DgILp8pGP2
+      Wz10pfOS+nyrhKNzTQkHsyjp4BNNXT/hIq1ZfsvlLvb396Oea3Nz07158+bjijFpppAAAAw3SURB
+      VNx5/Apa3Wczcq1C6LGnnOB2M4upCHtcR+DjT7Qrpmq+qVs3XTsxOU/s6P758+fu+Pj4T+WbLnQf
+      3VePYeVH+V2lHN3rPWvmZEawvz/SI/BxK5UE1Nlxb2mp15MU0+1yeHiYZKJXj3EY0bba9347eo/0
+      XtFyibsQ+LiTOjseXly4L58+7eVEadWqtY6uUXnKfng9lnWkr18JXVfgxrbF6r3Re0QXDuYh8NHJ
+      V/v77m8//ODur61FnbB5F8S27juvunuOFk49pqWmr46drq/l860tw5G55r3Qe/JV5HwHpoPAR2eq
+      C2syUKs1LWUeBVSuwD/IWMqwPnbX16LADhnl69zrPRjCVchQFgIfwdT9oYlBlRK6BpVvE5zHEvhq
+      vbRM0Halx942bDjX9bXoS7DLudE51DnXuacDBxYEPkzUt6+RaZf6frOsv+No1LJnTh+rcS3PEfJa
+      mi/RW0pmGtH7On3za4BFVDBi4RWi+OD/Ymen6Sd/d3ra7J+jVkMFlerTXUPqvEPL5nVaQdulzz6W
+      nkPPFboiV6+p6/H5kplW3v7ebtGg0f+8MhjQFYGPJBRKX+ztNTcry77yubYmvu25QjuILK+JkEcu
+      lHQwaDlr99f1+VxADgQ+Bu0R9Wygs2yBb6nHAqH6uqYs0Bdra3IX2QKfP0QAKAslHQya9YIjFn0+
+      F5ADgY9iWOrxOX/+pngu5hhQEgIfxbD006svvo/5Ij2H5apYfawRALoi8FGUFcOFV3LuoxPzHJbX
+      AuRElw6KYllIpcVQOevremzLls19LgrDeOTMzpDAD7oEUaqLT2NarCGZcz8d62MT+LAwZGfnbM5a
+      0qE1E6GsIXlycpKltKPH1GNbEPgIlTszQwI/+Ego6yCUulosWxHLkydPkl5aUI+lx7TQa6BDB6GM
+      mdk5m0MCP/hIGOHDIuYyhbu7u0lG+noMPZZVykstYjqMmdk5mxnhozgqhaxFXEpRo/KtrS3TRK7u
+      o/taR/aiY6ecA4tBj/AJfFjtR16nVXX3x48fNyPtLp9D/Tf6b3Ufa83eiz12TJcxMzvfqarrutt/
+      WFXaG/ZNyFGoD5nQh5VGyWdnQc1ht9LFS/R42uJYtXX/01kjeq2gtSyquolG932u/sW4aKGe4apv
+      j+u67vRztnPguw+h3/0/boU8PjBLYaw/gKG0+D58+LAZ4LBvPqyqqgq+Z13Xne8U2pYZ/NXDaAdW
+      Cs4+VtGmomMl7GFlzMqgTA4NfOr46JXq6tY2zT7pGOnMQYzc9XtH4GMI1A9f8r40OraU/f+YplEE
+      PiUdpKDPUYmhr2PiM44UjJ+joEwOmrR1xonbN2/eUNtENHXWqNPG0MWQhQ97VtQilhoU1BIcKmTC
+      1hn30gn+azs+PjY8DfApBat+9pZQ09cx6FgIe6RgzMjgLLYEfvDvDn7yIiXVyw8PD5s2yL7pOfXc
+      1OyRkjEjg+9kKelsOef+GfpE9OMjNf0MVmdMqsVZ82hRlYKe8iRSs/TfO+e+q+s66KdBLyN8R1kH
+      GSh4NTJ69epV1N478+ix9Rx6LsIeqUVkY3AWBwd+XddvqeOjJJrI9cGfqr6v0o0eywc9m6EhF2v9
+      vs3iIMElHffh54d2h3oach/9AbFdMvqgz5lC2t+6dvWo60bB7m9MyKIP+pwZtg95Vtd18C591sDX
+      pfh/CL2fJrtYjYhFUEfNbQMO/cFpzx6gb5oTMl534du6roPXRZkC330Ife3OthRyn83NTUo7ANDS
+      tRcM23Ff1nVtmkyKuaZtcHLrhVkuSgEAY6MsNF57wTxqjgl8UyMy/csAEJWF5juaSzrOWNZh8hYA
+      zJO15nKOixzhO8s3jV4go3wAU6YMNF7YJyo8Y0f4wZc9dO3l5qjlA5gqLeAzXlaz8+UMbxI1wm+f
+      OHhdu14o3ToApkjZZwz7s5iwdwlKOs76E2NIl64DgFQisi+6Fh5V0vn4IIbJW9GydZasA5gKrfze
+      2NiwvNqoyVovxQjfWb95WHULYEoiMi9Jp0uqwNdvlPD+ostLOnYATIKyzli7v2ozNlqSko77UNbR
+      AX0fej/15atjh42qAIyV1h6pM8fYivmiruu9FKcm1QjfWb+BdAKYwAUwZso4Y9i7VKN7l3KE7z6M
+      8lWfMW1I/sMPP7BjIYDR0U6t3377rfVlvazrOtlkZ+rANy3Ecu1Vhbj2LYCxUSdixGU4oxZaXZey
+      pOMXYj2z3FcnhNIOgDFRpkWE/bOUYe9Sj/Ddh1G+Zl91kA9D76sJXP384bqhAIZOzSgqUxtr97rT
+      suUyhndJOsJ3f1zzNvjSW66dwNUFAQBg6JRlERO1+6nD3uUIfPch9FWbMTWc6vqj+/um7wsAKIIy
+      rOu1lG9w2WZocslLOl5VVdoz4ZX1/my7AGCIIrZP8Dbqus7SwZIt8N2H0NeWmJuW+7IgC8DQRC6w
+      kpO6rrPVtbOUdGbsWLZccG09nxE+gCFRZkWE/VWbmdlkDfyYCVzX1vPZYA3AECirIur2LtdE7azc
+      I3w/gWtuRH358iWTuACKpoxSVkU4yzVROytrDd+L6c33Dg8PGe0DKI52wdzd3Y05rCw99zfJPsJ3
+      f5R2otJaJ5StlAGUJEHYy04fYe/6GuF/fDLjFsqeOnfU8sQmawAWTbsCRE7SupRbH3fRd+CrtKP+
+      0hXrYxD6ABYtUdhrhne9r9G96zvw3R87ap7H1PMJfQCLkijsdefV1JujzdNLDX9W+wKj6vm+R5+a
+      PoA+KXMShL1r6/a9hr1bxAj/4xNXlepWz2Mfh+4dAH1INEErT/powbxJ7yN8r33BUY2rru3eoU8f
+      QE7KmERh/3JRYe8WOcL/eABVpUnctdjH2d7epsQDIDlVECIXVXlaXLXQ/WJKCPzozh1vZWWlmcxl
+      wzUAsbQRmur1kdsleL135NxkYSUdrz0B6+0JiaI3RjvVcW1cADGUIcqSMYW9KyHw3R+hv2XdWXOW
+      Zs+1FzV1fQAWyg5lSIJOHNdmWhFh70oo6cyqqmq1Le+Ye/RnqcRzfHzMNXIBzKXrb+iyhIlG9W4m
+      7M9LOftFjPC99sSspxjpu7bEo8VZunI8ANxGGaGsGHPYu9JG+F67Gvc4xUSut7a29vFNBQDXrprd
+      29tzZ2fmHdxvom+NrUUsrJqnyMB3ibt3Zj19+rR5g+nkAaZLHTgaAD579iz1OShmgvYmxQa++yP0
+      j1P06c/SXjx6s1mhC0yP1uto0JdoUnbWWTuyLzLsXemB71VVpRVV26kfd2lp6ePeGADGTa2WGuRd
+      Xl7meJ1aQVv8CLKoSdvbtCfySerH1Ruv9isFvrp5AIyP/rb1N66/9Uxh/2QIYe+GMsL3qqpSr/5R
+      qrbN6zTiVw8upR5g+PTrXX/PmULetZ042vVyMKPFQQW+y9TBc51q/KrxKfjp4QeGQ730CnrN0WWo
+      0c8qthPnLoMLfPfHZO5+zOUSu9rc3GwWYzDqB8qlkFfp5uTkpI9jfKH8KXly9jaDDHwvd4lnlkb9
+      Cn5/A7BYCnh/yzya9wZXwrlu0IHvMrZuzqORvyaCFP6UfYD8VK5RuKvbpqeR/KziWy67GHzge+0V
+      tPb7GO1fp8lehb9W8epGmycQT8GulbC66X9nnHy9y1VbvhnF/iyjCXz3x2hfJZ7NRR+LNm7TyN9/
+      CWhlr/8ngA+04lWB7v+pm0byCfe0iXHSlnAGPaqfNarA96qqWm+Df6mMI/oz7e1zE34dYExuuzaF
+      gr2nurvFZRv0o7uwxigD31tkmQfA4IyqfHOTUQe++6PMo+B/WsDhACiTdlE7GFP55iajD3yvXbC1
+      n2NPHgCD9bId1Q9qAZXVZALfa4NfI/4dSj3AJF21c3wHUwl6b3KB782UenZKntwFkMzlTNCPunRz
+      m8kG/qyqqnba4O918RaAXmjR1FFd10dTP90E/oy23LPDqB8YPD+aP5pa2eYuBP4tqqpabYN/i/AH
+      BuGy3WblqLSLh5eCwO+gDf+t9pZtW2YAwV63IX9MyM9H4AdqJ3vXZ258AQD9UcCf+ttUJ1+tCPwE
+      2q0cVmdufAkA8RTu5/42xq0O+kbgZ9JOAC+3XwKPZv7p6AYCGmftP9+2oe7/ecFEax4EPgBMxD3e
+      aACYBgIfACaCwAeAiSDwAWAiCHwAmAgCHwAmgsAHgIkg8AFgIgh8AJgC59z/AwXeQIk3mH5TAAAA
+      AElFTkSuQmCC
--- a/clusters/overlays/local.home/components/cost-management-operator/kustomization.yaml
+++ b/clusters/overlays/local.home/components/cost-management-operator/kustomization.yaml
@@ -0,0 +1,15 @@
+kind: Kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+
+namespace: costmanagement-metrics-operator
+
+resources:
+  - https://github.com/redhat-cop/gitops-catalog/cost-management-operator/overlays/aggregate
+
+patchesJson6902:
+  - path: patch-source-and-name.yaml
+    target:
+      group: costmanagement-metrics-cfg.openshift.io
+      kind: CostManagementMetricsConfig
+      name: config
+      version: v1beta1
--- a/clusters/overlays/local.home/components/cost-management-operator/patch-source-and-name.yaml
+++ b/clusters/overlays/local.home/components/cost-management-operator/patch-source-and-name.yaml
@@ -0,0 +1,6 @@
+- op: replace
+  path: /spec/source/name
+  value: Home
+- op: replace
+  path: /metadata/name
+  value: home-cluster
--- a/clusters/overlays/local.home/components/lokistack/README.md
+++ b/clusters/overlays/local.home/components/lokistack/README.md
@@ -0,0 +1,54 @@
+
+
+### Introduction
+
+Installs the Tech Preview LokiStack for cluster logging using local QNAP NAS for object storage.
+
+Installation is based on docs here:
+
+https://github.com/grafana/loki/blob/main/operator/docs/forwarding_logs_to_gateway.md#openshift-logging
+
+# Accessing logs
+
+You can access the logs using the logcli tool from grafana:
+
+https://github.com/grafana/loki/releases/tag/v2.5.0
+
+Example queries:
+
+View raw application logs:
+```
+export LOKI_ADDR=http://lokistack-openshift-logging.apps.home.ocplab.com/api/logs/v1/application
+logcli --bearer-token="$(oc whoami -t)" query '{kubernetes_namespace_name="product-catalog-dev"}'
+```
+
+View applicatons logs textually without JSON:
+```
+export LOKI_ADDR=http://lokistack-openshift-logging.apps.home.ocplab.com/api/logs/v1/application
+logcli --bearer-token="$(oc whoami -t)" query '{kubernetes_namespace_name="product-catalog-dev", kubernetes_container_name="server"}' --output=raw | jq '."@timestamp",.kubernetes.pod_name,.level,.message' | paste - - - -
+```
+
+View infrastructure logs:
+```
+export LOKI_ADDR=http://lokistack-openshift-logging.apps.home.ocplab.com/api/logs/v1/infrastructure
+logcli --bearer-token="$(oc whoami -t)" query '{kubernetes_namespace_name="openshift-logging"}'
+```
+
+### Storage Secret
+
+You will need a storage secret for your S3 bucket for Loki to use, format of secret is as follows:
+
+```
+apiVersion: v1
+data:
+  access_key_id: XXXXXX
+  access_key_secret: XXXXXX
+  bucketnames: XXXXXX
+  endpoint: XXXXXXXXXXXX
+kind: Secret
+metadata:
+  name: loki-storage
+  namespace: openshift-logging
+```
+
+The sealed secret here is referencing Minio running on my QNAP NAS so non AWS S3 buckets do work fine.
--- a/clusters/overlays/local.home/components/lokistack/kustomization.yaml
+++ b/clusters/overlays/local.home/components/lokistack/kustomization.yaml
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../../../components/loki/operator/cluster-logging/base
+  - ../../../../../components/loki/operator/loki/base
+  - ../../../../../components/loki/instance/overlays/sno
+  - loki-storage-qnap-secret.yaml
--- a/clusters/overlays/local.home/components/lokistack/loki-storage-qnap-secret.yaml
+++ b/clusters/overlays/local.home/components/lokistack/loki-storage-qnap-secret.yaml
@@ -0,0 +1,16 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: loki-storage
+  namespace: openshift-logging
+spec:
+  encryptedData:
+    access_key_id: AgADsXMtym0OLY598xcLZ4e6zPgh9x3KtCRX59K3J/LriPJPwNuMugAMZcHjLaA9nm+Rwqg095uhGD0pUxK5N336fMiMJ+7WpzMsR8nqMS3eoOtxhXBwML5wXqLmpf2FSxujUXws847JsohHtZiCg6ZBlWuJ2pEaCz6yPecMU8dixz+7OMs079origgakI0FjHlEPMn6BOhAOR4TMCt877mNmeLWrmxNEQt3ql4qMvNH3Ru8G4YijmO+jS9OQYqXYwTbO237zx+D3DDw0PAuUzqMIKXSZZdGNmATXIROu9+4TJGT6YnraMxON81F4t78D+y6reM6AIXN49SDcIxpmSZrtLJ5QQesOPbZ+x4mdR2Rj4RaqyktuNaBknn+CUCtx9aUv5LpWcIu/e+ZXTsVLVXLsmDpVv/k9fe1tyhlQPgdCAg/Iwn+xF3YVvLEpfhrXrkcKFK0snn242NbJk4aTcY28O+XHyJn7lmsbu/BSao7cqtbwJsFNCVo+e23KUkBoenw3LMQ2lyle9AfLyD10JIR5beozyt6pxxPDjnBXx8zlxhA0dPryQkm5O/+fiJd3gidzJmZZuVr8i20DaBoM3RnDhF0uccgDsbbM0N9KkEO1JXco22NGeBveKtkMOQaNy7i1QIHIFafkcyP9CStz8swsaWk5WaSEyr7ysiKpZlYE6tyaHPW2h4/uG/NfrOi6PXzPE4d90oyOeVIC28Obxse3aVRTw==
+    access_key_secret: AgCE8EHoWhZm4q25TcXlMy65uPopUNULeyw1Z+reSAr3pDaT+9B2k8TkPyo8vwCLYykqQqPS3VV7X6J80upVGWbYBVUM/7kI3W6F1kRl5eQjDmkAUmFa0t2EAxQP7TN1VPHVLZGUhwTGXjARdDGgDHi/We7jhl781ZFIZ8G0nkWCSZrB4T4XI+Mb154nR+GMejrstjzhFdueWgFZX/wX3PmcbmI+eAu0yeiW9IWikmDTrQyv1P46dDyPAKquZc7Dbgy4AxJ/ebeQ4558sOW9hvhTxoQ0hrEezeOMAbzQKqPd2Y5470LxMtoGL+FNqbLHTBQnqSucyDzOO2hiFhnUaCPvpCE/TRT7T3NbQ8uaugYaRR3eNa3w9ILWduMQ2yDsG+cNrYHXcyoUtdAQQ1eRv11jFYFVARRRGuGiFzWsLmMDvokCxQgkYpJXj5HqeZ+oT2xBVgd7P+c6ZQXRzfuwUXTUh+w3QxZ4XrqBq1jv7RRnu+uCj3E+vaavqIS8ipYXfLzjneHFhlAm9GS3rAIbCPlrZCaIIe/r4KRjtP7Gj4f6jhaN5Xo5jvBPqLYfX/RY8fll9XJAZGH6a9k+NDcxrwiV/UBDEQcPgnx83bCuFQ/qvIdd3tnOZ2dIvEHXnLMfBYOd0OyvkC3CoGKgmf4d6x4xvrzyqRHSIBxOGvDMG54IutZwHngFEuQbtGgtD0eN/SsLRO4wcuDugYVgiSPCHQ+IONUqvj7c7IJgRQKad2oxmlP7ZzSExVV8
+    bucketnames: AgDA2DCtrPQmcdJ/QTBNZgmf2C7VSE96LVwje8J1N9XbmTte/d0oO9V0vUanXRKdraISTlHWBRBrYOxKx42nZMVzxKOHUCBMrdSN2z9ytgxNMhX2XNusTd4oDucsW+KM4IZyg95CXNvOSt01Y/uwdnJNK71VaiCSM1Sp+lIgVBzkwiase/YitOmCXVBofVLubWtsVwIGy5cWMmNhWmD0fjG5aIQ0Nx3OjYq/tIsrM4iB7FOn9Us1PQ9bkUNqJKu3LZtNIklzgDEUY6+uwtULt/jh8bTGHdptG18D1tuBf1SmD/xIWeCHf5Btp7XgRjivBR45DDIZHyc5mNdM7ydNvmae8SgOrugBWACQ37ZYiRIivDHJDs6Aa0fWDDd4ntdYclix7SurmqLx+/wzp7nyNmF3rCJY0u3FyX7twmLO2xZyabfqIqPY+kiGlKBY8uLGkLSDXbaLF78Vkww8Q5m5qdOZklADB+VZyii2PyFxLodeOKWujdG7vFnCiI41hCj3ry1FFM8o6397GO2zL1j4bflsmYh+9c5YKgc3ykzbLnAl+G30A505uXpBLJuXmHHXayGTNzU0D3EtWKnEwXF5NRYRQTdBPrwmUo7ml/UU04bdvJGob9dxGjypjB9CQG9pL3ouGTZZ60kNnSodhnKbRFv+Z1P8oNi4Vz6789eOrLVdn5kRppZy0f231HVRKfCXKjTAw96v
+    endpoint: AgClXa9d4ePlMAN9w+JajdcDv+Kde3Zp90vgZ2RE3pGebMq4WNpIZ3hHZzUWQWS90ffhJmGsPrry14aGSkKyj+2i5pVLFjrMhRajOcWvQrWcdNa/2XrkijpSoGTM0wXm1yLgmfRZGnhgt5LFWjuiOFze8j984FseGWp7ZKGA86CSfiWFidcaUhzVUaPC4P/tdfQMHRnYq1GdFw/6TxZRvpoEW/RRm3P2B+H6nAyrjILpdOCEzvM88WiVF93IB/oQWw4HnRt92lQ0A2Ni81s/pTngIYhIyXS6KrWt9+0w131fJSdvC5TRidcYXVAllxRyKUm/2hEqEtCA+w3yMyQ7ZW6rEhqWAJrN0qlDzSQ3rmYzRMKWaXQVDxrMhqg6PkaYjuQYQRLmOWzJ+4KCgUXI1jPOce5W3KOGPwVJNUe7RDRrjep3fDn7XjFJoWJG76zzGkAYWsY2QkZ4LwnxzuAFFQ3iyLYw/KDnOGG3BZvIKCHDLhk31PCkrOZV4rlmm1RIPpSeZOmbBGYoM3vSvdXNmUxGzju2LL3mBF0O9OkgKozQO+ihCGVjHJMRvpB5mcoKvcP9g2+HidAwlEAt8igm5uFFx06OMnvv7RmI+kLpcgE+crA3W0L1gZKdxFZKNKxn+AFBxY5TrAoQpaSuGv8czGxuy/ZxLWF0fSKeyv4uCMWY1wq4eXT8QiyJbWYtBh9sqKF6pqNABeDNwg79y4sP8Z76PPJreN8Sy8kq06lQvDbk
+  template:
+    metadata:
+      name: loki-storage
+      namespace: openshift-logging
+    type: Opaque
--- a/clusters/overlays/local.home/components/lvm-operator/kustomization.yaml
+++ b/clusters/overlays/local.home/components/lvm-operator/kustomization.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../../../components/lvm-operator/overlays/standalone
+
+patches:
+  - patch: |-
+      - op: add
+        path: /spec/storage/deviceClasses/0/deviceSelector
+        value:
+          paths:
+            - /dev/nvme1n1
+    target:
+      kind: LVMCluster
--- a/clusters/overlays/local.home/components/node-config/kustomization.yaml
+++ b/clusters/overlays/local.home/components/node-config/kustomization.yaml
@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - set-max-pods.yaml
+  - ../../../../../components/wake-on-lan/base
+
+patches:
+  - patch: |
+      - op: replace
+        path: /spec/config/systemd/units/0/name
+        value: wol@enp8s0.service
+      - op: add
+        path: /metadata/labels/machineconfiguration.openshift.io~1role
+        value: master
+    target:
+      kind: MachineConfig
+      name: 99-wol-service
--- a/clusters/overlays/local.home/components/node-config/set-max-pods.yaml
+++ b/clusters/overlays/local.home/components/node-config/set-max-pods.yaml
@@ -0,0 +1,12 @@
+apiVersion: machineconfiguration.openshift.io/v1
+kind: KubeletConfig
+metadata:
+  name: set-max-pods
+spec:
+  autoSizingReserved: true
+  machineConfigPoolSelector:
+    matchLabels:
+      pools.operator.machineconfiguration.openshift.io/master: ""
+  kubeletConfig:
+    podsPerCore: 11
+    maxPods: 352
--- a/clusters/overlays/local.home/components/tenants/appset.yaml
+++ b/clusters/overlays/local.home/components/tenants/appset.yaml
@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: tenants
+  namespace: openshift-gitops
+spec:
+  generators:
+  - git:
+      directories:
+      - path: tenants/**/base
+      repoURL: https://github.com/gnunn-gitops/cluster-config
+      revision: main
+  goTemplate: true
+  syncPolicy:
+    preserveResourcesOnDeletion: true
+  template:
+    metadata:
+      name: tenant-{{ index .path.segments 1 | normalize }}
+    spec:
+      destination:
+        name: in-cluster
+        namespace: default
+      project: cluster-config
+      source:
+        path: '{{ .path.path }}'
+        repoURL: https://github.com/gnunn-gitops/cluster-config
+      syncPolicy:
+        automated:
+          selfHeal: true
--- a/clusters/overlays/local.home/components/tenants/kustomization.yaml
+++ b/clusters/overlays/local.home/components/tenants/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - appset.yaml
--- a/clusters/overlays/local.hub/README.md
+++ b/clusters/overlays/local.hub/README.md
@@ -0,0 +1,3 @@
+#### Home (local) Cluster
+
+This is my home cluster which runs on a server under my desk and uses the highly original cluster name of 'home'. It runs in libvirt on a Ryzen 3900x server with 128 GB of memory. It is typically configured as three combined master/worker nodes with 7 vCPU and 35 GB per node.
--- a/clusters/overlays/local.hub/components/acs-operator/certificate.yaml
+++ b/clusters/overlays/local.hub/components/acs-operator/certificate.yaml
@@ -0,0 +1,13 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: central-tls-letsencrypt-cert
+  namespace: stackrox
+spec:
+  # Replace default secret since ACS doesn't support referencing a different secret
+  secretName: central-default-tls-cert
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+  - central-stackrox.apps.hub.ocplab.com
--- a/clusters/overlays/local.hub/components/acs-operator/kustomization.yaml
+++ b/clusters/overlays/local.hub/components/acs-operator/kustomization.yaml
@@ -0,0 +1,6 @@
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+resources:
+- ../../../../../components/acs-operator/overlays/aggregate
+- certificate.yaml
--- a/clusters/overlays/local.hub/components/consolelinks/acs-consolelink.yaml
+++ b/clusters/overlays/local.hub/components/consolelinks/acs-consolelink.yaml
@@ -0,0 +1,11 @@
+apiVersion: console.openshift.io/v1
+kind: ConsoleLink
+metadata:
+  name: acs
+spec:
+  href: 'https://central-stackrox.apps.hub.ocplab.com'
+  location: ApplicationMenu
+  text: Advanced Cluster Security
+  applicationMenu:
+    section: Red Hat Applications
+    imageURL: https://central-stackrox.apps.hub.ocplab.com/static/media/rh-favicon.0110fdfc5cab55416acf.ico
--- a/clusters/overlays/local.hub/components/consolelinks/kustomization.yaml
+++ b/clusters/overlays/local.hub/components/consolelinks/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ../../../../../components/consolelinks/base
+- acs-consolelink.yaml
--- a/clusters/overlays/local.hub/components/cost-management-operator/kustomization.yaml
+++ b/clusters/overlays/local.hub/components/cost-management-operator/kustomization.yaml
@@ -0,0 +1,15 @@
+kind: Kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+
+namespace: costmanagement-metrics-operator
+
+bases:
+- https://github.com/redhat-cop/gitops-catalog/cost-management-operator/overlays/aggregate
+
+patchesJson6902:
+  - path: patch-source-and-name.yaml
+    target:
+      group: costmanagement-metrics-cfg.openshift.io
+      kind: CostManagementMetricsConfig
+      name: config
+      version: v1beta1
--- a/clusters/overlays/local.hub/components/cost-management-operator/patch-source-and-name.yaml
+++ b/clusters/overlays/local.hub/components/cost-management-operator/patch-source-and-name.yaml
@@ -0,0 +1,6 @@
+- op: replace
+  path: /spec/source/name
+  value: Hub
+- op: replace
+  path: /metadata/name
+  value: hub-cluster
--- a/clusters/overlays/local.hub/components/eso/doppler-push-secret-store.yaml
+++ b/clusters/overlays/local.hub/components/eso/doppler-push-secret-store.yaml
@@ -0,0 +1,13 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: doppler-push-secret
+spec:
+  provider:
+    doppler:
+      auth:
+        secretRef:
+          dopplerToken:
+            name: eso-token-cluster-push-secret
+            key: dopplerToken
+            namespace: hub-secrets
--- a/clusters/overlays/local.hub/components/eso/kustomization.yaml
+++ b/clusters/overlays/local.hub/components/eso/kustomization.yaml
@@ -0,0 +1,3 @@
+resources:
+- ../../../../../components/eso/overlays/aggregate
+- doppler-push-secret-store.yaml
--- a/clusters/overlays/local.hub/components/lokistack/README.md
+++ b/clusters/overlays/local.hub/components/lokistack/README.md
@@ -0,0 +1,54 @@
+
+
+### Introduction
+
+Installs the Tech Preview LokiStack for cluster logging using local QNAP NAS for object storage.
+
+Installation is based on docs here:
+
+https://github.com/grafana/loki/blob/main/operator/docs/forwarding_logs_to_gateway.md#openshift-logging
+
+# Accessing logs
+
+You can access the logs using the logcli tool from grafana:
+
+https://github.com/grafana/loki/releases/tag/v2.5.0
+
+Example queries:
+
+View raw application logs:
+```
+export LOKI_ADDR=http://lokistack-openshift-logging.apps.home.ocplab.com/api/logs/v1/application
+logcli --bearer-token="$(oc whoami -t)" query '{kubernetes_namespace_name="product-catalog-dev"}'
+```
+
+View applicatons logs textually without JSON:
+```
+export LOKI_ADDR=http://lokistack-openshift-logging.apps.home.ocplab.com/api/logs/v1/application
+logcli --bearer-token="$(oc whoami -t)" query '{kubernetes_namespace_name="product-catalog-dev", kubernetes_container_name="server"}' --output=raw | jq '."@timestamp",.kubernetes.pod_name,.level,.message' | paste - - - -
+```
+
+View infrastructure logs:
+```
+export LOKI_ADDR=http://lokistack-openshift-logging.apps.home.ocplab.com/api/logs/v1/infrastructure
+logcli --bearer-token="$(oc whoami -t)" query '{kubernetes_namespace_name="openshift-logging"}'
+```
+
+### Storage Secret
+
+You will need a storage secret for your S3 bucket for Loki to use, format of secret is as follows:
+
+```
+apiVersion: v1
+data:
+  access_key_id: XXXXXX
+  access_key_secret: XXXXXX
+  bucketnames: XXXXXX
+  endpoint: XXXXXXXXXXXX
+kind: Secret
+metadata:
+  name: loki-storage
+  namespace: openshift-logging
+```
+
+The sealed secret here is referencing Minio running on my QNAP NAS so non AWS S3 buckets do work fine.
--- a/clusters/overlays/local.hub/components/lokistack/kustomization.yaml
+++ b/clusters/overlays/local.hub/components/lokistack/kustomization.yaml
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ../../../../../components/loki/operator/cluster-logging/base
+- ../../../../../components/loki/operator/loki/base
+- ../../../../../components/loki/instance/overlays/sno
+- loki-storage-qnap-secret.yaml
--- a/clusters/overlays/local.hub/components/lokistack/loki-storage-qnap-secret.yaml
+++ b/clusters/overlays/local.hub/components/lokistack/loki-storage-qnap-secret.yaml
@@ -0,0 +1,16 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: loki-storage
+  namespace: openshift-logging
+spec:
+  encryptedData:
+    access_key_id: AgADsXMtym0OLY598xcLZ4e6zPgh9x3KtCRX59K3J/LriPJPwNuMugAMZcHjLaA9nm+Rwqg095uhGD0pUxK5N336fMiMJ+7WpzMsR8nqMS3eoOtxhXBwML5wXqLmpf2FSxujUXws847JsohHtZiCg6ZBlWuJ2pEaCz6yPecMU8dixz+7OMs079origgakI0FjHlEPMn6BOhAOR4TMCt877mNmeLWrmxNEQt3ql4qMvNH3Ru8G4YijmO+jS9OQYqXYwTbO237zx+D3DDw0PAuUzqMIKXSZZdGNmATXIROu9+4TJGT6YnraMxON81F4t78D+y6reM6AIXN49SDcIxpmSZrtLJ5QQesOPbZ+x4mdR2Rj4RaqyktuNaBknn+CUCtx9aUv5LpWcIu/e+ZXTsVLVXLsmDpVv/k9fe1tyhlQPgdCAg/Iwn+xF3YVvLEpfhrXrkcKFK0snn242NbJk4aTcY28O+XHyJn7lmsbu/BSao7cqtbwJsFNCVo+e23KUkBoenw3LMQ2lyle9AfLyD10JIR5beozyt6pxxPDjnBXx8zlxhA0dPryQkm5O/+fiJd3gidzJmZZuVr8i20DaBoM3RnDhF0uccgDsbbM0N9KkEO1JXco22NGeBveKtkMOQaNy7i1QIHIFafkcyP9CStz8swsaWk5WaSEyr7ysiKpZlYE6tyaHPW2h4/uG/NfrOi6PXzPE4d90oyOeVIC28Obxse3aVRTw==
+    access_key_secret: AgCE8EHoWhZm4q25TcXlMy65uPopUNULeyw1Z+reSAr3pDaT+9B2k8TkPyo8vwCLYykqQqPS3VV7X6J80upVGWbYBVUM/7kI3W6F1kRl5eQjDmkAUmFa0t2EAxQP7TN1VPHVLZGUhwTGXjARdDGgDHi/We7jhl781ZFIZ8G0nkWCSZrB4T4XI+Mb154nR+GMejrstjzhFdueWgFZX/wX3PmcbmI+eAu0yeiW9IWikmDTrQyv1P46dDyPAKquZc7Dbgy4AxJ/ebeQ4558sOW9hvhTxoQ0hrEezeOMAbzQKqPd2Y5470LxMtoGL+FNqbLHTBQnqSucyDzOO2hiFhnUaCPvpCE/TRT7T3NbQ8uaugYaRR3eNa3w9ILWduMQ2yDsG+cNrYHXcyoUtdAQQ1eRv11jFYFVARRRGuGiFzWsLmMDvokCxQgkYpJXj5HqeZ+oT2xBVgd7P+c6ZQXRzfuwUXTUh+w3QxZ4XrqBq1jv7RRnu+uCj3E+vaavqIS8ipYXfLzjneHFhlAm9GS3rAIbCPlrZCaIIe/r4KRjtP7Gj4f6jhaN5Xo5jvBPqLYfX/RY8fll9XJAZGH6a9k+NDcxrwiV/UBDEQcPgnx83bCuFQ/qvIdd3tnOZ2dIvEHXnLMfBYOd0OyvkC3CoGKgmf4d6x4xvrzyqRHSIBxOGvDMG54IutZwHngFEuQbtGgtD0eN/SsLRO4wcuDugYVgiSPCHQ+IONUqvj7c7IJgRQKad2oxmlP7ZzSExVV8
+    bucketnames: AgDA2DCtrPQmcdJ/QTBNZgmf2C7VSE96LVwje8J1N9XbmTte/d0oO9V0vUanXRKdraISTlHWBRBrYOxKx42nZMVzxKOHUCBMrdSN2z9ytgxNMhX2XNusTd4oDucsW+KM4IZyg95CXNvOSt01Y/uwdnJNK71VaiCSM1Sp+lIgVBzkwiase/YitOmCXVBofVLubWtsVwIGy5cWMmNhWmD0fjG5aIQ0Nx3OjYq/tIsrM4iB7FOn9Us1PQ9bkUNqJKu3LZtNIklzgDEUY6+uwtULt/jh8bTGHdptG18D1tuBf1SmD/xIWeCHf5Btp7XgRjivBR45DDIZHyc5mNdM7ydNvmae8SgOrugBWACQ37ZYiRIivDHJDs6Aa0fWDDd4ntdYclix7SurmqLx+/wzp7nyNmF3rCJY0u3FyX7twmLO2xZyabfqIqPY+kiGlKBY8uLGkLSDXbaLF78Vkww8Q5m5qdOZklADB+VZyii2PyFxLodeOKWujdG7vFnCiI41hCj3ry1FFM8o6397GO2zL1j4bflsmYh+9c5YKgc3ykzbLnAl+G30A505uXpBLJuXmHHXayGTNzU0D3EtWKnEwXF5NRYRQTdBPrwmUo7ml/UU04bdvJGob9dxGjypjB9CQG9pL3ouGTZZ60kNnSodhnKbRFv+Z1P8oNi4Vz6789eOrLVdn5kRppZy0f231HVRKfCXKjTAw96v
+    endpoint: AgClXa9d4ePlMAN9w+JajdcDv+Kde3Zp90vgZ2RE3pGebMq4WNpIZ3hHZzUWQWS90ffhJmGsPrry14aGSkKyj+2i5pVLFjrMhRajOcWvQrWcdNa/2XrkijpSoGTM0wXm1yLgmfRZGnhgt5LFWjuiOFze8j984FseGWp7ZKGA86CSfiWFidcaUhzVUaPC4P/tdfQMHRnYq1GdFw/6TxZRvpoEW/RRm3P2B+H6nAyrjILpdOCEzvM88WiVF93IB/oQWw4HnRt92lQ0A2Ni81s/pTngIYhIyXS6KrWt9+0w131fJSdvC5TRidcYXVAllxRyKUm/2hEqEtCA+w3yMyQ7ZW6rEhqWAJrN0qlDzSQ3rmYzRMKWaXQVDxrMhqg6PkaYjuQYQRLmOWzJ+4KCgUXI1jPOce5W3KOGPwVJNUe7RDRrjep3fDn7XjFJoWJG76zzGkAYWsY2QkZ4LwnxzuAFFQ3iyLYw/KDnOGG3BZvIKCHDLhk31PCkrOZV4rlmm1RIPpSeZOmbBGYoM3vSvdXNmUxGzju2LL3mBF0O9OkgKozQO+ihCGVjHJMRvpB5mcoKvcP9g2+HidAwlEAt8igm5uFFx06OMnvv7RmI+kLpcgE+crA3W0L1gZKdxFZKNKxn+AFBxY5TrAoQpaSuGv8czGxuy/ZxLWF0fSKeyv4uCMWY1wq4eXT8QiyJbWYtBh9sqKF6pqNABeDNwg79y4sP8Z76PPJreN8Sy8kq06lQvDbk
+  template:
+    metadata:
+      name: loki-storage
+      namespace: openshift-logging
+    type: Opaque
--- a/clusters/overlays/local.hub/components/lvm-operator/kustomization.yaml
+++ b/clusters/overlays/local.hub/components/lvm-operator/kustomization.yaml
@@ -0,0 +1,12 @@
+resources:
+- ../../../../../components/lvm-operator/base
+
+patches:
+  - patch: |-
+      - op: add
+        path: /spec/storage/deviceClasses/0/deviceSelector
+        value:
+          paths:
+            - /dev/nvme0n1p5
+    target:
+      kind: LVMCluster
--- a/clusters/overlays/local.hub/components/nmstate/kustomization.yaml
+++ b/clusters/overlays/local.hub/components/nmstate/kustomization.yaml
@@ -0,0 +1,19 @@
+resources:
+- github.com/redhat-cop/gitops-catalog/nmstate/aggregate/overlays/default
+- node-network-configuration-policy.yaml
+
+patches:
+  - patch: |-
+      - op: replace
+        path: /spec/channel
+        value: "stable"
+    target:
+      kind: Subscription
+      name: kubernetes-nmstate-operator
+  - patch: |-
+      - op: add
+        path: /metadata/annotations/argocd.argoproj.io~1sync-options
+        value: SkipDryRunOnMissingResource=true
+    target:
+      kind: NMState
+      name: nmstate
--- a/clusters/overlays/local.hub/components/nmstate/node-network-configuration-policy.yaml
+++ b/clusters/overlays/local.hub/components/nmstate/node-network-configuration-policy.yaml
@@ -0,0 +1,68 @@
+apiVersion: nmstate.io/v1
+kind: NodeNetworkConfigurationPolicy
+metadata:
+  name: hub-server
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  desiredState:
+    interfaces:
+    - name: enp0s31f6
+      state: absent
+      type: ethernet
+      ipv4:
+        dhcp: true
+        enabled: true
+        auto-dns: true
+
+    # interfaces:
+    #   - name: bond0
+    #     description: Bond with ports enp4s0 and enp0s31f6
+    #     type: bond
+    #     state: up
+    #     copy-mac-from: enp4s0
+    #     ipv4:
+    #       dhcp: false
+    #       enabled: true
+    #     link-aggregation:
+    #       mode: active-backup
+    #       options:
+    #         miimon: '140'
+    #       port:
+    #       - enp4s0
+    #       - enp0s31f6
+    #     mtu: 1450
+    #   - name: br1
+    #     description: Linux bridge with bond0 as a port
+    #     type: linux-bridge
+    #     state: up
+    #     mtu: 9000
+    #     ipv4:
+    #       enabled: false
+    #     bridge:
+    #       options:
+    #         stp:
+    #           enabled: false
+    #       port:
+    #       - name: bond0
+
+    # interfaces:
+    # - name: enp4s0
+    #   state: up
+    #   type: ethernet
+    #   ipv4:
+    #     dhcp: false
+    #     enabled: true
+    # - name: enp0s31f6
+    #   state: up
+    #   type: ethernet
+    #   ipv4:
+    #     dhcp: true
+    #     enabled: true
+    #     auto-dns: true
+    # routes:
+    #   config:
+    #     - destination: 0.0.0.0/0
+    #       next-hop-address: 192.168.1.1
+    #       next-hop-interface: enp4s0
+    #       table-id: 254
--- a/clusters/overlays/local.hub/components/node-config/kustomization.yaml
+++ b/clusters/overlays/local.hub/components/node-config/kustomization.yaml
@@ -0,0 +1,15 @@
+resources:
+- set-max-pods.yaml
+- ../../../../../components/wake-on-lan/base
+
+patches:
+  - patch: |
+      - op: replace
+        path: /spec/config/systemd/units/0/name
+        value: wol@enp0s31f6.service
+      - op: add
+        path: /metadata/labels/machineconfiguration.openshift.io~1role
+        value: master
+    target:
+      kind: MachineConfig
+      name: 99-wol-service
--- a/clusters/overlays/local.hub/components/node-config/set-max-pods.yaml
+++ b/clusters/overlays/local.hub/components/node-config/set-max-pods.yaml
@@ -0,0 +1,12 @@
+apiVersion: machineconfiguration.openshift.io/v1
+kind: KubeletConfig
+metadata:
+  name: set-max-pods
+spec:
+  autoSizingReserved: true
+  machineConfigPoolSelector:
+    matchLabels:
+      pools.operator.machineconfiguration.openshift.io/master: ""
+  kubeletConfig:
+    podsPerCore: 10
+    maxPods: 450
--- a/clusters/overlays/local.hub/components/quay-registry-operator/README.md
+++ b/clusters/overlays/local.hub/components/quay-registry-operator/README.md
@@ -0,0 +1 @@
+Note you need to manually generate the config bundle secret in the generate folder, at some point I'll fully gitops this process.
--- a/clusters/overlays/local.hub/components/quay-registry-operator/generate/config-bundle-secret-qnap.yaml
+++ b/clusters/overlays/local.hub/components/quay-registry-operator/generate/config-bundle-secret-qnap.yaml
--- a/clusters/overlays/local.hub/components/quay-registry-operator/generate/config-qnap-example.yaml
+++ b/clusters/overlays/local.hub/components/quay-registry-operator/generate/config-qnap-example.yaml
@@ -0,0 +1,31 @@
+EXTERNAL_TLS_TERMINATION: false
+SERVER_HOSTNAME: registry.apps.home.ocplab.com
+PREFERRED_URL_SCHEME: https
+DISTRIBUTED_STORAGE_CONFIG:
+  # using Minio on QNAP NAS
+  radosGWStorage:
+    - RadosGWStorage
+    - access_key: XXXXX
+      secret_key: XXXX
+      bucket_name: quay
+      hostname: lab-nas.ocplab.com
+      is_secure: true
+      port: 9000
+      storage_path: /datastorage/registry
+DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
+DISTRIBUTED_STORAGE_PREFERENCE:
+  - radosGWStorage
+SSO_LOGIN_CONFIG:
+  CLIENT_ID: quay
+  CLIENT_SECRET: 723782ba-95d4-4d95-8b04-efebce0adf86
+  OIDC_SERVER: https://sso-sso.apps.home.ocplab.com/auth/realms/openshift/
+  LOGIN_SCOPES:
+    - openid
+  SERVICE_NAME: OpenShift
+SUPER_USERS:
+  - admin
+  - quayadmin
+FEATURE_DIRECT_LOGIN: true
+FEATURE_USER_INITIALIZE: true
+FEATURE_QUOTA_MANAGEMENT: true
+FEATURE_PROXY_CACHE: true
--- a/clusters/overlays/local.hub/components/quay-registry-operator/generate/create-qnap-sealed-secret.sh
+++ b/clusters/overlays/local.hub/components/quay-registry-operator/generate/create-qnap-sealed-secret.sh
@@ -0,0 +1,2 @@
+oc create secret generic --from-file config.yaml=./config-qnap-private.yaml config-bundle-secret --from-file=ssl.cert=fullchain.pem --from-file=ssl.key=key.pem -o yaml --dry-run=client -n quay > config-bundle-secret-qnap.yaml
+kubeseal --format yaml --cert ~/.bitnami/publickey.pem < config-bundle-secret-qnap.yaml
--- a/clusters/overlays/local.hub/components/quay-registry-operator/generate/generate-certs.sh
+++ b/clusters/overlays/local.hub/components/quay-registry-operator/generate/generate-certs.sh
@@ -0,0 +1,7 @@
+# Using Route53 with DNS challenge, source AWS creds (not in git repo but just sets access and secret key as env variables)
+. aws-creds
+mkdir -p qnap-tls
+acme.sh --force --issue --dns dns_aws --cert-file "./qnap-tls/cert.pem" --key-file "./qnap-tls/key.pem" --fullchain-file "./qnap-tls/fullchain.pem" --ca-file "./qnap-tls/ca.cer" -d registry.apps.home.ocplab.com
+
+# Convert CA to crt
+openssl x509 -inform PEM -in ./qnap-tls/ca.cer -out ./qnap-tls/letsencrypt_ca.crt
--- a/clusters/overlays/local.hub/components/quay-registry-operator/init-quay-job.yaml
+++ b/clusters/overlays/local.hub/components/quay-registry-operator/init-quay-job.yaml
@@ -0,0 +1,83 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: quay-init
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: quay-init
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: admin
+subjects:
+  - kind: ServiceAccount
+    name: quay-init
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: quay-init
+  annotations:
+    argocd.argoproj.io/sync-wave: "20"
+spec:
+  template:
+    spec:
+      containers:
+        - image: registry.redhat.io/ansible-automation-platform-21/ee-supported-rhel8:1.0
+          envFrom:
+          - secretRef:
+              name: init-user-password
+          command:
+            - /bin/bash
+            - -c
+            - |
+              #!/usr/bin/env bash
+
+              echo "Setup temporary OCP user to make ansible happy"
+
+              echo "tempuser:x:$(id -u):$(id -g):,,,:${HOME}:/bin/bash" >> /etc/passwd
+              echo "tempuser:x:$(id -G | cut -d' ' -f 2)" >> /etc/group
+              id
+
+              echo "Waiting for two minutes for quay to be ready"
+
+              sleep 120
+
+              git clone https://github.com/gnunn-gitops/quay-init
+
+              cd quay-init
+
+              ansible-galaxy collection install -r collections/requirements.yaml
+
+              ansible-playbook quay-init.yaml -e quay_init_password=$quay_init_password -e ansible_remote_tmp=/tmp
+
+              echo "Waiting for deploy/registry-clair-app to be available"
+              until oc get deployment registry-clair-app
+              do
+                sleep 5;
+              done
+              oc scale deploy/registry-clair-app --replicas=1
+
+              echo "Waiting for deploy/registry-quay-app to be available"
+              until oc get deployment registry-quay-app
+              do
+                sleep 5;
+              done
+              oc set resources deploy/registry-quay-app -c=quay-app --requests=cpu=1,memory=1Gi --limits=cpu=2,memory=4Gi
+              oc scale deploy/registry-quay-app --replicas=1
+
+              echo "Waiting for deploy/registry-clair-postgres to be available"
+              until oc get deployment registry-clair-postgres
+              do
+                sleep 5;
+              done
+              oc set resources deploy/registry-clair-postgres -c=postgres --limits=memory=3Gi
+
+          name: init-quay
+      dnsPolicy: ClusterFirst
+      restartPolicy: Never
+      terminationGracePeriodSeconds: 30
+      serviceAccount: quay-init
+      serviceAccountName: quay-init
--- a/clusters/overlays/local.hub/components/quay-registry-operator/init-user-password-secret.yaml
+++ b/clusters/overlays/local.hub/components/quay-registry-operator/init-user-password-secret.yaml
@@ -0,0 +1,15 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: init-user-password
+  namespace: quay
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  encryptedData:
+    quay_init_password: AgCFXt2+UWeWWgNO2EwPk10Vv07D8kXOYlVSPTi1AizSTJ35725eautJzhDSd1McS7A+VymUk6fdFDagx5oXJU7+Cr2V7n8sb+sQWQwiyaWuM4017PYHllCpMoU0Q5CF5yyZ11OyPPBi5Ucz391/TxgIZww9PGGXy2KolrL97fuvrVVgPdUdNw8SAG+6TlGTGiMuzg5VngLz8wKfNpQDdPum98DVRVvbzJHEp9Nu+rtglaCdLgsMcgTpWw59MKYsl7Slw7oZIxTZvRlu8m3DqGu+AqiFRGoLJpNhJ9aDMyH5QiQ+sf59VQILdTwTdPvC/wMAETKYqJ/PqEkTkYTsAdhS1AJDcMO2OoYGx7EheKNMRotjHSYor4DHedFqvVaA+X6ZjTU1so1Z5ToFW3tofnLXfrunuzUgU4Ld7pTl297Jyqy3J0kNF2vmsb0RExN8kbW+Rsk5rqHmYKm68lw28s+FI0Cejy29lk23j3V8m+WVY4ANtez1QTS0vU79+iauSVZx9Ab2hrD0IWLdU+18R+k1Mjd/ARBgxT/H6x4cGwhh32GF+46XPQpcNKrXeN0JsyDksllFHp6uXy6BYvDNxwm3eMVefOBdMkYr/z7pUqIYBtpQm9oyIEtr/j0f19CPmVX+glFsArVeCGizRrajtkLOb66x/OfoToZpwQzRalSwtHEHClLLXe8Y/HNm7vqx4golRYn3E3TiVOT0
+  template:
+    metadata:
+      name: init-user-password
+      namespace: quay
+    type: Opaque
--- a/clusters/overlays/local.hub/components/quay-registry-operator/kustomization.yaml
+++ b/clusters/overlays/local.hub/components/quay-registry-operator/kustomization.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+commonAnnotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+namespace: quay
+
+resources:
+- github.com/redhat-cop/gitops-catalog/quay-operator/operator/overlays/stable-3.8
+- init-user-password-secret.yaml
+- init-quay-job.yaml
+- registry-config-bundle-secret.yaml
+- registry.yaml
+- registry-app-route.yaml
--- a/clusters/overlays/local.hub/components/quay-registry-operator/registry-app-route.yaml
+++ b/clusters/overlays/local.hub/components/quay-registry-operator/registry-app-route.yaml
@@ -0,0 +1,59 @@
+kind: Route
+apiVersion: route.openshift.io/v1
+metadata:
+  name: registry-quay-app
+  labels:
+    app: quay
+    quay-component: quay-app
+    quay-operator/quayregistry: registry
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  host: registry.apps.home.ocplab.com
+  to:
+    kind: Service
+    name: registry-quay-app
+    weight: 100
+  port:
+    targetPort: https
+  tls:
+    termination: passthrough
+  wildcardPolicy: None
+---
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: registry-quay-builder
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  host: registry-builder.apps.home.ocplab.com
+  port:
+    targetPort: grpc
+  tls:
+    insecureEdgeTerminationPolicy: Redirect
+    termination: reencrypt
+  to:
+    kind: Service
+    name: registry-quay-app
+    weight: 100
+  wildcardPolicy: None
+---
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: registry-quay-config-editor
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  host: registry-config-editor.apps.home.ocplab.com
+  port:
+    targetPort: http
+  tls:
+    insecureEdgeTerminationPolicy: Redirect
+    termination: edge
+  to:
+    kind: Service
+    name: registry-quay-config-editor
+    weight: 100
+  wildcardPolicy: None
--- a/clusters/overlays/local.hub/components/quay-registry-operator/registry-config-bundle-secret.yaml
+++ b/clusters/overlays/local.hub/components/quay-registry-operator/registry-config-bundle-secret.yaml
--- a/clusters/overlays/local.hub/components/quay-registry-operator/registry.yaml
+++ b/clusters/overlays/local.hub/components/quay-registry-operator/registry.yaml
@@ -0,0 +1,27 @@
+apiVersion: quay.redhat.com/v1
+kind: QuayRegistry
+metadata:
+  name: registry
+  annotations:
+    argocd.argoproj.io/sync-wave: "10"
+spec:
+  components:
+    - managed: false
+      kind: tls
+    - managed: false
+      kind: horizontalpodautoscaler
+    - kind: route
+      managed: false
+    - kind: postgres
+      managed: true
+    - kind: clair
+      managed: true
+    - kind: redis
+      managed: true
+    - kind: mirror
+      managed: true
+    - kind: monitoring
+      managed: false
+    - kind: objectstorage
+      managed: false
+  configBundleSecret: config-bundle-secret
--- a/clusters/overlays/local.hub/components/rhtas-operator/kustomization.yaml
+++ b/clusters/overlays/local.hub/components/rhtas-operator/kustomization.yaml
@@ -0,0 +1,14 @@
+resources:
+- ../../../../../components/rhtas-operator/operator/base
+- ../../../../../components/rhtas-operator/instance/base
+
+patches:
+- patch: |
+    - op: replace
+      path: /spec/fulcio/config/OIDCIssuers/0/Issuer
+      value: https://sso.ocplab.com/realms/ocplab
+    - op: replace
+      path: /spec/fulcio/config/OIDCIssuers/0/IssuerURL
+      value: https://sso.ocplab.com/realms/ocplab
+  target:
+    kind: Securesign
--- a/clusters/overlays/rhdp/components/openshift-monitoring/base/cluster-monitoring-config-cm.yaml
+++ b/clusters/overlays/rhdp/components/openshift-monitoring/base/cluster-monitoring-config-cm.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cluster-monitoring-config
+  namespace: openshift-monitoring
+data:
+  config.yaml: |
+    enableUserWorkload: true
--- a/clusters/overlays/rhdp/components/openshift-monitoring/base/kustomization.yaml
+++ b/clusters/overlays/rhdp/components/openshift-monitoring/base/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- cluster-monitoring-config-cm.yaml
--- a/components/3scale-operator/base/apimanager.yaml
+++ b/components/3scale-operator/base/apimanager.yaml
@@ -0,0 +1,38 @@
+apiVersion: apps.3scale.net/v1alpha1
+kind: APIManager
+metadata:
+  name: apimanager
+  namespace: 3scale
+spec:
+  resourceRequirementsEnabled: true
+  wildcardDomain: 3scale.apps.home.ocplab.com
+  system:
+    database:
+      postgresql:
+        persistentVolumeClaim:
+          storageClassName: iscsi
+    redisPersistentVolumeClaim:
+      storageClassName: iscsi
+    fileStorage:
+      persistentVolumeClaim:
+        storageClassName: managed-nfs-storage
+    redisResources:
+      requests:
+        cpu: 150m
+        memory: 256Mi
+      limits:
+        cpu: 500m
+        memory: 4Gi
+  backend:
+    redisPersistentVolumeClaim:
+      storageClassName: iscsi
+    redisResources:
+      limits:
+        cpu: 500m
+        memory: 4Gi
+      requests:
+        cpu: 150m
+        memory: 256Mi
+  fileStorage:
+    persistentVolumeClaim:
+      storageClassName: managed-nfs-storage
--- a/components/acs-config/base/declarative-config.yaml
+++ b/components/acs-config/base/declarative-config.yaml
@@ -0,0 +1,125 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: declarative-configurations
+  namespace: stackrox
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: doppler-cluster
+  target:
+    name: declarative-configurations
+    creationPolicy: Owner
+    template:
+      data:
+        keycloak-auth.yaml: |
+          name: keycloak
+          minimumRole: None
+          uiEndpoint: central-stackrox.${SUB_DOMAIN}:443
+          oidc:
+              issuer: https://keycloak.${SUB_DOMAIN}/realms/openshift
+              mode: auto
+              clientID: acs
+              clientSecret: {{ .keycloak_client_secret }}
+              disableOfflineAccessScope: true
+          groups:
+              - key: email
+                value: admin@ocplab.com
+                role: Admin
+              - key: email
+                value: clusteradmin@workshop-noreply.com
+                role: Admin
+              - key: email
+                value: gnunn+user1@redhat.com
+                role: Product Catalog Admins
+        openshift-auth.yaml: |
+          name: openshift
+          uiEndpoint: central-stackrox.${SUB_DOMAIN}:443
+          openshift:
+              enable: true
+          minimumRole: None
+          groups:
+              - key: name
+                value: admin
+                role: Admin
+              - key: groups
+                value: product-catalog-admins
+                role: Product Catalog Admins
+        product-catalog-access-scope.yaml: |
+          name: product-catalog-admins
+          description: Access rights for users that can manage Product Catalog namespaces
+          rules:
+            includedNamespaces:
+            - clusterName: home
+              namespaceName: product-catalog-dev
+            - clusterName: home
+              namespaceName: product-catalog-test
+            - clusterName: home
+              namespaceName: product-catalog-monitor
+            - clusterName: home
+              namespaceName: product-catalog-prod
+            - clusterName: home
+              namespaceName: product-catalog-cicd
+            - clusterName: home
+              namespaceName: product-catalog-gitops
+        namespace-admin-permission-set.yaml: |
+          name: Namespace Administrator
+          description: A user that is an administrator of one or namespaces across various clusters
+          resources:
+            - resource: Access
+              access: NO_ACCESS
+            - resource: Administration
+              access: NO_ACCESS
+            - resource: Alert
+              access: READ_ACCESS
+            - resource: CVE
+              access: READ_ACCESS
+            - resource: Cluster
+              access: READ_ACCESS
+            - resource: Compliance
+              access: READ_ACCESS
+            - resource: Deployment
+              access: READ_ACCESS
+            - resource: DeploymentExtension
+              access: READ_ACCESS
+            - resource: Detection
+              access: READ_ACCESS
+            - resource: Image
+              access: READ_ACCESS
+            - resource: Integration
+              access: NO_ACCESS
+            - resource: K8sRole
+              access: READ_ACCESS
+            - resource: K8sRoleBinding
+              access: READ_ACCESS
+            - resource: K8sSubject
+              access: READ_ACCESS
+            - resource: Namespace
+              access: READ_ACCESS
+            - resource: NetworkGraph
+              access: READ_ACCESS
+            - resource: NetworkPolicy
+              access: READ_ACCESS
+            - resource: Node
+              access: READ_ACCESS
+            - resource: Secret
+              access: READ_ACCESS
+            - resource: ServiceAccount
+              access: READ_ACCESS
+            - resource: WatchedImage
+              access: READ_WRITE_ACCESS
+            - resource: VulnerabilityManagementApprovals
+              access: READ_ACCESS
+            - resource: VulnerabilityManagementRequests
+              access: READ_WRITE_ACCESS
+        product-catalog-roles.yaml: |
+          name: Product Catalog Admins
+          description: Administrators of product catalog namespaces
+          permissionSet: Namespace Administrator
+          accessScope: product-catalog-admins
+          globalAccess: NO_ACCESS
+  data:
+  - secretKey: keycloak_client_secret
+    remoteRef:
+      key: ACS_KEYCLOAK_CLIENT_SECRET
--- a/components/acs-config/base/kustomization.yaml
+++ b/components/acs-config/base/kustomization.yaml
@@ -0,0 +1,2 @@
+resources:
+- declarative-config.yaml
--- a/components/acs-operator/overlays/aggregate/admission-control-tls-push-secret.yaml
+++ b/components/acs-operator/overlays/aggregate/admission-control-tls-push-secret.yaml
@@ -0,0 +1,26 @@
+apiVersion: external-secrets.io/v1alpha1
+kind: PushSecret
+metadata:
+  name: admission-tls
+  namespace: stackrox
+spec:
+  refreshInterval: 10s
+  secretStoreRefs:
+    - name: doppler-push-secret
+      kind: ClusterSecretStore
+  selector:
+    secret:
+      name: admission-control-tls
+  data:
+    - match:
+        secretKey: ca.pem
+        remoteRef:
+          remoteKey: ACS_ADMISSION_CONTROL_TLS_CA
+    - match:
+        secretKey: admission-control-cert.pem
+        remoteRef:
+          remoteKey: ACS_ADMISSION_CONTROL_TLS_CERT
+    - match:
+        secretKey: admission-control-key.pem
+        remoteRef:
+          remoteKey: ACS_ADMISSION_CONTROL_TLS_KEY
--- a/components/acs-operator/overlays/aggregate/collector-tls-push-secret.yaml
+++ b/components/acs-operator/overlays/aggregate/collector-tls-push-secret.yaml
@@ -0,0 +1,26 @@
+apiVersion: external-secrets.io/v1alpha1
+kind: PushSecret
+metadata:
+  name: collector-tls
+  namespace: stackrox
+spec:
+  refreshInterval: 10s
+  secretStoreRefs:
+    - name: doppler-push-secret
+      kind: ClusterSecretStore
+  selector:
+    secret:
+      name: collector-tls
+  data:
+    - match:
+        secretKey: ca.pem
+        remoteRef:
+          remoteKey: ACS_COLLECTOR_TLS_CA
+    - match:
+        secretKey: collector-cert.pem
+        remoteRef:
+          remoteKey: ACS_COLLECTOR_TLS_CERT
+    - match:
+        secretKey: collector-key.pem
+        remoteRef:
+          remoteKey: ACS_COLLECTOR_TLS_KEY
--- a/components/acs-operator/overlays/aggregate/kustomization.yaml
+++ b/components/acs-operator/overlays/aggregate/kustomization.yaml
@@ -0,0 +1,31 @@
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+resources:
+  - github.com/redhat-cop/gitops-catalog/advanced-cluster-security-operator/aggregate/default
+  - admission-control-tls-push-secret.yaml
+  - collector-tls-push-secret.yaml
+  - sensor-tls-push-secret.yaml
+
+patches:
+  - patch: |-
+      - op: replace
+        path: /spec/channel
+        value: 'rhacs-4.7'
+    target:
+      kind: Subscription
+      name: rhacs-operator
+  - patch: |-
+      - op: replace
+        path: /spec/perNode/collector/collection
+        value: EBPF
+    target:
+      kind: SecuredCluster
+  - patch: |-
+      - op: add
+        path: /spec/central/declarativeConfiguration
+        value:
+          secrets:
+            - name: declarative-configurations
+    target:
+      kind: Central
--- a/components/acs-operator/overlays/aggregate/sensor-tls-push-secret.yaml
+++ b/components/acs-operator/overlays/aggregate/sensor-tls-push-secret.yaml
@@ -0,0 +1,26 @@
+apiVersion: external-secrets.io/v1alpha1
+kind: PushSecret
+metadata:
+  name: sensor-tls
+  namespace: stackrox
+spec:
+  refreshInterval: 10s
+  secretStoreRefs:
+    - name: doppler-push-secret
+      kind: ClusterSecretStore
+  selector:
+    secret:
+      name: sensor-tls
+  data:
+    - match:
+        secretKey: ca.pem
+        remoteRef:
+          remoteKey: ACS_SENSOR_TLS_CA
+    - match:
+        secretKey: sensor-cert.pem
+        remoteRef:
+          remoteKey: ACS_SENSOR_TLS_CERT
+    - match:
+        secretKey: sensor-key.pem
+        remoteRef:
+          remoteKey: ACS_SENSOR_TLS_KEY
--- a/components/acs-operator/overlays/secured-cluster/acs-admission-control-tls-secret.yaml
+++ b/components/acs-operator/overlays/secured-cluster/acs-admission-control-tls-secret.yaml
@@ -0,0 +1,25 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+  name: admission-control-tls
+  namespace: stackrox-secured-cluster-service
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: doppler-cluster
+  target:
+    name: admission-control-tls
+    creationPolicy: Owner
+  data:
+  - secretKey: ca.pem
+    remoteRef:
+      key: ACS_ADMISSION_CONTROL_TLS_CA
+  - secretKey: admission-control-cert.pem
+    remoteRef:
+      key: ACS_ADMISSION_CONTROL_TLS_CERT
+  - secretKey: admission-control-key.pem
+    remoteRef:
+      key: ACS_ADMISSION_CONTROL_TLS_KEY
--- a/components/acs-operator/overlays/secured-cluster/acs-collector-tls-secret.yaml
+++ b/components/acs-operator/overlays/secured-cluster/acs-collector-tls-secret.yaml
@@ -0,0 +1,25 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+  name: collector-tls
+  namespace: stackrox-secured-cluster-service
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: doppler-cluster
+  target:
+    name: collector-tls
+    creationPolicy: Owner
+  data:
+  - secretKey: ca.pem
+    remoteRef:
+      key: ACS_COLLECTOR_TLS_CA
+  - secretKey: collector-cert.pem
+    remoteRef:
+      key: ACS_COLLECTOR_TLS_CERT
+  - secretKey: collector-key.pem
+    remoteRef:
+      key: ACS_COLLECTOR_TLS_KEY
--- a/components/acs-operator/overlays/secured-cluster/acs-sensor-tls-secret.yaml
+++ b/components/acs-operator/overlays/secured-cluster/acs-sensor-tls-secret.yaml
@@ -0,0 +1,25 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+  name: sensor-tls
+  namespace: stackrox-secured-cluster-service
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: doppler-cluster
+  target:
+    name: sensor-tls
+    creationPolicy: Owner
+  data:
+  - secretKey: ca.pem
+    remoteRef:
+      key: ACS_SENSOR_TLS_CA
+  - secretKey: sensor-cert.pem
+    remoteRef:
+      key: ACS_SENSOR_TLS_CERT
+  - secretKey: sensor-key.pem
+    remoteRef:
+      key: ACS_SENSOR_TLS_KEY
--- a/components/acs-operator/overlays/secured-cluster/kustomization.yaml
+++ b/components/acs-operator/overlays/secured-cluster/kustomization.yaml
@@ -0,0 +1,19 @@
+# commonAnnotations:
+#   argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+resources:
+- github.com/redhat-cop/gitops-catalog/advanced-cluster-security-operator/operator/overlays/latest
+- namespace.yaml
+- acs-admission-control-tls-secret.yaml
+- acs-sensor-tls-secret.yaml
+- acs-collector-tls-secret.yaml
+- secured-cluster.yaml
+
+patches:
+  - patch: |-
+      - op: replace
+        path: /spec/channel
+        value: 'rhacs-4.7'
+    target:
+      kind: Subscription
+      name: rhacs-operator
--- a/components/acs-operator/overlays/secured-cluster/namespace.yaml
+++ b/components/acs-operator/overlays/secured-cluster/namespace.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+  name: stackrox-secured-cluster-service
--- a/components/acs-operator/overlays/secured-cluster/secured-cluster.yaml
+++ b/components/acs-operator/overlays/secured-cluster/secured-cluster.yaml
@@ -0,0 +1,18 @@
+kind: SecuredCluster
+apiVersion: platform.stackrox.io/v1alpha1
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "5"
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+  name: stackrox-secured-cluster-services
+  namespace: stackrox-secured-cluster-service
+spec:
+  clusterName: ${CLUSTER_NAME}
+  centralEndpoint: central-stackrox.apps.hub.ocplab.com:443
+  admissionControl:
+    contactImageScanners: ScanIfMissing
+    listenOnCreates: true
+    listenOnUpdates: true
+    timeoutSeconds: 6
+  scannerV4:
+    scannerComponent: Default
--- a/components/acs-operator/overlays/sso/create-sso-auth-provider-job.yaml
+++ b/components/acs-operator/overlays/sso/create-sso-auth-provider-job.yaml
@@ -0,0 +1,79 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "10"
+  name: create-sso-auth-provider
+  namespace: stackrox
+spec:
+  template:
+    spec:
+      containers:
+        - image: image-registry.openshift-image-registry.svc:5000/openshift/cli:latest
+          env:
+          - name: CLIENT_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: sso-secret
+                key: client-secret
+          - name: PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: central-htpasswd
+                key: password
+          - name: ISSUER
+            value: https://sso-sso.apps.home.ocplab.com/auth/realms/openshift
+          - name: DEFAULT_ROLE
+            value: Admin
+          command:
+            - /bin/bash
+            - -c
+            - |
+              #!/usr/bin/env bash
+
+              # Wait for central to be ready
+              attempt_counter=0
+              max_attempts=20
+              echo "Waiting for central to be available..."
+              until $(curl -k --output /dev/null --silent --head --fail https://central); do
+                  if [ ${attempt_counter} -eq ${max_attempts} ];then
+                    echo "Max attempts reached"
+                    exit 1
+                  fi
+                  printf '.'
+                  attempt_counter=$(($attempt_counter+1))
+                  echo "Made attempt $attempt_counter, waiting..."
+                  sleep 5
+              done
+
+              echo "Configuring SSO Provider"
+
+              echo "Test if SSO Provider already exists"
+
+              response=$(curl -k -u "admin:$PASSWORD" https://central/v1/authProviders?name=OpenShift | python3 -c "import sys, json; print(json.load(sys.stdin)['authProviders'], end = '')")
+
+              if [[ "$response" != "[]" ]] ; then
+                echo "OpenShift Provider already exists, exiting"
+                exit 0
+              fi
+
+              export DATA='{"name":"OpenShift","type":"oidc","uiEndpoint":"central-stackrox.apps.home.ocplab.com","enabled":true,"config":{"client_id":"stackrox","client_secret":"'${CLIENT_SECRET}'","issuer":"'$ISSUER'","mode":"post"},"validated":true,"extraUiEndpoints":[],"active":true}'
+
+              echo "Posting data: ${DATA}"
+
+              authid=$(curl -k -X POST -u "admin:$PASSWORD" -H "Content-Type: application/json" --data $DATA https://central/v1/authProviders | python3 -c "import sys, json; print(json.load(sys.stdin)['id'], end = '')")
+
+              echo "Authentication Provider created with id ${authid}"
+              echo "Updating minimum role to Admin"
+
+              export DATA='{"previous_groups":[],"required_groups":[{"props":{"authProviderId":"'${authid}'"},"roleName":"'${DEFAULT_ROLE}'"}]}'
+
+              curl -k -X POST -u "admin:$PASSWORD" -H "Content-Type: application/json" --data $DATA https://central/v1/groupsbatch
+
+          imagePullPolicy: Always
+          name: create-sso-auth-provider
+      dnsPolicy: ClusterFirst
+      restartPolicy: Never
+      serviceAccount: create-cluster-init
+      serviceAccountName: create-cluster-init
+      terminationGracePeriodSeconds: 30
--- a/components/acs-operator/overlays/sso/kustomization.yaml
+++ b/components/acs-operator/overlays/sso/kustomization.yaml
@@ -0,0 +1,18 @@
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+resources:
+  - github.com/redhat-cop/gitops-catalog/advanced-cluster-security-operator/operator/overlays/latest
+  - github.com/redhat-cop/gitops-catalog/advanced-cluster-security-operator/instance/overlays/internal-registry-integration
+  - sso-sealed-secret.yaml
+  - create-sso-auth-provider-job.yaml
+  # Use Andrew's Pipeline to create Stackrox API Tokens in tenant namespaces
+  - github.com/pittar-gitops/gitops-mono-repo-admins/03-cluster-services/08-advanced-cluster-security/pipelines-and-secrets
+
+patchesJson6902:
+  - path: patch-resources.yaml
+    target:
+      group: platform.stackrox.io
+      kind: Central
+      name: central
+      version: v1alpha1
--- a/components/acs-operator/overlays/sso/patch-resources.yaml
+++ b/components/acs-operator/overlays/sso/patch-resources.yaml
@@ -0,0 +1,22 @@
+- op: add
+  path: /spec/central/resources
+  value:
+    limits:
+      memory: 2Gi
+    requests:
+      cpu: 500m
+      memory: 512Mi
+- op: add
+  path: /spec/scanner/analyzer/resources
+  value:
+    limits:
+      memory: 1Gi
+    requests:
+      cpu: 250m
+      memory: 500Mi
+- op: replace
+  path: /spec/scanner/analyzer/scaling/autoScaling
+  value: Disabled
+- op: replace
+  path: /spec/scanner/analyzer/scaling/replicas
+  value: 2
--- a/components/acs-operator/overlays/sso/sso-sealed-secret.yaml
+++ b/components/acs-operator/overlays/sso/sso-sealed-secret.yaml
@@ -0,0 +1,15 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+  name: sso-secret
+  namespace: stackrox
+spec:
+  encryptedData:
+    client-secret: AgCk7m6UEoCoLvvLbUW+lXnYxaZ9Hm520Xg9/h9KMifm9mqFnzfxdlPksgZ0SIyw446ThrpAd/x39K1Azm5tMgQwIn+DaTOaDS3NVrwQWnaTBFph5AJ8DbcAMKFfSZAddCCizPlfkB3kv7zL8EIbj9d59Qbn3/0mu4hgqN0I2kOptQwFXt+kYYChrJ13LwDVJ5/wxPCa1VKUQ/osSX9wrddRBn/UQLPpXtH8loePfjn+9/oMMq49S4oiN9AjNUzuLLQHmg0OmeRtH34lGAkFgWHjNboOUDsmDCb78olGKTDIzNJ/Xz6iFmszZm1bhj7IG/VtcGoxroC/eddp1chGq4M8pMYEQkON6vp1bzP6LY3x6PxLjFg0Yl1EPSMZXyONNWJ9pl4drPsJqnw0QqLQG172ucbpGy2CwiaZ4ZwPtp/JcPJCDVW2nwwJNyNodfS8DgUbTF+cHm3/W0Z5BWi5CQvXBMRF3a9LyIuRoFW9w5XNnqKQP0lP/8NKW1K5LmgpVuJSGNg6JEQyRSDnK7WAnfDReDTTTEoivjFFQ7uUJFP/RDYWiXvSE3hNYse331QO5DCATmyDPm36txFaKtfVy/TdVhU7gV07FHPQju7IqfoI9pkc0pQtFUUYB9nFamuHsvkO4brnAjIYuCl7SJeM8xK37xLO4KgbKm/ldqxb80eUScBH963Lk9+H4zgyJ5Wq04dDdnxWrBedXjY00UBbmJ4CVDoGL/24HHbi118ZFTa3N9AJDss=
+  template:
+    metadata:
+      name: sso-secret
+      namespace: stackrox
+    type: Opaque
--- a/components/acs-tokens/base/README.md
+++ b/components/acs-tokens/base/README.md
@@ -0,0 +1,7 @@
+## Not being used at the moment, use at your own risk :)
+
+Uses a post-sync hook to generate ACS tokens for various namespaces to consume. Useful when there is a need to integrate with ACS for image scanning, etc.
+
+Namespaces can be passed in a comma-separated list via environment variables.
+
+based on Andrew Pitt's tekton task here: https://github.com/pittar-gitops/gitops-mono-repo-admins/tree/main/03-cluster-services/08-advanced-cluster-security/pipelines-and-secrets
--- a/components/acs-tokens/base/kustomization.yaml
+++ b/components/acs-tokens/base/kustomization.yaml
@@ -0,0 +1,6 @@
+namespace: stackrox
+
+resources:
+  - postsync-create-roxsecrets-sa-rbac.yaml
+  - postsync-create-roxsecrets-job.yaml
+  - postsync-roxsecret-namespaces.yaml
--- a/components/acs-tokens/base/postsync-create-roxsecrets-job.yaml
+++ b/components/acs-tokens/base/postsync-create-roxsecrets-job.yaml
@@ -0,0 +1,85 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: postsync-create-roxsecrets-job
+  namespace: stackrox
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+spec:
+  template:
+    spec:
+      containers:
+        - image: quay.io/gnunn/tools:4.10-1
+          env:
+          - name: PASSWORD
+            valueFrom:
+              secretKeyRef:
+                key: password
+                name: central-htpasswd
+          envFrom:
+          - configMapRef:
+              name: roxsecret-namespaces
+          command:
+          - /bin/bash
+          - -c
+          - |
+            # Wait for central to be ready
+            attempt_counter=0
+            max_attempts=20
+            echo "Waiting for central to be available..."
+            until $(curl -k --output /dev/null --silent --head --fail https://$CENTRAL_URL); do
+              if [ ${attempt_counter} -eq ${max_attempts} ];then
+                echo "Max attempts reached"
+                exit 1
+              fi
+              printf '.'
+              attempt_counter=$(($attempt_counter+1))
+              echo "Made attempt $attempt_counter, waiting..."
+              sleep 10
+            done
+
+            API_ENDPOINT="/v1/apitokens/generate"
+            CENTRAL_URL_API="https://$CENTRAL_URL$API_ENDPOINT"
+            echo "Central API endpoint: $CENTRAL_URL_API"
+            echo "Creating secrets in namespaces $NAMESPACES"
+
+            for NAMESPACE in ${NAMESPACES//,/ }
+            do
+              echo "Creating secret for $NAMESPACE"
+              if [[ `oc get namespace $NAMESPACE 2>/dev/null` ]] ;
+              then
+                  echo "Namespace '$NAMESPACE' exists, checking secret..."
+              else
+                  echo "Namespace '$NAMESPACE' doesn't exist, skipping"
+                  continue
+              fi
+
+              # If secret already exists, don't regenerate.
+              if [[ -n `oc get secret roxsecrets -n $NAMESPACE 2>/dev/null` ]] ;
+              then
+                  echo "Stackrox token secret already exists in $NAMESPACE"
+                  continue
+              fi
+              PAYLOAD="{\"name\": \"$NAMESPACE\", \"role\": \"Continuous Integration\"}"
+              echo "$PAYLOAD"
+              echo "Generate new token."
+              RESPONSE=$(curl -k \
+                -X POST -u "admin:$PASSWORD" \
+                -H "Content-Type: application/json" \
+                --data "$PAYLOAD" \
+                $CENTRAL_URL_API)
+              TOKEN=$(jq -r '.token' <<< "$RESPONSE")
+
+              # Create secret in target namespace
+              oc create secret generic roxsecrets \
+                --from-literal=rox_central_endpoint=$CENTRAL_URL:443 \
+                --from-literal=rox_api_token=$TOKEN \
+                -n $NAMESPACE
+            done
+          name: create-secrets
+      dnsPolicy: ClusterFirst
+      restartPolicy: Never
+      terminationGracePeriodSeconds: 30
+      serviceAccount: postsync-create-roxsecrets
+      serviceAccountName: postsync-create-roxsecrets
--- a/components/acs-tokens/base/postsync-create-roxsecrets-sa-rbac.yaml
+++ b/components/acs-tokens/base/postsync-create-roxsecrets-sa-rbac.yaml
@@ -0,0 +1,40 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: postsync-create-roxsecrets
+  namespace: stackrox
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: postsync-create-roxsecrets
+  namespace: stackrox
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+    verbs:
+      - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: postsync-create-roxsecrets
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: postsync-create-roxsecrets
+subjects:
+  - kind: ServiceAccount
+    name: postsync-create-roxsecrets
+    namespace: stackrox
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				Cluster specific overlays go here, typically each cluster will have a list of ArgoCD apps required for the configuration managed by the "app of app" pattern expressed in a corresponding overlay in the `/bootstrap/overlays` directory.
				`@@ -0,0 +1 @@`
				`Note you need to manually generate the config bundle secret in the generate folder, at some point I'll fully gitops this process.`