acre.yaml

# Copyright 2019 Copyright (c) 2019 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

dependency_versions: (( &temporary( read( __ctx.DIR "/dependency-versions.yaml", "yaml" ) ) ))
meta: (( ~~ ))
landscape:
  name: (( error("landscape name required") ))
  domain:
  namespace: garden
  defaultTTL: 120
  cluster:
    kubeconfig: ./kubeconfig
    networks: ~
  clusters: (( valid(landscape.cluster.networks) ? [ landscape.cluster ] :error("no cluster networks definition found") ))
  components: []
  versions:
    kube-apiserver:
      image_repo: k8s.gcr.io/hyperkube
      image_tag: v1.18.3
    etcd:
      etcd:
        image_repo: quay.io/coreos/etcd
        image_tag: "v3.3.13"
      backup_restore:
        image_repo: eu.gcr.io/gardener-project/gardener/etcdbrctl
        image_tag: "0.6.4"
    gardener:
      <<: (( merge ))
      repo: "https://github.com/gardener/gardener.git"
      tag: (( valid( branch ) -or valid( commit ) ? ~~ :.dependency_versions.versions.gardener.core.version ))
      apiserver:
        <<: (( merge ))
        image_repo: "eu.gcr.io/gardener-project/gardener/apiserver"
        image_tag: (( valid( tag ) ? tag :~~ ))
      controller_manager:
        <<: (( merge ))
        image_repo: "eu.gcr.io/gardener-project/gardener/controller-manager"
        image_tag: (( valid( tag ) ? tag :~~ ))
      admission_controller:
        <<: (( merge ))
        image_repo: "eu.gcr.io/gardener-project/gardener/admission-controller"
        image_tag: (( valid( tag ) ? tag :~~ ))
      scheduler:
        <<: (( merge ))
        image_repo: "eu.gcr.io/gardener-project/gardener/scheduler"
        image_tag: (( valid( tag ) ? tag :~~ ))
      gardenlet:
        <<: (( merge ))
        image_repo: "eu.gcr.io/gardener-project/gardener/gardenlet"
        image_tag: (( valid( tag ) ? tag :~~ ))
      extensions:
        dns-external:
          <<: (( merge ))
          tag: (( valid( dns-external.branch ) -or valid( dns-external.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.dns-external.version ))
          image_tag: (( valid( dns-external.tag ) ? dns-external.tag :~~ ))
          image_repo: (( ~~ ))
          repo: (( .dependency_versions.versions.gardener.extensions.dns-external.repo ))
          chart_path: charts/external-dns-management
        os-ubuntu:
          <<: (( merge ))
          tag: (( valid( os-ubuntu.branch ) -or valid( os-ubuntu.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.os-ubuntu.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.os-ubuntu.repo ))
          chart_path: charts/gardener-extension-os-ubuntu
          image_tag: (( valid( os-ubuntu.tag ) ? os-ubuntu.tag :~~ ))
          image_repo: (( ~~ ))
        os-gardenlinux:
          <<: (( merge ))
          tag: (( valid( os-gardenlinux.branch ) -or valid( os-gardenlinux.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.os-gardenlinux.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.os-gardenlinux.repo ))
          chart_path: charts/gardener-extension-os-gardenlinux
          image_tag: (( valid( os-gardenlinux.tag ) ? os-gardenlinux.tag :~~ ))
          image_repo: (( ~~ ))
        os-suse-chost:
          <<: (( merge ))
          tag: (( valid( os-suse-chost.branch ) -or valid( os-suse-chost.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.os-suse-chost.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.os-suse-chost.repo ))
          chart_path: charts/gardener-extension-os-suse-chost
          image_tag: (( valid( os-suse-chost.tag ) ? os-suse-chost.tag :~~ ))
          image_repo: (( ~~ ))
        provider-aws:
          <<: (( merge ))
          tag: (( valid( provider-aws.branch ) -or valid( provider-aws.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.provider-aws.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.provider-aws.repo ))
          chart_path: charts/gardener-extension-provider-aws
          image_tag: (( valid( provider-aws.tag ) ? provider-aws.tag :~~ ))
          image_repo: (( ~~ ))
        provider-gcp:
          <<: (( merge ))
          tag: (( valid( provider-gcp.branch ) -or valid( provider-gcp.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.provider-gcp.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.provider-gcp.repo ))
          chart_path: charts/gardener-extension-provider-gcp
          image_tag: (( valid( provider-gcp.tag ) ? provider-gcp.tag :~~ ))
          image_repo: (( ~~ ))
        provider-azure:
          <<: (( merge ))
          tag: (( valid( provider-azure.branch ) -or valid( provider-azure.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.provider-azure.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.provider-azure.repo ))
          chart_path: charts/gardener-extension-provider-azure
          image_tag: (( valid( provider-azure.tag ) ? provider-azure.tag :~~ ))
          image_repo: (( ~~ ))
        provider-openstack:
          <<: (( merge ))
          tag: (( valid( provider-openstack.branch ) -or valid( provider-openstack.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.provider-openstack.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.provider-openstack.repo ))
          chart_path: charts/gardener-extension-provider-openstack
          image_tag: (( valid( provider-openstack.tag ) ? provider-openstack.tag :~~ ))
          image_repo: (( ~~ ))
        networking-calico:
          <<: (( merge ))
          tag: (( valid( networking-calico.branch ) -or valid( networking-calico.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.networking-calico.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.networking-calico.repo ))
          chart_path: charts/gardener-extension-networking-calico
          image_tag: (( valid( networking-calico.tag ) ? networking-calico.tag :~~ ))
          image_repo: (( ~~ ))
        shoot-cert-service:
          <<: (( merge ))
          tag: (( valid( shoot-cert-service.branch ) -or valid( shoot-cert-service.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.shoot-cert-service.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.shoot-cert-service.repo ))
          chart_path: charts/gardener-extension-shoot-cert-service
          image_tag: (( valid( shoot-cert-service.tag ) ? shoot-cert-service.tag :~~ ))
          image_repo: (( ~~ ))
        shoot-dns-service:
          <<: (( merge ))
          tag: (( valid( shoot-dns-service.branch ) -or valid( shoot-dns-service.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.shoot-dns-service.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.shoot-dns-service.repo ))
          chart_path: charts/gardener-extension-shoot-dns-service
          image_tag: (( valid( shoot-dns-service.tag ) ? shoot-dns-service.tag :~~ ))
          image_repo: (( ~~ ))
        provider-vsphere:
          <<: (( merge ))
          tag: (( valid( provider-vsphere.branch ) -or valid( provider-vsphere.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.provider-vsphere.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.provider-vsphere.repo ))
          chart_path: charts/gardener-extension-provider-vsphere
          image_tag: (( valid( provider-vsphere.tag ) ? provider-vsphere.tag :~~ ))
          image_repo: (( ~~ ))
    dashboard:
      <<: (( merge ))
      repo: (( .dependency_versions.versions.dashboard.core.repo ))
      tag: (( valid( branch ) -or valid( commit ) ? ~~ :.dependency_versions.versions.dashboard.core.version ))
      image_tag: (( valid( tag ) ? tag :~~ ))
    ingress-controller:
      <<: (( merge ))
      repo: https://github.com/kubernetes/ingress-nginx.git
      image_tag: (( valid( tag ) ? substr(tag, length("controller-")) :~~ ))
      image_repo: eu.gcr.io/k8s-artifacts-prod/ingress-nginx/controller
      tag: (( valid( branch ) -or valid( commit ) ? ~~ :"controller-v0.43.0" ))
    nginx-ingress-k8s-backend:
      <<: (( merge ))
      image_tag: "0.9.0"
      image_repo: eu.gcr.io/gardener-project/gardener/ingress-default-backend
    identity:
      <<: (( merge ))
      repo: (( .dependency_versions.versions.dashboard.identity.repo ))
      tag: (( valid( branch ) -or valid( commit ) ? ~~ :.dependency_versions.versions.dashboard.identity.version ))
      branch: (( valid( commit ) ? ~~ :( dashboard.branch || ~~ ) ))
      commit: (( dashboard.commit || ~~ ))
    terminal-controller-manager:
      <<: (( merge ))
      repo: (( .dependency_versions.versions.dashboard.terminals.terminal-controller-manager.repo ))
      tag: (( valid( branch ) -or valid( commit ) ? ~~ :.dependency_versions.versions.dashboard.terminals.terminal-controller-manager.version ))
      image_tag: (( valid( tag ) ? tag :~~ ))
      image_repo: eu.gcr.io/gardener-project/gardener/terminal-controller-manager
    terminal-kube-rbac-proxy:
      <<: (( merge ))
      # to overwrite:
      # set image_repo here (mandatory)
      # set image_tag here (defaults to latest, if image_repo is set and image_tag is not given)
    dns-controller:
      <<: (( merge ))
      tag: (( valid( branch ) -or valid( commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.dns-external.version ))
      image_tag: (( valid( tag ) ? tag :~~ ))
      image_repo: (( ~~ ))
      repo: "https://github.com/gardener/external-dns-management.git"
    cert-manager:
      controller:
        <<: (( merge ))
        tag: (( valid( branch ) -or valid( commit ) ? ~~ :helm_tag )) # only used for CRDs
        repo: "https://github.com/jetstack/cert-manager.git"
        helm_repo: "https://charts.jetstack.io"
        helm_tag: "v1.3.1"
      cert-dns-bridge:
        <<: (( merge ))
        tag: (( valid( branch ) -or valid( commit ) ? ~~ :"2.0.0" ))
        image_tag: (( valid( tag ) ? tag :~~ ))
        image_repo: (( ~~ ))
        repo: "https://github.com/gardener/certificate-dns-bridge.git"
    monitoring:
      prometheus:
        image_repo: quay.io/prometheus/prometheus
        image_tag: v2.12.0
      blackbox-exporter:
        image_repo: quay.io/prometheus/blackbox-exporter
        image_tag: v0.14.0
      configmap-reload:
        image_repo: quay.io/coreos/configmap-reload
        image_tag: v0.0.1
      grafana:
        image_repo: grafana/grafana
        image_tag: "7.0.3"
      gardener-metrics-exporter:
        <<: (( merge ))
        repo: https://github.com/gardener/gardener-metrics-exporter.git
        tag: (( valid( branch ) -or valid( commit ) ? ~~ :"0.13.0" ))
        image_tag: (( valid( tag ) ? tag :~~ ))
        image_repo: (( ~~ ))
  iaas: (( merge none // map[ select[stub()|e|-> ( ! defined( e.mode ) ) -or ( e.mode != "inactive" ) ] |idx,v|-> v { "mode" = v.mode || "seed" } ] ))
  iaas_shooted_seeds: (( merge none // sum[landscape.iaas|[]|s,e|-> ( e.mode == "seed" -or e.mode == "soil" ) -and valid( e.seeds ) ? s map[e.seeds|x|-> x {"seed" = e.name}] :s] ))
  etcd:
    <<: (( merge ))
    backup:
      <<: (( merge ))
      active: true
      type: (( active ? .backup_type_mapping[iaas[0].type] :~~ ))
      region: (( active ? iaas[0].region :~~ ))
      credentials: (( active ? iaas[0].credentials :~~ ))
  dashboard: (( ~~ ))
  identity:
  ingress:
    annotations: (( ~~ ))
  gardener: (( ~~ ))
  monitoring:
    active: false
    username: admin
    password: (( ~~ ))
    hash: (( ~~ ))
  cert-manager:
    <<: (( merge ))
    server: (( merge none // valid( stub() ) ? ( type( stub() ) == "map" ? stub() :{ "url" = stub() } ) :{"url" = "self-signed"} ))
  dns:
    <<: (( merge ))
    type: (( .dns_type_mapping[iaas[0].type] ))
    credentials: (( iaas[0].credentials ))
dns_type_mapping:
  <<: (( &temporary ))
  gcp: google-clouddns
  aws: aws-route53
  azure: azure-dns
  openstack: openstack-designate

backup_type_mapping:
  <<: (( &temporary ))
  gcp: gcs
  aws: s3
  azure: abs
  openstack: swift


######################
##### VALIDATION #####
######################

validation:
  <<: (( &temporary ))

  ### AUXILIARY FUNCTIONS ###
  return_true: (( |x|-> true )) # dummy validator that never fails
  instantiate_validator: (( |values,validator|-> *validator )) # instantiates a validator with given values
  email_regex: "[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*@[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)+$" # a simple email regex
  flatten: (( |l|-> sum[l|[]|s,e|-> s e.[*]] )) # flattens a list of lists to a list of elements
  length_validator: (( |x,l|-> [length( x ) <= l, x, "exceeded maximum allowed length (" l "):" " " x] )) # returns true if the length of x is equals or lesser than l

  ### VALIDATOR DEFINITIONS ###
  types:
    iaas:
      # <type>.config: validated for each iaas entry
      # <type>.profileConfig: validated for each iaas entry that results in a cloudprofile (= doesn't have a 'cloudprofile' field referencing another iaas entry)
      # <type>.networks: validated for shooted seed iaas entries
      gcp:
        credentials:
          - mapfield
          - serviceaccount.json
        config:
          - ["mapfield", "region"]
          - ["mapfield", "zones", ["list"]]
        profileConfig:
          - (( return_true ))
        networks:
          - ["mapfield", "workers", ["cidr"]]
      aws:
        credentials:
          - and
          - ["mapfield", "accessKeyID"]
          - ["mapfield", "secretAccessKey"]
        config:
          - ["mapfield", "region"]
          - ["mapfield", "zones", ["list"]]
        profileConfig:
          - (( return_true ))
        networks:
          - ["mapfield", "internal", ["cidr"]]
          - ["mapfield", "public", ["cidr"]]
          - ["mapfield", "vpc", ["or", ["mapfield", "id"], ["mapfield", "cidr", ["cidr"]]]]
      azure:
        credentials:
          - and
          - ["mapfield", "clientID"]
          - ["mapfield", "clientSecret"]
          - ["mapfield", "subscriptionID"]
          - ["mapfield", "tenantID"]
        config:
          - ["mapfield", "region"]
        profileConfig:
          - (( return_true ))
        networks:
          - ["mapfield", "workers", ["cidr"]]
          - ["mapfield", "vnet", ["or", ["mapfield", "name"], ["mapfield", "cidr", ["cidr"]]]]
      vsphere:
        credentials:
          - and
          - ["mapfield", "nsxtPassword"]
          - ["mapfield", "nsxtUsername"]
          - ["mapfield", "vspherePassword"]
          - ["mapfield", "vsphereUsername"]
        config:
          - ["mapfield", "region"]
          - ["mapfield", "zones", ["list"]]
        profileConfig:
          - and
          - - mapfield
            - loadBalancerConfig
            - - and
              - - mapfield
                - size
                - ["valueset", ["SMALL", "MEDIUM", "LARGE"]]
              - - mapfield
                - classes
                - - list
                  - ["mapfield", "name"]
          - ["mapfield", "defaultClassStoragePolicyName"]
          - ["mapfield", "dnsServers", ["list", ["ip"]]]
          - ["mapfield", "folder"]
          - - mapfield
            - machineImageDefinitions
            - - list
              - - and
                - ["mapfield", "name"]
                - - mapfield
                  - versions
                  - - list
                    - - and
                      - ["optionalfield", "guestId"]
                      - ["mapfield", "path"]
                      - ["mapfield", "version"]
          - - optionalfield
            - machineTypeOptions
            - - list
              - - and
                - ["mapfield", "name"]
                - ["mapfield", "memoryReservationLockedToMax", ["type", "bool"]]
                - ["optionalfield", "extraConfig", "map"]
          - - mapfield
            - regionDefinitions
            - - list
              - - and
                - ["mapfield", "name"]
                - ["mapfield", "vsphereHost"]
                - ["optionalfield", "vsphereInsecureSSL", ["type", "bool"]]
                - ["mapfield", "nsxtHost"]
                - ["optionalfield", "nsxtInsecureSSL", ["type", "bool"]]
                - ["optionalfield", "nsxtRemoteAuth", ["type", "bool"]]
                - ["mapfield", "transportZone"]
                - ["mapfield", "logicalTier0Router"]
                - ["mapfield", "edgeCluster"]
                - ["mapfield", "snatIPPool"]
          - ["optionalfield", "csiResizerDisabled", ["type", "bool"]]
          - - optionalfield
            - failureDomainLabels
            - - and
              - ["mapfield", "region"]
              - ["mapfield", "zone"]
        networks: []
      openstack:
        credentials:
          - and
          - ["mapfield", "domainName"]
          - ["mapfield", "tenantName"]
          - ["mapfield", "username"]
          - ["mapfield", "password"]
          - ["mapfield", "authURL"]
        config:
          - ["mapfield", "region"]
          - ["mapfield", "zones", ["list"]]
        profileConfig:
          - and
          - - mapfield
            - floatingPools
            - - list
              - ["mapfield", "name"]
          - - mapfield
            - machineImages
            - - list
              - - and
                - ["mapfield", "name"]
                - - mapfield
                  - versions
                  - - list
                    - ["mapfield", "version"]
          - - mapfield
            - loadBalancerProviders
            - - list
              - ["mapfield", "name"]
          - - mapfield
            - machineTypes
            - - list
              - - and
                - ["mapfield", "name"]
                - ["mapfield", "cpu"]
                - ["mapfield", "gpu"]
                - ["mapfield", "memory"]
                - ["mapfield", "usable"]
                - - optionalfield
                  - storage
                  - - and
                    - ["mapfield", "class"]
                    - ["mapfield", "type"]
                    - ["mapfield", "size"]
          - ["optionalfield", "dhcpDomain", "dnsdomain"]
          - ["optionalfield", "keystoneURL", "dnsdomain"]
          - ["optionalfield", "useOctavia", ["type", "bool"]]
          - ["optionalfield", "dnsServers", ["list", ["ip"]]]
          - ["optionalfield", "nodeVolumeAttachLimit", ["type", "int"]]
          - - mapfield
            - machineImageDefinitions
            - - list
              - - and
                - ["mapfield", "name"]
                - - mapfield
                  - versions
                  - - list
                    - - and
                      - - or
                        - ["mapfield", "image"]
                        - - mapfield
                          - regions
                          - - list
                            - - and
                              - ["mapfield", "name"]
                              - ["mapfield", "id"]
                      - ["mapfield", "version"]
        networks:
          - ["mapfield", "workers", ["cidr"]]
    etcd_backup:
      gcs:
        credentials: (( iaas.gcp.credentials ))
        config: (( return_true ))
      s3:
        credentials: (( iaas.aws.credentials ))
        config: (( return_true ))
      abs:
        credentials: (( iaas.azure.credentials ))
        config: ["mapfield", "resourceGroup"]
      swift:
        credentials: (( iaas.openstack.credentials ))
        config: (( return_true ))
    backup_config:
      - <<: (( &template ))
      - and
      - - mapfield
        - type
        - - valueset
          - (( keys( types.etcd_backup ) ))
      - ["mapfield", "region"]
      - - mapfield
        - credentials
        - (( types.etcd_backup[values.type].credentials ))
    dns:
      google-clouddns:
        credentials: (( iaas.gcp.credentials ))
        config: (( return_true ))
      aws-route53:
        credentials: (( iaas.aws.credentials ))
        config: (( return_true ))
      azure-dns:
        credentials: (( iaas.azure.credentials ))
        config: (( return_true ))
      openstack-designate:
        credentials:
          - <<: (( iaas.openstack.credentials ))
          - ["mapfield", "region"]
        config: (( return_true ))
      cloudflare-dns:
        credentials:
          - mapfield
          - apiToken
        config: (( return_true ))
      infoblox-dns:
        credentials:
          - and
          - ["mapfield", "USERNAME"]
          - ["mapfield", "PASSWORD"]
          - ["mapfield", "HOST", ["ip"]]
          - ["optionalfield", "PORT", ["type", "int"]]
          - ["optionalfield", "SSL_VERIFY", ["type", "bool"]]
          - ["optionalfield", "VERSION"]
          - ["optionalfield", "VIEW"]
          - ["optionalfield", "HTTP_POOL_CONNECTIONS", ["type", "int"]]
          - ["optionalfield", "HTTP_REQUEST_TIMEOUT", ["type", "int"]]
          - ["optionalfield", "CA_CERT", ["ca"]]
          - ["optionalfield", "PROXY_URL"]
        config: (( return_true ))
# providerConfig support not complete in Gardener
#        config:
#          - mapfield
#          - providerConfig
#          - - and
#            - ["mapfield", "host", ["ip"]]
#            - ["optionalfield", "port", ["type", "int"]]
#            - ["optionalfield", "sslVerify", ["type", "bool"]]
#            - ["optionalfield", "version"]
#            - ["optionalfield", "view"]
#            - ["optionalfield", "httpPoolConnections", ["type", "int"]]
#            - ["optionalfield", "httpRequestTimeout", ["type", "int"]]
#            - ["optionalfield", "caCert", ["ca"]]
#            - ["optionalfield", "maxResults", ["type", "int"]]
#            - ["optionalfield", "proxyUrl"]
  iaas_entry_validators:
    basic:
      - <<: (( &template ))
      - and
      - ["mapfield", "name"]
      - ["mapfield", "type", ["valueset", (( keys( types.iaas ) ))]]
      - ["mapfield", "mode", ["valueset", ["seed", "profile", "cloudprofile", "soil"]]]
      - - optionalfield
        - shootDefaultNetworks
        - - and
          - ["mapfield", "pods", ["cidr"]]
          - ["mapfield", "services", ["cidr"]]
      - - optionalfield
        - credentials
        - (( types.iaas[values.type].credentials ))
      - - optionalfield
        - featureGates
        - - and
          - ["optionalfield", "Logging", ["type", "bool"]]
          - ["optionalfield", "HVPA", ["type", "bool"]]
          - ["optionalfield", "HVPAForShootedSeed", ["type", "bool"]]
          - ["optionalfield", "ManagedIstio", ["type", "bool"]]
          - ["optionalfield", "APIServerSNI", ["type", "bool"]]
          - ["optionalfield", "KonnectivityTunnel", ["type", "bool"]]
          - ["optionalfield", "CachedRuntimeClients", ["type", "bool"]]
          - ["optionalfield", "NodeLocalDNS", ["type", "bool"]]
          - ["optionalfield", "MountHostCADirectories", ["type", "bool"]]
          - ["optionalfield", "SeedKubeScheduler", ["type", "bool"]]
      - - optionalfield
        - gardenClientConnection
        - - and
          - ["optionalfield", "qps", ["type", "int"]]
          - ["optionalfield", "burst", ["type", "int"]]
      - - optionalfield
        - seedClientConnection
        - - and
          - ["optionalfield", "qps", ["type", "int"]]
          - ["optionalfield", "burst", ["type", "int"]]
      - - optionalfield
        - shootClientConnection
        - - and
          - ["optionalfield", "qps", ["type", "int"]]
          - ["optionalfield", "burst", ["type", "int"]]
      - - optionalfield
        - imageVectorOverwrite
        - - mapfield
          - images
          - - list
            - - and
              - ["mapfield", "name"]
              - ["optionalfield", "sourceRepository"]
              - ["mapfield", "repository"]
              - ["optionalfield", "tag"]
              - ["optionalfield", "version"]
      - - optionalfield
        - componentImageVectorOverwrite
        - - mapfield
          - components
          - - list
            - - and
              - ["mapfield", "name"]
              - - mapfield
                - imageVectorOverwrite
                - - mapfield
                  - images
                  - - list
                    - - and
                      - ["mapfield", "name"]
                      - ["optionalfield", "sourceRepository"]
                      - ["mapfield", "repository"]
                      - ["optionalfield", "tag"]
                      - ["optionalfield", "version"]
      - <<: (( types.iaas[values.type].config ))
    seeds_common:
      - <<: (( &template ))
      - - mapfield
        - credentials
        - (( types.iaas[values.type].credentials ))
      - - optionalfield
        - seedConfig
        - - and
          - - optionalfield
            - backup
            - - and
              - ["optionalfield", "active", ["type", "bool"]]
              - (( defined( values.seedConfig.backup.type ) -or defined( values.seedConfig.backup.credentials ) -or defined( values.seedConfig.backup.region ) ? validation.instantiate_validator( values.seedConfig.backup, validation.types.backup_config ) :~~ ))
          - ["optionalfield", "providerConfig", "map"]
    initial_seed:
      - <<: (( &template ))
      - and
      - ["mapfield", "mode", ["valueset", ["seed", "soil"]]]
      - <<: (( *validation.iaas_entry_validators.seeds_common ))
    seed:
      - <<: (( &template ))
      - and
      - - mapfield
        - cluster
        - - and
          - ["mapfield", "kubeconfig"]
          - - mapfield
            - networks
            - (( validation.networks ))
      - <<: (( *validation.iaas_entry_validators.seeds_common ))
    cloudprofile:
      - <<: (( &template ))
      - <<: (( types.iaas[values.type].profileConfig ))
    shooted_seed:
      - <<: (( &template ))
      - and
      - - mapfield
        - name
        - - (( validation.length_validator ))
          - 10
      - - mapfield
        - mode
        - ["valueset", ["seed", "soil"]]
      - - mapfield
        - cluster
        - - mapfield
          - networks
          - (( validation.networks types.iaas[values.type].networks ))
      - <<: (( *validation.iaas_entry_validators.seeds_common ))
  dashboard_validator:
    - and
    - - optionalfield
      - cname
      - - and
        - - mapfield
          - domain
          - - dnsdomain
        - - optionalfield
          - dns
          - - and
            - - mapfield
              - type
              - - valueset
                - (( keys( validation.types.dns ) ))
            - - mapfield
              - credentials
              - (( types.dns[landscape.dashboard.cname.dns.type].credentials || [] ))
    - - optionalfield
      - terminals
      - - and
        - - mapfield
          - active
          - - type
            - bool
        - - optionalfield
          - cert
          - - and
            - - optionalfield
              - email
              - - match
                - (( validation.email_regex ))
            - - optionalfield
              - server
            - - optionalfield
              - privateKey
              - privatekey
  dashboard_no_seed_strategy_validator: (( |db|-> [! defined( db.frontendConfig.seedCandidateDeterminationStrategy ), "valid", "the 'frontendConfig.seedCandidateDeterminationStrategy' value for the dashboard is derived from the Gardener config and cannot be set here - set 'landscape.gardener.seedCandidateDeterminationStrategy' instead"] ))
  dashboard_terminals_validator: (( |db,cm|-> [! (( db.terminals.active || false ) -and ( cm.server.url == "self-signed" -or cm.server.url == "staging" )), "valid", "the 'dashboard terminals' feature requires trusted certificates, please configure the cert-manager accordingly"] ))
  networks:
    - and
    - ["mapfield", "nodes", "cidr"]
    - ["mapfield", "pods", "cidr"]
    - ["mapfield", "services", "cidr"]
  cert-manager_validators:
    basic:
      - and
      - - optionalfield
        - email
        - - match
          - (( validation.email_regex ))
      - - mapfield
        - server
        - - and
          - - mapfield
            - url
            - - or
              - ["valueset", ["self-signed", "staging", "live"]]
              - dnsdomain
          - - optionalfield
            - ca
            - ["and", [(( cert-manager_validators.selfsigned )), (( landscape.cert-manager.server.url ))], [(( cert-manager_validators.acme )), (( landscape.cert-manager.server.url ))]]
      - - optionalfield
        - privateKey
        - privatekey
    selfsigned: (( |ca,url|-> [url == "self-signed" ? valid( ca.crt ) -and valid( ca.key ) :true, "valid", "if 'landscape.cert-manager.server.url' is set to 'self-signed', you should either specify a CA with key ('server.ca.crt' and 'server.ca.key' set), or no CA at all ('server.ca' node not present)"] ))
    acme: (( |ca,url|-> [url != "self-signed" ? valid( ca.crt ) -and ( ! defined( ca.key ) ) :true, "if 'landscape.cert-manager.server.url' is not set to 'self-signed', you should either specify a CA without key ('server.ca.crt' set, no 'server.ca.key'), or the 'server.ca' node should not be present at all"] ))
    email: (( |ca,id|-> [valid( ca.email ) -or valid( id.users[0].email ), "either 'landscape.cert-manager.email' or 'landscape.identity.users[0].email' needs to be set"] ))
  identity_validator:
    - and
    - - optionalfield
      - users
      - - list
        - - and
          - - mapfield
            - email
            - - match
              - (( validation.email_regex ))
          - - mapfield
            - username
          - - or
            - ["mapfield", "password"]
            - ["mapfield", "hash"]
    - - optionalfield
      - connectors
      - - list
        - - and
          - ["mapfield", "type"]
          - ["mapfield", "id"]
          - ["mapfield", "name"]
    - ["optionalfield", "allowProjectCreationForAll", ["type", "bool"]]
    - ["optionalfield", "useIdentityDomain", ["type", "bool"]]


  ### VALIDATIONS ###
  # structure resembles structure of landscape where possible
  ##### landscape.name
  name: (( validate( landscape.name, "dnslabel" ) ))
  ##### landscape.domain
  domain: (( validate( landscape.domain, "dnsdomain" ) ))
  ##### landscape.cluster.networks
  cluster:
    networks: (( validate( landscape.clusters[0].networks, validation.networks ) ))
  ##### landscape.iaas
  iaas:
    basic: (( map[landscape.iaas|entry|-> validate( entry, validation.instantiate_validator(entry, iaas_entry_validators.basic) )] ))
    initial_seed: (( validate( landscape.iaas[0], validation.instantiate_validator(landscape.iaas[0], iaas_entry_validators.initial_seed) ) ))
    seed_soil: (( map[select[landscape.iaas.[1..]|elem|-> elem.mode == "seed" -or elem.mode == "soil"]|id,entry|-> validate( entry, validation.instantiate_validator(entry, iaas_entry_validators.seed) )] ))
    cloudprofile: (( map[select[landscape.iaas landscape.iaas_shooted_seeds|elem|-> ! valid( elem.cloudprofile )]|id,entry|-> validate( entry, validation.instantiate_validator(entry, iaas_entry_validators.cloudprofile) )] ))
    shooted_seed: (( map[validation.flatten( select[select[landscape.iaas|elem|-> elem.mode == "seed" -or elem.mode == "soil"]|elem|-> valid( elem.seeds )].[*].seeds ) |entry|-> validate( entry, validation.instantiate_validator(entry, iaas_entry_validators.basic), validation.instantiate_validator(entry, iaas_entry_validators.shooted_seed) )] ))
  ##### landscape.etcd
  etcd:
    backup_active: (( validate( landscape.etcd.backup.active, ["type", "bool"] ) ))
    backup: (( landscape.etcd.backup.active == true ? validate( landscape.etcd.backup, [ "and", validation.instantiate_validator( landscape.etcd.backup, validation.types.backup_config ), validation.types.etcd_backup[landscape.etcd.backup.type].config ] ) :~~ ))
  ##### landscape.dns
  dns:
    type: (( validate( landscape.dns, ["mapfield", "type", ["valueset", keys( types.dns )]] ) ))
    hostedZoneIDs: (( validate( landscape.dns, ["optionalfield", "hostedZoneIDs", ["map", ["valueset", ["include", "exclude"]], "list"]] ) ))
    provider_config: (( validate( landscape.dns, types.dns[landscape.dns.type].config ) ))
    credentials: (( validate( landscape.dns, ["mapfield", "credentials", types.dns[landscape.dns.type].credentials] ) ))
  ##### landscape.gardener
  gardener:
    seedCandidateDeterminationStrategy: (( defined( landscape.gardener.seedCandidateDeterminationStrategy ) ? validate( landscape.gardener, ["optionalfield", "seedCandidateDeterminationStrategy", ["valueset", ["SameRegion", "MinimalDistance"]]] ) :~~ ))
    network-policies: (( defined( landscape.gardener.network-policies ) ? validate( landscape.gardener.network-policies, ["optionalfield", "active", ["type", "bool"]] ) :~~ ))
    extensions: (( defined( landscape.gardener.extensions ) ? validate( keys( landscape.gardener.extensions ), ["list", ["valueset", keys( landscape.versions.gardener.extensions )]] ) :~~ ))
    shootDomainPrefix: (( defined( landscape.gardener.shootDomainPrefix ) ? validate( landscape.gardener, ["optionalfield", "shootDomainPrefix", "dnslabel"] ) :~~ ))
  ##### landscape.dashboard
  dashboard: (( defined( landscape.dashboard ) ? validate( landscape.dashboard, validation.dashboard_validator, validation.dashboard_no_seed_strategy_validator, [validation.dashboard_terminals_validator, landscape.cert-manager] ) :~~ ))
  ##### landscape.certmanager
  cert-manager: (( validate( landscape.cert-manager, validation.cert-manager_validators.basic, [validation.cert-manager_validators.email, landscape.identity] ) ))
  ##### landscape.identity TODO
  identity:
    identityspec: (( |id|-> [valid( id.users || id.connectors ), "valid", "identity config needs to contain either 'users' or 'connectors' (or both)"] ))
    validator: (( validate( landscape.identity, identityspec, validation.identity_validator ) ))