feat: Add mosquitto-MQTT Chart (#39)

* feat: Add mosquitto-MQTT Chart

* fix:linting issue

* fix:linting issue

* fix:linting issue

* fix:linting issue

* fix:linting issue

* fix:linting issue

* fix:linting issue

* fix:linting issue

* fix:linting issue

charts/mosquitto-mqtt/.helmignore

@@ -0,0 +1,30 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+# OWNERS file for Kubernetes
+OWNERS
+# helm-docs templates
+*.gotmpl
+# docs folder
+/docs
+# icon
+icon.png

charts/mosquitto-mqtt/Chart.yaml

@@ -0,0 +1,24 @@
+annotations:
+  truecharts.org/SCALE-support: "true"
+  truecharts.org/catagories: |
+    - homeautomation
+  truecharts.org/grade: U
+apiVersion: v2
+appVersion: 2.0.15
+dependencies:
+- name: common
+  version: 11.1.2
+description: Eclipse Mosquitto - An open source MQTT broker
+keywords:
+- mosquitto
+- MQTT
+- eclipse-iot
+kubeVersion: '>=1.16.0-0'
+maintainers:
+  - name: improwised
+name: mosquitto
+sources:
+- https://github.com/truecharts/charts/tree/master/charts/stable/mosquitto
+- https://github.com/eclipse/mosquitto
+type: application
+version: 8.0.12

charts/mosquitto-mqtt/README.md

@@ -0,0 +1,12 @@
+# README
+
+## General Info
+
+TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE.
+However only installations using the TrueNAS SCALE Apps system are supported.
+
+## Reference
+
+[website](https://truecharts.org/charts/stable/)
+
+

charts/mosquitto-mqtt/charts/common/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/mosquitto-mqtt/charts/common/Chart.yaml

@@ -0,0 +1,17 @@
+apiVersion: v2
+appVersion: latest
+description: Function library for TrueCharts
+home: https://github.com/truecharts/apps/tree/master/charts/common
+icon: https://avatars.githubusercontent.com/u/76400755
+keywords:
+- truecharts
+- library-chart
+- common
+kubeVersion: '>=1.16.0-0'
+maintainers:
+- email: info@truecharts.org
+  name: TrueCharts
+  url: https://truecharts.org
+name: common
+type: library
+version: 11.1.2

charts/mosquitto-mqtt/charts/common/crds/ingressroute.yaml

@@ -0,0 +1,267 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.6.2
+  creationTimestamp: null
+  name: ingressroutes.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  names:
+    kind: IngressRoute
+    listKind: IngressRouteList
+    plural: ingressroutes
+    singular: ingressroute
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: IngressRoute is the CRD implementation of a Traefik HTTP Router.
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: IngressRouteSpec defines the desired state of IngressRoute.
+            properties:
+              entryPoints:
+                description: 'EntryPoints defines the list of entry point names to
+                  bind to. Entry points have to be configured in the static configuration.
+                  More info: https://doc.traefik.io/traefik/v2.9/routing/entrypoints/
+                  Default: all.'
+                items:
+                  type: string
+                type: array
+              routes:
+                description: Routes defines the list of routes.
+                items:
+                  description: Route holds the HTTP route configuration.
+                  properties:
+                    kind:
+                      description: Kind defines the kind of the route. Rule is the
+                        only supported kind.
+                      enum:
+                      - Rule
+                      type: string
+                    match:
+                      description: 'Match defines the router''s rule. More info: https://doc.traefik.io/traefik/v2.9/routing/routers/#rule'
+                      type: string
+                    middlewares:
+                      description: 'Middlewares defines the list of references to
+                        Middleware resources. More info: https://doc.traefik.io/traefik/v2.9/routing/providers/kubernetes-crd/#kind-middleware'
+                      items:
+                        description: MiddlewareRef is a reference to a Middleware
+                          resource.
+                        properties:
+                          name:
+                            description: Name defines the name of the referenced Middleware
+                              resource.
+                            type: string
+                          namespace:
+                            description: Namespace defines the namespace of the referenced
+                              Middleware resource.
+                            type: string
+                        required:
+                        - name
+                        type: object
+                      type: array
+                    priority:
+                      description: 'Priority defines the router''s priority. More
+                        info: https://doc.traefik.io/traefik/v2.9/routing/routers/#priority'
+                      type: integer
+                    services:
+                      description: Services defines the list of Service. It can contain
+                        any combination of TraefikService and/or reference to a Kubernetes
+                        Service.
+                      items:
+                        description: Service defines an upstream HTTP service to proxy
+                          traffic to.
+                        properties:
+                          kind:
+                            description: Kind defines the kind of the Service.
+                            enum:
+                            - Service
+                            - TraefikService
+                            type: string
+                          name:
+                            description: Name defines the name of the referenced Kubernetes
+                              Service or TraefikService. The differentiation between
+                              the two is specified in the Kind field.
+                            type: string
+                          namespace:
+                            description: Namespace defines the namespace of the referenced
+                              Kubernetes Service or TraefikService.
+                            type: string
+                          passHostHeader:
+                            description: PassHostHeader defines whether the client
+                              Host header is forwarded to the upstream Kubernetes
+                              Service. By default, passHostHeader is true.
+                            type: boolean
+                          port:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            description: Port defines the port of a Kubernetes Service.
+                              This can be a reference to a named port.
+                            x-kubernetes-int-or-string: true
+                          responseForwarding:
+                            description: ResponseForwarding defines how Traefik forwards
+                              the response from the upstream Kubernetes Service to
+                              the client.
+                            properties:
+                              flushInterval:
+                                description: 'FlushInterval defines the interval,
+                                  in milliseconds, in between flushes to the client
+                                  while copying the response body. A negative value
+                                  means to flush immediately after each write to the
+                                  client. This configuration is ignored when ReverseProxy
+                                  recognizes a response as a streaming response; for
+                                  such responses, writes are flushed to the client
+                                  immediately. Default: 100ms'
+                                type: string
+                            type: object
+                          scheme:
+                            description: Scheme defines the scheme to use for the
+                              request to the upstream Kubernetes Service. It defaults
+                              to https when Kubernetes Service port is 443, http otherwise.
+                            type: string
+                          serversTransport:
+                            description: ServersTransport defines the name of ServersTransport
+                              resource to use. It allows to configure the transport
+                              between Traefik and your servers. Can only be used on
+                              a Kubernetes Service.
+                            type: string
+                          sticky:
+                            description: 'Sticky defines the sticky sessions configuration.
+                              More info: https://doc.traefik.io/traefik/v2.9/routing/services/#sticky-sessions'
+                            properties:
+                              cookie:
+                                description: Cookie defines the sticky cookie configuration.
+                                properties:
+                                  httpOnly:
+                                    description: HTTPOnly defines whether the cookie
+                                      can be accessed by client-side APIs, such as
+                                      JavaScript.
+                                    type: boolean
+                                  name:
+                                    description: Name defines the Cookie name.
+                                    type: string
+                                  sameSite:
+                                    description: 'SameSite defines the same site policy.
+                                      More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
+                                    type: string
+                                  secure:
+                                    description: Secure defines whether the cookie
+                                      can only be transmitted over an encrypted connection
+                                      (i.e. HTTPS).
+                                    type: boolean
+                                type: object
+                            type: object
+                          strategy:
+                            description: Strategy defines the load balancing strategy
+                              between the servers. RoundRobin is the only supported
+                              value at the moment.
+                            type: string
+                          weight:
+                            description: Weight defines the weight and should only
+                              be specified when Name references a TraefikService object
+                              (and to be precise, one that embeds a Weighted Round
+                              Robin).
+                            type: integer
+                        required:
+                        - name
+                        type: object
+                      type: array
+                  required:
+                  - kind
+                  - match
+                  type: object
+                type: array
+              tls:
+                description: 'TLS defines the TLS configuration. More info: https://doc.traefik.io/traefik/v2.9/routing/routers/#tls'
+                properties:
+                  certResolver:
+                    description: 'CertResolver defines the name of the certificate
+                      resolver to use. Cert resolvers have to be configured in the
+                      static configuration. More info: https://doc.traefik.io/traefik/v2.9/https/acme/#certificate-resolvers'
+                    type: string
+                  domains:
+                    description: 'Domains defines the list of domains that will be
+                      used to issue certificates. More info: https://doc.traefik.io/traefik/v2.9/routing/routers/#domains'
+                    items:
+                      description: Domain holds a domain name with SANs.
+                      properties:
+                        main:
+                          description: Main defines the main domain name.
+                          type: string
+                        sans:
+                          description: SANs defines the subject alternative domain
+                            names.
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                    type: array
+                  options:
+                    description: 'Options defines the reference to a TLSOption, that
+                      specifies the parameters of the TLS connection. If not defined,
+                      the `default` TLSOption is used. More info: https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options'
+                    properties:
+                      name:
+                        description: 'Name defines the name of the referenced TLSOption.
+                          More info: https://doc.traefik.io/traefik/v2.9/routing/providers/kubernetes-crd/#kind-tlsoption'
+                        type: string
+                      namespace:
+                        description: 'Namespace defines the namespace of the referenced
+                          TLSOption. More info: https://doc.traefik.io/traefik/v2.9/routing/providers/kubernetes-crd/#kind-tlsoption'
+                        type: string
+                    required:
+                    - name
+                    type: object
+                  secretName:
+                    description: SecretName is the name of the referenced Kubernetes
+                      Secret to specify the certificate details.
+                    type: string
+                  store:
+                    description: Store defines the reference to the TLSStore, that
+                      will be used to store certificates. Please note that only `default`
+                      TLSStore can be used.
+                    properties:
+                      name:
+                        description: 'Name defines the name of the referenced TLSStore.
+                          More info: https://doc.traefik.io/traefik/v2.9/routing/providers/kubernetes-crd/#kind-tlsstore'
+                        type: string
+                      namespace:
+                        description: 'Namespace defines the namespace of the referenced
+                          TLSStore. More info: https://doc.traefik.io/traefik/v2.9/routing/providers/kubernetes-crd/#kind-tlsstore'
+                        type: string
+                    required:
+                    - name
+                    type: object
+                type: object
+            required:
+            - routes
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

charts/mosquitto-mqtt/charts/common/crds/ingressroutetcp.yaml

@@ -0,0 +1,211 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.6.2
+  creationTimestamp: null
+  name: ingressroutetcps.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  names:
+    kind: IngressRouteTCP
+    listKind: IngressRouteTCPList
+    plural: ingressroutetcps
+    singular: ingressroutetcp
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: IngressRouteTCP is the CRD implementation of a Traefik TCP Router.
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: IngressRouteTCPSpec defines the desired state of IngressRouteTCP.
+            properties:
+              entryPoints:
+                description: 'EntryPoints defines the list of entry point names to
+                  bind to. Entry points have to be configured in the static configuration.
+                  More info: https://doc.traefik.io/traefik/v2.9/routing/entrypoints/
+                  Default: all.'
+                items:
+                  type: string
+                type: array
+              routes:
+                description: Routes defines the list of routes.
+                items:
+                  description: RouteTCP holds the TCP route configuration.
+                  properties:
+                    match:
+                      description: 'Match defines the router''s rule. More info: https://doc.traefik.io/traefik/v2.9/routing/routers/#rule_1'
+                      type: string
+                    middlewares:
+                      description: Middlewares defines the list of references to MiddlewareTCP
+                        resources.
+                      items:
+                        description: ObjectReference is a generic reference to a Traefik
+                          resource.
+                        properties:
+                          name:
+                            description: Name defines the name of the referenced Traefik
+                              resource.
+                            type: string
+                          namespace:
+                            description: Namespace defines the namespace of the referenced
+                              Traefik resource.
+                            type: string
+                        required:
+                        - name
+                        type: object
+                      type: array
+                    priority:
+                      description: 'Priority defines the router''s priority. More
+                        info: https://doc.traefik.io/traefik/v2.9/routing/routers/#priority_1'
+                      type: integer
+                    services:
+                      description: Services defines the list of TCP services.
+                      items:
+                        description: ServiceTCP defines an upstream TCP service to
+                          proxy traffic to.
+                        properties:
+                          name:
+                            description: Name defines the name of the referenced Kubernetes
+                              Service.
+                            type: string
+                          namespace:
+                            description: Namespace defines the namespace of the referenced
+                              Kubernetes Service.
+                            type: string
+                          port:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            description: Port defines the port of a Kubernetes Service.
+                              This can be a reference to a named port.
+                            x-kubernetes-int-or-string: true
+                          proxyProtocol:
+                            description: 'ProxyProtocol defines the PROXY protocol
+                              configuration. More info: https://doc.traefik.io/traefik/v2.9/routing/services/#proxy-protocol'
+                            properties:
+                              version:
+                                description: Version defines the PROXY Protocol version
+                                  to use.
+                                type: integer
+                            type: object
+                          terminationDelay:
+                            description: TerminationDelay defines the deadline that
+                              the proxy sets, after one of its connected peers indicates
+                              it has closed the writing capability of its connection,
+                              to close the reading capability as well, hence fully
+                              terminating the connection. It is a duration in milliseconds,
+                              defaulting to 100. A negative value means an infinite
+                              deadline (i.e. the reading capability is never closed).
+                            type: integer
+                          weight:
+                            description: Weight defines the weight used when balancing
+                              requests between multiple Kubernetes Service.
+                            type: integer
+                        required:
+                        - name
+                        - port
+                        type: object
+                      type: array
+                  required:
+                  - match
+                  type: object
+                type: array
+              tls:
+                description: 'TLS defines the TLS configuration on a layer 4 / TCP
+                  Route. More info: https://doc.traefik.io/traefik/v2.9/routing/routers/#tls_1'
+                properties:
+                  certResolver:
+                    description: 'CertResolver defines the name of the certificate
+                      resolver to use. Cert resolvers have to be configured in the
+                      static configuration. More info: https://doc.traefik.io/traefik/v2.9/https/acme/#certificate-resolvers'
+                    type: string
+                  domains:
+                    description: 'Domains defines the list of domains that will be
+                      used to issue certificates. More info: https://doc.traefik.io/traefik/v2.9/routing/routers/#domains'
+                    items:
+                      description: Domain holds a domain name with SANs.
+                      properties:
+                        main:
+                          description: Main defines the main domain name.
+                          type: string
+                        sans:
+                          description: SANs defines the subject alternative domain
+                            names.
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                    type: array
+                  options:
+                    description: 'Options defines the reference to a TLSOption, that
+                      specifies the parameters of the TLS connection. If not defined,
+                      the `default` TLSOption is used. More info: https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options'
+                    properties:
+                      name:
+                        description: Name defines the name of the referenced Traefik
+                          resource.
+                        type: string
+                      namespace:
+                        description: Namespace defines the namespace of the referenced
+                          Traefik resource.
+                        type: string
+                    required:
+                    - name
+                    type: object
+                  passthrough:
+                    description: Passthrough defines whether a TLS router will terminate
+                      the TLS connection.
+                    type: boolean
+                  secretName:
+                    description: SecretName is the name of the referenced Kubernetes
+                      Secret to specify the certificate details.
+                    type: string
+                  store:
+                    description: Store defines the reference to the TLSStore, that
+                      will be used to store certificates. Please note that only `default`
+                      TLSStore can be used.
+                    properties:
+                      name:
+                        description: Name defines the name of the referenced Traefik
+                          resource.
+                        type: string
+                      namespace:
+                        description: Namespace defines the namespace of the referenced
+                          Traefik resource.
+                        type: string
+                    required:
+                    - name
+                    type: object
+                type: object
+            required:
+            - routes
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

charts/mosquitto-mqtt/charts/common/crds/ingressrouteudp.yaml

@@ -0,0 +1,98 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.6.2
+  creationTimestamp: null
+  name: ingressrouteudps.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  names:
+    kind: IngressRouteUDP
+    listKind: IngressRouteUDPList
+    plural: ingressrouteudps
+    singular: ingressrouteudp
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: IngressRouteUDP is a CRD implementation of a Traefik UDP Router.
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: IngressRouteUDPSpec defines the desired state of a IngressRouteUDP.
+            properties:
+              entryPoints:
+                description: 'EntryPoints defines the list of entry point names to
+                  bind to. Entry points have to be configured in the static configuration.
+                  More info: https://doc.traefik.io/traefik/v2.9/routing/entrypoints/
+                  Default: all.'
+                items:
+                  type: string
+                type: array
+              routes:
+                description: Routes defines the list of routes.
+                items:
+                  description: RouteUDP holds the UDP route configuration.
+                  properties:
+                    services:
+                      description: Services defines the list of UDP services.
+                      items:
+                        description: ServiceUDP defines an upstream UDP service to
+                          proxy traffic to.
+                        properties:
+                          name:
+                            description: Name defines the name of the referenced Kubernetes
+                              Service.
+                            type: string
+                          namespace:
+                            description: Namespace defines the namespace of the referenced
+                              Kubernetes Service.
+                            type: string
+                          port:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            description: Port defines the port of a Kubernetes Service.
+                              This can be a reference to a named port.
+                            x-kubernetes-int-or-string: true
+                          weight:
+                            description: Weight defines the weight used when balancing
+                              requests between multiple Kubernetes Service.
+                            type: integer
+                        required:
+                        - name
+                        - port
+                        type: object
+                      type: array
+                  type: object
+                type: array
+            required:
+            - routes
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

charts/mosquitto-mqtt/charts/common/crds/middlewares.yaml

@@ -0,0 +1,917 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.6.2
+  creationTimestamp: null
+  name: middlewares.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  names:
+    kind: Middleware
+    listKind: MiddlewareList
+    plural: middlewares
+    singular: middleware
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: 'Middleware is the CRD implementation of a Traefik Middleware.
+          More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/overview/'
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: MiddlewareSpec defines the desired state of a Middleware.
+            properties:
+              addPrefix:
+                description: 'AddPrefix holds the add prefix middleware configuration.
+                  This middleware updates the path of a request before forwarding
+                  it. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/addprefix/'
+                properties:
+                  prefix:
+                    description: Prefix is the string to add before the current path
+                      in the requested URL. It should include a leading slash (/).
+                    type: string
+                type: object
+              basicAuth:
+                description: 'BasicAuth holds the basic auth middleware configuration.
+                  This middleware restricts access to your services to known users.
+                  More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/basicauth/'
+                properties:
+                  headerField:
+                    description: 'HeaderField defines a header field to store the
+                      authenticated user. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/basicauth/#headerfield'
+                    type: string
+                  realm:
+                    description: 'Realm allows the protected resources on a server
+                      to be partitioned into a set of protection spaces, each with
+                      its own authentication scheme. Default: traefik.'
+                    type: string
+                  removeHeader:
+                    description: 'RemoveHeader sets the removeHeader option to true
+                      to remove the authorization header before forwarding the request
+                      to your service. Default: false.'
+                    type: boolean
+                  secret:
+                    description: Secret is the name of the referenced Kubernetes Secret
+                      containing user credentials.
+                    type: string
+                type: object
+              buffering:
+                description: 'Buffering holds the buffering middleware configuration.
+                  This middleware retries or limits the size of requests that can
+                  be forwarded to backends. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/buffering/#maxrequestbodybytes'
+                properties:
+                  maxRequestBodyBytes:
+                    description: 'MaxRequestBodyBytes defines the maximum allowed
+                      body size for the request (in bytes). If the request exceeds
+                      the allowed size, it is not forwarded to the service, and the
+                      client gets a 413 (Request Entity Too Large) response. Default:
+                      0 (no maximum).'
+                    format: int64
+                    type: integer
+                  maxResponseBodyBytes:
+                    description: 'MaxResponseBodyBytes defines the maximum allowed
+                      response size from the service (in bytes). If the response exceeds
+                      the allowed size, it is not forwarded to the client. The client
+                      gets a 500 (Internal Server Error) response instead. Default:
+                      0 (no maximum).'
+                    format: int64
+                    type: integer
+                  memRequestBodyBytes:
+                    description: 'MemRequestBodyBytes defines the threshold (in bytes)
+                      from which the request will be buffered on disk instead of in
+                      memory. Default: 1048576 (1Mi).'
+                    format: int64
+                    type: integer
+                  memResponseBodyBytes:
+                    description: 'MemResponseBodyBytes defines the threshold (in bytes)
+                      from which the response will be buffered on disk instead of
+                      in memory. Default: 1048576 (1Mi).'
+                    format: int64
+                    type: integer
+                  retryExpression:
+                    description: 'RetryExpression defines the retry conditions. It
+                      is a logical combination of functions with operators AND (&&)
+                      and OR (||). More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/buffering/#retryexpression'
+                    type: string
+                type: object
+              chain:
+                description: 'Chain holds the configuration of the chain middleware.
+                  This middleware enables to define reusable combinations of other
+                  pieces of middleware. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/chain/'
+                properties:
+                  middlewares:
+                    description: Middlewares is the list of MiddlewareRef which composes
+                      the chain.
+                    items:
+                      description: MiddlewareRef is a reference to a Middleware resource.
+                      properties:
+                        name:
+                          description: Name defines the name of the referenced Middleware
+                            resource.
+                          type: string
+                        namespace:
+                          description: Namespace defines the namespace of the referenced
+                            Middleware resource.
+                          type: string
+                      required:
+                      - name
+                      type: object
+                    type: array
+                type: object
+              circuitBreaker:
+                description: CircuitBreaker holds the circuit breaker configuration.
+                properties:
+                  checkPeriod:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    description: CheckPeriod is the interval between successive checks
+                      of the circuit breaker condition (when in standby state).
+                    x-kubernetes-int-or-string: true
+                  expression:
+                    description: Expression is the condition that triggers the tripped
+                      state.
+                    type: string
+                  fallbackDuration:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    description: FallbackDuration is the duration for which the circuit
+                      breaker will wait before trying to recover (from a tripped state).
+                    x-kubernetes-int-or-string: true
+                  recoveryDuration:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    description: RecoveryDuration is the duration for which the circuit
+                      breaker will try to recover (as soon as it is in recovering
+                      state).
+                    x-kubernetes-int-or-string: true
+                type: object
+              compress:
+                description: 'Compress holds the compress middleware configuration.
+                  This middleware compresses responses before sending them to the
+                  client, using gzip compression. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/compress/'
+                properties:
+                  excludedContentTypes:
+                    description: ExcludedContentTypes defines the list of content
+                      types to compare the Content-Type header of the incoming requests
+                      and responses before compressing.
+                    items:
+                      type: string
+                    type: array
+                  minResponseBodyBytes:
+                    description: 'MinResponseBodyBytes defines the minimum amount
+                      of bytes a response body must have to be compressed. Default:
+                      1024.'
+                    type: integer
+                type: object
+              contentType:
+                description: ContentType holds the content-type middleware configuration.
+                  This middleware exists to enable the correct behavior until at least
+                  the default one can be changed in a future version.
+                properties:
+                  autoDetect:
+                    description: AutoDetect specifies whether to let the `Content-Type`
+                      header, if it has not been set by the backend, be automatically
+                      set to a value derived from the contents of the response. As
+                      a proxy, the default behavior should be to leave the header
+                      alone, regardless of what the backend did with it. However,
+                      the historic default was to always auto-detect and set the header
+                      if it was nil, and it is going to be kept that way in order
+                      to support users currently relying on it.
+                    type: boolean
+                type: object
+              digestAuth:
+                description: 'DigestAuth holds the digest auth middleware configuration.
+                  This middleware restricts access to your services to known users.
+                  More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/digestauth/'
+                properties:
+                  headerField:
+                    description: 'HeaderField defines a header field to store the
+                      authenticated user. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/basicauth/#headerfield'
+                    type: string
+                  realm:
+                    description: 'Realm allows the protected resources on a server
+                      to be partitioned into a set of protection spaces, each with
+                      its own authentication scheme. Default: traefik.'
+                    type: string
+                  removeHeader:
+                    description: RemoveHeader defines whether to remove the authorization
+                      header before forwarding the request to the backend.
+                    type: boolean
+                  secret:
+                    description: Secret is the name of the referenced Kubernetes Secret
+                      containing user credentials.
+                    type: string
+                type: object
+              errors:
+                description: 'ErrorPage holds the custom error middleware configuration.
+                  This middleware returns a custom page in lieu of the default, according
+                  to configured ranges of HTTP Status codes. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/errorpages/'
+                properties:
+                  query:
+                    description: Query defines the URL for the error page (hosted
+                      by service). The {status} variable can be used in order to insert
+                      the status code in the URL.
+                    type: string
+                  service:
+                    description: 'Service defines the reference to a Kubernetes Service
+                      that will serve the error page. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/errorpages/#service'
+                    properties:
+                      kind:
+                        description: Kind defines the kind of the Service.
+                        enum:
+                        - Service
+                        - TraefikService
+                        type: string
+                      name:
+                        description: Name defines the name of the referenced Kubernetes
+                          Service or TraefikService. The differentiation between the
+                          two is specified in the Kind field.
+                        type: string
+                      namespace:
+                        description: Namespace defines the namespace of the referenced
+                          Kubernetes Service or TraefikService.
+                        type: string
+                      passHostHeader:
+                        description: PassHostHeader defines whether the client Host
+                          header is forwarded to the upstream Kubernetes Service.
+                          By default, passHostHeader is true.
+                        type: boolean
+                      port:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        description: Port defines the port of a Kubernetes Service.
+                          This can be a reference to a named port.
+                        x-kubernetes-int-or-string: true
+                      responseForwarding:
+                        description: ResponseForwarding defines how Traefik forwards
+                          the response from the upstream Kubernetes Service to the
+                          client.
+                        properties:
+                          flushInterval:
+                            description: 'FlushInterval defines the interval, in milliseconds,
+                              in between flushes to the client while copying the response
+                              body. A negative value means to flush immediately after
+                              each write to the client. This configuration is ignored
+                              when ReverseProxy recognizes a response as a streaming
+                              response; for such responses, writes are flushed to
+                              the client immediately. Default: 100ms'
+                            type: string
+                        type: object
+                      scheme:
+                        description: Scheme defines the scheme to use for the request
+                          to the upstream Kubernetes Service. It defaults to https
+                          when Kubernetes Service port is 443, http otherwise.
+                        type: string
+                      serversTransport:
+                        description: ServersTransport defines the name of ServersTransport
+                          resource to use. It allows to configure the transport between
+                          Traefik and your servers. Can only be used on a Kubernetes
+                          Service.
+                        type: string
+                      sticky:
+                        description: 'Sticky defines the sticky sessions configuration.
+                          More info: https://doc.traefik.io/traefik/v2.9/routing/services/#sticky-sessions'
+                        properties:
+                          cookie:
+                            description: Cookie defines the sticky cookie configuration.
+                            properties:
+                              httpOnly:
+                                description: HTTPOnly defines whether the cookie can
+                                  be accessed by client-side APIs, such as JavaScript.
+                                type: boolean
+                              name:
+                                description: Name defines the Cookie name.
+                                type: string
+                              sameSite:
+                                description: 'SameSite defines the same site policy.
+                                  More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
+                                type: string
+                              secure:
+                                description: Secure defines whether the cookie can
+                                  only be transmitted over an encrypted connection
+                                  (i.e. HTTPS).
+                                type: boolean
+                            type: object
+                        type: object
+                      strategy:
+                        description: Strategy defines the load balancing strategy
+                          between the servers. RoundRobin is the only supported value
+                          at the moment.
+                        type: string
+                      weight:
+                        description: Weight defines the weight and should only be
+                          specified when Name references a TraefikService object (and
+                          to be precise, one that embeds a Weighted Round Robin).
+                        type: integer
+                    required:
+                    - name
+                    type: object
+                  status:
+                    description: Status defines which status or range of statuses
+                      should result in an error page. It can be either a status code
+                      as a number (500), as multiple comma-separated numbers (500,502),
+                      as ranges by separating two codes with a dash (500-599), or
+                      a combination of the two (404,418,500-599).
+                    items:
+                      type: string
+                    type: array
+                type: object
+              forwardAuth:
+                description: 'ForwardAuth holds the forward auth middleware configuration.
+                  This middleware delegates the request authentication to a Service.
+                  More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/forwardauth/'
+                properties:
+                  address:
+                    description: Address defines the authentication server address.
+                    type: string
+                  authRequestHeaders:
+                    description: AuthRequestHeaders defines the list of the headers
+                      to copy from the request to the authentication server. If not
+                      set or empty then all request headers are passed.
+                    items:
+                      type: string
+                    type: array
+                  authResponseHeaders:
+                    description: AuthResponseHeaders defines the list of headers to
+                      copy from the authentication server response and set on forwarded
+                      request, replacing any existing conflicting headers.
+                    items:
+                      type: string
+                    type: array
+                  authResponseHeadersRegex:
+                    description: 'AuthResponseHeadersRegex defines the regex to match
+                      headers to copy from the authentication server response and
+                      set on forwarded request, after stripping all headers that match
+                      the regex. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/forwardauth/#authresponseheadersregex'
+                    type: string
+                  tls:
+                    description: TLS defines the configuration used to secure the
+                      connection to the authentication server.
+                    properties:
+                      caOptional:
+                        type: boolean
+                      caSecret:
+                        description: CASecret is the name of the referenced Kubernetes
+                          Secret containing the CA to validate the server certificate.
+                          The CA certificate is extracted from key `tls.ca` or `ca.crt`.
+                        type: string
+                      certSecret:
+                        description: CertSecret is the name of the referenced Kubernetes
+                          Secret containing the client certificate. The client certificate
+                          is extracted from the keys `tls.crt` and `tls.key`.
+                        type: string
+                      insecureSkipVerify:
+                        description: InsecureSkipVerify defines whether the server
+                          certificates should be validated.
+                        type: boolean
+                    type: object
+                  trustForwardHeader:
+                    description: 'TrustForwardHeader defines whether to trust (ie:
+                      forward) all X-Forwarded-* headers.'
+                    type: boolean
+                type: object
+              headers:
+                description: 'Headers holds the headers middleware configuration.
+                  This middleware manages the requests and responses headers. More
+                  info: https://doc.traefik.io/traefik/v2.9/middlewares/http/headers/#customrequestheaders'
+                properties:
+                  accessControlAllowCredentials:
+                    description: AccessControlAllowCredentials defines whether the
+                      request can include user credentials.
+                    type: boolean
+                  accessControlAllowHeaders:
+                    description: AccessControlAllowHeaders defines the Access-Control-Request-Headers
+                      values sent in preflight response.
+                    items:
+                      type: string
+                    type: array
+                  accessControlAllowMethods:
+                    description: AccessControlAllowMethods defines the Access-Control-Request-Method
+                      values sent in preflight response.
+                    items:
+                      type: string
+                    type: array
+                  accessControlAllowOriginList:
+                    description: AccessControlAllowOriginList is a list of allowable
+                      origins. Can also be a wildcard origin "*".
+                    items:
+                      type: string
+                    type: array
+                  accessControlAllowOriginListRegex:
+                    description: AccessControlAllowOriginListRegex is a list of allowable
+                      origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).
+                    items:
+                      type: string
+                    type: array
+                  accessControlExposeHeaders:
+                    description: AccessControlExposeHeaders defines the Access-Control-Expose-Headers
+                      values sent in preflight response.
+                    items:
+                      type: string
+                    type: array
+                  accessControlMaxAge:
+                    description: AccessControlMaxAge defines the time that a preflight
+                      request may be cached.
+                    format: int64
+                    type: integer
+                  addVaryHeader:
+                    description: AddVaryHeader defines whether the Vary header is
+                      automatically added/updated when the AccessControlAllowOriginList
+                      is set.
+                    type: boolean
+                  allowedHosts:
+                    description: AllowedHosts defines the fully qualified list of
+                      allowed domain names.
+                    items:
+                      type: string
+                    type: array
+                  browserXssFilter:
+                    description: BrowserXSSFilter defines whether to add the X-XSS-Protection
+                      header with the value 1; mode=block.
+                    type: boolean
+                  contentSecurityPolicy:
+                    description: ContentSecurityPolicy defines the Content-Security-Policy
+                      header value.
+                    type: string
+                  contentTypeNosniff:
+                    description: ContentTypeNosniff defines whether to add the X-Content-Type-Options
+                      header with the nosniff value.
+                    type: boolean
+                  customBrowserXSSValue:
+                    description: CustomBrowserXSSValue defines the X-XSS-Protection
+                      header value. This overrides the BrowserXssFilter option.
+                    type: string
+                  customFrameOptionsValue:
+                    description: CustomFrameOptionsValue defines the X-Frame-Options
+                      header value. This overrides the FrameDeny option.
+                    type: string
+                  customRequestHeaders:
+                    additionalProperties:
+                      type: string
+                    description: CustomRequestHeaders defines the header names and
+                      values to apply to the request.
+                    type: object
+                  customResponseHeaders:
+                    additionalProperties:
+                      type: string
+                    description: CustomResponseHeaders defines the header names and
+                      values to apply to the response.
+                    type: object
+                  featurePolicy:
+                    description: 'Deprecated: use PermissionsPolicy instead.'
+                    type: string
+                  forceSTSHeader:
+                    description: ForceSTSHeader defines whether to add the STS header
+                      even when the connection is HTTP.
+                    type: boolean
+                  frameDeny:
+                    description: FrameDeny defines whether to add the X-Frame-Options
+                      header with the DENY value.
+                    type: boolean
+                  hostsProxyHeaders:
+                    description: HostsProxyHeaders defines the header keys that may
+                      hold a proxied hostname value for the request.
+                    items:
+                      type: string
+                    type: array
+                  isDevelopment:
+                    description: IsDevelopment defines whether to mitigate the unwanted
+                      effects of the AllowedHosts, SSL, and STS options when developing.
+                      Usually testing takes place using HTTP, not HTTPS, and on localhost,
+                      not your production domain. If you would like your development
+                      environment to mimic production with complete Host blocking,
+                      SSL redirects, and STS headers, leave this as false.
+                    type: boolean
+                  permissionsPolicy:
+                    description: PermissionsPolicy defines the Permissions-Policy
+                      header value. This allows sites to control browser features.
+                    type: string
+                  publicKey:
+                    description: PublicKey is the public key that implements HPKP
+                      to prevent MITM attacks with forged certificates.
+                    type: string
+                  referrerPolicy:
+                    description: ReferrerPolicy defines the Referrer-Policy header
+                      value. This allows sites to control whether browsers forward
+                      the Referer header to other sites.
+                    type: string
+                  sslForceHost:
+                    description: 'Deprecated: use RedirectRegex instead.'
+                    type: boolean
+                  sslHost:
+                    description: 'Deprecated: use RedirectRegex instead.'
+                    type: string
+                  sslProxyHeaders:
+                    additionalProperties:
+                      type: string
+                    description: 'SSLProxyHeaders defines the header keys with associated
+                      values that would indicate a valid HTTPS request. It can be
+                      useful when using other proxies (example: "X-Forwarded-Proto":
+                      "https").'
+                    type: object
+                  sslRedirect:
+                    description: 'Deprecated: use EntryPoint redirection or RedirectScheme
+                      instead.'
+                    type: boolean
+                  sslTemporaryRedirect:
+                    description: 'Deprecated: use EntryPoint redirection or RedirectScheme
+                      instead.'
+                    type: boolean
+                  stsIncludeSubdomains:
+                    description: STSIncludeSubdomains defines whether the includeSubDomains
+                      directive is appended to the Strict-Transport-Security header.
+                    type: boolean
+                  stsPreload:
+                    description: STSPreload defines whether the preload flag is appended
+                      to the Strict-Transport-Security header.
+                    type: boolean
+                  stsSeconds:
+                    description: STSSeconds defines the max-age of the Strict-Transport-Security
+                      header. If set to 0, the header is not set.
+                    format: int64
+                    type: integer
+                type: object
+              inFlightReq:
+                description: 'InFlightReq holds the in-flight request middleware configuration.
+                  This middleware limits the number of requests being processed and
+                  served concurrently. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/inflightreq/'
+                properties:
+                  amount:
+                    description: Amount defines the maximum amount of allowed simultaneous
+                      in-flight request. The middleware responds with HTTP 429 Too
+                      Many Requests if there are already amount requests in progress
+                      (based on the same sourceCriterion strategy).
+                    format: int64
+                    type: integer
+                  sourceCriterion:
+                    description: 'SourceCriterion defines what criterion is used to
+                      group requests as originating from a common source. If several
+                      strategies are defined at the same time, an error will be raised.
+                      If none are set, the default is to use the requestHost. More
+                      info: https://doc.traefik.io/traefik/v2.9/middlewares/http/inflightreq/#sourcecriterion'
+                    properties:
+                      ipStrategy:
+                        description: 'IPStrategy holds the IP strategy configuration
+                          used by Traefik to determine the client IP. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/ipwhitelist/#ipstrategy'
+                        properties:
+                          depth:
+                            description: Depth tells Traefik to use the X-Forwarded-For
+                              header and take the IP located at the depth position
+                              (starting from the right).
+                            type: integer
+                          excludedIPs:
+                            description: ExcludedIPs configures Traefik to scan the
+                              X-Forwarded-For header and select the first IP not in
+                              the list.
+                            items:
+                              type: string
+                            type: array
+                        type: object
+                      requestHeaderName:
+                        description: RequestHeaderName defines the name of the header
+                          used to group incoming requests.
+                        type: string
+                      requestHost:
+                        description: RequestHost defines whether to consider the request
+                          Host as the source.
+                        type: boolean
+                    type: object
+                type: object
+              ipWhiteList:
+                description: 'IPWhiteList holds the IP whitelist middleware configuration.
+                  This middleware accepts / refuses requests based on the client IP.
+                  More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/ipwhitelist/'
+                properties:
+                  ipStrategy:
+                    description: 'IPStrategy holds the IP strategy configuration used
+                      by Traefik to determine the client IP. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/ipwhitelist/#ipstrategy'
+                    properties:
+                      depth:
+                        description: Depth tells Traefik to use the X-Forwarded-For
+                          header and take the IP located at the depth position (starting
+                          from the right).
+                        type: integer
+                      excludedIPs:
+                        description: ExcludedIPs configures Traefik to scan the X-Forwarded-For
+                          header and select the first IP not in the list.
+                        items:
+                          type: string
+                        type: array
+                    type: object
+                  sourceRange:
+                    description: SourceRange defines the set of allowed IPs (or ranges
+                      of allowed IPs by using CIDR notation).
+                    items:
+                      type: string
+                    type: array
+                type: object
+              passTLSClientCert:
+                description: 'PassTLSClientCert holds the pass TLS client cert middleware
+                  configuration. This middleware adds the selected data from the passed
+                  client TLS certificate to a header. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/passtlsclientcert/'
+                properties:
+                  info:
+                    description: Info selects the specific client certificate details
+                      you want to add to the X-Forwarded-Tls-Client-Cert-Info header.
+                    properties:
+                      issuer:
+                        description: Issuer defines the client certificate issuer
+                          details to add to the X-Forwarded-Tls-Client-Cert-Info header.
+                        properties:
+                          commonName:
+                            description: CommonName defines whether to add the organizationalUnit
+                              information into the issuer.
+                            type: boolean
+                          country:
+                            description: Country defines whether to add the country
+                              information into the issuer.
+                            type: boolean
+                          domainComponent:
+                            description: DomainComponent defines whether to add the
+                              domainComponent information into the issuer.
+                            type: boolean
+                          locality:
+                            description: Locality defines whether to add the locality
+                              information into the issuer.
+                            type: boolean
+                          organization:
+                            description: Organization defines whether to add the organization
+                              information into the issuer.
+                            type: boolean
+                          province:
+                            description: Province defines whether to add the province
+                              information into the issuer.
+                            type: boolean
+                          serialNumber:
+                            description: SerialNumber defines whether to add the serialNumber
+                              information into the issuer.
+                            type: boolean
+                        type: object
+                      notAfter:
+                        description: NotAfter defines whether to add the Not After
+                          information from the Validity part.
+                        type: boolean
+                      notBefore:
+                        description: NotBefore defines whether to add the Not Before
+                          information from the Validity part.
+                        type: boolean
+                      sans:
+                        description: Sans defines whether to add the Subject Alternative
+                          Name information from the Subject Alternative Name part.
+                        type: boolean
+                      serialNumber:
+                        description: SerialNumber defines whether to add the client
+                          serialNumber information.
+                        type: boolean
+                      subject:
+                        description: Subject defines the client certificate subject
+                          details to add to the X-Forwarded-Tls-Client-Cert-Info header.
+                        properties:
+                          commonName:
+                            description: CommonName defines whether to add the organizationalUnit
+                              information into the subject.
+                            type: boolean
+                          country:
+                            description: Country defines whether to add the country
+                              information into the subject.
+                            type: boolean
+                          domainComponent:
+                            description: DomainComponent defines whether to add the
+                              domainComponent information into the subject.
+                            type: boolean
+                          locality:
+                            description: Locality defines whether to add the locality
+                              information into the subject.
+                            type: boolean
+                          organization:
+                            description: Organization defines whether to add the organization
+                              information into the subject.
+                            type: boolean
+                          organizationalUnit:
+                            description: OrganizationalUnit defines whether to add
+                              the organizationalUnit information into the subject.
+                            type: boolean
+                          province:
+                            description: Province defines whether to add the province
+                              information into the subject.
+                            type: boolean
+                          serialNumber:
+                            description: SerialNumber defines whether to add the serialNumber
+                              information into the subject.
+                            type: boolean
+                        type: object
+                    type: object
+                  pem:
+                    description: PEM sets the X-Forwarded-Tls-Client-Cert header with
+                      the escaped certificate.
+                    type: boolean
+                type: object
+              plugin:
+                additionalProperties:
+                  x-kubernetes-preserve-unknown-fields: true
+                description: 'Plugin defines the middleware plugin configuration.
+                  More info: https://doc.traefik.io/traefik/plugins/'
+                type: object
+              rateLimit:
+                description: 'RateLimit holds the rate limit configuration. This middleware
+                  ensures that services will receive a fair amount of requests, and
+                  allows one to define what fair is. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/ratelimit/'
+                properties:
+                  average:
+                    description: Average is the maximum rate, by default in requests/s,
+                      allowed for the given source. It defaults to 0, which means
+                      no rate limiting. The rate is actually defined by dividing Average
+                      by Period. So for a rate below 1req/s, one needs to define a
+                      Period larger than a second.
+                    format: int64
+                    type: integer
+                  burst:
+                    description: Burst is the maximum number of requests allowed to
+                      arrive in the same arbitrarily small period of time. It defaults
+                      to 1.
+                    format: int64
+                    type: integer
+                  period:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    description: 'Period, in combination with Average, defines the
+                      actual maximum rate, such as: r = Average / Period. It defaults
+                      to a second.'
+                    x-kubernetes-int-or-string: true
+                  sourceCriterion:
+                    description: SourceCriterion defines what criterion is used to
+                      group requests as originating from a common source. If several
+                      strategies are defined at the same time, an error will be raised.
+                      If none are set, the default is to use the request's remote
+                      address field (as an ipStrategy).
+                    properties:
+                      ipStrategy:
+                        description: 'IPStrategy holds the IP strategy configuration
+                          used by Traefik to determine the client IP. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/ipwhitelist/#ipstrategy'
+                        properties:
+                          depth:
+                            description: Depth tells Traefik to use the X-Forwarded-For
+                              header and take the IP located at the depth position
+                              (starting from the right).
+                            type: integer
+                          excludedIPs:
+                            description: ExcludedIPs configures Traefik to scan the
+                              X-Forwarded-For header and select the first IP not in
+                              the list.
+                            items:
+                              type: string
+                            type: array
+                        type: object
+                      requestHeaderName:
+                        description: RequestHeaderName defines the name of the header
+                          used to group incoming requests.
+                        type: string
+                      requestHost:
+                        description: RequestHost defines whether to consider the request
+                          Host as the source.
+                        type: boolean
+                    type: object
+                type: object
+              redirectRegex:
+                description: 'RedirectRegex holds the redirect regex middleware configuration.
+                  This middleware redirects a request using regex matching and replacement.
+                  More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/redirectregex/#regex'
+                properties:
+                  permanent:
+                    description: Permanent defines whether the redirection is permanent
+                      (301).
+                    type: boolean
+                  regex:
+                    description: Regex defines the regex used to match and capture
+                      elements from the request URL.
+                    type: string
+                  replacement:
+                    description: Replacement defines how to modify the URL to have
+                      the new target URL.
+                    type: string
+                type: object
+              redirectScheme:
+                description: 'RedirectScheme holds the redirect scheme middleware
+                  configuration. This middleware redirects requests from a scheme/port
+                  to another. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/redirectscheme/'
+                properties:
+                  permanent:
+                    description: Permanent defines whether the redirection is permanent
+                      (301).
+                    type: boolean
+                  port:
+                    description: Port defines the port of the new URL.
+                    type: string
+                  scheme:
+                    description: Scheme defines the scheme of the new URL.
+                    type: string
+                type: object
+              replacePath:
+                description: 'ReplacePath holds the replace path middleware configuration.
+                  This middleware replaces the path of the request URL and store the
+                  original path in an X-Replaced-Path header. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/replacepath/'
+                properties:
+                  path:
+                    description: Path defines the path to use as replacement in the
+                      request URL.
+                    type: string
+                type: object
+              replacePathRegex:
+                description: 'ReplacePathRegex holds the replace path regex middleware
+                  configuration. This middleware replaces the path of a URL using
+                  regex matching and replacement. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/replacepathregex/'
+                properties:
+                  regex:
+                    description: Regex defines the regular expression used to match
+                      and capture the path from the request URL.
+                    type: string
+                  replacement:
+                    description: Replacement defines the replacement path format,
+                      which can include captured variables.
+                    type: string
+                type: object
+              retry:
+                description: 'Retry holds the retry middleware configuration. This
+                  middleware reissues requests a given number of times to a backend
+                  server if that server does not reply. As soon as the server answers,
+                  the middleware stops retrying, regardless of the response status.
+                  More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/retry/'
+                properties:
+                  attempts:
+                    description: Attempts defines how many times the request should
+                      be retried.
+                    type: integer
+                  initialInterval:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    description: InitialInterval defines the first wait time in the
+                      exponential backoff series. The maximum interval is calculated
+                      as twice the initialInterval. If unspecified, requests will
+                      be retried immediately. The value of initialInterval should
+                      be provided in seconds or as a valid duration format, see https://pkg.go.dev/time#ParseDuration.
+                    x-kubernetes-int-or-string: true
+                type: object
+              stripPrefix:
+                description: 'StripPrefix holds the strip prefix middleware configuration.
+                  This middleware removes the specified prefixes from the URL path.
+                  More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/stripprefix/'
+                properties:
+                  forceSlash:
+                    description: 'ForceSlash ensures that the resulting stripped path
+                      is not the empty string, by replacing it with / when necessary.
+                      Default: true.'
+                    type: boolean
+                  prefixes:
+                    description: Prefixes defines the prefixes to strip from the request
+                      URL.
+                    items:
+                      type: string
+                    type: array
+                type: object
+              stripPrefixRegex:
+                description: 'StripPrefixRegex holds the strip prefix regex middleware
+                  configuration. This middleware removes the matching prefixes from
+                  the URL path. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/stripprefixregex/'
+                properties:
+                  regex:
+                    description: Regex defines the regular expression to match the
+                      path prefix from the request URL.
+                    items:
+                      type: string
+                    type: array
+                type: object
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

charts/mosquitto-mqtt/charts/common/crds/middlewarestcp.yaml

@@ -0,0 +1,72 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.6.2
+  creationTimestamp: null
+  name: middlewaretcps.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  names:
+    kind: MiddlewareTCP
+    listKind: MiddlewareTCPList
+    plural: middlewaretcps
+    singular: middlewaretcp
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: 'MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.
+          More info: https://doc.traefik.io/traefik/v2.9/middlewares/overview/'
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: MiddlewareTCPSpec defines the desired state of a MiddlewareTCP.
+            properties:
+              inFlightConn:
+                description: InFlightConn defines the InFlightConn middleware configuration.
+                properties:
+                  amount:
+                    description: Amount defines the maximum amount of allowed simultaneous
+                      connections. The middleware closes the connection if there are
+                      already amount connections opened.
+                    format: int64
+                    type: integer
+                type: object
+              ipWhiteList:
+                description: IPWhiteList defines the IPWhiteList middleware configuration.
+                properties:
+                  sourceRange:
+                    description: SourceRange defines the allowed IPs (or ranges of
+                      allowed IPs by using CIDR notation).
+                    items:
+                      type: string
+                    type: array
+                type: object
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

charts/mosquitto-mqtt/charts/common/crds/serverstransports.yaml

@@ -0,0 +1,128 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.6.2
+  creationTimestamp: null
+  name: serverstransports.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  names:
+    kind: ServersTransport
+    listKind: ServersTransportList
+    plural: serverstransports
+    singular: serverstransport
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: 'ServersTransport is the CRD implementation of a ServersTransport.
+          If no serversTransport is specified, the default@internal will be used.
+          The default@internal serversTransport is created from the static configuration.
+          More info: https://doc.traefik.io/traefik/v2.9/routing/services/#serverstransport_1'
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: ServersTransportSpec defines the desired state of a ServersTransport.
+            properties:
+              certificatesSecrets:
+                description: CertificatesSecrets defines a list of secret storing
+                  client certificates for mTLS.
+                items:
+                  type: string
+                type: array
+              disableHTTP2:
+                description: DisableHTTP2 disables HTTP/2 for connections with backend
+                  servers.
+                type: boolean
+              forwardingTimeouts:
+                description: ForwardingTimeouts defines the timeouts for requests
+                  forwarded to the backend servers.
+                properties:
+                  dialTimeout:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    description: DialTimeout is the amount of time to wait until a
+                      connection to a backend server can be established.
+                    x-kubernetes-int-or-string: true
+                  idleConnTimeout:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    description: IdleConnTimeout is the maximum period for which an
+                      idle HTTP keep-alive connection will remain open before closing
+                      itself.
+                    x-kubernetes-int-or-string: true
+                  pingTimeout:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    description: PingTimeout is the timeout after which the HTTP/2
+                      connection will be closed if a response to ping is not received.
+                    x-kubernetes-int-or-string: true
+                  readIdleTimeout:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    description: ReadIdleTimeout is the timeout after which a health
+                      check using ping frame will be carried out if no frame is received
+                      on the HTTP/2 connection.
+                    x-kubernetes-int-or-string: true
+                  responseHeaderTimeout:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    description: ResponseHeaderTimeout is the amount of time to wait
+                      for a server's response headers after fully writing the request
+                      (including its body, if any).
+                    x-kubernetes-int-or-string: true
+                type: object
+              insecureSkipVerify:
+                description: InsecureSkipVerify disables SSL certificate verification.
+                type: boolean
+              maxIdleConnsPerHost:
+                description: MaxIdleConnsPerHost controls the maximum idle (keep-alive)
+                  to keep per-host.
+                type: integer
+              peerCertURI:
+                description: PeerCertURI defines the peer cert URI used to match against
+                  SAN URI during the peer certificate verification.
+                type: string
+              rootCAsSecrets:
+                description: RootCAsSecrets defines a list of CA secret used to validate
+                  self-signed certificate.
+                items:
+                  type: string
+                type: array
+              serverName:
+                description: ServerName defines the server name used to contact the
+                  server.
+                type: string
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

charts/mosquitto-mqtt/charts/common/crds/tlsoptions.yaml

@@ -0,0 +1,113 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.6.2
+  creationTimestamp: null
+  name: tlsoptions.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  names:
+    kind: TLSOption
+    listKind: TLSOptionList
+    plural: tlsoptions
+    singular: tlsoption
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: 'TLSOption is the CRD implementation of a Traefik TLS Option,
+          allowing to configure some parameters of the TLS connection. More info:
+          https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options'
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: TLSOptionSpec defines the desired state of a TLSOption.
+            properties:
+              alpnProtocols:
+                description: 'ALPNProtocols defines the list of supported application
+                  level protocols for the TLS handshake, in order of preference. More
+                  info: https://doc.traefik.io/traefik/v2.9/https/tls/#alpn-protocols'
+                items:
+                  type: string
+                type: array
+              cipherSuites:
+                description: 'CipherSuites defines the list of supported cipher suites
+                  for TLS versions up to TLS 1.2. More info: https://doc.traefik.io/traefik/v2.9/https/tls/#cipher-suites'
+                items:
+                  type: string
+                type: array
+              clientAuth:
+                description: ClientAuth defines the server's policy for TLS Client
+                  Authentication.
+                properties:
+                  clientAuthType:
+                    description: ClientAuthType defines the client authentication
+                      type to apply.
+                    enum:
+                    - NoClientCert
+                    - RequestClientCert
+                    - RequireAnyClientCert
+                    - VerifyClientCertIfGiven
+                    - RequireAndVerifyClientCert
+                    type: string
+                  secretNames:
+                    description: SecretNames defines the names of the referenced Kubernetes
+                      Secret storing certificate details.
+                    items:
+                      type: string
+                    type: array
+                type: object
+              curvePreferences:
+                description: 'CurvePreferences defines the preferred elliptic curves
+                  in a specific order. More info: https://doc.traefik.io/traefik/v2.9/https/tls/#curve-preferences'
+                items:
+                  type: string
+                type: array
+              maxVersion:
+                description: 'MaxVersion defines the maximum TLS version that Traefik
+                  will accept. Possible values: VersionTLS10, VersionTLS11, VersionTLS12,
+                  VersionTLS13. Default: None.'
+                type: string
+              minVersion:
+                description: 'MinVersion defines the minimum TLS version that Traefik
+                  will accept. Possible values: VersionTLS10, VersionTLS11, VersionTLS12,
+                  VersionTLS13. Default: VersionTLS10.'
+                type: string
+              preferServerCipherSuites:
+                description: 'PreferServerCipherSuites defines whether the server
+                  chooses a cipher suite among his own instead of among the client''s.
+                  It is enabled automatically when minVersion or maxVersion is set.
+                  Deprecated: https://github.com/golang/go/issues/45430'
+                type: boolean
+              sniStrict:
+                description: SniStrict defines whether Traefik allows connections
+                  from clients connections that do not specify a server_name extension.
+                type: boolean
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

charts/mosquitto-mqtt/charts/common/crds/tlsstores.yaml

@@ -0,0 +1,99 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.6.2
+  creationTimestamp: null
+  name: tlsstores.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  names:
+    kind: TLSStore
+    listKind: TLSStoreList
+    plural: tlsstores
+    singular: tlsstore
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: 'TLSStore is the CRD implementation of a Traefik TLS Store. For
+          the time being, only the TLSStore named default is supported. This means
+          that you cannot have two stores that are named default in different Kubernetes
+          namespaces. More info: https://doc.traefik.io/traefik/v2.9/https/tls/#certificates-stores'
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: TLSStoreSpec defines the desired state of a TLSStore.
+            properties:
+              certificates:
+                description: Certificates is a list of secret names, each secret holding
+                  a key/certificate pair to add to the store.
+                items:
+                  description: Certificate holds a secret name for the TLSStore resource.
+                  properties:
+                    secretName:
+                      description: SecretName is the name of the referenced Kubernetes
+                        Secret to specify the certificate details.
+                      type: string
+                  required:
+                  - secretName
+                  type: object
+                type: array
+              defaultCertificate:
+                description: DefaultCertificate defines the default certificate configuration.
+                properties:
+                  secretName:
+                    description: SecretName is the name of the referenced Kubernetes
+                      Secret to specify the certificate details.
+                    type: string
+                required:
+                - secretName
+                type: object
+              defaultGeneratedCert:
+                description: DefaultGeneratedCert defines the default generated certificate
+                  configuration.
+                properties:
+                  domain:
+                    description: Domain is the domain definition for the DefaultCertificate.
+                    properties:
+                      main:
+                        description: Main defines the main domain name.
+                        type: string
+                      sans:
+                        description: SANs defines the subject alternative domain names.
+                        items:
+                          type: string
+                        type: array
+                    type: object
+                  resolver:
+                    description: Resolver is the name of the resolver that will be
+                      used to issue the DefaultCertificate.
+                    type: string
+                type: object
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

charts/mosquitto-mqtt/charts/common/crds/traefikservices.yaml

@@ -0,0 +1,381 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.6.2
+  creationTimestamp: null
+  name: traefikservices.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  names:
+    kind: TraefikService
+    listKind: TraefikServiceList
+    plural: traefikservices
+    singular: traefikservice
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: 'TraefikService is the CRD implementation of a Traefik Service.
+          TraefikService object allows to: - Apply weight to Services on load-balancing
+          - Mirror traffic on services More info: https://doc.traefik.io/traefik/v2.9/routing/providers/kubernetes-crd/#kind-traefikservice'
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: TraefikServiceSpec defines the desired state of a TraefikService.
+            properties:
+              mirroring:
+                description: Mirroring defines the Mirroring service configuration.
+                properties:
+                  kind:
+                    description: Kind defines the kind of the Service.
+                    enum:
+                    - Service
+                    - TraefikService
+                    type: string
+                  maxBodySize:
+                    description: MaxBodySize defines the maximum size allowed for
+                      the body of the request. If the body is larger, the request
+                      is not mirrored. Default value is -1, which means unlimited
+                      size.
+                    format: int64
+                    type: integer
+                  mirrors:
+                    description: Mirrors defines the list of mirrors where Traefik
+                      will duplicate the traffic.
+                    items:
+                      description: MirrorService holds the mirror configuration.
+                      properties:
+                        kind:
+                          description: Kind defines the kind of the Service.
+                          enum:
+                          - Service
+                          - TraefikService
+                          type: string
+                        name:
+                          description: Name defines the name of the referenced Kubernetes
+                            Service or TraefikService. The differentiation between
+                            the two is specified in the Kind field.
+                          type: string
+                        namespace:
+                          description: Namespace defines the namespace of the referenced
+                            Kubernetes Service or TraefikService.
+                          type: string
+                        passHostHeader:
+                          description: PassHostHeader defines whether the client Host
+                            header is forwarded to the upstream Kubernetes Service.
+                            By default, passHostHeader is true.
+                          type: boolean
+                        percent:
+                          description: 'Percent defines the part of the traffic to
+                            mirror. Supported values: 0 to 100.'
+                          type: integer
+                        port:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          description: Port defines the port of a Kubernetes Service.
+                            This can be a reference to a named port.
+                          x-kubernetes-int-or-string: true
+                        responseForwarding:
+                          description: ResponseForwarding defines how Traefik forwards
+                            the response from the upstream Kubernetes Service to the
+                            client.
+                          properties:
+                            flushInterval:
+                              description: 'FlushInterval defines the interval, in
+                                milliseconds, in between flushes to the client while
+                                copying the response body. A negative value means
+                                to flush immediately after each write to the client.
+                                This configuration is ignored when ReverseProxy recognizes
+                                a response as a streaming response; for such responses,
+                                writes are flushed to the client immediately. Default:
+                                100ms'
+                              type: string
+                          type: object
+                        scheme:
+                          description: Scheme defines the scheme to use for the request
+                            to the upstream Kubernetes Service. It defaults to https
+                            when Kubernetes Service port is 443, http otherwise.
+                          type: string
+                        serversTransport:
+                          description: ServersTransport defines the name of ServersTransport
+                            resource to use. It allows to configure the transport
+                            between Traefik and your servers. Can only be used on
+                            a Kubernetes Service.
+                          type: string
+                        sticky:
+                          description: 'Sticky defines the sticky sessions configuration.
+                            More info: https://doc.traefik.io/traefik/v2.9/routing/services/#sticky-sessions'
+                          properties:
+                            cookie:
+                              description: Cookie defines the sticky cookie configuration.
+                              properties:
+                                httpOnly:
+                                  description: HTTPOnly defines whether the cookie
+                                    can be accessed by client-side APIs, such as JavaScript.
+                                  type: boolean
+                                name:
+                                  description: Name defines the Cookie name.
+                                  type: string
+                                sameSite:
+                                  description: 'SameSite defines the same site policy.
+                                    More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
+                                  type: string
+                                secure:
+                                  description: Secure defines whether the cookie can
+                                    only be transmitted over an encrypted connection
+                                    (i.e. HTTPS).
+                                  type: boolean
+                              type: object
+                          type: object
+                        strategy:
+                          description: Strategy defines the load balancing strategy
+                            between the servers. RoundRobin is the only supported
+                            value at the moment.
+                          type: string
+                        weight:
+                          description: Weight defines the weight and should only be
+                            specified when Name references a TraefikService object
+                            (and to be precise, one that embeds a Weighted Round Robin).
+                          type: integer
+                      required:
+                      - name
+                      type: object
+                    type: array
+                  name:
+                    description: Name defines the name of the referenced Kubernetes
+                      Service or TraefikService. The differentiation between the two
+                      is specified in the Kind field.
+                    type: string
+                  namespace:
+                    description: Namespace defines the namespace of the referenced
+                      Kubernetes Service or TraefikService.
+                    type: string
+                  passHostHeader:
+                    description: PassHostHeader defines whether the client Host header
+                      is forwarded to the upstream Kubernetes Service. By default,
+                      passHostHeader is true.
+                    type: boolean
+                  port:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    description: Port defines the port of a Kubernetes Service. This
+                      can be a reference to a named port.
+                    x-kubernetes-int-or-string: true
+                  responseForwarding:
+                    description: ResponseForwarding defines how Traefik forwards the
+                      response from the upstream Kubernetes Service to the client.
+                    properties:
+                      flushInterval:
+                        description: 'FlushInterval defines the interval, in milliseconds,
+                          in between flushes to the client while copying the response
+                          body. A negative value means to flush immediately after
+                          each write to the client. This configuration is ignored
+                          when ReverseProxy recognizes a response as a streaming response;
+                          for such responses, writes are flushed to the client immediately.
+                          Default: 100ms'
+                        type: string
+                    type: object
+                  scheme:
+                    description: Scheme defines the scheme to use for the request
+                      to the upstream Kubernetes Service. It defaults to https when
+                      Kubernetes Service port is 443, http otherwise.
+                    type: string
+                  serversTransport:
+                    description: ServersTransport defines the name of ServersTransport
+                      resource to use. It allows to configure the transport between
+                      Traefik and your servers. Can only be used on a Kubernetes Service.
+                    type: string
+                  sticky:
+                    description: 'Sticky defines the sticky sessions configuration.
+                      More info: https://doc.traefik.io/traefik/v2.9/routing/services/#sticky-sessions'
+                    properties:
+                      cookie:
+                        description: Cookie defines the sticky cookie configuration.
+                        properties:
+                          httpOnly:
+                            description: HTTPOnly defines whether the cookie can be
+                              accessed by client-side APIs, such as JavaScript.
+                            type: boolean
+                          name:
+                            description: Name defines the Cookie name.
+                            type: string
+                          sameSite:
+                            description: 'SameSite defines the same site policy. More
+                              info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
+                            type: string
+                          secure:
+                            description: Secure defines whether the cookie can only
+                              be transmitted over an encrypted connection (i.e. HTTPS).
+                            type: boolean
+                        type: object
+                    type: object
+                  strategy:
+                    description: Strategy defines the load balancing strategy between
+                      the servers. RoundRobin is the only supported value at the moment.
+                    type: string
+                  weight:
+                    description: Weight defines the weight and should only be specified
+                      when Name references a TraefikService object (and to be precise,
+                      one that embeds a Weighted Round Robin).
+                    type: integer
+                required:
+                - name
+                type: object
+              weighted:
+                description: Weighted defines the Weighted Round Robin configuration.
+                properties:
+                  services:
+                    description: Services defines the list of Kubernetes Service and/or
+                      TraefikService to load-balance, with weight.
+                    items:
+                      description: Service defines an upstream HTTP service to proxy
+                        traffic to.
+                      properties:
+                        kind:
+                          description: Kind defines the kind of the Service.
+                          enum:
+                          - Service
+                          - TraefikService
+                          type: string
+                        name:
+                          description: Name defines the name of the referenced Kubernetes
+                            Service or TraefikService. The differentiation between
+                            the two is specified in the Kind field.
+                          type: string
+                        namespace:
+                          description: Namespace defines the namespace of the referenced
+                            Kubernetes Service or TraefikService.
+                          type: string
+                        passHostHeader:
+                          description: PassHostHeader defines whether the client Host
+                            header is forwarded to the upstream Kubernetes Service.
+                            By default, passHostHeader is true.
+                          type: boolean
+                        port:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          description: Port defines the port of a Kubernetes Service.
+                            This can be a reference to a named port.
+                          x-kubernetes-int-or-string: true
+                        responseForwarding:
+                          description: ResponseForwarding defines how Traefik forwards
+                            the response from the upstream Kubernetes Service to the
+                            client.
+                          properties:
+                            flushInterval:
+                              description: 'FlushInterval defines the interval, in
+                                milliseconds, in between flushes to the client while
+                                copying the response body. A negative value means
+                                to flush immediately after each write to the client.
+                                This configuration is ignored when ReverseProxy recognizes
+                                a response as a streaming response; for such responses,
+                                writes are flushed to the client immediately. Default:
+                                100ms'
+                              type: string
+                          type: object
+                        scheme:
+                          description: Scheme defines the scheme to use for the request
+                            to the upstream Kubernetes Service. It defaults to https
+                            when Kubernetes Service port is 443, http otherwise.
+                          type: string
+                        serversTransport:
+                          description: ServersTransport defines the name of ServersTransport
+                            resource to use. It allows to configure the transport
+                            between Traefik and your servers. Can only be used on
+                            a Kubernetes Service.
+                          type: string
+                        sticky:
+                          description: 'Sticky defines the sticky sessions configuration.
+                            More info: https://doc.traefik.io/traefik/v2.9/routing/services/#sticky-sessions'
+                          properties:
+                            cookie:
+                              description: Cookie defines the sticky cookie configuration.
+                              properties:
+                                httpOnly:
+                                  description: HTTPOnly defines whether the cookie
+                                    can be accessed by client-side APIs, such as JavaScript.
+                                  type: boolean
+                                name:
+                                  description: Name defines the Cookie name.
+                                  type: string
+                                sameSite:
+                                  description: 'SameSite defines the same site policy.
+                                    More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
+                                  type: string
+                                secure:
+                                  description: Secure defines whether the cookie can
+                                    only be transmitted over an encrypted connection
+                                    (i.e. HTTPS).
+                                  type: boolean
+                              type: object
+                          type: object
+                        strategy:
+                          description: Strategy defines the load balancing strategy
+                            between the servers. RoundRobin is the only supported
+                            value at the moment.
+                          type: string
+                        weight:
+                          description: Weight defines the weight and should only be
+                            specified when Name references a TraefikService object
+                            (and to be precise, one that embeds a Weighted Round Robin).
+                          type: integer
+                      required:
+                      - name
+                      type: object
+                    type: array
+                  sticky:
+                    description: 'Sticky defines whether sticky sessions are enabled.
+                      More info: https://doc.traefik.io/traefik/v2.9/routing/providers/kubernetes-crd/#stickiness-and-load-balancing'
+                    properties:
+                      cookie:
+                        description: Cookie defines the sticky cookie configuration.
+                        properties:
+                          httpOnly:
+                            description: HTTPOnly defines whether the cookie can be
+                              accessed by client-side APIs, such as JavaScript.
+                            type: boolean
+                          name:
+                            description: Name defines the Cookie name.
+                            type: string
+                          sameSite:
+                            description: 'SameSite defines the same site policy. More
+                              info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
+                            type: string
+                          secure:
+                            description: Secure defines whether the cookie can only
+                              be transmitted over an encrypted connection (i.e. HTTPS).
+                            type: boolean
+                        type: object
+                    type: object
+                type: object
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

charts/mosquitto-mqtt/charts/common/templates/SCALE/_externalInterfaces.tpl

@@ -0,0 +1,17 @@
+{{/*
+This template serves as a blueprint for External Interface objects that are created
+using the SCALE GUI.
+*/}}
+{{- define "tc.common.scale.externalInterfaces" -}}
+{{- if  .Values.global.ixChartContext }}
+{{- range $index, $iface := .Values.ixExternalInterfacesConfiguration  }}
+---
+apiVersion: "k8s.cni.cncf.io/v1"
+kind: NetworkAttachmentDefinition
+metadata:
+  name: ix-{{ $.Release.Name }}-{{ $index }}
+spec:
+  config: '{{ $iface }}'
+{{- end }}
+{{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/SCALE/_portal.tpl

@@ -0,0 +1,93 @@
+{{- define "tc.common.scale.portal" -}}
+{{- if .Values.ixChartContext }}
+{{- if .Values.portal }}
+{{- if .Values.portal.enabled }}
+{{- $primaryService := get .Values.service (include "tc.common.lib.util.service.primary" .) }}
+{{- $primaryPort := get $primaryService.ports (include "tc.common.lib.util.service.ports.primary" (dict "values" $primaryService)) -}}
+{{- $ingr := index .Values.ingress (keys .Values.ingress | first) -}}
+{{- $host := "$node_ip" }}
+{{- $port := 443 }}
+{{- $protocol := "https" }}
+{{- $path := "/" }}
+{{- $ingressport := 443 }}
+
+{{- if $ingr }}
+  {{- if $ingr.enabled }}
+    {{- range $ingr.hosts }}
+      {{- if .hostTpl }}
+        {{ $host = ( tpl .hostTpl $ ) }}
+      {{- else if .host }}
+        {{ $host = .host }}
+      {{- else }}
+        {{ $host = "$node_ip" }}
+      {{- end }}
+      {{- if .paths }}
+        {{- $path = (first .paths).path  }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+
+{{- $namespace := "default" }}
+{{- if $ingr.ingressClassName }}
+{{- $namespace := ( printf "ix-%s" $ingr.ingressClassName ) }}
+{{- end }}
+{{- $traefikportalhook := lookup "v1" "ConfigMap" $namespace "portalhook" }}
+
+{{- $entrypoint := "websecure" }}
+{{- if $ingr.entrypoint }}
+  {{- $entrypoint = $ingr.entrypoint }}
+{{- end }}
+
+{{- if .Values.portal.ingressPort  }}
+  {{- $ingressport = .Values.portal.ingressPort }}
+{{- else if $traefikportalhook }}
+  {{- if ( index $traefikportalhook.data $entrypoint ) }}
+    {{- $ingressport = ( index $traefikportalhook.data $entrypoint ) }}
+  {{- end }}
+{{- end }}
+
+{{- if eq $host "$node_ip" }}
+  {{- if eq $primaryService.type "NodePort" }}
+    {{- $port = $primaryPort.nodePort }}
+  {{- end }}
+  {{- if eq $primaryService.type "LoadBalancer" }}
+    {{- $port = $primaryPort.port }}
+  {{- end }}
+    {{- if eq $primaryPort.protocol "HTTP" }}
+      {{- $protocol = "http" }}
+    {{- end }}
+{{- else }}
+  {{- $port = $ingressport }}
+  {{- if $ingr.tls }}
+    {{- $protocol = "https" }}
+  {{- end }}
+{{- end }}
+
+
+{{- if and ( .Values.portal.host ) ( eq $host "$node_ip" ) }}
+  {{- $host = ( tpl .Values.portal.host $ ) }}
+{{- end }}
+
+{{- if .Values.portal.path }}
+  {{- $path = ( tpl .Values.portal.path $ ) }}
+{{- end }}
+
+---
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: portal
+  labels:
+  {{ include "tc.common.labels" . | nindent 4 }}
+data:
+  protocol: {{ $protocol }}
+  host: {{ $host | quote }}
+  port: {{ $port | quote }}
+  path: {{ $path | quote }}
+  url: {{ ( printf "%v://%v:%v%v" $protocol $host $port $path ) | quote }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/SCALE/cert/_certSecret.tpl

@@ -0,0 +1,30 @@
+{{- define "tc.common.scale.cert.secret" -}}
+
+{{- $secretName := include "tc.common.names.fullname" . -}}
+
+{{- if .ObjectValues.certHolder -}}
+  {{- if hasKey .ObjectValues.certHolder "nameOverride" -}}
+    {{- $secretName = ( printf "%v-%v-%v-%v" $secretName .ObjectValues.certHolder.nameOverride "ixcert" .ObjectValues.certHolder.scaleCert ) -}}
+  {{- else }}
+    {{- $secretName = ( printf "%v-%v-%v" $secretName "ixcert" .ObjectValues.certHolder.scaleCert ) -}}
+  {{ end -}}
+{{ else }}
+  {{- $_ := set $ "ObjectValues" (dict "certHolder" .Values) -}}
+  {{- $secretName = ( printf "%v-%v-%v-%v" $secretName "scalecert" "ixcert" .Values.scaleCert ) -}}
+{{ end -}}
+
+{{- if eq (include "tc.common.scale.cert.available" $ ) "true" -}}
+
+
+{{- printf "\n%s\n" "---" }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $secretName }}-{{ .Release.Revision }}
+  labels: {{ include "tc.common.labels" . | nindent 4 }}
+type: kubernetes.io/tls
+data:
+  tls.crt: {{ (include "tc.common.scale.cert.publicKey" $ ) | toString | b64enc | quote }}
+  tls.key: {{ (include "tc.common.scale.cert.privateKey" $ ) | toString | b64enc | quote }}
+{{- end -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/SCALE/cert/_certs.tpl

@@ -0,0 +1,57 @@
+{{/*
+Retrieve true/false if certificate is configured
+*/}}
+{{- define "tc.common.scale.cert.available" -}}
+{{- if .ObjectValues.certHolder.scaleCert -}}
+{{- $values := (. | mustDeepCopy) -}}
+{{- $_ := set $values "commonCertOptions" (dict "certKeyName" $values.ObjectValues.certHolder.scaleCert) -}}
+{{- template "tc.common.scale.cert_present" $values -}}
+{{- else -}}
+{{- false -}}
+{{- end -}}
+{{- end -}}
+
+
+{{/*
+Retrieve public key of certificate
+*/}}
+{{- define "tc.common.scale.cert.publicKey" -}}
+{{- $values := (. | mustDeepCopy) -}}
+{{- $_ := set $values "commonCertOptions" (dict "certKeyName" $values.ObjectValues.certHolder.scaleCert "publicKey" true) -}}
+{{ include "tc.common.scale.cert" $values }}
+{{- end -}}
+
+
+{{/*
+Retrieve private key of certificate
+*/}}
+{{- define "tc.common.scale.cert.privateKey" -}}
+{{- $values := (. | mustDeepCopy) -}}
+{{- $_ := set $values "commonCertOptions" (dict "certKeyName" $values.ObjectValues.certHolder.scaleCert) -}}
+{{ include "tc.common.scale.cert" $values }}
+{{- end -}}
+
+{{/*
+Retrieve true/false if certificate is available in ixCertificates
+*/}}
+{{- define "tc.common.scale.cert_present" -}}
+{{- $values := . -}}
+{{- hasKey $values.Values.ixCertificates ($values.commonCertOptions.certKeyName | toString) -}}
+{{- end -}}
+
+
+{{/*
+Retrieve certificate from variable name
+*/}}
+{{- define "tc.common.scale.cert" -}}
+{{- $values := . -}}
+{{- $certKey := ($values.commonCertOptions.certKeyName | toString) -}}
+{{- if hasKey $values.Values.ixCertificates $certKey -}}
+{{- $cert := get $values.Values.ixCertificates $certKey -}}
+{{- if $values.commonCertOptions.publicKey -}}
+{{ $cert.certificate }}
+{{- else -}}
+{{ $cert.privatekey }}
+{{- end -}}
+{{- end -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/addons/code-server/_codeserver.tpl

@@ -0,0 +1,50 @@
+{{/*
+Template to render code-server addon
+It will include / inject the required templates based on the given values.
+*/}}
+{{- define "tc.common.addon.codeserver" -}}
+{{- if .Values.addons.codeserver.enabled -}}
+  {{/* Append the code-server container to the additionalContainers */}}
+  {{- $container := include "tc.common.addon.codeserver.container" . | fromYaml -}}
+  {{- if $container -}}
+    {{- $_ := set .Values.additionalContainers "addon-codeserver" $container -}}
+  {{- end -}}
+
+  {{/* Include the deployKeySecret if not empty */}}
+  {{- $secret := include "tc.common.addon.codeserver.deployKeySecret" . -}}
+  {{- if $secret -}}
+    {{- $secret | nindent 0 -}}
+  {{- end -}}
+
+  {{/* Append the secret volume to the volumes */}}
+  {{- $volume := include "tc.common.addon.codeserver.deployKeyVolumeSpec" . | fromYaml -}}
+  {{- if $volume -}}
+    {{- $_ := set .Values.persistence "deploykey" (dict "enabled" "true" "mountPath" "-" "type" "custom" "volumeSpec" $volume) -}}
+  {{- end -}}
+
+  {{/* Add the code-server service */}}
+  {{- if .Values.addons.codeserver.service.enabled -}}
+    {{- $serviceValues := .Values.addons.codeserver.service -}}
+    {{- $_ := set $serviceValues "nameOverride" "codeserver" -}}
+    {{- $_ := set $ "ObjectValues" (dict "service" $serviceValues) -}}
+    {{- include "tc.common.class.service" $ -}}
+    {{- $_ := unset $ "ObjectValues" -}}
+  {{- end -}}
+
+  {{/* Add the code-server ingress */}}
+  {{- if .Values.addons.codeserver.ingress.enabled -}}
+    {{- $ingressValues := .Values.addons.codeserver.ingress -}}
+    {{- $_ := set $ingressValues "nameOverride" "codeserver" -}}
+
+    {{/* Determine the target service name & port */}}
+    {{- $svcName := printf "%v-codeserver" (include "tc.common.names.fullname" .) -}}
+    {{- $svcPort := .Values.addons.codeserver.service.ports.codeserver.port -}}
+    {{- range $_, $host := $ingressValues.hosts -}}
+      {{- $_ := set (index $host.paths 0) "service" (dict "name" $svcName "port" $svcPort) -}}
+    {{- end -}}
+    {{- $_ := set $ "ObjectValues" (dict "ingress" $ingressValues) -}}
+    {{- include "tc.common.class.ingress" $ -}}
+    {{- $_ := unset $ "ObjectValues" -}}
+  {{- end -}}
+{{- end -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/addons/code-server/_container.tpl

@@ -0,0 +1,50 @@
+{{/*
+The code-server sidecar container to be inserted.
+*/}}
+{{- define "tc.common.addon.codeserver.container" -}}
+name: codeserver
+image: "{{ .Values.codeserverImage.repository }}:{{ .Values.codeserverImage.tag }}"
+imagePullPolicy: {{ .Values.codeserverImage.pullPolicy }}
+securityContext:
+  runAsUser: 0
+  runAsGroup: 0
+env:
+{{- range $envList := .Values.addons.codeserver.envList }}
+  {{- if and $envList.name $envList.value }}
+  - name: {{ $envList.name }}
+    value: {{ $envList.value | quote }}
+  {{- else }}
+  {{- fail "Please specify name/value for codeserver environment variable" }}
+  {{- end }}
+{{- end}}
+{{- with .Values.addons.codeserver.env }}
+{{- range $k, $v := . }}
+  - name: {{ $k }}
+    value: {{ $v | quote }}
+{{- end }}
+{{- end }}
+ports:
+- name: codeserver
+  containerPort: {{ .Values.addons.codeserver.service.ports.codeserver.port }}
+  protocol: TCP
+args:
+{{- range .Values.addons.codeserver.args }}
+- {{ . | quote }}
+{{- end }}
+- "--port"
+- "{{ .Values.addons.codeserver.service.ports.codeserver.port }}"
+- {{ .Values.addons.codeserver.workingDir | default "/" }}
+{{- with (include "tc.common.controller.volumeMounts" . | trim) }}
+volumeMounts:
+  {{ nindent 2 . }}
+{{- end }}
+{{- if or .Values.addons.codeserver.git.deployKey .Values.addons.codeserver.git.deployKeyBase64 .Values.addons.codeserver.git.deployKeySecret }}
+  - name: deploykey
+    mountPath: /root/.ssh/id_rsa
+    subPath: id_rsa
+{{- end }}
+{{- with .Values.addons.codeserver.resources }}
+resources:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/addons/code-server/_secret.tpl

@@ -0,0 +1,22 @@
+{{/*
+The OpenVPN credentials secrets to be included.
+*/}}
+{{- define "tc.common.addon.codeserver.deployKeySecret" -}}
+{{- if or .Values.addons.codeserver.git.deployKey .Values.addons.codeserver.git.deployKeyBase64 }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "tc.common.names.fullname" . }}-deploykey
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+type: Opaque
+{{- if .Values.addons.codeserver.git.deployKey }}
+stringData:
+  id_rsa: {{ .Values.addons.codeserver.git.deployKey | quote }}
+{{- else }}
+data:
+  id_rsa: {{ .Values.addons.codeserver.git.deployKeyBase64 | quote }}
+{{- end }}
+{{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/addons/code-server/_volume.tpl

@@ -0,0 +1,17 @@
+{{/*
+The volume (referencing git deploykey) to be inserted into additionalVolumes.
+*/}}
+{{- define "tc.common.addon.codeserver.deployKeyVolumeSpec" -}}
+{{- if or .Values.addons.codeserver.git.deployKey .Values.addons.codeserver.git.deployKeyBase64 .Values.addons.codeserver.git.deployKeySecret }}
+secret:
+  {{- if .Values.addons.codeserver.git.deployKeySecret }}
+  secretName: {{ .Values.addons.codeserver.git.deployKeySecret }}
+  {{- else }}
+  secretName: {{ include "tc.common.names.fullname" . }}-deploykey
+  {{- end }}
+  defaultMode: 256
+  items:
+    - key: id_rsa
+      path: id_rsa
+{{- end -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/addons/vpn/_vpn.tpl

@@ -0,0 +1,24 @@
+{{/*
+Template to render VPN addon
+It will include / inject the required templates based on the given values.
+*/}}
+{{- define "tc.common.addon.vpn" -}}
+{{- if ne "disabled" .Values.addons.vpn.type -}}
+  {{- if eq "openvpn" .Values.addons.vpn.type -}}
+    {{- include "tc.common.addon.openvpn" . }}
+  {{- end -}}
+
+  {{- if eq "wireguard" .Values.addons.vpn.type -}}
+    {{- include "tc.common.addon.wireguard" . }}
+  {{- end -}}
+
+  {{- if eq "tailscale" .Values.addons.vpn.type -}}
+    {{- include "tc.common.addon.tailscale" . }}
+  {{- end -}}
+
+  {{- if ne "tailscale" .Values.addons.vpn.type -}}
+    {{- $_ := set .Values.persistence "vpnconfig" .Values.addons.vpn.configFile -}}
+  {{- end -}}
+
+{{- end -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/addons/vpn/openvpn/_addon.tpl

@@ -0,0 +1,17 @@
+{{/*
+Template to render OpenVPN addon. It will add the container to the list of additionalContainers
+and add a credentials secret if speciffied.
+*/}}
+{{- define "tc.common.addon.openvpn" -}}
+  {{/* Append the openVPN container to the additionalContainers */}}
+  {{- $container := include "tc.common.addon.openvpn.container" . | fromYaml -}}
+  {{- if $container -}}
+    {{- $_ := set .Values.additionalContainers "addon-openvpn" $container -}}
+  {{- end -}}
+
+  {{/* Include the secret if not empty */}}
+  {{- $secret := include "tc.common.addon.openvpn.secret" . -}}
+  {{- if $secret -}}
+    {{- $secret | nindent 0 -}}
+  {{- end -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/addons/vpn/openvpn/_container.tpl

@@ -0,0 +1,72 @@
+{{/*
+The OpenVPN sidecar container to be inserted.
+*/}}
+{{- define "tc.common.addon.openvpn.container" -}}
+name: openvpn
+image: "{{ .Values.openvpnImage.repository }}:{{ .Values.openvpnImage.tag }}"
+imagePullPolicy: {{ .Values.openvpnImage.pullPolicy }}
+securityContext:
+  runAsUser: 0
+  runAsGroup: 0
+  capabilities:
+    add:
+      - NET_ADMIN
+      - SYS_MODULE
+env:
+{{- range $envList := .Values.addons.vpn.envList }}
+  {{- if and $envList.name $envList.value }}
+  - name: {{ $envList.name }}
+    value: {{ $envList.value | quote }}
+  {{- else }}
+  {{- fail "Please specify name/value for VPN environment variable" }}
+  {{- end }}
+{{- end}}
+{{- with .Values.addons.vpn.env }}
+{{- range $k, $v := . }}
+  - name: {{ $k }}
+    value: {{ $v | quote }}
+{{- end }}
+{{- end }}
+
+{{- if .Values.addons.vpn.killSwitch }}
+  - name: FIREWALL
+    value: "ON"
+  - name: ROUTE_1
+    value: "172.16.0.0/12"
+  {{- range $index, $value := .Values.addons.vpn.excludedNetworks_IPv4 }}
+  - name: ROUTE_{{ add $index 2 }}
+    value: {{ $value | quote }}
+  {{- end}}
+{{- if .Values.addons.vpn.excludedNetworks_IPv6 }}
+  {{- $excludednetworksv6 := ""}}
+  {{- range .Values.addons.vpn.excludedNetworks_IPv4 }}
+    {{- $excludednetworksv6 =  ( printf "%v;%v" $excludednetworksv6 . ) }}
+  {{- end}}
+  {{- range $index, $value := .Values.addons.vpn.excludedNetworks_IPv6 }}
+  - name: ROUTE6_{{ add $index 1 }}
+    value: {{ $value | quote }}
+  {{- end}}
+{{- end }}
+{{- end }}
+
+{{- if or ( .Values.addons.vpn.openvpn.username ) ( .Values.addons.vpn.openvpn.password ) }}
+envFrom:
+  - secretRef:
+      name: {{ include "tc.common.names.fullname" . }}-openvpn
+{{- end }}
+volumeMounts:
+  - mountPath: {{ .Values.persistence.shared.mountPath }}
+    name: shared
+{{- if .Values.addons.vpn.configFile }}
+  - name: vpnconfig
+    mountPath: /vpn/vpn.conf
+{{- end }}
+{{- with .Values.addons.vpn.livenessProbe }}
+livenessProbe:
+  {{- toYaml . | nindent 2 }}
+{{- end -}}
+{{- with .Values.addons.vpn.resources }}
+resources:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/addons/vpn/openvpn/_secret.tpl

@@ -0,0 +1,14 @@
+{{/*
+The OpenVPN credentials secrets to be included.
+*/}}
+{{- define "tc.common.addon.openvpn.secret" -}}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "tc.common.names.fullname" $ }}-openvpn
+  labels:
+  {{- include "tc.common.labels" $ | nindent 4 }}
+data:
+  VPN_AUTH: {{ ( printf "%v;%v" .Values.addons.vpn.openvpn.username .Values.addons.vpn.openvpn.password ) | b64enc }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/addons/vpn/tailscale/_addon.tpl

@@ -0,0 +1,13 @@
+{{/*
+Template to render Tailscale addon. It will add the container to the list of additionalContainers.
+*/}}
+
+{{- define "tc.common.addon.tailscale" -}}
+  {{/* Append the Tailscale container to the additionalContainers */}}
+  {{- $container := fromYaml (include "tc.common.addon.tailscale.container" .) -}}
+  {{- if $container -}}
+    {{- $_ := set .Values.additionalContainers "addon-tailscale" $container -}}
+    {{- include "tailscale.secret" . -}}
+    {{- $_ := set .Values.persistence (printf "%v-%v" .Release.Name "tailscale" ) (include "tailscale.addon.persistence" . | fromYaml) -}}
+  {{- end -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/addons/vpn/tailscale/_container.tpl

@@ -0,0 +1,98 @@
+{{/*
+The Tailscale sidecar container to be inserted.
+*/}}
+{{- define "tc.common.addon.tailscale.container" -}}
+{{- $secretName := printf "%s-tailscale-secret" (include "tc.common.names.fullname" .) }}
+name: tailscale
+image: "{{ .Values.tailscaleImage.repository }}:{{ .Values.tailscaleImage.tag }}"
+imagePullPolicy: {{ .Values.tailscaleImage.pullPolicy }}
+
+command:
+  - /usr/local/bin/containerboot
+
+securityContext:
+{{- if .Values.addons.vpn.tailscale.userspace }}
+  runAsUser: 1000
+  runAsGroup: 1000
+  runAsNonRoot: true
+  readOnlyRootFilesystem: true
+{{- else }}
+  runAsUser: 0
+  runAsGroup: 0
+  runAsNonRoot: false
+  readOnlyRootFilesystem: false
+{{- end }}
+  capabilities:
+    add:
+      - NET_ADMIN
+
+envFrom:
+  - secretRef:
+      name: {{ $secretName }}
+
+env:
+  - name: TS_SOCKET
+    value: /var/run/tailscale/tailscaled.sock
+  - name: TS_STATE_DIR
+    value: /var/lib/tailscale
+  - name: TS_AUTH_ONCE
+    value: {{ .Values.addons.vpn.tailscale.auth_once | quote }}
+  - name: TS_USERSPACE
+    value: {{ .Values.addons.vpn.tailscale.userspace | quote }}
+  - name: TS_ACCEPT_DNS
+    value: {{ .Values.addons.vpn.tailscale.accept_dns | quote }}
+    {{- with .Values.addons.vpn.tailscale.outbound_http_proxy_listen }}
+  - name: TS_OUTBOUND_HTTP_PROXY_LISTEN
+    value: {{ . }}
+    {{- end }}
+    {{- with .Values.addons.vpn.tailscale.routes }}
+  - name: TS_ROUTES
+    value: {{ . }}
+    {{- end }}
+    {{- with .Values.addons.vpn.tailscale.dest_ip }}
+  - name: TS_DEST_IP
+    value: {{ . }}
+    {{- end }}
+    {{- with .Values.addons.vpn.tailscale.sock5_server }}
+  - name: TS_SOCKS5_SERVER
+    value: {{ . }}
+    {{- end }}
+    {{- with .Values.addons.vpn.tailscale.extra_args }}
+  - name: TS_EXTRA_ARGS
+    value: {{ . | quote }}
+    {{- end }}
+    {{- with .Values.addons.vpn.tailscale.daemon_extra_args }}
+  - name: TS_TAILSCALED_EXTRA_ARGS
+    value: {{ . | quote }}
+    {{- end }}
+
+{{- range $envList := .Values.addons.vpn.envList }}
+  {{- if and $envList.name $envList.value }}
+  - name: {{ $envList.name }}
+    value: {{ $envList.value | quote }}
+  {{- else }}
+  {{- fail "Please specify name/value for VPN environment variable" }}
+  {{- end }}
+{{- end}}
+
+{{- with .Values.addons.vpn.env }}
+{{- range $k, $v := . }}
+  - name: {{ $k }}
+    value: {{ $v | quote }}
+{{- end }}
+{{- end }}
+
+volumeMounts:
+  - mountPath: {{ .Values.persistence.shared.mountPath }}
+    name: shared
+  - mountPath: /var/lib/tailscale
+    name: {{ printf "%v-%v" .Release.Name "tailscale" }}
+{{- with .Values.addons.vpn.livenessProbe }}
+livenessProbe:
+  {{- toYaml . | nindent 2 }}
+{{- end -}}
+{{- with .Values.addons.vpn.resources }}
+resources:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/addons/vpn/tailscale/_persistence.tpl

@@ -0,0 +1,6 @@
+{{- define "tailscale.addon.persistence" -}}
+enabled: true
+mountPath: /var/lib/tailscale
+size: 1Gi
+noMount: true
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/addons/vpn/tailscale/_secret.tpl

@@ -0,0 +1,19 @@
+{{/* Define the secret */}}
+{{- define "tailscale.secret" -}}
+
+{{- $secretName := printf "%s-tailscale-secret" (include "tc.common.names.fullname" .) }}
+
+---
+{{/* This secrets are loaded on tailscale */}}
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: {{ $secretName }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+data:
+  {{- with .Values.addons.vpn.tailscale.authkey }}
+  TS_AUTH_KEY: {{ . | b64enc }}
+  {{- end }}
+{{- end }}

charts/mosquitto-mqtt/charts/common/templates/addons/vpn/wireguard/_addon.tpl

@@ -0,0 +1,11 @@
+{{/*
+Template to render Wireguard addon. It will add the container to the list of additionalContainers.
+*/}}
+*/}}
+{{- define "tc.common.addon.wireguard" -}}
+  {{/* Append the Wireguard container to the additionalContainers */}}
+  {{- $container := fromYaml (include "tc.common.addon.wireguard.container" .) -}}
+  {{- if $container -}}
+    {{- $_ := set .Values.additionalContainers "addon-wireguard" $container -}}
+  {{- end -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/addons/vpn/wireguard/_container.tpl

@@ -0,0 +1,70 @@
+{{/*
+The Wireguard sidecar container to be inserted.
+*/}}
+{{- define "tc.common.addon.wireguard.container" -}}
+name: wireguard
+image: "{{ .Values.wireguardImage.repository }}:{{ .Values.wireguardImage.tag }}"
+imagePullPolicy: {{ .Values.wireguardImage.pullPolicy }}
+securityContext:
+  runAsUser: 568
+  runAsGroup: 568
+  capabilities:
+    add:
+      - NET_ADMIN
+      - SYS_MODULE
+env:
+  - name: SEPARATOR
+    value: ";"
+  - name: IPTABLES_BACKEND
+    value: "nft"
+{{- range $envList := .Values.addons.vpn.envList }}
+  {{- if and $envList.name $envList.value }}
+  - name: {{ $envList.name }}
+    value: {{ $envList.value | quote }}
+  {{- else }}
+  {{- fail "Please specify name/value for VPN environment variable" }}
+  {{- end }}
+{{- end}}
+
+{{- with .Values.addons.vpn.env }}
+{{- range $k, $v := . }}
+  - name: {{ $k }}
+    value: {{ $v | quote }}
+{{- end }}
+{{- end }}
+
+{{- if .Values.addons.vpn.killSwitch }}
+  - name: KILLSWITCH
+    value: "true"
+  {{- $excludednetworksv4 := "172.16.0.0/12"}}
+  {{- range .Values.addons.vpn.excludedNetworks_IPv4 }}
+    {{- $excludednetworksv4 =  ( printf "%v;%v" $excludednetworksv4 . ) }}
+  {{- end}}
+  - name: KILLSWITCH_EXCLUDEDNETWORKS_IPV4
+    value: {{ $excludednetworksv4 | quote }}
+{{- if .Values.addons.vpn.excludedNetworks_IPv6 }}
+  {{- $excludednetworksv6 := ""}}
+  {{- range .Values.addons.vpn.excludedNetworks_IPv4 }}
+    {{- $excludednetworksv6 =  ( printf "%v;%v" $excludednetworksv6 . ) }}
+  {{- end}}
+  - name: KILLSWITCH_EXCLUDEDNETWORKS_IPV6
+    value: {{ .Values.addons.vpn.excludedNetworks_IPv6 | quote }}
+{{- end }}
+{{- end }}
+
+volumeMounts:
+  - mountPath: {{ .Values.persistence.shared.mountPath }}
+    name: shared
+{{- if .Values.addons.vpn.configFile }}
+  - name: vpnconfig
+    mountPath: /etc/wireguard/wg0.conf
+{{- end }}
+{{- with .Values.addons.vpn.livenessProbe }}
+livenessProbe:
+  {{- toYaml . | nindent 2 }}
+{{- end -}}
+{{- with .Values.addons.vpn.resources }}
+resources:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/class/_HorizontalPodAutoscaler.tpl

@@ -0,0 +1,47 @@
+{{/*
+This template serves as a blueprint for horizontal pod autoscaler objects that are created
+using the common library.
+*/}}
+{{- define "tc.common.class.hpa" -}}
+  {{- $targetName := include "tc.common.names.fullname" . }}
+  {{- $fullName := include "tc.common.names.fullname" . -}}
+  {{- $hpaName := $fullName -}}
+  {{- $values := .Values.hpa -}}
+
+  {{- if hasKey . "ObjectValues" -}}
+    {{- with .ObjectValues.hpa -}}
+      {{- $values = . -}}
+    {{- end -}}
+  {{ end -}}
+
+  {{- if and (hasKey $values "nameOverride") $values.nameOverride -}}
+    {{- $hpaName = printf "%v-%v" $hpaName $values.nameOverride -}}
+  {{- end }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ $hpaName }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: {{ $values.targetKind | default ( include "tc.common.names.controllerType" . ) }}
+    name: {{ $values.target | default $targetName }}
+  minReplicas: {{ $values.minReplicas | default 1 }}
+  maxReplicas: {{ $values.maxReplicas | default 3 }}
+  metrics:
+    {{- if $values.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        targetAverageUtilization: {{ $values.targetCPUUtilizationPercentage }}
+    {{- end }}
+    {{- if $values.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        targetAverageUtilization: {{ $values.targetMemoryUtilizationPercentage }}
+    {{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/class/_configmap.tpl

@@ -0,0 +1,35 @@
+{{/*
+This template serves as a blueprint for all configMap objects that are created
+within the common library.
+*/}}
+{{- define "tc.common.class.configmap" -}}
+  {{- $fullName := include "tc.common.names.fullname" . -}}
+  {{- $configMapName := $fullName -}}
+  {{- $values := .Values.configmap -}}
+
+  {{- if hasKey . "ObjectValues" -}}
+    {{- with .ObjectValues.configmap -}}
+      {{- $values = . -}}
+    {{- end -}}
+  {{ end -}}
+
+  {{- if and (hasKey $values "nameOverride") $values.nameOverride -}}
+    {{- $configMapName = printf "%v-%v" $configMapName $values.nameOverride -}}
+  {{- end }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ $configMapName }}
+  {{- with (merge ($values.labels | default dict) (include "tc.common.labels" $ | fromYaml)) }}
+  labels: {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+  {{- with (merge ($values.annotations | default dict) (include "tc.common.annotations" $ | fromYaml)) }}
+  annotations:
+    {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+data:
+{{- with $values.data }}
+  {{- tpl (toYaml .) $ | nindent 2 }}
+{{- end }}
+{{- end }}

charts/mosquitto-mqtt/charts/common/templates/class/_ingress.tpl

@@ -0,0 +1,128 @@
+{{/*
+This template serves as a blueprint for all Ingress objects that are created
+within the common library.
+*/}}
+{{- define "tc.common.class.ingress" -}}
+  {{- $fullName := include "tc.common.names.fullname" . -}}
+  {{- $ingressName := $fullName -}}
+  {{- $values := .Values.ingress -}}
+
+  {{- if hasKey . "ObjectValues" -}}
+    {{- with .ObjectValues.ingress -}}
+      {{- $values = . -}}
+    {{- end -}}
+  {{ end -}}
+
+  {{- if and (hasKey $values "nameOverride") $values.nameOverride -}}
+    {{- $ingressName = printf "%v-%v" $ingressName $values.nameOverride -}}
+  {{- end -}}
+
+  {{- $primaryService := get .Values.service (include "tc.common.lib.util.service.primary" .) -}}
+  {{- $autoLinkService := get .Values.service (include "tc.common.lib.util.service.primary" .) -}}
+  {{- $defaultServiceName := $fullName -}}
+  {{- if and (hasKey $primaryService "nameOverride") $primaryService.nameOverride -}}
+    {{- $defaultServiceName = printf "%v-%v" $defaultServiceName $primaryService.nameOverride -}}
+  {{- end -}}
+  {{- $defaultServicePort := get $primaryService.ports (include "tc.common.lib.util.service.ports.primary" (dict "values" $primaryService)) -}}
+
+  {{- if and (hasKey $values "nameOverride") ( $values.nameOverride ) ( $values.autoLink ) -}}
+    {{- $autoLinkService = get .Values.service $values.nameOverride -}}
+    {{- $defaultServiceName = $ingressName -}}
+    {{- $defaultServicePort = get $autoLinkService.ports $values.nameOverride -}}
+  {{- end -}}
+
+
+  {{- $isStable := include "tc.common.capabilities.ingress.isStable" . }}
+
+  {{- $mddwrNamespace := "default" }}
+  {{- if $values.ingressClassName }}
+  {{- $mddwrNamespace = ( printf "ix-%s" $values.ingressClassName ) }}
+  {{- end }}
+
+  {{- $fixedMiddlewares := "" }}
+  {{- if $values.enableFixedMiddlewares }}
+  {{ range $index, $fixedMiddleware := $values.fixedMiddlewares }}
+      {{- if $index }}
+      {{ $fixedMiddlewares = ( printf "%v, %v-%v@%v" $fixedMiddlewares $mddwrNamespace $fixedMiddleware "kubernetescrd" ) }}
+      {{- else }}
+      {{ $fixedMiddlewares = ( printf "%v-%v@%v" $mddwrNamespace $fixedMiddleware "kubernetescrd" ) }}
+      {{- end }}
+  {{ end }}
+  {{- end }}
+
+  {{- $middlewares := "" }}
+  {{ range $index, $middleware := $values.middlewares }}
+      {{- if $index }}
+      {{ $middlewares = ( printf "%v, %v-%v@%v" $middlewares $mddwrNamespace $middleware "kubernetescrd" ) }}
+      {{- else }}
+      {{ $middlewares = ( printf "%v-%v@%v" $mddwrNamespace $middleware "kubernetescrd" ) }}
+      {{- end }}
+  {{ end }}
+
+  {{- if and ( $fixedMiddlewares ) ( $middlewares ) }}
+    {{ $middlewares = ( printf "%v, %v" $fixedMiddlewares $middlewares ) }}
+  {{- else if $fixedMiddlewares }}
+      {{ $middlewares = ( printf "%s" $fixedMiddlewares ) }}
+  {{ end }}
+
+---
+apiVersion: {{ include "tc.common.capabilities.ingress.apiVersion" . }}
+kind: Ingress
+metadata:
+  name: {{ $ingressName }}
+  {{- with (merge ($values.labels | default dict) (include "tc.common.labels" $ | fromYaml)) }}
+  labels: {{- toYaml . | nindent 4 }}
+  {{- end }}
+  annotations:
+    "traefik.ingress.kubernetes.io/router.entrypoints": {{ $values.entrypoint | default "websecure" }}
+    "traefik.ingress.kubernetes.io/router.middlewares": {{ $middlewares | quote }}
+  {{- with (merge ($values.annotations | default dict) (include "tc.common.annotations" $ | fromYaml)) }}
+    {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if and $isStable $values.ingressClassName }}
+  ingressClassName: {{ $values.ingressClassName }}
+  {{- end }}
+  {{- if $values.tls }}
+  tls:
+    {{- range $index, $tlsValues :=  $values.tls }}
+    - hosts:
+        {{- range $tlsValues.hosts }}
+        - {{ tpl . $ | quote }}
+        {{- end }}
+      {{- if $tlsValues.scaleCert }}
+      secretName: {{ ( printf "%v-%v-%v-%v-%v-%v" $ingressName "tls" $index "ixcert" $tlsValues.scaleCert $.Release.Revision ) }}
+      {{- else if .secretName }}
+      secretName: {{ tpl .secretName $ | quote}}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+  rules:
+  {{- range $values.hosts }}
+    - host: {{ tpl .host $ | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          {{- $service := $defaultServiceName -}}
+          {{- $port := $defaultServicePort.port -}}
+          {{- if .service -}}
+            {{- $service = default $service .service.name -}}
+            {{- $port = default $port .service.port -}}
+          {{- end }}
+          - path: {{ tpl .path $ | quote }}
+            {{- if $isStable }}
+            pathType: {{ default "Prefix" .pathType }}
+            {{- end }}
+            backend:
+              {{- if $isStable }}
+              service:
+                name: {{ $service }}
+                port:
+                  number: {{ $port }}
+              {{- else }}
+              serviceName: {{ $service }}
+              servicePort: {{ $port }}
+              {{- end }}
+          {{- end }}
+  {{- end }}
+{{- end }}

charts/mosquitto-mqtt/charts/common/templates/class/_networkPolicy.tpl

@@ -0,0 +1,176 @@
+{{/*
+Blueprint for the NetworkPolicy object that can be included in the addon.
+*/}}
+{{- define "tc.common.class.networkpolicy" -}}
+  {{- $fullName := include "tc.common.names.fullname" . -}}
+  {{- $networkPolicyName := $fullName -}}
+  {{- $values := .Values.networkPolicy -}}
+
+  {{- if hasKey . "ObjectValues" -}}
+    {{- with .ObjectValues.networkPolicy -}}
+      {{- $values = . -}}
+    {{- end -}}
+  {{ end -}}
+
+  {{- if and (hasKey $values "nameOverride") $values.nameOverride -}}
+    {{- $networkPolicyName = printf "%v-%v" $networkPolicyName $values.nameOverride -}}
+  {{- end }}
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: {{ $networkPolicyName }}
+  {{- with (merge ($values.labels | default dict) (include "tc.common.labels" $ | fromYaml)) }}
+  labels: {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with (merge ($values.annotations | default dict) (include "tc.common.annotations" $ | fromYaml)) }}
+  annotations:
+    {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+spec:
+  podSelector:
+  {{- if $values.podSelector }}
+  {{- with $values.podSelector }}
+    {{- . | toYaml | nindent 4 }}
+  {{- end -}}
+  {{- else }}
+    matchLabels:
+    {{- include "tc.common.labels.selectorLabels" . | nindent 6 }}
+  {{- end }}
+
+  {{- if $values.policyType }}
+  {{- if eq $values.policyType "ingress" }}
+  policyTypes: ["Ingress"]
+  {{- else if eq $values.policyType "egress" }}
+  policyTypes: ["Egress"]
+
+  {{- else if eq $values.policyType "ingress-egress" }}
+  policyTypes: ["Ingress", "Egress"]
+  {{- end -}}
+  {{- end -}}
+
+  {{- if $values.egress }}
+  egress:
+  {{- range $values.egress }}
+  - to:
+    {{- range .to }}
+    {{- $nss := false }}
+    {{- $ipb := false }}
+      {{- if .ipBlock }}
+      {{- if .ipBlock.cidr }}
+      {{- $ipb = true }}
+    - ipBlock:
+        cidr: {{ .ipBlock.cidr }}
+      {{- if .ipBlock.except }}
+        except:
+        {{- range .ipBlock.except }}
+        - {{ . }}
+        {{- end }}
+      {{- end -}}
+      {{- end -}}
+      {{- end -}}
+
+      {{- if and ( .namespaceSelector ) ( not $ipb ) }}
+      {{- if or ( .namespaceSelector.matchLabels ) ( .namespaceSelector.matchExpressions ) -}}
+      {{- $nss = true }}
+    - namespaceSelector:
+       {{- if .namespaceSelector.matchLabels }}
+         matchLabels:
+          {{- .namespaceSelector.matchLabels | toYaml | nindent 12 }}
+       {{- end -}}
+       {{- if .namespaceSelector.matchExpressions }}
+         matchExpressions:
+          {{- .namespaceSelector.matchExpressions | toYaml | nindent 12 }}
+       {{- end -}}
+      {{- end -}}
+      {{- end -}}
+
+      {{- if and ( .podSelector ) ( not $ipb ) }}
+      {{- if or ( .podSelector.matchLabels ) ( .podSelector.matchExpressions ) }}
+      {{- if $nss }}
+      podSelector:
+      {{- else }}
+    - podSelector:
+      {{- end }}
+       {{- if .podSelector.matchLabels }}
+         matchLabels:
+          {{- .podSelector.matchLabels | toYaml | nindent 12 }}
+       {{- end -}}
+       {{- if .podSelector.matchExpressions }}
+         matchExpressions:
+          {{- .podSelector.matchExpressions | toYaml | nindent 12 }}
+       {{- end -}}
+      {{- end -}}
+      {{- end -}}
+    {{- end -}}
+
+
+  {{- with .ports }}
+    ports:
+    {{- . | toYaml | nindent 6 }}
+  {{- end -}}
+  {{- end -}}
+  {{- end -}}
+
+  {{- if $values.ingress }}
+  ingress:
+  {{- range $values.ingress }}
+  - from:
+    {{- range .from }}
+    {{- $nss := false }}
+    {{- $ipb := false }}
+      {{- if .ipBlock }}
+      {{- if .ipBlock.cidr }}
+      {{- $ipb = true }}
+    - ipBlock:
+        cidr: {{ .ipBlock.cidr }}
+      {{- if .ipBlock.except }}
+        except:
+        {{- range .ipBlock.except }}
+        - {{ . }}
+        {{- end }}
+      {{- end -}}
+      {{- end -}}
+      {{- end -}}
+
+      {{- if and ( .namespaceSelector ) ( not $ipb ) }}
+      {{- if or ( .namespaceSelector.matchLabels ) ( .namespaceSelector.matchExpressions ) -}}
+      {{- $nss = true }}
+    - namespaceSelector:
+       {{- if .namespaceSelector.matchLabels }}
+         matchLabels:
+          {{- .namespaceSelector.matchLabels | toYaml | nindent 12 }}
+       {{- end -}}
+       {{- if .namespaceSelector.matchExpressions }}
+         matchExpressions:
+          {{- .namespaceSelector.matchExpressions | toYaml | nindent 12 }}
+       {{- end -}}
+      {{- end -}}
+      {{- end -}}
+
+      {{- if and ( .podSelector ) ( not $ipb ) }}
+      {{- if or ( .podSelector.matchLabels ) ( .podSelector.matchExpressions ) }}
+      {{- if $nss }}
+      podSelector:
+      {{- else }}
+    - podSelector:
+      {{- end }}
+       {{- if .podSelector.matchLabels }}
+         matchLabels:
+          {{- .podSelector.matchLabels | toYaml | nindent 12 }}
+       {{- end -}}
+       {{- if .podSelector.matchExpressions }}
+         matchExpressions:
+          {{- .podSelector.matchExpressions | toYaml | nindent 12 }}
+       {{- end -}}
+      {{- end -}}
+      {{- end -}}
+    {{- end -}}
+
+  {{- with .ports }}
+    ports:
+    {{- . | toYaml | nindent 6 }}
+  {{- end -}}
+  {{- end -}}
+  {{- end -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/class/_pvc.tpl

@@ -0,0 +1,54 @@
+{{/*
+This template serves as a blueprint for all PersistentVolumeClaim objects that are created
+within the common library.
+*/}}
+{{- define "tc.common.class.pvc" -}}
+{{- $values := .Values.persistence -}}
+{{- if hasKey . "ObjectValues" -}}
+  {{- with .ObjectValues.persistence -}}
+    {{- $values = . -}}
+  {{- end -}}
+{{ end -}}
+{{- $pvcName := include "tc.common.names.fullname" . -}}
+{{- if and (hasKey $values "nameOverride") $values.nameOverride -}}
+  {{- if not (eq $values.nameOverride "-") -}}
+    {{- $pvcName = printf "%v-%v" $pvcName $values.nameOverride -}}
+  {{ end -}}
+{{ end }}
+{{- if $values.forceName -}}
+  {{- $pvcName = $values.forceName -}}
+{{ end }}
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ $pvcName }}
+  {{- if or $values.retain $values.annotations }}
+  annotations:
+    {{- if $values.retain }}
+    "helm.sh/resource-policy": keep
+    {{- end }}
+    {{- with (merge ($values.annotations | default dict) (include "tc.common.annotations" $ | fromYaml)) }}
+    {{- tpl ( toYaml . ) $ | nindent 4 }}
+    {{- end }}
+  {{- end }}
+  labels:
+  {{- include "tc.common.labels" . | nindent 4 }}
+  {{- with $values.labels }}
+    {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+spec:
+  accessModes:
+    - {{ ( $values.accessMode | default "ReadWriteOnce" ) | quote }}
+  resources:
+    requests:
+      storage: {{ $values.size | default "999Gi" | quote }}
+  {{- with $values.spec }}
+  {{ tpl ( toYaml . ) $ | indent 2 }}
+  {{- end }}
+  {{ include "tc.common.storage.storageClassName" ( dict "persistence" $values "global" $ ) }}
+  {{- if $values.volumeName }}
+  volumeName: {{ $values.volumeName | quote }}
+  {{- end }}
+
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/class/_rbac.tpl

@@ -0,0 +1,71 @@
+{{/*
+This template serves as a blueprint for rbac objects that are created
+using the common library.
+*/}}
+{{- define "tc.common.class.rbac" -}}
+  {{- $fullName := include "tc.common.names.fullname" . -}}
+  {{- $saName := $fullName -}}
+  {{- $rbacName := $fullName -}}
+  {{- $values := .Values.rbac -}}
+  {{- $saValues := .Values.serviceAccount -}}
+  {{- if hasKey . "ObjectValues" -}}
+    {{- with .ObjectValues.rbac -}}
+      {{- $values = . -}}
+    {{- end -}}
+  {{ end -}}
+
+  {{- if and (hasKey $values "nameOverride") $values.nameOverride -}}
+    {{- $saName = printf "%v-%v" $saName $values.nameOverride -}}
+    {{- if not (hasKey $saValues $values.nameOverride) -}}
+      {{- $saName = "default" -}}
+    {{- end }}
+  {{- end }}
+
+  {{- if and (hasKey $values "nameOverride") $values.nameOverride -}}
+    {{- $rbacName = printf "%v-%v" $rbacName $values.nameOverride -}}
+  {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ $rbacName }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+    {{- with $values.labels }}
+    {{- tpl ( toYaml . ) $ | nindent 4 }}
+    {{- end }}
+  annotations:
+    {{- with (merge ($values.annotations | default dict) (include "tc.common.annotations" $ | fromYaml)) }}
+    {{- tpl ( toYaml . ) $ | nindent 4 }}
+    {{- end }}
+{{- with $values.rules }}
+rules:
+  {{- tpl ( toYaml . ) $ | nindent 4 }}
+{{- end}}
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ $rbacName }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+    {{- with $values.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  annotations:
+    {{- with (merge ($values.annotations | default dict) (include "tc.common.annotations" $ | fromYaml)) }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ $rbacName }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ $saName }}
+    namespace: {{ .Release.Namespace }}
+  {{- with $values.subjects }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/class/_secret.tpl

@@ -0,0 +1,35 @@
+{{/*
+This template serves as a blueprint for all secret objects that are created
+within the common library.
+*/}}
+{{- define "tc.common.class.secret" -}}
+  {{- $fullName := include "tc.common.names.fullname" . -}}
+  {{- $secretName := $fullName -}}
+  {{- $values := .Values.secret -}}
+
+  {{- if hasKey . "ObjectValues" -}}
+    {{- with .ObjectValues.secret -}}
+      {{- $values = . -}}
+    {{- end -}}
+  {{ end -}}
+
+  {{- if and (hasKey $values "nameOverride") $values.nameOverride -}}
+    {{- $secretName = printf "%v-%v" $secretName $values.nameOverride -}}
+  {{- end }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $secretName }}
+  {{- with (merge ($values.labels | default dict) (include "tc.common.labels" $ | fromYaml)) }}
+  labels: {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with (merge ($values.annotations | default dict) (include "tc.common.annotations" $ | fromYaml)) }}
+  annotations:
+    {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+stringData:
+{{- with $values.data }}
+  {{- tpl (toYaml .) $ | nindent 2 }}
+{{- end }}
+{{- end }}

charts/mosquitto-mqtt/charts/common/templates/class/_service.tpl

@@ -0,0 +1,125 @@
+{{/*
+This template serves as a blueprint for all Service objects that are created
+within the common library.
+*/}}
+{{- define "tc.common.class.service" -}}
+{{- $values := .Values.service -}}
+{{- if hasKey . "ObjectValues" -}}
+  {{- with .ObjectValues.service -}}
+    {{- $values = . -}}
+  {{- end -}}
+{{ end -}}
+
+{{- $serviceName := include "tc.common.names.fullname" . -}}
+{{- if and (hasKey $values "nameOverride") $values.nameOverride -}}
+  {{- $serviceName = printf "%v-%v" $serviceName $values.nameOverride -}}
+{{ end -}}
+{{- $svcType := $values.type | default "" -}}
+{{- $primaryPort := get $values.ports (include "tc.common.lib.util.service.ports.primary" (dict "values" $values)) }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $serviceName }}
+  {{- with (merge ($values.labels | default dict) (include "tc.common.labels" $ | fromYaml)) }}
+  labels: {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+  annotations:
+  {{- if eq ( $primaryPort.protocol | default "" ) "HTTPS" }}
+    traefik.ingress.kubernetes.io/service.serversscheme: https
+  {{- end }}
+  {{- if eq ( $svcType | default "" ) "LoadBalancer" }}
+    metallb.universe.tf/allow-shared-ip: {{ include "tc.common.names.fullname" . }}
+  {{- end }}
+  {{- with (merge ($values.annotations | default dict) (include "tc.common.annotations" $ | fromYaml)) }}
+    {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if (or (eq $svcType "LoadBalancer") (empty $svcType)) }}
+  type: LoadBalancer
+  {{- if $values.LoadBalancer }}
+  LoadBalancer: {{ $values.LoadBalancer }}
+  {{end}}
+  {{- else if eq $svcType "ExternalName" }}
+  type: {{ $svcType }}
+  externalName: {{ $values.externalName }}
+  {{- else if eq $svcType "ExternalIP" }}
+  {{- else if eq $svcType "LoadBalancer" }}
+  type: {{ $svcType }}
+  {{- if $values.loadBalancerIP }}
+  loadBalancerIP: {{ $values.loadBalancerIP }}
+  {{- end }}
+  {{- if $values.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges:
+    {{ toYaml $values.loadBalancerSourceRanges | nindent 4 }}
+  {{- end -}}
+  {{- else }}
+  type: {{ $svcType }}
+  {{- end }}
+  {{- if $values.externalTrafficPolicy }}
+  externalTrafficPolicy: {{ $values.externalTrafficPolicy }}
+  {{- end }}
+  {{- if $values.sessionAffinity }}
+  sessionAffinity: {{ $values.sessionAffinity }}
+  {{- if $values.sessionAffinityConfig }}
+  sessionAffinityConfig:
+    {{ toYaml $values.sessionAffinityConfig | nindent 4 }}
+  {{- end -}}
+  {{- end }}
+  {{- with $values.externalIPs }}
+  externalIPs:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- if $values.publishNotReadyAddresses }}
+  publishNotReadyAddresses: {{ $values.publishNotReadyAddresses }}
+  {{- end }}
+  ports:
+  {{- range $name, $port := $values.ports }}
+  {{- if $port.enabled }}
+  - port: {{ $port.port }}
+    targetPort: {{ $port.targetPort | default $name }}
+    {{- if $port.protocol }}
+    {{- if or ( eq $port.protocol "HTTP" ) ( eq $port.protocol "HTTPS" ) ( eq $port.protocol "TCP" ) }}
+    protocol: TCP
+    {{- else }}
+    protocol: {{ $port.protocol }}
+    {{- end }}
+    {{- else }}
+    protocol: TCP
+    {{- end }}
+    name: {{ $name }}
+    {{- if (and (eq $svcType "NodePort") (not (empty $port.nodePort))) }}
+    nodePort: {{ $port.nodePort }}
+    {{ end }}
+  {{- end }}
+  {{- end }}
+  {{- if and ( ne $svcType "ExternalName" ) ( ne $svcType "ExternalIP" )}}
+  selector:
+  {{- if $values.selector }}
+  {{- with $values.selector }}
+    {{- tpl (toYaml .) $ | nindent 4 }}
+  {{- end }}
+  {{- else }}
+    {{- include "tc.common.labels.selectorLabels" . | nindent 4 }}
+  {{- end }}
+  {{- end }}
+{{- if eq $svcType "ExternalIP" }}
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: {{ $serviceName }}
+  labels:
+    {{- include "tc.common.labels" $ | nindent 4 }}
+subsets:
+  - addresses:
+      - ip: {{ $values.externalIP }}
+    ports:
+    {{- range $name, $port := $values.ports }}
+    {{- if $port.enabled }}
+      - port: {{ $port.port | default 80 }}
+        name: {{ $name }}
+    {{- end }}
+    {{- end }}
+{{- end }}
+{{- end }}

charts/mosquitto-mqtt/charts/common/templates/class/_serviceaccount.tpl

@@ -0,0 +1,31 @@
+{{/*
+This template serves as a blueprint for ServiceAccount objects that are created
+using the common library.
+*/}}
+{{- define "tc.common.class.serviceAccount" -}}
+  {{- $fullName := include "tc.common.names.fullname" . -}}
+  {{- $saName := $fullName -}}
+  {{- $values := .Values.serviceAccount -}}
+
+  {{- if hasKey . "ObjectValues" -}}
+    {{- with .ObjectValues.serviceAccount -}}
+      {{- $values = . -}}
+    {{- end -}}
+  {{- end -}}
+
+  {{- if and (hasKey $values "nameOverride") $values.nameOverride -}}
+    {{- $saName = printf "%v-%v" $saName $values.nameOverride -}}
+  {{- end }}
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ $saName }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+  {{- with $values.annotations }}
+  annotations:
+    {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+{{- end }}

charts/mosquitto-mqtt/charts/common/templates/lib/chart/_annotations.tpl

@@ -0,0 +1,22 @@
+{{/* Common annotations shared across objects */}}
+{{- define "tc.common.annotations" -}}
+  {{- with .Values.global.annotations }}
+    {{- range $k, $v := . }}
+      {{- $name := $k }}
+      {{- $value := tpl $v $ }}
+{{ $name }}: {{ quote $value }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/* Annotations on all workload spec objects */}}
+{{- define "tc.common.annotations.workload.spec" -}}
+{{- if .Values.ixExternalInterfacesConfigurationNames }}
+k8s.v1.cni.cncf.io/networks: {{ join ", " .Values.ixExternalInterfacesConfigurationNames }}
+{{- end }}
+{{- end -}}
+
+{{/* Annotations on all workload objects */}}
+{{- define "tc.common.annotations.workload" -}}
+rollme: {{ randAlphaNum 5 | quote }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/chart/_capabilities.tpl

@@ -0,0 +1,19 @@
+{{/* Allow KubeVersion to be overridden. */}}
+{{- define "tc.common.capabilities.ingress.kubeVersion" -}}
+  {{- default .Capabilities.KubeVersion.Version .Values.kubeVersionOverride -}}
+{{- end -}}
+
+{{/* Return the appropriate apiVersion for Ingress objects */}}
+{{- define "tc.common.capabilities.ingress.apiVersion" -}}
+  {{- print "networking.k8s.io/v1" -}}
+  {{- if semverCompare "<1.19" (include "tc.common.capabilities.ingress.kubeVersion" .) -}}
+    {{- print "beta1" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/* Check Ingress stability */}}
+{{- define "tc.common.capabilities.ingress.isStable" -}}
+  {{- if eq (include "tc.common.capabilities.ingress.apiVersion" .) "networking.k8s.io/v1" -}}
+    {{- true -}}
+  {{- end -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/chart/_labels.tpl

@@ -0,0 +1,23 @@
+{{/* Common labels shared across objects */}}
+{{- define "tc.common.labels" -}}
+helm.sh/chart: {{ include "tc.common.names.chart" . }}
+{{ include "tc.common.labels.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+helm-revision: "{{ .Release.Revision }}"
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- with .Values.global.labels }}
+  {{- range $k, $v := . }}
+    {{- $name := $k }}
+    {{- $value := tpl $v $ }}
+{{ $name }}: {{ quote $value }}
+    {{- end }}
+{{- end }}
+{{- end -}}
+
+{{/* Selector labels shared across objects */}}
+{{- define "tc.common.labels.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "tc.common.names.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/chart/_names.tpl

@@ -0,0 +1,56 @@
+{{/* Expand the name of the chart */}}
+{{- define "tc.common.names.name" -}}
+  {{- $globalNameOverride := "" -}}
+  {{- if hasKey .Values "global" -}}
+    {{- $globalNameOverride = (default $globalNameOverride .Values.global.nameOverride) -}}
+  {{- end -}}
+  {{- default .Chart.Name (default .Values.nameOverride $globalNameOverride) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "tc.common.names.fullname" -}}
+  {{- $name := include "tc.common.names.name" . -}}
+  {{- $globalFullNameOverride := "" -}}
+  {{- if hasKey .Values "global" -}}
+    {{- $globalFullNameOverride = (default $globalFullNameOverride .Values.global.fullnameOverride) -}}
+  {{- end -}}
+  {{- if or .Values.fullnameOverride $globalFullNameOverride -}}
+    {{- $name = default .Values.fullnameOverride $globalFullNameOverride -}}
+  {{- else -}}
+    {{- if contains $name .Release.Name -}}
+      {{- $name = .Release.Name -}}
+    {{- else -}}
+      {{- $name = printf "%s-%s" .Release.Name $name -}}
+    {{- end -}}
+  {{- end -}}
+  {{- trunc 63 $name | trimSuffix "-" -}}
+{{- end -}}
+
+{{/* Create chart name and version as used by the chart label */}}
+{{- define "tc.common.names.chart" -}}
+  {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/* Return the properly cased version of the controller type */}}
+{{- define "tc.common.names.controllerType" -}}
+  {{- if eq .Values.controller.type "deployment" -}}
+    {{- print "Deployment" -}}
+  {{- else if eq .Values.controller.type "daemonset" -}}
+    {{- print "DaemonSet" -}}
+  {{- else if eq .Values.controller.type "statefulset"  -}}
+    {{- print "StatefulSet" -}}
+  {{- else -}}
+    {{- fail (printf "Not a valid controller.type (%s)" .Values.controller.type) -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Create the "name" + "." + "namespace" fqdn
+*/}}
+{{- define "tc.common.names.fqdn" -}}
+{{- printf "%s.%s" (include "tc.common.names.fullname" .) .Release.Namespace | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/controller/_container.tpl

@@ -0,0 +1,150 @@
+{{/* The main container included in the controller */}}
+{{- define "tc.common.controller.mainContainer" -}}
+- name: {{ include "tc.common.names.fullname" . }}
+  image: {{ include "tc.common.images.selector" . }}
+  imagePullPolicy: {{ .Values.image.pullPolicy }}
+  {{- with .Values.command }}
+  command:
+    {{- if kindIs "string" . }}
+    - {{ tpl . $ }}
+    {{- else }}
+      {{ tpl ( toYaml . ) $ | nindent 4 }}
+    {{- end }}
+  {{- end }}
+  {{- if or ( .Values.extraArgs ) ( .Values.args ) }}
+  args:
+  {{- with .Values.args }}
+    {{- if kindIs "string" . }}
+    - {{ tpl . $ }}
+    {{- else }}
+    {{- tpl ( toYaml . ) $ | nindent 4 }}
+    {{- end }}
+  {{- end }}
+  {{- with .Values.extraArgs }}
+    {{- if kindIs "string" . }}
+    - {{ tpl . $ }}
+    {{- else }}
+    {{- tpl ( toYaml . ) $ | nindent 4 }}
+    {{- end }}
+  {{- end }}
+  {{- end }}
+  {{- with .Values.tty }}
+  tty: {{ . }}
+  {{- end }}
+  {{- with .Values.stdin }}
+  stdin: {{ . }}
+  {{- end }}
+  {{- with .Values.securityContext }}
+  securityContext:
+    {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+  {{- with .Values.lifecycle }}
+  lifecycle:
+    {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+  {{- with .Values.termination.messagePath }}
+  terminationMessagePath: {{ tpl . $ }}
+  {{- end }}
+  {{- with .Values.termination.messagePolicy }}
+  terminationMessagePolicy: {{ tpl . $ }}
+  {{- end }}
+
+  env:
+   {{- if and ( not .Values.podSecurityContext.runAsUser) ( .Values.security.PUID ) }}
+    - name: PUID
+      value: {{ tpl ( toYaml .Values.security.PUID ) $ | quote }}
+    - name: USER_ID
+      value: {{ tpl ( toYaml .Values.security.PUID ) $ | quote }}
+    - name: UID
+      value: {{ tpl ( toYaml .Values.security.PUID ) $ | quote }}
+   {{- end }}
+    - name: UMASK
+      value: {{ tpl ( toYaml .Values.security.UMASK ) $ | quote }}
+    - name: UMASK_SET
+      value: {{ tpl ( toYaml .Values.security.UMASK ) $ | quote }}
+   {{- if and ( not .Values.podSecurityContext.runAsUser) ( .Values.security.PUID ) }}
+    - name: PGID
+      value: {{ tpl ( toYaml .Values.podSecurityContext.fsGroup ) $ | quote }}
+    - name: GROUP_ID
+      value: {{ tpl ( toYaml .Values.podSecurityContext.fsGroup ) $ | quote }}
+    - name: GID
+      value: {{ tpl ( toYaml .Values.podSecurityContext.fsGroup ) $ | quote }}
+   {{- end }}
+   {{- if or ( .Values.securityContext.readOnlyRootFilesystem ) ( .Values.securityContext.runAsNonRoot ) }}
+    - name: S6_READ_ONLY_ROOT
+      value: "1"
+   {{- end }}
+   {{- if not ( .Values.scaleGPU ) }}
+    - name: NVIDIA_VISIBLE_DEVICES
+      value: "void"
+   {{- else }}
+    - name: NVIDIA_DRIVER_CAPABILITIES
+      value: "all"
+   {{- end }}
+    - name: TZ
+      value: {{ tpl ( toYaml .Values.TZ ) $ | quote }}
+  {{- with .Values.env }}
+    {{- range $k, $v := . }}
+      {{- $name := $k }}
+      {{- $value := $v }}
+      {{- if kindIs "int" $name }}
+        {{- $name = required "environment variables as a list of maps require a name field" $value.name }}
+      {{- end }}
+    - name: {{ quote $name }}
+      {{- if kindIs "map" $value -}}
+        {{- if hasKey $value "value" }}
+            {{- $value = $value.value -}}
+        {{- else if hasKey $value "valueFrom" }}
+      valueFrom: {{- tpl ( toYaml $value.valueFrom ) $ | nindent 8 }}
+        {{- else }}
+      valueFrom: {{- tpl ( toYaml $value ) $ | nindent 8 }}
+        {{- end }}
+      {{- end }}
+      {{- if not (kindIs "map" $value) }}
+        {{- if kindIs "string" $value }}
+          {{- $value = tpl $value $ }}
+        {{- end }}
+      value: {{ quote $value }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+  {{- range $envList := .Values.envList }}
+    {{- if and $envList.name $envList.value }}
+    - name: {{ $envList.name }}
+      value: {{ $envList.value | quote }}
+    {{- else }}
+    {{- fail "Please specify name/value for environment variable" }}
+    {{- end }}
+  {{- end}}
+  envFrom:
+  {{- if .Values.secretEnv }}
+    - secretRef:
+        name: {{ include "tc.common.names.fullname" . }}
+  {{- end }}
+  {{- range .Values.envFrom }}
+  {{- if  .secretRef }}
+    - secretRef:
+        name: {{ tpl .secretRef.name $ | quote }}
+  {{- else if  .configMapRef }}
+    - configMapRef:
+        name: {{ tpl .configMapRef.name $ | quote }}
+  {{- else }}
+  {{- end }}
+  {{- end }}
+  ports:
+  {{- include "tc.common.controller.ports" . | trim | nindent 4 }}
+  {{- with (include "tc.common.controller.volumeMounts" . | trim) }}
+  volumeMounts:
+    {{ nindent 4 . }}
+  {{- end }}
+  {{- include "tc.common.controller.probes" . | trim | nindent 2 }}
+  {{/*
+  Merges the TrueNAS SCALE generated GPU info with the .Values.resources dict
+  */}}
+  {{- $resources := dict "limits" ( .Values.scaleGPU | default dict ) }}
+  {{- $resources = merge $resources .Values.resources }}
+  resources:
+  {{- with $resources }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/controller/_pod.tpl

@@ -0,0 +1,128 @@
+{{/*
+The pod definition included in the controller.
+*/}}
+{{- define "tc.common.controller.pod" -}}
+  {{- with .Values.imagePullSecrets }}
+imagePullSecrets:
+    {{ tpl ( toYaml . ) $ | nindent 2 }}
+  {{- end }}
+
+{{- $saName := include "tc.common.names.fullname" . -}}
+{{- if not .Values.serviceAccount.main.enabled }}
+  {{ $saName = "default" }}
+{{- end }}
+serviceAccountName: {{ $saName }}
+  {{- with .Values.podSecurityContext }}
+securityContext:
+    {{ tpl ( toYaml . ) $ | nindent 2 }}
+  {{- end }}
+  {{- with .Values.priorityClassName }}
+priorityClassName: {{ tpl . $ }}
+  {{- end }}
+  {{- with .Values.schedulerName }}
+schedulerName: {{ tpl . $ }}
+  {{- end }}
+  {{- with .Values.hostNetwork }}
+hostNetwork: {{ . }}
+  {{- end }}
+  {{- with .Values.hostname }}
+hostname: {{ tpl . $ }}
+  {{- end }}
+  {{- if .Values.dnsPolicy }}
+dnsPolicy: {{ .Values.dnsPolicy }}
+  {{- else if .Values.hostNetwork }}
+dnsPolicy: ClusterFirstWithHostNet
+  {{- else }}
+dnsPolicy: ClusterFirst
+  {{- end }}
+{{- if or .Values.dnsConfig.options .Values.dnsConfig.nameservers .Values.dnsConfig.searches }}
+dnsConfig:
+  {{- with .Values.dnsConfig.options }}
+  options:
+    {{ tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+  {{- with .Values.dnsConfig.nameservers }}
+  nameservers:
+    {{ tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+  {{- with .Values.dnsConfig.searches }}
+  searches:
+    {{ tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+{{- end }}
+enableServiceLinks: {{ .Values.enableServiceLinks }}
+  {{- with .Values.termination.gracePeriodSeconds }}
+terminationGracePeriodSeconds: {{ . }}
+  {{- end }}
+initContainers:
+  {{- include "tc.common.controller.prepare" . | nindent 2 }}
+  {{- if and ( or ( .Release.IsInstall ) ( .Values.test.install ) ) ( .Values.installContainers )}}
+    {{- $installContainers := list }}
+    {{- range $index, $key := (keys .Values.installContainers | uniq | sortAlpha) }}
+      {{- $container := get $.Values.installContainers $key }}
+      {{- if not $container.name -}}
+        {{- $_ := set $container "name" $key }}
+      {{- end }}
+      {{- $installContainers = append $installContainers $container }}
+    {{- end }}
+    {{- tpl (toYaml $installContainers) $ | nindent 2 }}
+  {{- end }}
+  {{- if and ( or ( .Release.IsUpgrade ) ( .Values.test.upgrade ) ) ( .Values.upgradeContainers )}}
+    {{- $upgradeContainers := list }}
+    {{- range $index, $key := (keys .Values.upgradeContainers | uniq | sortAlpha) }}
+      {{- $container := get $.Values.upgradeContainers $key }}
+      {{- if not $container.name -}}
+        {{- $_ := set $container "name" $key }}
+      {{- end }}
+      {{- $upgradeContainers = append $upgradeContainers $container }}
+    {{- end }}
+    {{- tpl (toYaml $upgradeContainers) $ | nindent 2 }}
+  {{- end }}
+  {{- if .Values.initContainers }}
+    {{- $initContainers := list }}
+    {{- range $index, $key := (keys .Values.initContainers | uniq | sortAlpha) }}
+      {{- $container := get $.Values.initContainers $key }}
+      {{- if not $container.name -}}
+        {{- $_ := set $container "name" $key }}
+      {{- end }}
+      {{- $initContainers = append $initContainers $container }}
+    {{- end }}
+    {{- tpl (toYaml $initContainers) $ | nindent 2 }}
+  {{- end }}
+containers:
+  {{- include "tc.common.controller.mainContainer" . | nindent 2 }}
+  {{- with .Values.additionalContainers }}
+    {{- $additionalContainers := list }}
+    {{- range $name, $container := . }}
+      {{- if not $container.name -}}
+        {{- $_ := set $container "name" $name }}
+      {{- end }}
+      {{- $additionalContainers = append $additionalContainers $container }}
+    {{- end }}
+    {{- tpl (toYaml $additionalContainers) $ | nindent 2 }}
+  {{- end }}
+  {{- with (include "tc.common.controller.volumes" . | trim) }}
+volumes:
+    {{- nindent 2 . }}
+  {{- end }}
+  {{- with .Values.hostAliases }}
+hostAliases:
+    {{ tpl ( toYaml . ) $ | nindent 2 }}
+  {{- end }}
+  {{- with .Values.nodeSelector }}
+nodeSelector:
+    {{ tpl ( toYaml . ) $ | nindent 2 }}
+  {{- end }}
+  {{- with .Values.affinity }}
+affinity:
+    {{ tpl ( toYaml . ) $ | nindent 2 }}
+  {{- end }}
+  {{- with .Values.topologySpreadConstraints }}
+topologySpreadConstraints:
+    {{ tpl ( toYaml . ) $ | nindent 2 }}
+  {{- end }}
+  {{- with .Values.tolerations }}
+tolerations:
+    {{ tpl ( toYaml . ) $ | nindent 2 }}
+  {{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/controller/_ports.tpl

@@ -0,0 +1,36 @@
+{{/*
+Ports included by the controller.
+*/}}
+{{- define "tc.common.controller.ports" -}}
+  {{- $ports := list -}}
+  {{- range .Values.service -}}
+    {{- if .enabled -}}
+      {{- range $name, $port := .ports -}}
+        {{- $_ := set $port "name" $name -}}
+        {{- $ports = mustAppend $ports $port -}}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+
+{{/* export/render the list of ports */}}
+{{- if $ports -}}
+{{- range $_ := $ports }}
+{{- if .enabled }}
+- name: {{ tpl .name $ }}
+  {{- if and .targetPort (kindIs "string" .targetPort) }}
+  {{- fail (printf "Our charts do not support named ports for targetPort. (port name %s, targetPort %s)" .name .targetPort) }}
+  {{- end }}
+  containerPort: {{ .targetPort | default .port }}
+  {{- if .protocol }}
+  {{- if or ( eq .protocol "HTTP" ) ( eq .protocol "HTTPS" ) ( eq .protocol "TCP" ) }}
+  protocol: TCP
+  {{- else }}
+  protocol: {{ tpl .protocol $ }}
+  {{- end }}
+  {{- else }}
+  protocol: TCP
+  {{- end }}
+{{- end}}
+{{- end -}}
+{{- end -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/controller/_prepare.tpl

@@ -0,0 +1,213 @@
+{{/*
+This template serves as the blueprint for the mountPermissions job that is run
+before chart installation.
+*/}}
+{{- define "tc.common.controller.prepare" -}}
+{{- $group := .Values.podSecurityContext.fsGroup -}}
+{{- $hostPathMounts := dict -}}
+{{- $autoperms := false -}}
+{{- range $name, $mount := .Values.persistence -}}
+  {{- if and $mount.enabled $mount.setPermissions -}}
+    {{- $name = default ( $name| toString ) $mount.name -}}
+    {{- $_ := set $hostPathMounts $name $mount -}}
+    {{- $autoperms = true -}}
+  {{- end -}}
+{{- end }}
+{{- if or $autoperms ( and ( .Values.addons.vpn.configFile.enabled ) ( ne .Values.addons.vpn.type "disabled" ) ( ne .Values.addons.vpn.type "tailscale" ) ) }}
+- name: auto-permissions
+  image: {{ .Values.alpineImage.repository }}:{{ .Values.alpineImage.tag }}
+  securityContext:
+    runAsUser: 0
+    runAsNonRoot: false
+  resources:
+  {{- with .Values.resources }}
+    {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+  command:
+    - "/bin/sh"
+    - "-c"
+    - |
+      /bin/sh <<'EOF'
+      echo "Automatically correcting permissions..."
+      {{- if and ( .Values.addons.vpn.configFile.enabled ) ( ne .Values.addons.vpn.type "disabled" ) ( ne .Values.addons.vpn.type "tailscale" ) }}
+      echo "Automatically correcting permissions for vpn config file..."
+      /usr/bin/nfs4xdr_winacl -a chown -O 568 -G 568 -c /vpn/vpn.conf -p /vpn/vpn.conf || echo "Failed setting permissions..."
+      {{- end }}
+      {{- range $_, $hpm := $hostPathMounts }}
+      echo "Automatically correcting permissions for {{ $hpm.mountPath }}..."
+      /usr/bin/nfs4xdr_winacl -a chown -G {{ $group }} -r -c {{ tpl $hpm.mountPath $ | squote }} -p {{ tpl $hpm.mountPath $ | squote }} || echo "Failed setting permissions..."
+      {{- end }}
+      EOF
+  volumeMounts:
+    {{- range $name, $hpm := $hostPathMounts }}
+    - name: {{ $name }}
+      mountPath: {{ $hpm.mountPath }}
+      {{- if $hpm.subPath }}
+      subPath: {{ $hpm.subPath }}
+      {{- end }}
+    {{- end }}
+    {{- if and ( .Values.addons.vpn.configFile.enabled ) ( ne .Values.addons.vpn.type "disabled" ) ( ne .Values.addons.vpn.type "tailscale" ) }}
+    - name: vpnconfig
+      mountPath: /vpn/vpn.conf
+    {{- end }}
+{{- end }}
+{{- if or .Values.mariadb.enabled .Values.redis.enabled .Values.mongodb.enabled .Values.clickhouse.enabled .Values.solr.enabled .Values.postgresql.enabled .Values.cnpg.enabled }}
+- name: db-wait
+  image: {{ .Values.ubuntuImage.repository }}:{{ .Values.ubuntuImage.tag }}
+  securityContext:
+    runAsUser: 568
+    runAsGroup: 568
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+  resources:
+  {{- with .Values.resources }}
+    {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+  env:
+    {{- if .Values.mariadb.enabled }}
+    - name: MARIADB_HOST
+      valueFrom:
+        secretKeyRef:
+          name: mariadbcreds
+          key: plainhost
+    - name: MARIADB_ROOT_PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: mariadbcreds
+          key: mariadb-root-password
+    {{- end }}
+    {{- if .Values.redis.enabled }}
+    - name: REDIS_HOST
+      valueFrom:
+        secretKeyRef:
+          name: rediscreds
+          key: plainhost
+    - name: REDIS_PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: rediscreds
+          key: redis-password
+    - name: REDIS_PORT
+      value: "6379"
+    {{- end }}
+    {{- if .Values.mongodb.enabled }}
+    - name: MONGODB_HOST
+      valueFrom:
+        secretKeyRef:
+          name: mongodbcreds
+          key: plainhost
+    - name: MONGODB_DATABASE
+      value: "{{ .Values.mongodb.mongodbDatabase }}"
+    {{- end }}
+    {{- if .Values.clickhouse.enabled }}
+    - name: CLICKHOUSE_PING
+      valueFrom:
+        secretKeyRef:
+          name: clickhousecreds
+          key: ping
+    {{- end }}
+    {{- if .Values.solr.enabled }}
+    - name: SOLR_HOST
+      valueFrom:
+        secretKeyRef:
+          name: solrcreds
+          key: plainhost
+    - name: SOLR_CORES
+      value: "{{ .Values.solr.solrCores }}"
+    - name: SOLR_ENABLE_AUTHENTICATION
+      value: "{{ .Values.solr.solrEnableAuthentication }}"
+    {{- if eq .Values.solr.solrEnableAuthentication "yes" }}
+    - name: SOLR_ADMIN_USERNAME
+      value: "{{ .Values.solr.solrUsername }}"
+    - name: SOLR_ADMIN_PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: solrcreds
+          key: solr-password
+    {{- end }}
+    {{- end }}
+  command:
+    - "/bin/sh"
+    - "-c"
+    - |
+      /bin/bash <<'EOF'
+      echo "Executing DB waits..."
+      {{- if .Values.postgresql.enabled }}
+      {{- $pghost := printf "%v-%v" .Release.Name "postgresql" }}
+      until
+        pg_isready -U {{ .Values.postgresql.postgresqlUsername }} -h {{ $pghost }}
+        do sleep 2
+      done
+      {{- end }}
+      {{- if .Values.mongodb.enabled }}
+      until
+        HOME=/config && echo "db.runCommand(\"ping\")" | mongosh --host ${MONGODB_HOST} --port 27017 ${MONGODB_DATABASE} --quiet;
+        do sleep 2;
+      done
+      {{- end }}
+      {{- if .Values.cnpg.enabled }}
+      {{- $cnpgName := include "tc.common.names.fullname" . -}}
+      {{- $cnpgName = printf "%v-%v" $cnpgName "cnpg" -}}
+      {{- $pghost := printf "%s-rw" $cnpgName }}
+      until
+        pg_isready -U {{ .Values.cnpg.user }} -h {{ $pghost }}
+        do sleep 2
+      done
+      until
+        pg_isready -U {{ .Values.cnpg.user }} -h pooler-{{ $pghost }}
+        do sleep 2
+      done
+      {{- end }}
+      {{- if .Values.mariadb.enabled }}
+      until
+        mysqladmin -uroot -h"${MARIADB_HOST}" -p"${MARIADB_ROOT_PASSWORD}" ping \
+        && mysqladmin -uroot -h"${MARIADB_HOST}" -p"${MARIADB_ROOT_PASSWORD}" status;
+        do sleep 2;
+      done
+      {{- end }}
+      {{- if .Values.redis.enabled }}
+      [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD";
+      export LIVE=false;
+      until "$LIVE";
+      do
+        response=$(
+            timeout -s 3 2 \
+            redis-cli \
+              -h "$REDIS_HOST" \
+              -p "$REDIS_PORT" \
+              ping
+          )
+        if [ "$response" == "PONG" ] || [ "$response" == "LOADING Redis is loading the dataset in memory" ]; then
+          LIVE=true
+          echo "$response"
+          echo "Redis Responded, ending initcontainer and starting main container(s)..."
+        else
+          echo "$response"
+          echo "Redis not responding... Sleeping for 10 sec..."
+          sleep 10
+        fi;
+      done
+      {{- end }}
+      {{- if .Values.clickhouse.enabled }}
+      until wget --quiet --tries=1 --spider "${CLICKHOUSE_PING}"; do
+        echo "ClickHouse - no response. Sleeping 2 seconds..."
+        sleep 2
+      done
+      echo "ClickHouse - accepting connections"
+      {{- end }}
+      {{- if .Values.solr.enabled }}
+      if [ "$SOLR_ENABLE_AUTHENTICATION" == "yes" ]; then
+        until curl --fail --user "${SOLR_ADMIN_USERNAME}":"${SOLR_ADMIN_PASSWORD}" "${SOLR_HOST}":8983/solr/"${SOLR_CORES}"/admin/ping; do
+          echo "Solr is not responding... Sleeping 2 seconds..."
+          sleep 2
+        done
+      else
+        until curl --fail "${SOLR_HOST}":8983/solr/"${SOLR_CORES}"/admin/ping; do
+          echo "Solr is not responding... Sleeping 2 seconds..."
+          sleep 2
+        done
+      fi;
+      {{- end }}
+      EOF
+{{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/controller/_probes.tpl

@@ -0,0 +1,51 @@
+{{/*
+Probes selection logic.
+*/}}
+{{- define "tc.common.controller.probes" -}}
+{{- $primaryService := get .Values.service (include "tc.common.lib.util.service.primary" .) -}}
+{{- $primaryPort := "" -}}
+{{- if $primaryService -}}
+  {{- $primaryPort = get $primaryService.ports (include "tc.common.lib.util.service.ports.primary" (dict "serviceName" (include "tc.common.lib.util.service.primary" .) "values" $primaryService)) -}}
+{{- end -}}
+{{- $probeType := "TCP" -}}
+
+{{- range $probeName, $probe := .Values.probes }}
+  {{- if $probe.enabled -}}
+    {{- "" | nindent 0 }}
+    {{- $probeName }}Probe:
+    {{- if $probe.custom -}}
+      {{- $probe.spec | toYaml | nindent 2 }}
+    {{- else }}
+      {{- if and $primaryService $primaryPort -}}
+          {{- if $probe.type -}}
+            {{- if eq $probe.type "AUTO" -}}
+              {{- $probeType = $primaryPort.protocol -}}
+            {{- else -}}
+              {{- $probeType = $probe.type -}}
+            {{- end }}
+          {{- end }}
+
+          {{- if or ( eq $probeType "HTTPS" ) ( eq $probeType "HTTP" ) -}}
+              {{- "httpGet:" | nindent 2 }}
+                {{- printf "path: %v" $probe.path | nindent 4 }}
+                {{- printf "scheme: %v" $probeType | nindent 4 }}
+          {{- else -}}
+            {{- "tcpSocket:" | nindent 2 }}
+          {{- end }}
+
+          {{- if $probe.port }}
+            {{- printf "port: %v" ( tpl ( $probe.port | toString ) $ ) | nindent 4 }}
+          {{- else if $primaryPort.targetPort }}
+            {{- printf "port: %v" $primaryPort.targetPort | nindent 4 }}
+          {{- else}}
+            {{- printf "port: %v" $primaryPort.port | nindent 4 }}
+          {{- end }}
+          {{- printf "initialDelaySeconds: %v" $probe.spec.initialDelaySeconds  | nindent 2 }}
+          {{- printf "failureThreshold: %v" $probe.spec.failureThreshold  | nindent 2 }}
+          {{- printf "timeoutSeconds: %v" $probe.spec.timeoutSeconds  | nindent 2 }}
+          {{- printf "periodSeconds: %v" $probe.spec.periodSeconds | nindent 2 }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{- end }}

charts/mosquitto-mqtt/charts/common/templates/lib/controller/_volumeMounts.tpl

@@ -0,0 +1,37 @@
+{{/* Volumes included by the controller */}}
+{{- define "tc.common.controller.volumeMounts" -}}
+  {{- range $index, $item := .Values.persistence }}
+  {{- if not $item.noMount }}
+    {{- $mountPath := (printf "/%v" $index) -}}
+    {{- if eq "hostPath" (default "pvc" $item.type) -}}
+      {{- $mountPath = $item.hostPath -}}
+    {{- end -}}
+    {{- with $item.mountPath -}}
+      {{- $mountPath = . -}}
+    {{- end }}
+    {{- if and $item.enabled (ne $mountPath "-") }}
+- mountPath: {{ tpl $mountPath $ }}
+  name: {{ tpl $index $ }}
+      {{- with $item.subPath }}
+  subPath: {{ tpl . $ }}
+      {{- end }}
+      {{- with $item.readOnly }}
+  readOnly: {{ . }}
+      {{- end }}
+      {{- with $item.mountPropagation }}
+  mountPropagation: {{ tpl . $ }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+  {{- end }}
+
+  {{- if eq .Values.controller.type "statefulset" }}
+    {{- range $index, $vct := .Values.volumeClaimTemplates }}
+- mountPath: {{ $vct.mountPath }}
+  name: {{ tpl ( toString $index ) $ }}
+      {{- if $vct.subPath }}
+  subPath: {{ $vct.subPath }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/controller/_volumes.tpl

@@ -0,0 +1,71 @@
+{{/*
+Volumes included by the controller.
+*/}}
+{{- define "tc.common.controller.volumes" -}}
+{{- range $index, $persistence := .Values.persistence }}
+{{- if $persistence.enabled }}
+- name: {{ tpl ( toString $index ) $ }}
+  {{- if eq (default "pvc" $persistence.type) "pvc" }}
+    {{- $pvcName := (include "tc.common.names.fullname" $) -}}
+    {{- if $persistence.existingClaim }}
+      {{/* Always prefer an existingClaim if that is set */}}
+      {{- $pvcName = $persistence.existingClaim -}}
+    {{- else -}}
+      {{/* Otherwise refer to the PVC name */}}
+      {{- if $persistence.nameOverride -}}
+        {{- if not (eq $persistence.nameOverride "-") -}}
+          {{- $pvcName = (printf "%s-%s" (include "tc.common.names.fullname" $) $persistence.nameOverride) -}}
+        {{- end -}}
+      {{- else -}}
+        {{- $pvcName = (printf "%s-%s" (include "tc.common.names.fullname" $) $index) -}}
+      {{- end -}}
+      {{- if $persistence.forceName -}}
+        {{- $pvcName = $persistence.forceName -}}
+      {{- end -}}
+    {{- end }}
+  persistentVolumeClaim:
+    claimName: {{ tpl $pvcName $ }}
+  {{- else if eq $persistence.type "emptyDir" }}
+    {{- $emptyDir := dict -}}
+    {{- with $persistence.medium -}}
+      {{- $_ := set $emptyDir "medium" . -}}
+    {{- end -}}
+    {{- with $persistence.sizeLimit -}}
+      {{- $_ := set $emptyDir "sizeLimit" . -}}
+    {{- end }}
+  emptyDir: {{- tpl ( toYaml $emptyDir ) $ | nindent 4 }}
+  {{- else if or (eq $persistence.type "configMap") (eq $persistence.type "secret") }}
+    {{- $objectName := (required (printf "objectName not set for persistence item %s" $index) $persistence.objectName) }}
+    {{- $objectName = tpl $objectName $ }}
+    {{- if eq $persistence.type "configMap" }}
+  configMap:
+    name: {{ $objectName }}
+    {{- else }}
+  secret:
+    secretName: {{ $objectName }}
+    {{- end }}
+    {{- with $persistence.defaultMode }}
+    defaultMode: {{ tpl . $ }}
+    {{- end }}
+    {{- with $persistence.items }}
+    items:
+      {{- tpl ( toYaml . ) $ | nindent 6 }}
+    {{- end }}
+  {{- else if eq $persistence.type "hostPath" }}
+  hostPath:
+    path: {{ required "hostPath not set" $persistence.hostPath }}
+    {{- with $persistence.hostPathType }}
+    type: {{ tpl  . $ }}
+    {{- end }}
+  {{- else if eq $persistence.type "nfs" }}
+  nfs:
+    server: {{ required "server not set" $persistence.server }}
+    path: {{ required "path not set" $persistence.path }}
+  {{- else if eq $persistence.type "custom" }}
+    {{- tpl ( toYaml $persistence.volumeSpec ) $ | nindent 2 }}
+  {{- else }}
+    {{- fail (printf "Not a valid persistence.type (%s)" $persistence.type) }}
+  {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}

charts/mosquitto-mqtt/charts/common/templates/lib/dependencies/_clickhouseInjector.tpl

@@ -0,0 +1,46 @@
+{{/*
+  This template generates a random password and ensures it persists across updates/edits to the chart
+*/}}
+{{- define "tc.common.dependencies.clickhouse.injector" -}}
+{{- if .Values.clickhouse.enabled }}
+
+{{- $secretName := "clickhousecreds" }}
+
+{{- $dbPass := "" }}
+{{- with (lookup "v1" "Secret" .Release.Namespace $secretName) }}
+  {{- $dbPass = (index .data "clickhouse-password") | b64dec }}
+{{- else }}
+  {{- $dbPass = randAlphaNum 50 }}
+{{- end }}
+
+{{- $host     := printf              "%v-clickhouse"           .Release.Name }}
+{{- $portHost := printf              "%v-clickhouse:8123"      .Release.Name }}
+{{- $ping     := printf       "http://%v-clickhouse:8123/ping" .Release.Name }}
+{{- $url      := printf "http://%v:%v@%v-clickhouse:8123/%v"   .Values.clickhouse.clickhouseUsername $dbPass .Release.Name .Values.clickhouse.clickhouseDatabase }}
+{{- $jdbc     := printf    "jdbc:ch://%v-clickhouse:8123/%v"   .Release.Name }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+  name: {{ $secretName }}
+data:
+  clickhouse-password: {{ $dbPass | b64enc | quote }}
+  plainhost:           {{ $host | b64enc | quote }}
+  plainporthost:       {{ $portHost | b64enc | quote }}
+  ping:                {{ $ping | b64enc | quote }}
+  url:                 {{ $url | b64enc | quote }}
+  jdbc:                {{ $jdbc | b64enc | quote }}
+
+{{- $_ := set .Values.clickhouse     "clickhousePassword" ($dbPass | quote) }}
+{{- $_ := set .Values.clickhouse.url "plain"              ($host | quote) }}
+{{- $_ := set .Values.clickhouse.url "plainhost"          ($host | quote) }}
+{{- $_ := set .Values.clickhouse.url "plainport"          ($portHost | quote) }}
+{{- $_ := set .Values.clickhouse.url "plainporthost"      ($portHost | quote) }}
+{{- $_ := set .Values.clickhouse.url "ping"               ($ping | quote) }}
+{{- $_ := set .Values.clickhouse.url "complete"           ($url | quote) }}
+{{- $_ := set .Values.clickhouse.url "jdbc"               ($jdbc | quote) }}
+
+{{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/dependencies/_cnpgInjector.tpl

@@ -0,0 +1,183 @@
+{{/*
+This template serves as a blueprint for all cnpg objects that are created
+within the common library.
+*/}}
+{{- define "tc.common.dependencies.cnpg.main" -}}
+{{- if .Values.cnpg.enabled }}
+{{- $cnpgName := include "tc.common.names.fullname" . }}
+{{- $cnpgName = printf "%v-%v" $cnpgName "cnpg" }}
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: {{ $cnpgName }}
+  {{- with (merge (.Values.cnpg.labels | default dict) (include "tc.common.labels" $ | fromYaml)) }}
+  labels: {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+  annotations:
+  {{- with (merge (.Values.cnpg.annotations | default dict) (include "tc.common.annotations" $ | fromYaml)) }}
+    {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+spec:
+  instances: {{ .Values.cnpg.instances | default 2  }}
+
+  bootstrap:
+    initdb:
+      database: {{ .Values.cnpg.database | default "app" }}
+      owner: {{ .Values.cnpg.user | default "app" }}
+      secret:
+        name: cnpg-user
+
+  superuserSecret:
+    name: cnpg-superuser
+
+  primaryUpdateStrategy: {{ .Values.cnpg.primaryUpdateStrategy | default "unsupervised" }}
+
+  storage:
+    pvcTemplate:
+      {{ include "tc.common.storage.storageClassName" ( dict "persistence" .Values.cnpg.storage "global" $) }}
+      accessModes:
+        - ReadWriteOnce
+      resources:
+        requests:
+          storage: {{ .Values.cnpg.storage.size | default "256Gi" | quote }}
+
+  walStorage:
+    pvcTemplate:
+      {{ include "tc.common.storage.storageClassName" ( dict "persistence" .Values.cnpg.storage "global" $) }}
+      accessModes:
+        - ReadWriteOnce
+      resources:
+        requests:
+          storage: {{ .Values.cnpg.storage.walsize | default "256Gi" | quote }}
+
+  monitoring:
+    enablePodMonitor: {{ .Values.cnpg.monitoring.enablePodMonitor | default true }}
+
+  nodeMaintenanceWindow:
+    inProgress: false
+    reusePVC: on
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Pooler
+metadata:
+  {{ $poolerrwname := printf "pooler-%s-rw" $cnpgName }}
+  name: {{ $poolerrwname }}
+spec:
+  cluster:
+    name: {{ $cnpgName }}
+
+  instances: {{ .Values.cnpg.instances | default 2 }}
+  type: rw
+  pgbouncer:
+    poolMode: session
+    parameters:
+      max_client_conn: "1000"
+      default_pool_size: "10"
+{{ if ( .Values.cnpg.monitoring.enablePodMonitor | default true ) }}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: {{ $cnpgName }}-rw
+spec:
+  selector:
+    matchLabels:
+      cnpg.io/poolerName: {{ $poolerrwname }}
+  podMetricsEndpoints:
+  - port: metrics
+{{ end }}
+{{ if ( .Values.cnpg.acceptRO | default true ) }}
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Pooler
+metadata:
+  {{ $poolerroname := printf "pooler-%s-ro" $cnpgName }}
+  name: {{ $poolerroname }}
+spec:
+  cluster:
+    name: {{ $cnpgName }}
+
+  instances: {{ .Values.cnpg.instances | default 2 }}
+  type: ro
+  pgbouncer:
+    poolMode: session
+    parameters:
+      max_client_conn: "1000"
+      default_pool_size: "10"
+{{ if ( .Values.cnpg.monitoring.enablePodMonitor | default true ) }}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: {{ $cnpgName }}-ro
+spec:
+  selector:
+    matchLabels:
+      cnpg.io/poolerName: {{ $poolerroname }}
+  podMetricsEndpoints:
+  - port: metrics
+{{ end }}
+{{ end }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+  name: cnpgcreds
+{{- $dbprevious := lookup "v1" "Secret" .Release.Namespace "cnpgcreds" }}
+{{- $dbPass := "" }}
+{{- $pgPass := "" }}
+data:
+{{- if $dbprevious }}
+  {{- $dbPass = ( index $dbprevious.data "user-password" ) | b64dec  }}
+  {{- $pgPass = ( index $dbprevious.data "superuser-password" ) | b64dec  }}
+  user-password: {{ ( index $dbprevious.data "user-password" ) }}
+  superuser-password: {{ ( index $dbprevious.data "superuser-password" ) }}
+{{- else }}
+  {{- $dbPass = .Values.cnpg.password | default ( randAlphaNum 62 ) }}
+  {{- $pgPass = .Values.cnpg.superUserPassword | default ( randAlphaNum 62 ) }}
+  user-password: {{ $dbPass | b64enc | quote }}
+  superuser-password: {{ $pgPass | b64enc | quote }}
+{{- end }}
+  {{- $std := ( ( printf "postgresql://%v:%v@%v:5432/%v" .Values.cnpg.user $dbPass $poolerrwname .Values.cnpg.database  ) | b64enc | quote ) }}
+  {{- $nossl := ( ( printf "postgresql://%v:%v@%v:5432/%v?sslmode=disable" .Values.cnpg.user $dbPass $poolerrwname .Values.cnpg.database  ) | b64enc | quote ) }}
+  {{- $porthost := ( ( printf "%s:5432" $poolerrwname ) | b64enc | quote ) }}
+  {{- $host := ( ( printf "%s" $poolerrwname ) | b64enc | quote ) }}
+  {{- $jdbc := ( ( printf "jdbc:postgresql://%v:5432/%v" $poolerrwname .Values.cnpg.database  ) | b64enc | quote ) }}
+
+  std: {{ $std }}
+  nossl: {{ $nossl }}
+  porthost: {{ $porthost }}
+  host: {{ $host }}
+  jdbc: {{ $jdbc }}
+type: Opaque
+{{- $_ := set .Values.cnpg.creds "password" ( $dbPass | quote ) }}
+{{- $_ := set .Values.cnpg.creds "superUserPassword" ( $pgPass | quote ) }}
+{{- $_ := set .Values.cnpg.creds "std" $std }}
+{{- $_ := set .Values.cnpg.creds "nossl" $nossl }}
+{{- $_ := set .Values.cnpg.creds "porthost" $porthost }}
+{{- $_ := set .Values.cnpg.creds "host" $host }}
+{{- $_ := set .Values.cnpg.creds "jdbc" $jdbc }}
+---
+apiVersion: v1
+data:
+  username: {{ "postgres" | b64enc | quote  }}
+  password: {{ $pgPass | b64enc | quote }}
+kind: Secret
+metadata:
+  name: cnpg-superuser
+type: kubernetes.io/basic-auth
+---
+apiVersion: v1
+data:
+  username: {{ .Values.cnpg.user | b64enc | quote }}
+  password: {{ $dbPass | b64enc | quote }}
+kind: Secret
+metadata:
+  name: cnpg-user
+type: kubernetes.io/basic-auth
+
+{{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/dependencies/_mariadbInjector.tpl

@@ -0,0 +1,48 @@
+{{/*
+This template generates a random password and ensures it persists across updates/edits to the chart
+*/}}
+{{- define "tc.common.dependencies.mariadb.injector" -}}
+{{- $pghost := printf "%v-%v" .Release.Name "mariadb" }}
+
+{{- if .Values.mariadb.enabled }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+  name: mariadbcreds
+{{- $dbprevious := lookup "v1" "Secret" .Release.Namespace "mariadbcreds" }}
+{{- $dbPass := "" }}
+{{- $rootPass := "" }}
+data:
+{{- if $dbprevious }}
+  {{- $dbPass = ( index $dbprevious.data "mariadb-password" ) | b64dec  }}
+  {{- $rootPass = ( index $dbprevious.data "mariadb-root-password" ) | b64dec  }}
+  mariadb-password: {{ ( index $dbprevious.data "mariadb-password" ) }}
+  mariadb-root-password: {{ ( index $dbprevious.data "mariadb-root-password" ) }}
+{{- else }}
+  {{- $dbPass = randAlphaNum 50 }}
+  {{- $rootPass = randAlphaNum 50 }}
+  mariadb-password: {{ $dbPass | b64enc | quote }}
+  mariadb-root-password: {{ $rootPass | b64enc | quote }}
+{{- end }}
+  url: {{ ( printf "sql://%v:%v@%v-mariadb:3306/%v" .Values.mariadb.mariadbUsername $dbPass .Release.Name .Values.mariadb.mariadbDatabase  ) | b64enc | quote }}
+  urlnossl: {{ ( printf "sql://%v:%v@%v-mariadb:3306/%v?sslmode=disable" .Values.mariadb.mariadbUsername $dbPass .Release.Name .Values.mariadb.mariadbDatabase  ) | b64enc | quote }}
+  plainporthost: {{ ( printf "%v-%v:3306" .Release.Name "mariadb" ) | b64enc | quote }}
+  plainhost: {{ ( printf "%v-%v" .Release.Name "mariadb" ) | b64enc | quote }}
+  jdbc: {{ ( printf "jdbc:sqlserver://%v-mariadb:3306/%v" .Release.Name .Values.mariadb.mariadbDatabase  ) | b64enc | quote }}
+  jdbc-mysql: {{ ( printf "jdbc:mysql://%v-mariadb:3306/%v" .Release.Name .Values.mariadb.mariadbDatabase  ) | b64enc | quote }}
+  jdbc-mariadb: {{ ( printf "jdbc:mariadb://%v-mariadb:3306/%v" .Release.Name .Values.mariadb.mariadbDatabase  ) | b64enc | quote }}
+type: Opaque
+{{- $_ := set .Values.mariadb "mariadbPassword" ( $dbPass | quote ) }}
+{{- $_ := set .Values.mariadb "mariadbRootPassword" ( $rootPass | quote ) }}
+{{- $_ := set .Values.mariadb.url "plain" ( ( printf "%v-%v" .Release.Name "mariadb" ) | quote ) }}
+{{- $_ := set .Values.mariadb.url "plainhost" ( ( printf "%v-%v" .Release.Name "mariadb" ) | quote ) }}
+{{- $_ := set .Values.mariadb.url "plainport" ( ( printf "%v-%v:3306" .Release.Name "mariadb" ) | quote ) }}
+{{- $_ := set .Values.mariadb.url "plainporthost" ( ( printf "%v-%v:3306" .Release.Name "mariadb" ) | quote ) }}
+{{- $_ := set .Values.mariadb.url "complete" ( ( printf "sql://%v:%v@%v-mariadb:3306/%v" .Values.mariadb.mariadbUsername $dbPass .Release.Name .Values.mariadb.mariadbDatabase  ) | quote ) }}
+{{- $_ := set .Values.mariadb.url "jdbc" ( ( printf "jdbc:sqlserver://%v-mariadb:3306/%v" .Release.Name .Values.mariadb.mariadbDatabase  ) | quote ) }}
+
+{{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/dependencies/_mongodbInjector.tpl

@@ -0,0 +1,47 @@
+{{/*
+This template generates a random password and ensures it persists across updates/edits to the chart
+*/}}
+{{- define "tc.common.dependencies.mongodb.injector" -}}
+{{- $pghost := printf "%v-%v" .Release.Name "mongodb" }}
+
+{{- if .Values.mongodb.enabled }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+  name: mongodbcreds
+{{- $dbprevious := lookup "v1" "Secret" .Release.Namespace "mongodbcreds" }}
+{{- $dbPass := "" }}
+{{- $rootPass := "" }}
+data:
+{{- if $dbprevious }}
+  {{- $dbPass = ( index $dbprevious.data "mongodb-password" ) | b64dec  }}
+  {{- $rootPass = ( index $dbprevious.data "mongodb-root-password" ) | b64dec  }}
+  mongodb-password: {{ ( index $dbprevious.data "mongodb-password" ) }}
+  mongodb-root-password: {{ ( index $dbprevious.data "mongodb-root-password" ) }}
+{{- else }}
+  {{- $dbPass = randAlphaNum 50 }}
+  {{- $rootPass = randAlphaNum 50 }}
+  mongodb-password: {{ $dbPass | b64enc | quote }}
+  mongodb-root-password: {{ $rootPass | b64enc | quote }}
+{{- end }}
+  url: {{ ( printf "mongodb://%v:%v@%v-mongodb:27017/%v" .Values.mongodb.mongodbUsername $dbPass .Release.Name .Values.mongodb.mongodbDatabase  ) | b64enc | quote }}
+  urlssl: {{ ( printf "mongodb://%v:%v@%v-mongodb:27017/%v?ssl=true" .Values.mongodb.mongodbUsername $dbPass .Release.Name .Values.mongodb.mongodbDatabase  ) | b64enc | quote }}
+  urltls: {{ ( printf "mongodb://%v:%v@%v-mongodb:27017/%v?tls=true" .Values.mongodb.mongodbUsername $dbPass .Release.Name .Values.mongodb.mongodbDatabase  ) | b64enc | quote }}
+  jdbc: {{ ( printf "jdbc:mongodb://%v-mongodb:27017/%v" .Release.Name .Values.mongodb.mongodbDatabase  ) | b64enc | quote }}
+  plainhost: {{ ( printf "%v-%v" .Release.Name "mongodb" ) | b64enc | quote }}
+  plainporthost: {{ ( printf "%v-%v:27017" .Release.Name "mongodb" ) | b64enc | quote }}
+type: Opaque
+{{- $_ := set .Values.mongodb "mongodbPassword" ( $dbPass | quote ) }}
+{{- $_ := set .Values.mongodb "mongodbRootPassword" ( $rootPass | quote ) }}
+{{- $_ := set .Values.mongodb.url "plain" ( ( printf "%v-%v" .Release.Name "mongodb" ) | quote ) }}
+{{- $_ := set .Values.mongodb.url "plainhost" ( ( printf "%v-%v" .Release.Name "mongodb" ) | quote ) }}
+{{- $_ := set .Values.mongodb.url "plainport" ( ( printf "%v-%v:27017" .Release.Name "mongodb" ) | quote ) }}
+{{- $_ := set .Values.mongodb.url "plainporthost" ( ( printf "%v-%v:27017" .Release.Name "mongodb" ) | quote ) }}
+{{- $_ := set .Values.mongodb.url "complete" ( ( printf "mongodb://%v:%v@%v-mongodb:27017/%v" .Values.mongodb.mongodbUsername $dbPass .Release.Name .Values.mongodb.mongodbDatabase  ) | quote ) }}
+{{- $_ := set .Values.mongodb.url "jdbc" ( ( printf "jdbc:mongodb://%v-mongodb:27017/%v" .Release.Name .Values.mongodb.mongodbDatabase  ) | quote ) }}
+
+{{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/dependencies/_postgresInjector.tpl

@@ -0,0 +1,48 @@
+{{/*
+This template generates a random password and ensures it persists across updates/edits to the chart
+*/}}
+{{- define "tc.common.dependencies.postgresql.injector" -}}
+{{- $pghost := printf "%v-%v" .Release.Name "postgresql" }}
+
+{{- if .Values.postgresql.enabled }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+  name: dbcreds
+{{- $dbprevious := lookup "v1" "Secret" .Release.Namespace "dbcreds" }}
+{{- $dbPass := "" }}
+{{- $pgPass := "" }}
+data:
+{{- if $dbprevious }}
+  {{- $dbPass = ( index $dbprevious.data "postgresql-password" ) | b64dec  }}
+  {{- $pgPass = ( index $dbprevious.data "postgresql-postgres-password" ) | b64dec  }}
+  postgresql-password: {{ ( index $dbprevious.data "postgresql-password" ) }}
+  postgresql-postgres-password: {{ ( index $dbprevious.data "postgresql-postgres-password" ) }}
+{{- else }}
+  {{- $dbPass = randAlphaNum 50 }}
+  {{- $pgPass = randAlphaNum 50 }}
+  postgresql-password: {{ $dbPass | b64enc | quote }}
+  postgresql-postgres-password: {{ $pgPass | b64enc | quote }}
+{{- end }}
+  url: {{ ( printf "postgresql://%v:%v@%v-postgresql:5432/%v" .Values.postgresql.postgresqlUsername $dbPass .Release.Name .Values.postgresql.postgresqlDatabase  ) | b64enc | quote }}
+  url-noql: {{ ( printf "postgres://%v:%v@%v-postgresql:5432/%v" .Values.postgresql.postgresqlUsername $dbPass .Release.Name .Values.postgresql.postgresqlDatabase  ) | b64enc | quote }}
+  urlnossl: {{ ( printf "postgresql://%v:%v@%v-postgresql:5432/%v?sslmode=disable" .Values.postgresql.postgresqlUsername $dbPass .Release.Name .Values.postgresql.postgresqlDatabase  ) | b64enc | quote }}
+  plainporthost: {{ ( printf "%v-%v" .Release.Name "postgresql" ) | b64enc | quote }}
+  plainhost: {{ ( printf "%v-%v" .Release.Name "postgresql" ) | b64enc | quote }}
+  jdbc: {{ ( printf "jdbc:postgresql://%v-postgresql:5432/%v" .Release.Name .Values.postgresql.postgresqlDatabase  ) | b64enc | quote }}
+type: Opaque
+{{- $_ := set .Values.postgresql "postgresqlPassword" ( $dbPass | quote ) }}
+{{- $_ := set .Values.postgresql "postgrespassword" ( $pgPass | quote ) }}
+{{- $_ := set .Values.postgresql.url "plain" ( ( printf "%v-%v" .Release.Name "postgresql" ) | quote ) }}
+{{- $_ := set .Values.postgresql.url "plainhost" ( ( printf "%v-%v" .Release.Name "postgresql" ) | quote ) }}
+{{- $_ := set .Values.postgresql.url "plainport" ( ( printf "%v-%v:5432" .Release.Name "postgresql" ) | quote ) }}
+{{- $_ := set .Values.postgresql.url "plainporthost" ( ( printf "%v-%v:5432" .Release.Name "postgresql" ) | quote ) }}
+{{- $_ := set .Values.postgresql.url "complete" ( ( printf "postgresql://%v:%v@%v-postgresql:5432/%v" .Values.postgresql.postgresqlUsername $dbPass .Release.Name .Values.postgresql.postgresqlDatabase  ) | quote ) }}
+{{- $_ := set .Values.postgresql.url "complete-noql" ( ( printf "postgres://%v:%v@%v-postgresql:5432/%v" .Values.postgresql.postgresqlUsername $dbPass .Release.Name .Values.postgresql.postgresqlDatabase  ) | quote ) }}
+{{- $_ := set .Values.postgresql.url "jdbc" ( ( printf "jdbc:postgresql://%v-postgresql:5432/%v" .Release.Name .Values.postgresql.postgresqlDatabase  ) | quote ) }}
+
+{{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/dependencies/_redisInjector.tpl

@@ -0,0 +1,38 @@
+{{/*
+This template generates a random password and ensures it persists across updates/edits to the chart
+*/}}
+{{- define "tc.common.dependencies.redis.injector" -}}
+{{- $pghost := printf "%v-%v" .Release.Name "redis" }}
+
+{{- if .Values.redis.enabled }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+  name: rediscreds
+{{- $dbprevious := lookup "v1" "Secret" .Release.Namespace "rediscreds" }}
+{{- $dbPass := "" }}
+{{- $dbIndex := default "0" .Values.redis.redisDatabase }}
+data:
+{{- if $dbprevious }}
+  {{- $dbPass = ( index $dbprevious.data "redis-password" ) | b64dec  }}
+  redis-password: {{ ( index $dbprevious.data "redis-password" ) }}
+{{- else }}
+  {{- $dbPass = randAlphaNum 50 }}
+  redis-password: {{ $dbPass | b64enc | quote }}
+{{- end }}
+  url: {{ ( printf "redis://%v:%v@%v-redis:6379/%v" .Values.redis.redisUsername $dbPass .Release.Name $dbIndex ) | b64enc | quote }}
+  plainhostpass: {{ ( printf "%v:%v@%v-redis" .Values.redis.redisUsername $dbPass .Release.Name ) | b64enc | quote }}
+  plainporthost: {{ ( printf "%v-%v:6379" .Release.Name "redis" ) | b64enc | quote }}
+  plainhost: {{ ( printf "%v-%v" .Release.Name "redis" ) | b64enc | quote }}
+type: Opaque
+{{- $_ := set .Values.redis "redisPassword" ( $dbPass | quote ) }}
+{{- $_ := set .Values.redis.url "plain" ( ( printf "%v-%v" .Release.Name "redis" ) | quote ) }}
+{{- $_ := set .Values.redis.url "plainhost" ( ( printf "%v-%v" .Release.Name "redis" ) | quote ) }}
+{{- $_ := set .Values.redis.url "plainport" ( ( printf "%v-%v:6379" .Release.Name "redis" ) | quote ) }}
+{{- $_ := set .Values.redis.url "plainporthost" ( ( printf "%v-%v:6379" .Release.Name "redis" ) | quote ) }}
+
+{{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/dependencies/_solrInjector.tpl

@@ -0,0 +1,33 @@
+{{/*
+This template generates a random password and ensures it persists across updates/edits to the chart
+*/}}
+{{- define "tc.common.dependencies.solr.injector" -}}
+{{- $host := printf "%v-%v" .Release.Name "solr" }}
+
+{{- if .Values.solr.enabled }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+  name: solrcreds
+{{- $solrprevious := lookup "v1" "Secret" .Release.Namespace "solrcreds" }}
+{{- $solrPass := "" }}
+data:
+{{- if $solrprevious }}
+  {{- $solrPass = ( index $solrprevious.data "solr-password" ) | b64dec  }}
+  solr-password: {{ ( index $solrprevious.data "solr-password" ) }}
+{{- else }}
+  {{- $solrPass = randAlphaNum 50 }}
+  solr-password: {{ $solrPass | b64enc | quote }}
+{{- end }}
+  url: {{ ( printf "http://%v:%v@%v-solr:8983/url/%v" .Values.solr.solrUsername $solrPass .Release.Name .Values.solr.solrCores ) | b64enc | quote }}
+  plainhost: {{ ( ( printf "%v-%v" .Release.Name "solr" ) ) | b64enc | quote }}
+type: Opaque
+{{- $_ := set .Values.solr "solrPassword" ( $solrPass | quote ) }}
+{{- $_ := set .Values.solr.url "plain" ( ( printf "%v-%v" .Release.Name "solr" ) | quote ) }}
+{{- $_ := set .Values.solr.url "plainhost" ( ( printf "%v-%v" .Release.Name "solr" ) | quote ) }}
+
+{{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/util/_affinities.tpl

@@ -0,0 +1,102 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/*
+Return a soft nodeAffinity definition
+{{ include "tc.common.affinities.nodes.soft" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}}
+*/}}
+{{- define "tc.common.affinities.nodes.soft" -}}
+preferredDuringSchedulingIgnoredDuringExecution:
+  - preference:
+      matchExpressions:
+        - key: {{ .key }}
+          operator: In
+          values:
+            {{- range .values }}
+            - {{ . | quote }}
+            {{- end }}
+    weight: 1
+{{- end -}}
+
+{{/*
+Return a hard nodeAffinity definition
+{{ include "tc.common.affinities.nodes.hard" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}}
+*/}}
+{{- define "tc.common.affinities.nodes.hard" -}}
+requiredDuringSchedulingIgnoredDuringExecution:
+  nodeSelectorTerms:
+    - matchExpressions:
+        - key: {{ .key }}
+          operator: In
+          values:
+            {{- range .values }}
+            - {{ . | quote }}
+            {{- end }}
+{{- end -}}
+
+{{/*
+Return a nodeAffinity definition
+{{ include "tc.common.affinities.nodes" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}}
+*/}}
+{{- define "tc.common.affinities.nodes" -}}
+  {{- if eq .type "soft" }}
+    {{- include "tc.common.affinities.nodes.soft" . -}}
+  {{- else if eq .type "hard" }}
+    {{- include "tc.common.affinities.nodes.hard" . -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Return a soft podAffinity/podAntiAffinity definition
+{{ include "tc.common.affinities.pods.soft" (dict "component" "FOO" "extraMatchLabels" .Values.extraMatchLabels "context" $) -}}
+*/}}
+{{- define "tc.common.affinities.pods.soft" -}}
+{{- $component := default "" .component -}}
+{{- $extraMatchLabels := default (dict) .extraMatchLabels -}}
+preferredDuringSchedulingIgnoredDuringExecution:
+  - podAffinityTerm:
+      labelSelector:
+        matchLabels: {{- (include "tc.common.labels.matchLabels" .context) | nindent 10 }}
+          {{- if not (empty $component) }}
+          {{ printf "app.kubernetes.io/component: %s" $component }}
+          {{- end }}
+          {{- range $key, $value := $extraMatchLabels }}
+          {{ $key }}: {{ $value | quote }}
+          {{- end }}
+      namespaces:
+        - {{ .context.Release.Namespace | quote }}
+      topologyKey: kubernetes.io/hostname
+    weight: 1
+{{- end -}}
+
+{{/*
+Return a hard podAffinity/podAntiAffinity definition
+{{ include "tc.common.affinities.pods.hard" (dict "component" "FOO" "extraMatchLabels" .Values.extraMatchLabels "context" $) -}}
+*/}}
+{{- define "tc.common.affinities.pods.hard" -}}
+{{- $component := default "" .component -}}
+{{- $extraMatchLabels := default (dict) .extraMatchLabels -}}
+requiredDuringSchedulingIgnoredDuringExecution:
+  - labelSelector:
+      matchLabels: {{- (include "tc.common.labels.matchLabels" .context) | nindent 8 }}
+        {{- if not (empty $component) }}
+        {{ printf "app.kubernetes.io/component: %s" $component }}
+        {{- end }}
+        {{- range $key, $value := $extraMatchLabels }}
+        {{ $key }}: {{ $value | quote }}
+        {{- end }}
+    namespaces:
+      - {{ .context.Release.Namespace | quote }}
+    topologyKey: kubernetes.io/hostname
+{{- end -}}
+
+{{/*
+Return a podAffinity/podAntiAffinity definition
+{{ include "tc.common.affinities.pods" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}}
+*/}}
+{{- define "tc.common.affinities.pods" -}}
+  {{- if eq .type "soft" }}
+    {{- include "tc.common.affinities.pods.soft" . -}}
+  {{- else if eq .type "hard" }}
+    {{- include "tc.common.affinities.pods.hard" . -}}
+  {{- end -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/util/_images.tpl

@@ -0,0 +1,39 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Return the proper image name
+{{ include "tc.common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" $) }}
+*/}}
+{{- define "tc.common.images.image" -}}
+{{- $repositoryName := .imageRoot.repository -}}
+{{- $tag := .imageRoot.tag | toString -}}
+{{- printf "%s:%s" $repositoryName $tag -}}
+{{- end -}}
+
+{{/*
+Return the image name using the selector
+{{ include "tc.common.images.selector" . }}
+*/}}
+{{- define "tc.common.images.selector" -}}
+{{- $imageDict := get .Values "image" }}
+{{- $selected := .Values.imageSelector }}
+{{- if hasKey .Values $selected }}
+{{- $imageDict = get .Values $selected }}
+{{- end }}
+{{- $repositoryName := $imageDict.repository -}}
+{{- $tag :=$imageDict.tag | toString -}}
+{{- printf "%s:%s" $repositoryName $tag -}}
+{{- end -}}
+
+{{/*
+Return the proper Docker Image Registry Secret Names (deprecated: use tc.common.images.renderPullSecrets instead)
+{{ include "tc.common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }}
+*/}}
+{{- define "tc.common.images.pullSecrets" -}}
+{{- end -}}
+
+{{/*
+Return the proper Docker Image Registry Secret Names evaluating values as templates
+{{ include "tc.common.images.renderPullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $) }}
+*/}}
+{{- define "tc.common.images.renderPullSecrets" -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/util/_labels.tpl

@@ -0,0 +1,14 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Kubernetes standard labels
+*/}}
+{{- define "tc.common.labels.standard" -}}
+{{- include "tc.common.labels" . }}
+{{- end -}}
+
+{{/*
+Labels to use on deploy.spec.selector.matchLabels and svc.spec.selector
+*/}}
+{{- define "tc.common.labels.matchLabels" -}}
+{{- include "tc.common.labels.selectorLabels" . }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/util/_manifest-updater.tpl

@@ -0,0 +1,82 @@
+{{- define "tc.common.lib.util.manifest.update" -}}
+{{- if .Values.manifests.enabled }}
+{{- $fullName := include "tc.common.names.fullname" . }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: {{ $fullName }}-manifests
+  annotations:
+    "helm.sh/hook": pre-install, pre-upgrade
+    "helm.sh/hook-weight": "-6"
+    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
+spec:
+  template:
+    spec:
+      serviceAccountName: {{ $fullName }}-manifests
+      containers:
+        - name: {{ $fullName }}-manifests
+          image: {{ .Values.kubectlImage.repository }}:{{ .Values.kubectlImage.tag }}
+          securityContext:
+            runAsUser: 568
+            runAsGroup: 568
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+          command:
+            - "/bin/sh"
+            - "-c"
+            - |
+              /bin/sh <<'EOF'
+              echo "installing manifests..."
+              kubectl apply --server-side --force-conflicts -k https://github.com/truecharts/manifests/{{ if .Values.manifests.staging }}staging{{ else }}manifests{{ end }} {{ if .Values.manifests.nonBlocking }} || echo "Manifest application failed..."{{ end }}
+              EOF
+          volumeMounts:
+            - name: {{ $fullName }}-manifests-temp
+              mountPath: /tmp
+      restartPolicy: Never
+      volumes:
+        - name: {{ $fullName }}-manifests-temp
+          emptyDir: {}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ $fullName }}-manifests
+  annotations:
+    "helm.sh/hook": pre-install, pre-upgrade
+    "helm.sh/hook-weight": "-7"
+    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
+rules:
+  - apiGroups:  ["*"]
+    resources:  ["*"]
+    verbs:  ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ $fullName }}-manifests
+  annotations:
+    "helm.sh/hook": pre-install, pre-upgrade
+    "helm.sh/hook-weight": "-7"
+    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ $fullName }}-manifests
+subjects:
+  - kind: ServiceAccount
+    name: {{ $fullName }}-manifests
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ $fullName }}-manifests
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/hook": pre-install, pre-upgrade
+    "helm.sh/hook-weight": "-7"
+    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
+{{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/util/_primary-ingress.tpl

@@ -0,0 +1,21 @@
+{{/* Return the name of the primary ingress object */}}
+{{- define "tc.common.lib.util.ingress.primary" -}}
+  {{- $enabledIngresses := dict -}}
+  {{- range $name, $ingress := .Values.ingress -}}
+    {{- if $ingress.enabled -}}
+      {{- $_ := set $enabledIngresses $name . -}}
+    {{- end -}}
+  {{- end -}}
+
+  {{- $result := "" -}}
+  {{- range $name, $ingress := $enabledIngresses -}}
+    {{- if and (hasKey $ingress "primary") $ingress.primary -}}
+      {{- $result = $name -}}
+    {{- end -}}
+  {{- end -}}
+
+  {{- if not $result -}}
+    {{- $result = keys $enabledIngresses | first -}}
+  {{- end -}}
+  {{- $result -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/util/_primary-rbac.tpl

@@ -0,0 +1,23 @@
+{{/*
+Return the primary rbac object
+*/}}
+{{- define "tc.common.lib.util.rbac.primary" -}}
+  {{- $enabledrbacs := dict -}}
+  {{- range $name, $rbac := .Values.rbac -}}
+    {{- if $rbac.enabled -}}
+      {{- $_ := set $enabledrbacs $name . -}}
+    {{- end -}}
+  {{- end -}}
+
+  {{- $result := "" -}}
+  {{- range $name, $rbac := $enabledrbacs -}}
+    {{- if and (hasKey $rbac "primary") $rbac.primary -}}
+      {{- $result = $name -}}
+    {{- end -}}
+  {{- end -}}
+
+  {{- if not $result -}}
+    {{- $result = keys $enabledrbacs | first -}}
+  {{- end -}}
+  {{- $result -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/util/_primary-service.tpl

@@ -0,0 +1,23 @@
+{{/*
+Return the primary service object
+*/}}
+{{- define "tc.common.lib.util.service.primary" -}}
+  {{- $enabledServices := dict -}}
+  {{- range $name, $service := .Values.service -}}
+    {{- if $service.enabled -}}
+      {{- $_ := set $enabledServices $name . -}}
+    {{- end -}}
+  {{- end -}}
+
+  {{- $result := "" -}}
+  {{- range $name, $service := $enabledServices -}}
+    {{- if and (hasKey $service "primary") $service.primary -}}
+      {{- $result = $name -}}
+    {{- end -}}
+  {{- end -}}
+
+  {{- if not $result -}}
+    {{- $result = keys $enabledServices | first -}}
+  {{- end -}}
+  {{- $result -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/util/_primary-serviceAccount.tpl

@@ -0,0 +1,23 @@
+{{/*
+Return the primary serviceAccount object
+*/}}
+{{- define "tc.common.lib.util.serviceaccount.primary" -}}
+  {{- $enabledServiceaccounts := dict -}}
+  {{- range $name, $serviceAccount := .Values.serviceAccount -}}
+    {{- if $serviceAccount.enabled -}}
+      {{- $_ := set $enabledServiceaccounts $name . -}}
+    {{- end -}}
+  {{- end -}}
+
+  {{- $result := "" -}}
+  {{- range $name, $serviceAccount := $enabledServiceaccounts -}}
+    {{- if and (hasKey $serviceAccount "primary") $serviceAccount.primary -}}
+      {{- $result = $name -}}
+    {{- end -}}
+  {{- end -}}
+
+  {{- if not $result -}}
+    {{- $result = keys $enabledServiceaccounts | first -}}
+  {{- end -}}
+  {{- $result -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/util/_service_ports.tpl

@@ -0,0 +1,27 @@
+{{/*
+Return the primary port for a given Service object.
+*/}}
+{{- define "tc.common.lib.util.service.ports.primary" -}}
+  {{- $enabledPorts := dict -}}
+  {{- range $name, $port := .values.ports -}}
+    {{- if $port.enabled -}}
+      {{- $_ := set $enabledPorts $name . -}}
+    {{- end -}}
+  {{- end -}}
+
+  {{- if eq 0 (len $enabledPorts) }}
+    {{- fail (printf "No ports are enabled for service \"%s\"!" .serviceName) }}
+  {{- end }}
+
+  {{- $result := "" -}}
+  {{- range $name, $port := $enabledPorts -}}
+    {{- if and (hasKey $port "primary") $port.primary -}}
+      {{- $result = $name -}}
+    {{- end -}}
+  {{- end -}}
+
+  {{- if not $result -}}
+    {{- $result = keys $enabledPorts | first -}}
+  {{- end -}}
+  {{- $result -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/util/_storage.tpl

@@ -0,0 +1,52 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Return  the proper Storage Class
+{{ include "tc.common.storage.classname" ( dict "persistence" .Values.path.to.the.persistence "global" $ ) }}
+*/}}
+{{- define "tc.common.storage.storageClassName" -}}
+
+{{- if .persistence.storageClass -}}
+  {{- if (eq "-" .persistence.storageClass) -}}
+    {{- printf "storageClassName: \"\"" -}}
+  {{- else if and (eq "SCALE-ZFS" .persistence.storageClass ) -}}
+    {{- printf "storageClassName: %s" .global.Values.global.ixChartContext.storageClassName -}}
+  {{- else -}}
+    {{- printf "storageClassName: %s" .persistence.storageClass -}}
+  {{- end -}}
+{{- else if .global.Values.global.ixChartContext -}}
+  {{- printf "storageClassName: %s" .global.Values.global.ixChartContext.storageClassName -}}
+{{- end -}}
+
+{{- end -}}
+
+{{- define "tc.common.storage.storageClass" -}}
+
+{{- if .persistence.storageClass -}}
+  {{- if (eq "-" .persistence.storageClass) -}}
+    {{- printf "storageClass: \"\"" -}}
+  {{- else if and (eq "SCALE-ZFS" .persistence.storageClass ) -}}
+    {{- printf "storageClass: %s" .global.Values.global.ixChartContext.storageClassName -}}
+  {{- else -}}
+    {{- printf "storageClass: %s" .persistence.storageClass -}}
+  {{- end -}}
+{{- else if .global.Values.global.ixChartContext -}}
+  {{- printf "storageClass: %s" .global.Values.global.ixChartContext.storageClassName -}}
+{{- end -}}
+
+{{- end -}}
+
+{{- define "tc.common.storage.class" -}}
+
+{{- if .persistence.storageClass -}}
+  {{- if (eq "-" .persistence.storageClass) -}}
+    {{- printf "\"\"" -}}
+  {{- else if and (eq "SCALE-ZFS" .persistence.storageClass ) -}}
+    {{- printf "%s" .global.Values.global.ixChartContext.storageClassName -}}
+  {{- else -}}
+    {{- printf "%s" .persistence.storageClass -}}
+  {{- end -}}
+{{- else if .global.Values.global.ixChartContext -}}
+  {{- printf "%s" .global.Values.global.ixChartContext.storageClassName -}}
+{{- end -}}
+
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/util/_tplvalues.tpl

@@ -0,0 +1,13 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Renders a value that contains template.
+Usage:
+{{ include "tc.common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $) }}
+*/}}
+{{- define "tc.common.tplvalues.render" -}}
+    {{- if typeIs "string" .value }}
+        {{- tpl .value .context }}
+    {{- else }}
+        {{- tpl (.value | toYaml) .context }}
+    {{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/util/_warnings.tpl

@@ -0,0 +1,14 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Warning about using rolling tag.
+Usage:
+{{ include "tc.common.warnings.rollingTag" .Values.path.to.the.imageRoot }}
+*/}}
+{{- define "tc.common.warnings.rollingTag" -}}
+
+{{- if not (.tag | toString | regexFind "-r\\d+$|sha256:") }}
+WARNING: Rolling tag detected ({{ .repository }}:{{ .tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/
+{{- end }}
+
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/values/_capabilities.tpl

@@ -0,0 +1,52 @@
+{{/* automatically set CAP_NET_BIND_SERVICE */}}
+{{- define "tc.common.lib.values.capabilities" -}}
+  {{- $fixedCapAdd := list }}
+  {{- $customCapAdd := list }}
+  {{- $valueCapAdd := list }}
+  {{- $dynamicCapAdd := list }}
+  {{- $fixedCapDrop := list }}
+  {{- $customCapDrop := list }}
+  {{- $valueCapDrop := list }}
+  {{- $dynamicCapDrop := list }}
+  {{- if .Values.securityContext.capabilities.add }}
+  {{- $valueCapAdd = .Values.securityContext.capabilities.add }}
+  {{- end }}
+  {{- if .Values.securityContext.capabilities.drop }}
+  {{- $valueCapDrop = .Values.securityContext.capabilities.drop }}
+  {{- end }}
+  {{- if .Values.customCapabilities.add }}
+  {{- $customCapAdd = .Values.customCapabilities.add }}
+  {{- end }}
+  {{- if .Values.customCapabilities.drop }}
+  {{- $customCapDrop = .Values.customCapabilities.drop }}
+  {{- end }}
+
+  {{- $privPort := false }}
+  {{- range .Values.service }}
+  {{- range $name, $values := .ports }}
+  {{- if and ( $values.targetPort ) ( kindIs "int" $values.targetPort ) }}
+  {{- if ( semverCompare "<= 1024" ( toString $values.targetPort ) ) }}
+  {{- $privPort = true }}
+  {{- end }}
+  {{- else if and ( $values.port ) ( kindIs "int" $values.port )  }}
+  {{- if ( semverCompare "<= 1024" ( toString $values.port ) ) }}
+  {{- $privPort = true }}
+  {{- end }}
+  {{- end }}
+  {{- end }}
+  {{- end }}
+
+  {{- if $privPort }}
+  {{- $dynamicCapAdd = list "NET_BIND_SERVICE" }}
+  {{- end }}
+
+  {{/* combine and write all capabilities to .Values */}}
+  {{- $CapAdd := concat $fixedCapAdd $valueCapAdd $dynamicCapAdd }}
+  {{- $CapDrop := concat $fixedCapDrop $valueCapDrop $dynamicCapDrop }}
+  {{- if $CapDrop }}
+  {{- $_ := set .Values.securityContext.capabilities "drop" $CapDrop -}}
+  {{- end }}
+  {{- if $CapAdd }}
+  {{- $_ := set .Values.securityContext.capabilities "add" $CapAdd -}}
+  {{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/values/_persistenceSimple.tpl

@@ -0,0 +1,19 @@
+{{/* Allow some extra "fake" persistence options for SCALE GUI simplification */}}
+{{- define "tc.common.lib.values.persistence.simple" -}}
+  {{- range .Values.persistence }}
+  {{- if .type }}
+  {{- if eq .type "simplePVC" }}
+  {{- $_ := set . "type" "pvc" }}
+  {{- end }}
+  {{- if eq .type "simpleHP" }}
+  {{- $_ := set . "type" "hostPath" }}
+  {{- if .setPermissionsSimple }}
+  {{- $_ := set . "setPermissions" .setPermissionsSimple }}
+  {{- end }}
+  {{- if .hostPathSimple }}
+  {{- $_ := set . "hostPath" .hostPathSimple }}
+  {{- end }}
+  {{- end }}
+  {{- end }}
+  {{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/values/_privileged.tpl

@@ -0,0 +1,8 @@
+{{/* Enable privileged securitycontext when deviceList is used */}}
+{{- define "tc.common.lib.values.securityContext.privileged" -}}
+  {{- if .Values.securityContext.privileged }}
+  {{- else if .Values.deviceList }}
+  {{- $_ := set .Values.securityContext "privileged" true -}}
+  {{- $_ := set .Values.securityContext "allowPrivilegeEscalation" true -}}
+  {{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/values/_serviceSimple.tpl

@@ -0,0 +1,10 @@
+{{/* Allow some extra "fake" service options for SCALE GUI simplification */}}
+{{- define "tc.common.lib.values.service.simple" -}}
+  {{- range .Values.service }}
+  {{- if .type }}
+  {{- if eq .type "Simple" }}
+  {{- $_ := set . "type" "LoadBalancer" }}
+  {{- end }}
+  {{- end }}
+  {{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/values/_supplementalGroups.tpl

@@ -0,0 +1,28 @@
+{{/* Append default supplementalGroups to user defined groups */}}
+{{- define "tc.common.lib.values.supplementalGroups" -}}
+
+  {{/* save supplementalGroups to placeholder variables */}}
+  {{- $fixedGroups := list 568 }}
+  {{- $valuegroups := list }}
+  {{- $devGroups := list }}
+  {{- $gpuGroups := list }}
+
+  {{/* put user-entered supplementalgroups in placeholder variable */}}
+  {{- if .Values.podSecurityContext.supplementalGroups }}
+  {{- $valuegroups = .Values.podSecurityContext.supplementalGroups }}
+  {{- end }}
+
+  {{/* Append requered groups to supplementalGroups when deviceList is used */}}
+  {{- if and ( .Values.deviceList ) ( .Values.global.ixChartContext ) }}
+  {{- $devGroups = list 5 10 20 24 }}
+  {{- end }}
+
+  {{/* Append requered groups to supplementalGroups when scaleGPU is used */}}
+  {{- if and ( .Values.scaleGPU ) ( .Values.global.ixChartContext ) }}
+  {{- $gpuGroups = list 44 107 }}
+  {{- end }}
+
+  {{/* combine and write all supplementalGroups to .Values */}}
+  {{- $supGroups := concat $fixedGroups $valuegroups $devGroups $gpuGroups }}
+  {{- $_ := set .Values.podSecurityContext "supplementalGroups" $supGroups -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/values/_values.tpl

@@ -0,0 +1,9 @@
+{{/* Merge the local chart values and the common chart defaults */}}
+{{- define "tc.common.values.init" -}}
+  {{- if .Values.common -}}
+    {{- $defaultValues := deepCopy .Values.common -}}
+    {{- $userValues := deepCopy (omit .Values "common") -}}
+    {{- $mergedValues := mustMergeOverwrite $defaultValues $userValues -}}
+    {{- $_ := set . "Values" (deepCopy $mergedValues) -}}
+  {{- end -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/values/_vctSimple.tpl

@@ -0,0 +1,10 @@
+{{/* Allow some extra "fake" VolumeClaimTemplate options for SCALE GUI simplification */}}
+{{- define "tc.common.lib.values.volumeClaimTemplates.simple" -}}
+  {{- range .Values.volumeClaimTemplates }}
+  {{- if .type }}
+  {{- if eq .type "simplePVC" }}
+  {{- $_ := set . "type" "pvc" }}
+  {{- end }}
+  {{- end }}
+  {{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/values/lists/_controllerAnnotationsList.tpl

@@ -0,0 +1,9 @@
+{{/* merge controllerAnnotationsList with controllerAnnotations */}}
+{{- define "tc.common.lib.values.controller.annotations.list" -}}
+  {{- $controllerAnnotationsDict := dict }}
+  {{- range .Values.controller.annotationsList }}
+  {{- $_ := set $controllerAnnotationsDict .name .value }}
+  {{- end }}
+  {{- $controlleranno := merge .Values.controller.annotations $controllerAnnotationsDict }}
+  {{- $_ := set .Values.controller "annotations" (deepCopy $controlleranno) -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/values/lists/_controllerLabelsList.tpl

@@ -0,0 +1,9 @@
+{{/* merge controllerLabelsList with controllerLabels */}}
+{{- define "tc.common.lib.values.controller.label.list" -}}
+  {{- $controllerLabelsDict := dict }}
+  {{- range .Values.controller.labelsList }}
+  {{- $_ := set $controllerLabelsDict .name .value }}
+  {{- end }}
+  {{- $controllerlab := merge .Values.controller.labels $controllerLabelsDict }}
+  {{- $_ := set .Values "labels" (deepCopy $controllerlab) -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/values/lists/_ingressAnnotationsList.tpl

@@ -0,0 +1,14 @@
+{{/* merge ingressAnnotationsList with ingressAnnotations */}}
+{{- define "tc.common.lib.values.ingress.annotations.list" -}}
+ {{- range $index, $item := .Values.ingress }}
+ {{- if $item.enabled }}
+ {{- $ingressAnnotationsDict := dict }}
+ {{- range $item.annotationsList }}
+ {{- $_ := set $ingressAnnotationsDict .name .value }}
+ {{- end }}
+ {{- $tmp := $item.annotations }}
+ {{- $ingressanno := merge $tmp $ingressAnnotationsDict }}
+ {{- $_ := set $item "annotations" (deepCopy $ingressanno) -}}
+ {{- end }}
+ {{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/values/lists/_ingressLabelsList.tpl

@@ -0,0 +1,14 @@
+{{/* merge ingressLabelsList with ingressLabels */}}
+{{- define "tc.common.lib.values.ingress.label.list" -}}
+  {{- range $index, $item := .Values.ingress }}
+  {{- if $item.enabled }}
+  {{- $ingressLabelsDict := dict }}
+  {{- range $item.labelsList }}
+  {{- $_ := set $ingressLabelsDict .name .value }}
+  {{- end }}
+  {{- $tmp := $item.labels }}
+  {{- $ingresslab := merge $tmp $ingressLabelsDict }}
+  {{- $_ := set $item "labels" (deepCopy $ingresslab) -}}
+  {{- end }}
+  {{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/values/lists/_ingressList.tpl

@@ -0,0 +1,13 @@
+{{/* merge ingressList with ingress */}}
+{{- define "tc.common.lib.values.ingress.list" -}}
+  {{- $ingDict := dict }}
+  {{- range $index, $item := .Values.ingressList -}}
+    {{- $name := ( printf "list-%s" ( $index | toString ) ) }}
+    {{- if $item.name }}
+      {{- $name = $item.name }}
+    {{- end }}
+    {{- $_ := set $ingDict $name $item }}
+  {{- end }}
+  {{- $ing := merge .Values.ingress $ingDict }}
+  {{- $_ := set .Values "ingress" (deepCopy $ing) -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/values/lists/_persistenceAnnotationsList.tpl

@@ -0,0 +1,14 @@
+{{/* merge persistenceAnnotationsList with persistenceAnnotations */}}
+{{- define "tc.common.lib.values.persistence.annotations.list" -}}
+  {{- range $index, $item := .Values.persistence }}
+  {{- if $item.enabled }}
+  {{- $persistenceAnnotationsDict := dict }}
+  {{- range $item.annotationsList }}
+  {{- $_ := set $persistenceAnnotationsDict .name .value }}
+  {{- end }}
+  {{- $tmp := $item.annotations }}
+  {{- $persistenceanno := merge $tmp $persistenceAnnotationsDict }}
+  {{- $_ := set $item "annotations" (deepCopy $persistenceanno) -}}
+  {{- end }}
+  {{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/values/lists/_persistenceLabelsList.tpl

@@ -0,0 +1,14 @@
+{{/* merge persistenceLabelsList with persistenceLabels */}}
+{{- define "tc.common.lib.values.persistence.label.list" -}}
+  {{- range $index, $item := .Values.persistence }}
+  {{- if $item.enabled }}
+  {{- $persistenceLabelsDict := dict }}
+  {{- range $item.labelsList }}
+  {{- $_ := set $persistenceLabelsDict .name .value }}
+  {{- end }}
+  {{- $tmp := $item.labels }}
+  {{- $persistencelab := merge $tmp $persistenceLabelsDict }}
+  {{- $_ := set $item "labels" (deepCopy $persistencelab) -}}
+  {{- end }}
+  {{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/values/lists/_persistenceList.tpl

@@ -0,0 +1,21 @@
+{{/* merge persistenceList with Persitence */}}
+{{- define "tc.common.lib.values.persistence.list" -}}
+  {{- $perDict := dict }}
+  {{- range $index, $item := .Values.persistenceList -}}
+    {{- $name := ( printf "list-%s" ( $index | toString ) ) }}
+    {{- if $item.name }}
+      {{- $name = $item.name }}
+    {{- end }}
+    {{- $_ := set $perDict $name $item }}
+  {{- end }}
+
+  {{- range $index, $item := .Values.deviceList -}}
+    {{- $name := ( printf "device-%s" ( $index | toString ) ) }}
+    {{- if $item.name }}
+      {{- $name = $item.name }}
+    {{- end }}
+    {{- $_ := set $perDict $name $item }}
+  {{- end }}
+  {{- $per := merge .Values.persistence $perDict }}
+  {{- $_ := set .Values "persistence" (deepCopy $per) -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/values/lists/_podAnnotationsList.tpl

@@ -0,0 +1,9 @@
+{{/* merge podAnnotationsList with podAnnotations */}}
+{{- define "tc.common.lib.values.pod.annotations.list" -}}
+  {{- $podAnnotationsDict := dict }}
+  {{- range .Values.podAnnotationsList }}
+  {{- $_ := set $podAnnotationsDict .name .value }}
+  {{- end }}
+  {{- $podanno := merge .Values.podAnnotations $podAnnotationsDict }}
+  {{- $_ := set .Values "podAnnotations" (deepCopy $podanno) -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/values/lists/_podLabelsList.tpl

@@ -0,0 +1,9 @@
+{{/* merge podLabelsList with podLabels */}}
+{{- define "tc.common.lib.values.pod.label.list" -}}
+  {{- $podLabelsDict := dict }}
+  {{- range .Values.controller.labelsList }}
+  {{- $_ := set $podLabelsDict .name .value }}
+  {{- end }}
+  {{- $podlab := merge .Values.controller.labels $podLabelsDict }}
+  {{- $_ := set .Values.controller "labels" (deepCopy $podlab) -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/values/lists/_portsList.tpl

@@ -0,0 +1,20 @@
+{{/* merge portsList with ports */}}
+{{- define "tc.common.lib.values.ports.list" -}}
+  {{- range $index, $item := .Values.service -}}
+  {{- if $item.enabled }}
+  {{- $portsDict := dict }}
+  {{- range $index2, $item2 :=  $item.portsList -}}
+  {{- if $item2.enabled }}
+    {{- $name := ( printf "list-%s" ( $index2 | toString ) ) }}
+    {{- if $item2.name }}
+      {{- $name = $item2.name }}
+    {{- end }}
+    {{- $_ := set $portsDict $name $item2 }}
+  {{- end }}
+  {{- $tmp := $item.ports }}
+  {{- $ports := merge $tmp $portsDict }}
+  {{- $_ := set $item "ports" (deepCopy $ports) -}}
+  {{- end }}
+  {{- end }}
+  {{- end }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/lib/values/lists/_serviceList.tpl

@@ -0,0 +1,15 @@
+{{/* merge serviceList with service */}}
+{{- define "tc.common.lib.values.service.list" -}}
+  {{- $portsDict := dict }}
+  {{- range $index, $item := .Values.serviceList -}}
+  {{- if $item.enabled }}
+    {{- $name := ( printf "list-%s" ( $index | toString ) ) }}
+    {{- if $item.name }}
+      {{- $name = $item.name }}
+    {{- end }}
+    {{- $_ := set $portsDict $name $item }}
+  {{- end }}
+  {{- end }}
+  {{- $srv := merge .Values.service $portsDict }}
+  {{- $_ := set .Values "service" (deepCopy $srv) -}}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/loader/_all.tpl

@@ -0,0 +1,11 @@
+{{/*
+Main entrypoint for the common library chart. It will render all underlying templates based on the provided values.
+*/}}
+{{- define "tc.common.loader.all" -}}
+  {{/* Generate chart and dependency values */}}
+  {{- include "tc.common.loader.init" . }}
+
+  {{/* Generate remaining objects */}}
+  {{- include "tc.common.loader.apply" . }}
+
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/loader/_apply.tpl

@@ -0,0 +1,54 @@
+{{/*
+Secondary entrypoint and primary loader for the common chart
+*/}}
+{{- define "tc.common.loader.apply" -}}
+
+  {{/* Render the externalInterfaces */}}
+  {{ include "tc.common.scale.externalInterfaces" .  | nindent 0 }}
+
+  {{/* Enable code-server add-on if required */}}
+  {{- if .Values.addons.codeserver.enabled }}
+    {{- include "tc.common.addon.codeserver" . }}
+  {{- end -}}
+
+  {{/* Enable VPN add-on if required */}}
+  {{- if ne "disabled" .Values.addons.vpn.type -}}
+    {{- include "tc.common.addon.vpn" . }}
+  {{- end -}}
+
+  {{/* Build the configmaps */}}
+  {{ include "tc.common.spawner.configmap" . | nindent 0 }}
+
+  {{/* Build the secrets */}}
+  {{ include "tc.common.spawner.secret" . | nindent 0 }}
+
+  {{/* Build the templates */}}
+  {{- include "tc.common.spawner.pvc" . }}
+
+  {{ include "tc.common.spawner.serviceaccount" . | nindent 0 }}
+
+  {{- if .Values.controller.enabled }}
+    {{- if eq .Values.controller.type "deployment" }}
+      {{- include "tc.common.deployment" . | nindent 0 }}
+    {{ else if eq .Values.controller.type "daemonset" }}
+      {{- include "tc.common.daemonset" . | nindent 0 }}
+    {{ else if eq .Values.controller.type "statefulset"  }}
+      {{- include "tc.common.statefulset" . | nindent 0 }}
+    {{ else }}
+      {{- fail (printf "Not a valid controller.type (%s)" .Values.controller.type) }}
+    {{- end -}}
+ {{- end -}}
+
+  {{ include "tc.common.spawner.rbac" . | nindent 0 }}
+
+  {{ include "tc.common.spawner.hpa" . | nindent 0 }}
+
+  {{ include "tc.common.spawner.service" . | nindent 0 }}
+
+  {{ include "tc.common.spawner.ingress" .  | nindent 0 }}
+
+  {{ include "tc.common.scale.portal" .  | nindent 0 }}
+
+  {{ include "tc.common.spawner.networkpolicy" . | nindent 0 }}
+
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/loader/_init.tpl

@@ -0,0 +1,41 @@
+{{- define "tc.common.loader.init" -}}
+  {{/* Merge the local chart values and the common chart defaults */}}
+  {{- include "tc.common.values.init" . }}
+
+  {{- include "tc.common.loader.lists" . }}
+
+  {{- include "tc.common.lib.values.persistence.simple" . }}
+
+  {{- include "tc.common.lib.values.volumeClaimTemplates.simple" . }}
+
+  {{- include "tc.common.lib.values.service.simple" . }}
+
+  {{- include "tc.common.lib.values.capabilities" . }}
+
+  {{- include "tc.common.lib.values.supplementalGroups" . }}
+
+  {{- include "tc.common.lib.values.securityContext.privileged" . }}
+
+  {{ include "tc.common.lib.util.manifest.update" . | nindent 0 }}
+
+  {{/* Autogenerate cnpg objects if needed */}}
+  {{- include "tc.common.dependencies.cnpg.main" . }}
+
+  {{/* Autogenerate postgresql passwords if needed */}}
+  {{- include "tc.common.dependencies.postgresql.injector" . }}
+
+  {{/* Autogenerate redis passwords if needed */}}
+  {{- include "tc.common.dependencies.redis.injector" . }}
+
+  {{/* Autogenerate mariadb passwords if needed */}}
+  {{- include "tc.common.dependencies.mariadb.injector" . }}
+
+  {{/* Autogenerate mongodb passwords if needed */}}
+  {{- include "tc.common.dependencies.mongodb.injector" . }}
+
+  {{/* Autogenerate clickhouse passwords if needed */}}
+  {{- include "tc.common.dependencies.clickhouse.injector" . }}
+
+  {{/* Autogenerate solr passwords if needed */}}
+  {{- include "tc.common.dependencies.solr.injector" . }}
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/loader/_lists.tpl

@@ -0,0 +1,21 @@
+{{/* load all list to dict injectors */}}
+{{- define "tc.common.loader.lists" -}}
+
+  {{ include "tc.common.lib.values.controller.label.list" . }}
+  {{ include "tc.common.lib.values.controller.annotations.list" . }}
+
+  {{ include "tc.common.lib.values.pod.label.list" . }}
+  {{ include "tc.common.lib.values.pod.annotations.list" . }}
+
+  {{ include "tc.common.lib.values.persistence.list" . }}
+  {{ include "tc.common.lib.values.persistence.label.list" . }}
+  {{ include "tc.common.lib.values.persistence.annotations.list" . }}
+
+  {{ include "tc.common.lib.values.service.list" . }}
+  {{ include "tc.common.lib.values.ports.list" . }}
+
+  {{ include "tc.common.lib.values.ingress.list" . }}
+  {{ include "tc.common.lib.values.ingress.label.list" . }}
+  {{ include "tc.common.lib.values.ingress.annotations.list" . }}
+
+{{- end -}}

charts/mosquitto-mqtt/charts/common/templates/pods/_daemonset.tpl

@@ -0,0 +1,36 @@
+{{/*
+This template serves as the blueprint for the DaemonSet objects that are created
+within the common library.
+*/}}
+{{- define "tc.common.daemonset" }}
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ include "tc.common.names.fullname" . }}
+  {{- with (merge (.Values.controller.labels | default dict) (include "tc.common.labels" $ | fromYaml)) }}
+  labels: {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+  {{- with (merge (.Values.controller.annotations | default dict) (include "tc.common.annotations" $ | fromYaml) (include "tc.common.annotations.workload" $ | fromYaml)) }}
+  annotations: {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+spec:
+  revisionHistoryLimit: {{ .Values.controller.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+      {{- include "tc.common.labels.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+      {{- include "tc.common.annotations.workload.spec" . | nindent 8 }}
+      {{- with .Values.podAnnotations }}
+        {{- tpl ( toYaml . ) $ | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "tc.common.labels.selectorLabels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- tpl ( toYaml . ) $ | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- include "tc.common.controller.pod" . | nindent 6 }}
+{{- end }}

charts/mosquitto-mqtt/charts/common/templates/pods/_deployment.tpl

@@ -0,0 +1,54 @@
+{{/*
+This template serves as the blueprint for the Deployment objects that are created
+within the common library.
+*/}}
+{{- define "tc.common.deployment" }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "tc.common.names.fullname" . }}
+  {{- with (merge (.Values.controller.labels | default dict) (include "tc.common.labels" $ | fromYaml)) }}
+  labels: {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+  {{- with (merge (.Values.controller.annotations | default dict) (include "tc.common.annotations" $ | fromYaml) (include "tc.common.annotations.workload" $ | fromYaml)) }}
+  annotations: {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+spec:
+  revisionHistoryLimit: {{ .Values.controller.revisionHistoryLimit }}
+  replicas: {{ .Values.controller.replicas }}
+  {{- $strategy := default "Recreate" .Values.controller.strategy }}
+  {{- if and (ne $strategy "Recreate") (ne $strategy "RollingUpdate") }}
+    {{- fail (printf "Not a valid strategy type for Deployment (%s)" $strategy) }}
+  {{- end }}
+  strategy:
+    type: {{ $strategy }}
+    {{- with .Values.controller.rollingUpdate }}
+      {{- if and (eq $strategy "RollingUpdate") (or .surge .unavailable) }}
+    rollingUpdate:
+        {{- with .unavailable }}
+      maxUnavailable: {{ . }}
+        {{- end }}
+        {{- with .surge }}
+      maxSurge: {{ . }}
+        {{- end }}
+      {{- end }}
+    {{- end }}
+  selector:
+    matchLabels:
+      {{- include "tc.common.labels.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+      {{- include "tc.common.annotations.workload.spec" . | nindent 8 }}
+      {{- with .Values.podAnnotations }}
+        {{- tpl ( toYaml . ) $ | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "tc.common.labels.selectorLabels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- tpl ( toYaml . ) $ | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- include "tc.common.controller.pod" . | nindent 6 }}
+{{- end }}

charts/mosquitto-mqtt/charts/common/templates/pods/_statefulset.tpl

@@ -0,0 +1,61 @@
+{{/*
+This template serves as the blueprint for the StatefulSet objects that are created
+within the common library.
+*/}}
+{{- define "tc.common.statefulset" }}
+{{- $values := .Values }}
+{{- $releaseName := .Release.Name }}
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "tc.common.names.fullname" . }}
+  {{- with (merge (.Values.controller.labels | default dict) (include "tc.common.labels" $ | fromYaml)) }}
+  labels: {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+  {{- with (merge (.Values.controller.annotations | default dict) (include "tc.common.annotations" $ | fromYaml) (include "tc.common.annotations.workload" $ | fromYaml)) }}
+  annotations: {{- tpl ( toYaml . ) $ | nindent 4 }}
+  {{- end }}
+spec:
+  revisionHistoryLimit: {{ .Values.controller.revisionHistoryLimit }}
+  replicas: {{ .Values.controller.replicas }}
+  {{- $strategy := default "RollingUpdate" .Values.controller.strategy }}
+  {{- if and (ne $strategy "OnDelete") (ne $strategy "RollingUpdate") }}
+    {{- fail (printf "Not a valid strategy type for StatefulSet (%s)" $strategy) }}
+  {{- end }}
+  updateStrategy:
+    type: {{ $strategy }}
+    {{- if and (eq $strategy "RollingUpdate") .Values.controller.rollingUpdate.partition }}
+    rollingUpdate:
+      partition: {{ .Values.controller.rollingUpdate.partition }}
+    {{- end }}
+  selector:
+    matchLabels:
+      {{- include "tc.common.labels.selectorLabels" . | nindent 6 }}
+  serviceName: {{ include "tc.common.names.fullname" . }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- tpl ( toYaml . ) $ | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "tc.common.labels.selectorLabels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- tpl ( toYaml . ) $ | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- include "tc.common.controller.pod" . | nindent 6 }}
+  volumeClaimTemplates:
+    {{- range $index, $vct := .Values.volumeClaimTemplates }}
+    - metadata:
+        name: {{ tpl ( toString $index ) $ }}
+      spec:
+        accessModes:
+          - {{ tpl ( $vct.accessMode | default "ReadWriteOnce" ) $ | quote }}
+        resources:
+          requests:
+            storage: {{ tpl ( $vct.size | default "999Gi" ) $ | quote }}
+        {{ include "tc.common.storage.storageClassName" ( dict "persistence" $vct "global" $) }}
+    {{- end }}
+{{- end }}