Run to UTC

gitignore

.gitignore

@@ -1 +1,23 @@
-oc-datacenter
+# ---> Go
+# If you prefer the allow list template instead of the deny list, see community template:
+# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
+#
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Test binary, built with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Dependency directories (remove the comment below to include it)
+# vendor/
+
+# Go workspace file
+go.work
+

Dockerfile

@@ -1,29 +1,45 @@
+ARG KUBERNETES_HOST=${KUBERNETES_HOST:-"127.0.0.1"}
+
+FROM golang:alpine AS deps
+
+WORKDIR /app
+COPY go.mod go.sum ./
+RUN sed -i '/replace/d' go.mod
+RUN go mod download
+
+#----------------------------------------------------------------------------------------------
+
 FROM golang:alpine AS builder
 
 WORKDIR /app 
 
+RUN go install github.com/beego/bee/v2@latest
+
+WORKDIR /oc-datacenter
+
+COPY --from=deps /go/pkg /go/pkg
+COPY --from=deps /app/go.mod /app/go.sum ./
+
+RUN export CGO_ENABLED=0 && \
+    export GOOS=linux && \
+    export GOARCH=amd64 && \
+    export BUILD_FLAGS="-ldflags='-w -s'"
+
 COPY . .
 
-RUN apk add git
+RUN sed -i '/replace/d' go.mod
+RUN bee pack
+RUN mkdir -p /app/extracted && tar -zxvf oc-datacenter.tar.gz -C /app/extracted
+#----------------------------------------------------------------------------------------------
 
-RUN go get github.com/beego/bee/v2 && go install github.com/beego/bee/v2@master
+FROM golang:alpine
 
-RUN timeout 15 bee run -gendoc=true -downdoc=true -runmode=dev || :
-
-RUN sed -i 's/http:\/\/127.0.0.1:8080\/swagger\/swagger.json/swagger.json/g' swagger/index.html
-
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-w -s" .
-
-RUN ls /app
-
-FROM scratch
+ENV KUBERNETES_SERVICE_HOST=$KUBERNETES_HOST
 
 WORKDIR /app
-
-COPY --from=builder /app/oc-datacenter /usr/bin/ 
-COPY --from=builder /app/swagger /app/swagger
-
-COPY docker_datacenter.json /etc/oc/datacenter.json
+COPY --from=builder /app/extracted/oc-datacenter /usr/bin/ 
+COPY --from=builder /app/extracted/swagger /app/swagger
+COPY --from=builder /app/extracted/docker_datacenter.json /etc/oc/datacenter.json
 
 EXPOSE 8080
 

LICENSE

@@ -1,9 +0,0 @@
-MIT License
-
-Copyright (c) <year> <copyright holders>
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

LICENSE.md

@@ -0,0 +1,660 @@
+# GNU AFFERO GENERAL PUBLIC LICENSE
+
+Version 3, 19 November 2007
+
+Copyright (C) 2007 Free Software Foundation, Inc.
+<https://fsf.org/>
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+## Preamble
+
+The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works. By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains
+free software for all its users.
+
+When we speak of free software, we are referring to freedom, not
+price. Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate. Many developers of free software are heartened and
+encouraged by the resulting cooperation. However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community. It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server. Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals. This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing
+under this license.
+
+The precise terms and conditions for copying, distribution and
+modification follow.
+
+## TERMS AND CONDITIONS
+
+### 0. Definitions.
+
+"This License" refers to version 3 of the GNU Affero General Public
+License.
+
+"Copyright" also means copyright-like laws that apply to other kinds
+of works, such as semiconductor masks.
+
+"The Program" refers to any copyrightable work licensed under this
+License. Each licensee is addressed as "you". "Licensees" and
+"recipients" may be individuals or organizations.
+
+To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of
+an exact copy. The resulting work is called a "modified version" of
+the earlier work or a work "based on" the earlier work.
+
+A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy. Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies. Mere interaction with a user
+through a computer network, with no transfer of a copy, is not
+conveying.
+
+An interactive user interface displays "Appropriate Legal Notices" to
+the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License. If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+### 1. Source Code.
+
+The "source code" for a work means the preferred form of the work for
+making modifications to it. "Object code" means any non-source form of
+a work.
+
+A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form. A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities. However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work. For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+The Corresponding Source need not include anything that users can
+regenerate automatically from other parts of the Corresponding Source.
+
+The Corresponding Source for a work in source code form is that same
+work.
+
+### 2. Basic Permissions.
+
+All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met. This License explicitly affirms your unlimited
+permission to run the unmodified Program. The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work. This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+You may make, run and propagate covered works that you do not convey,
+without conditions so long as your license otherwise remains in force.
+You may convey covered works to others for the sole purpose of having
+them make modifications exclusively for you, or provide you with
+facilities for running those works, provided that you comply with the
+terms of this License in conveying all material for which you do not
+control copyright. Those thus making or running the covered works for
+you must do so exclusively on your behalf, under your direction and
+control, on terms that prohibit them from making any copies of your
+copyrighted material outside their relationship with you.
+
+Conveying under any other circumstances is permitted solely under the
+conditions stated below. Sublicensing is not allowed; section 10 makes
+it unnecessary.
+
+### 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such
+circumvention is effected by exercising rights under this License with
+respect to the covered work, and you disclaim any intention to limit
+operation or modification of the work as a means of enforcing, against
+the work's users, your or third parties' legal rights to forbid
+circumvention of technological measures.
+
+### 4. Conveying Verbatim Copies.
+
+You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+### 5. Conveying Modified Source Versions.
+
+You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these
+conditions:
+
+-   a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+-   b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under
+    section 7. This requirement modifies the requirement in section 4
+    to "keep intact all notices".
+-   c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy. This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged. This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+-   d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit. Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+### 6. Conveying Non-Source Forms.
+
+You may convey a covered work in object code form under the terms of
+sections 4 and 5, provided that you also convey the machine-readable
+Corresponding Source under the terms of this License, in one of these
+ways:
+
+-   a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+-   b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the Corresponding
+    Source from a network server at no charge.
+-   c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source. This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+-   d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge. You need not require recipients to copy the
+    Corresponding Source along with the object code. If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source. Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+-   e) Convey the object code using peer-to-peer transmission,
+    provided you inform other peers where the object code and
+    Corresponding Source of the work are being offered to the general
+    public at no charge under subsection 6d.
+
+A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal,
+family, or household purposes, or (2) anything designed or sold for
+incorporation into a dwelling. In determining whether a product is a
+consumer product, doubtful cases shall be resolved in favor of
+coverage. For a particular product received by a particular user,
+"normally used" refers to a typical or common use of that class of
+product, regardless of the status of the particular user or of the way
+in which the particular user actually uses, or expects or is expected
+to use, the product. A product is a consumer product regardless of
+whether the product has substantial commercial, industrial or
+non-consumer uses, unless such uses represent the only significant
+mode of use of the product.
+
+"Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to
+install and execute modified versions of a covered work in that User
+Product from a modified version of its Corresponding Source. The
+information must suffice to ensure that the continued functioning of
+the modified object code is in no case prevented or interfered with
+solely because modification has been made.
+
+If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information. But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or
+updates for a work that has been modified or installed by the
+recipient, or for the User Product in which it has been modified or
+installed. Access to a network may be denied when the modification
+itself materially and adversely affects the operation of the network
+or violates the rules and protocols for communication across the
+network.
+
+Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+### 7. Additional Terms.
+
+"Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law. If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it. (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.) You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders
+of that material) supplement the terms of this License with terms:
+
+-   a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+-   b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+-   c) Prohibiting misrepresentation of the origin of that material,
+    or requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+-   d) Limiting the use for publicity purposes of names of licensors
+    or authors of the material; or
+-   e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+-   f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions
+    of it) with contractual assumptions of liability to the recipient,
+    for any liability that these contractual assumptions directly
+    impose on those licensors and authors.
+
+All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10. If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term. If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions; the
+above requirements apply either way.
+
+### 8. Termination.
+
+You may not propagate or modify a covered work except as expressly
+provided under this License. Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+However, if you cease all violation of this License, then your license
+from a particular copyright holder is reinstated (a) provisionally,
+unless and until the copyright holder explicitly and finally
+terminates your license, and (b) permanently, if the copyright holder
+fails to notify you of the violation by some reasonable means prior to
+60 days after the cessation.
+
+Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License. If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+### 9. Acceptance Not Required for Having Copies.
+
+You are not required to accept this License in order to receive or run
+a copy of the Program. Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance. However,
+nothing other than this License grants you permission to propagate or
+modify any covered work. These actions infringe copyright if you do
+not accept this License. Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+### 10. Automatic Licensing of Downstream Recipients.
+
+Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License. You are not responsible
+for enforcing compliance by third parties with this License.
+
+An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations. If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License. For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+### 11. Patents.
+
+A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based. The
+work thus licensed is called the contributor's "contributor version".
+
+A contributor's "essential patent claims" are all patent claims owned
+or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version. For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement). To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients. "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+A patent license is "discriminatory" if it does not include within the
+scope of its coverage, prohibits the exercise of, or is conditioned on
+the non-exercise of one or more of the rights that are specifically
+granted under this License. You may not convey a covered work if you
+are a party to an arrangement with a third party that is in the
+business of distributing software, under which you make payment to the
+third party based on the extent of your activity of conveying the
+work, and under which the third party grants, to any of the parties
+who would receive the covered work from you, a discriminatory patent
+license (a) in connection with copies of the covered work conveyed by
+you (or copies made from those copies), or (b) primarily for and in
+connection with specific products or compilations that contain the
+covered work, unless you entered into that arrangement, or that patent
+license was granted, prior to 28 March 2007.
+
+Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+### 12. No Surrender of Others' Freedom.
+
+If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License. If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under
+this License and any other pertinent obligations, then as a
+consequence you may not convey it at all. For example, if you agree to
+terms that obligate you to collect a royalty for further conveying
+from those to whom you convey the Program, the only way you could
+satisfy both those terms and this License would be to refrain entirely
+from conveying the Program.
+
+### 13. Remote Network Interaction; Use with the GNU General Public License.
+
+Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your
+version supports such interaction) an opportunity to receive the
+Corresponding Source of your version by providing access to the
+Corresponding Source from a network server at no charge, through some
+standard or customary means of facilitating copying of software. This
+Corresponding Source shall include the Corresponding Source for any
+work covered by version 3 of the GNU General Public License that is
+incorporated pursuant to the following paragraph.
+
+Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work. The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+### 14. Revised Versions of this License.
+
+The Free Software Foundation may publish revised and/or new versions
+of the GNU Affero General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Program
+specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation. If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever
+published by the Free Software Foundation.
+
+If the Program specifies that a proxy can decide which future versions
+of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+Later license versions may give you additional or different
+permissions. However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+### 15. Disclaimer of Warranty.
+
+THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT
+WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND
+PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE
+DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR
+CORRECTION.
+
+### 16. Limitation of Liability.
+
+IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR
+CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES
+ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT
+NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR
+LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM
+TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER
+PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+### 17. Interpretation of Sections 15 and 16.
+
+If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+END OF TERMS AND CONDITIONS
+
+## How to Apply These Terms to Your New Programs
+
+If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these
+terms.
+
+To do so, attach the following notices to the program. It is safest to
+attach them to the start of each source file to most effectively state
+the exclusion of warranty; and each file should have at least the
+"copyright" line and a pointer to where the full notice is found.
+
+        <one line to give the program's name and a brief idea of what it does.>
+        Copyright (C) <year>  <name of author>
+
+        This program is free software: you can redistribute it and/or modify
+        it under the terms of the GNU Affero General Public License as
+        published by the Free Software Foundation, either version 3 of the
+        License, or (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+        GNU Affero General Public License for more details.
+
+        You should have received a copy of the GNU Affero General Public License
+        along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper
+mail.
+
+If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source. For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code. There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for
+the specific requirements.
+
+You should also get your employer (if you work as a programmer) or
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary. For more information on this, and how to apply and follow
+the GNU AGPL, see <https://www.gnu.org/licenses/>.

Makefile

@@ -0,0 +1,42 @@
+.DEFAULT_GOAL := all
+
+build: clean
+	bee pack
+
+run:
+	bee run -gendoc=true -downdoc=true
+
+purge:
+	lsof -t -i:8092 | xargs kill | true
+
+run-dev:
+	bee generate routers && bee run -gendoc=true -downdoc=true -runmode=prod
+
+dev: purge run-dev
+
+debug:
+	bee run -downdebug -gendebug
+
+clean:
+	rm -rf oc-datacenter.tar.gz
+
+docker:
+	DOCKER_BUILDKIT=1 docker build -t oc-datacenter -f Dockerfile . --build-arg=HOST=$(HOST) --build-arg=KUBERNETES_HOST=$(KUBERNETES_HOST) --build-arg=KUBERNETES_SERVICE_PORT=$(KUBERNETES_SERVICE_PORT) --build-arg=KUBE_CA=$(KUBE_CA) --build-arg=KUBE_CERT=$(KUBE_CERT) --build-arg=KUBE_DATA=$(KUBE_DATA)
+	docker tag oc-datacenter opencloudregistry/oc-datacenter:latest
+
+publish-kind:
+	kind load docker-image opencloudregistry/oc-datacenter:latest --name $(CLUSTER_NAME) | true
+
+publish-registry:
+	docker push opencloudregistry/oc-datacenter:latest
+
+docker-deploy:
+	docker compose up -d
+
+run-docker: docker publish-kind publish-registry docker-deploy
+
+all: docker publish-kind
+
+ci: docker publish-registry 
+
+.PHONY: build run clean docker publish-kind publish-registry

README.md

@@ -7,9 +7,62 @@ To build :
     bee generate routers
     bee run -gendoc=true -downdoc=true
 
+OR 
+    make dev
+
 If default Swagger page is displayed instead of tyour api, change url in swagger/index.html file to :
 
     url: "swagger.json"
 
 Note on particular process :
-- set a bookin delete all related workflow booking before creating new ones. (no update of existing ones)
+- set a bookin delete all related workflow booking before creating new ones. (no update of existing ones)
+
+## Admiralty
+
+The routes in /admiralty will trigger actions on the DC's Kubernetes API to retrieve information on Admiralty resources.
+
+### Targets
+
+Remote clusters that can be used by Admiralty to delegate pods.
+
+To set up a target Admiralty needs to associate a `secret` which contains an edited version of the target's `kubeconfig`. 
+
+Once the Target is set the remote cluster appears in the output of `kubectl get nodes` under the name `admiralty-<namespace>-<target name>-*`
+
+**TODO** : We might need a way to test if an IP is associated to an admiralty target 
+
+# Docker Kube Settings
+
+Set up your base64 key from your ~/.kube/config.
+Don't forget to set up your external IP in docker_datacenter.json
+## Admiralty
+
+The routes in /admiralty will trigger actions on the DC's Kubernetes API to retrieve information on Admiralty resources.
+
+### Targets
+
+Remote clusters that can be used by Admiralty to delegate pods.
+
+To set up a target Admiralty needs to associate a `secret` which contains an edited version of the target's `kubeconfig`. 
+
+Once the Target is set the remote cluster appears in the output of `kubectl get nodes` under the name `admiralty-<namespace>-<target name>-*`
+
+**TODO** : We might need a way to test if an IP is associated to an admiralty target 
+
+# Docker Kube Settings
+
+Set up your base64 key from your ~/.kube/config.
+Don't forget to set up your external IP in docker_datacenter.json
+## Admiralty
+
+The routes in /admiralty will trigger actions on the DC's Kubernetes API to retrieve information on Admiralty resources.
+
+### Targets
+
+Remote clusters that can be used by Admiralty to delegate pods.
+
+To set up a target Admiralty needs to associate a `secret` which contains an edited version of the target's `kubeconfig`. 
+
+Once the Target is set the remote cluster appears in the output of `kubectl get nodes` under the name `admiralty-<namespace>-<target name>-*`
+
+**TODO** : We might need a way to test if an IP is associated to an admiralty target 

conf/app.conf

@@ -1,5 +1,5 @@
 appname = oc-datacenter
-httpport = 8080
+httpport = 8092
 runmode = dev
 autorender = false
 copyrequestbody = true
@@ -7,4 +7,4 @@ EnableDocs = true
 sqlconn = 
 
 MONGO_URL = "mongodb://127.0.0.1:27017/beego-demo"
-MONGO_DATABASE = "DC_myDC-demo_06042021"
+MONGO_DATABASE = "DC_myDC-demo_06042021"

conf/config.go

@@ -0,0 +1,26 @@
+package conf
+
+import "sync"
+
+type Config struct {
+	Mode            string
+	KubeHost        string
+	KubePort        string
+	KubeCA          string
+	KubeCert        string
+	KubeData        string
+	MinioRootKey    string
+	MinioRootSecret string
+	MonitorMode     string
+	MonitorAddress  string
+}
+
+var instance *Config
+var once sync.Once
+
+func GetConfig() *Config {
+	once.Do(func() {
+		instance = &Config{}
+	})
+	return instance
+}

controllers/booking.go

@@ -1,166 +0,0 @@
-package controllers
-
-import (
-	"encoding/json"
-	"errors"
-	"time"
-
-	oclib "cloud.o-forge.io/core/oc-lib"
-	"cloud.o-forge.io/core/oc-lib/dbs"
-	b "cloud.o-forge.io/core/oc-lib/models/booking"
-	"cloud.o-forge.io/core/oc-lib/models/workflow_execution"
-	beego "github.com/beego/beego/v2/server/web"
-)
-
-// Operations about workspace
-type BookingController struct {
-	beego.Controller
-}
-
-// @Title Search
-// @Description search booking
-// @Param	search		path 	string	true		"the word search you want to get"
-// @Success 200 {booking} models.booking
-// @router /search/:search [get]
-func (o *BookingController) Search() {
-	// store and return Id or post with UUID
-	search := o.Ctx.Input.Param(":search")
-	o.Data["json"] = oclib.Search(nil, search, oclib.LibDataEnum(oclib.BOOKING))
-	o.ServeJSON()
-}
-
-// @Title GetAll
-// @Description find booking by id
-// @Success 200 {booking} models.booking
-// @router / [get]
-func (o *BookingController) GetAll() {
-	o.Data["json"] = oclib.LoadAll(oclib.LibDataEnum(oclib.BOOKING))
-	o.ServeJSON()
-}
-
-// @Title Get
-// @Description find booking by id
-// @Param	id		path 	string	true		"the id you want to get"
-// @Success 200 {booking} models.booking
-// @router /:id [get]
-func (o *BookingController) Get() {
-	id := o.Ctx.Input.Param(":id")
-	o.Data["json"] = oclib.LoadOne(oclib.LibDataEnum(oclib.BOOKING), id)
-	o.ServeJSON()
-}
-
-// @Title Check
-// @Description check booking
-// @Param	id	path 	string		"id of the datacenter"
-// @Param	start_date		path 	string		"the booking start date" format "2006-01-02T15:04:05"
-// @Param	end_date		path 	string		"the booking end date" format "2006-01-02T15:04:05"
-// @Success 200 {object} models.object
-// @router /check/:id/:start_date/:end_date [get]
-func (o *BookingController) Check() {
-	/*
-	 * This function is used to check if a booking is available for a specific datacenter.
-	 * It takes the following parameters:
-	 * - id: the id of the datacenter
-	 * - start_date: the start date of the booking
-	 * - end_date: the end date of the booking
-	 */
-	id := o.Ctx.Input.Param(":id")
-	date, err := time.Parse("2006-01-02T15:04:05", o.Ctx.Input.Param(":start_date"))
-	date2, err2 := time.Parse("2006-01-02T15:04:05", o.Ctx.Input.Param(":end_date"))
-	if err != nil || err2 != nil {
-		o.Data["json"] = map[string]interface{}{
-			"data": map[string]interface{}{
-				"is_available": false,
-			},
-			"code":  400,
-			"error": errors.New("invalid date format"),
-		}
-	} else {
-		booking := &b.Booking{}                                     // create a new booking object
-		isAvailable, err2 := booking.CheckBooking(id, date, &date2) // check if the booking is available
-		code := 200
-		err := ""
-		if !isAvailable {
-			code = 409
-			err = "booking not available"
-			if err2 != nil {
-				err += " - " + err2.Error()
-			}
-		}
-		o.Data["json"] = map[string]interface{}{
-			"data": map[string]interface{}{
-				"is_available": isAvailable,
-			},
-			"code":  code,
-			"error": err,
-		}
-	}
-	o.ServeJSON()
-}
-
-// @Title Post
-// @Description create booking
-// @Param	booking		body 	string	true		"the booking you want to post"
-// @Success 200 {object} models.object
-// @router / [post]
-func (o *BookingController) Post() {
-	/*
-	 * This function is used to create a booking.
-	 * It takes the following parameters:
-	 * - booking: the booking you want to post
-	 * The booking is a JSON object that contains the following fields:
-	 * - datacenter_resource_id: the id of the datacenter
-	 * - workflow_execution: the workflow execution
-	 */
-	var resp workflow_execution.WorkflowExecutions
-	json.Unmarshal(o.Ctx.Input.CopyBody(10000), &resp)
-	dc_id := resp.ResourceID
-	// delete all previous bookings
-	res := oclib.Search(&dbs.Filters{And: map[string][]dbs.Filter{
-		"workflowexecution.workflow_id": {{Operator: dbs.EQUAL.String(), Value: resp.WorkflowID}},
-		"datacenter_resource_id":        {{Operator: dbs.EQUAL.String(), Value: dc_id}},
-	}}, "", oclib.LibDataEnum(oclib.BOOKING))
-	if res.Code != 200 {
-		o.Data["json"] = map[string]interface{}{
-			"data":  nil,
-			"code":  res.Code,
-			"error": res.Err,
-		}
-		o.ServeJSON()
-		return
-	}
-	for _, b := range res.Data { // delete all previous bookings
-		oclib.DeleteOne(oclib.LibDataEnum(oclib.BOOKING), b.GetID())
-	}
-	books := make([]interface{}, 0)
-	errormsg := ""
-	for _, exec := range resp.Executions { // create new bookings
-		if ok, _ := (&b.Booking{}).CheckBooking(dc_id, *exec.ExecDate, exec.EndDate); !ok {
-			res.Err += " -> the booking from " + exec.ExecDate.String() + " is already taken."
-			o.Data["json"] = map[string]interface{}{
-				"data":  nil,
-				"code":  res.Code,
-				"error": res.Err + " -> the booking from " + exec.ExecDate.String() + " is already taken.",
-			}
-			o.ServeJSON()
-			return
-		}
-		new := &b.Booking{
-			DatacenterResourceID: dc_id,
-			WorkflowExecution:    *exec,
-		}
-		// store the booking
-		b := oclib.StoreOne(oclib.LibDataEnum(oclib.BOOKING), new.Serialize())
-		if b.Code == 200 {
-			books = append(books, b.Data)
-		} else {
-			errormsg += " -> " + b.Err
-		}
-	}
-	o.Data["json"] = map[string]interface{}{
-		"data":  books,
-		"code":  200,
-		"error": errormsg,
-	}
-	o.ServeJSON()
-}

controllers/datacenter.go

@@ -0,0 +1,117 @@
+package controllers
+
+import (
+	"net/http"
+	"oc-datacenter/infrastructure/monitor"
+	"time"
+
+	oclib "cloud.o-forge.io/core/oc-lib"
+	"cloud.o-forge.io/core/oc-lib/dbs"
+	beego "github.com/beego/beego/v2/server/web"
+	"github.com/gorilla/websocket"
+)
+
+// Operations about workspace
+type DatacenterController struct {
+	beego.Controller
+}
+
+// @Title GetAll
+// @Description find booking by id
+// @Param	is_draft		query 	string	false		"draft wished"
+// @Success 200 {booking} models.booking
+// @router / [get]
+func (o *DatacenterController) GetAll() {
+	user, peerID, groups := oclib.ExtractTokenInfo(*o.Ctx.Request)
+	isDraft := o.Ctx.Input.Query("is_draft")
+	storages := oclib.NewRequest(oclib.LibDataEnum(oclib.LIVE_STORAGE), user, peerID, groups, nil).Search(&dbs.Filters{
+		Or: map[string][]dbs.Filter{
+			"abstractinstanciatedresource.abstractresource.abstractobject.creator_id": {{Operator: dbs.EQUAL.String(), Value: peerID}},
+		},
+	}, "", isDraft == "true")
+	computes := oclib.NewRequest(oclib.LibDataEnum(oclib.LIVE_DATACENTER), user, peerID, groups, nil).Search(&dbs.Filters{
+		Or: map[string][]dbs.Filter{
+			"abstractinstanciatedresource.abstractresource.abstractobject.creator_id": {{Operator: dbs.EQUAL.String(), Value: peerID}},
+		},
+	}, "", isDraft == "true")
+	storages.Data = append(storages.Data, computes.Data...)
+	if storages.Err != "" {
+		storages.Err += " - " + computes.Err
+	}
+	o.Data["json"] = storages
+	o.ServeJSON()
+}
+
+// @Title Get
+// @Description find booking by id
+// @Param	id		path 	string	true		"the id you want to get"
+// @Param	is_draft		query 	string	false		"draft wished"
+// @Success 200 {booking} models.booking
+// @router /:id [get]
+func (o *DatacenterController) Get() {
+	user, peerID, groups := oclib.ExtractTokenInfo(*o.Ctx.Request)
+	isDraft := o.Ctx.Input.Query("is_draft")
+	id := o.Ctx.Input.Param(":id")
+	storages := oclib.NewRequest(oclib.LibDataEnum(oclib.LIVE_STORAGE), user, peerID, groups, nil).Search(&dbs.Filters{
+		Or: map[string][]dbs.Filter{
+			"abstractinstanciatedresource.abstractresource.abstractobject.id":         {{Operator: dbs.EQUAL.String(), Value: id}},
+			"abstractinstanciatedresource.abstractresource.abstractobject.creator_id": {{Operator: dbs.EQUAL.String(), Value: peerID}},
+		},
+	}, "", isDraft == "true")
+	if len(storages.Data) == 0 {
+		computes := oclib.NewRequest(oclib.LibDataEnum(oclib.LIVE_DATACENTER), user, peerID, groups, nil).Search(&dbs.Filters{
+			Or: map[string][]dbs.Filter{
+				"abstractinstanciatedresource.abstractresource.abstractobject.id":         {{Operator: dbs.EQUAL.String(), Value: id}},
+				"abstractinstanciatedresource.abstractresource.abstractobject.creator_id": {{Operator: dbs.EQUAL.String(), Value: peerID}},
+			},
+		}, "", isDraft == "true")
+		if len(computes.Data) == 0 {
+			o.Data["json"] = map[string]interface{}{
+				"data": nil,
+				"code": computes.Code,
+				"err":  computes.Err,
+			}
+		} else {
+			o.Data["json"] = map[string]interface{}{
+				"data": computes.Data[0],
+				"code": computes.Code,
+				"err":  computes.Err,
+			}
+		}
+
+	} else {
+		o.Data["json"] = map[string]interface{}{
+			"data": storages.Data[0],
+			"code": storages.Code,
+			"err":  storages.Err,
+		}
+	}
+	o.ServeJSON()
+}
+
+var upgrader = websocket.Upgrader{
+	CheckOrigin: func(r *http.Request) bool { return true }, // allow all origins
+}
+
+// @Title Log
+// @Description find booking by id
+// @Param	id		path 	string	true		"the id you want to get"
+// @Success 200 {booking} models.booking
+// @router /:id [get]
+func (o *DatacenterController) Log() {
+	// user, peerID, groups := oclib.ExtractTokenInfo(*o.Ctx.Request)
+	id := o.Ctx.Input.Param(":id")
+	conn, err := upgrader.Upgrade(o.Ctx.ResponseWriter, o.Ctx.Request, nil)
+	if err != nil {
+		o.Ctx.WriteString("WebSocket upgrade failed: " + err.Error())
+		return
+	}
+	defer conn.Close()
+	monitors, err := monitor.NewMonitorService()
+	if err != nil {
+		o.Ctx.WriteString("Monitor service unavailable: " + err.Error())
+		return
+	}
+	ctx := monitor.StreamRegistry.Register(id)
+	monitors.Stream(ctx, id, 1*time.Second, conn)
+}

controllers/error_handler.go

@@ -0,0 +1,21 @@
+package controllers
+
+import (
+	"fmt"
+
+	beego "github.com/beego/beego/v2/server/web"
+)
+
+func HandleControllerErrors(c beego.Controller, code int, err *error, data *map[string]interface{}, messages ...string) {
+	for _, mess := range messages {
+		fmt.Println(mess)
+	}
+	if data != nil {
+		c.Data["json"] = data
+	}
+	if err != nil {
+		c.Data["json"] = map[string]string{"error": (*err).Error()}
+	}
+	c.Ctx.Output.SetStatus(code)
+	c.ServeJSON()
+}

controllers/session.go

@@ -0,0 +1,55 @@
+package controllers
+
+import (
+	"fmt"
+	"oc-datacenter/conf"
+	"strconv"
+
+	"cloud.o-forge.io/core/oc-lib/tools"
+	beego "github.com/beego/beego/v2/server/web"
+)
+
+type SessionController struct {
+	beego.Controller
+}
+
+// @Title GetToken
+// @Description find booking by id
+// @Param	id	path 	string		"id of the datacenter"
+// @Param	duration	path 	string		"duration of the token"
+// @Success 200 {booking} models.booking
+// @router /token/:id/:duration [get]
+func (o *SessionController) GetToken() {
+	id := o.Ctx.Input.Param(":id")
+	durationSTR := o.Ctx.Input.Param(":duration")
+
+	duration, err := strconv.Atoi(durationSTR)
+	if err != nil {
+		// change code to 400
+		o.Ctx.Output.SetStatus(400)
+		o.Data["json"] = map[string]string{"error": "duration invalid"}
+		o.ServeJSON()
+		return
+	}
+
+	serv, err := tools.NewKubernetesService(conf.GetConfig().KubeHost+":"+conf.GetConfig().KubePort,
+		conf.GetConfig().KubeCA, conf.GetConfig().KubeCert, conf.GetConfig().KubeData)
+	if err != nil {
+		// change code to 500
+		o.Ctx.Output.SetStatus(500)
+		o.Data["json"] = map[string]string{"error": err.Error()}
+		o.ServeJSON()
+		return
+	}
+	fmt.Println("BLAPO", id, duration)
+	token, err := serv.GenerateToken(o.Ctx.Request.Context(), id, duration)
+	if err != nil {
+		// change code to 500
+		o.Ctx.Output.SetStatus(500)
+		o.Data["json"] = map[string]string{"error": err.Error()}
+		o.ServeJSON()
+		return
+	}
+	o.Data["json"] = token
+	o.ServeJSON()
+}

controllers/version.go

@@ -15,7 +15,10 @@ type VersionController struct {
 // @Success 200
 // @router / [get]
 func (c *VersionController) GetAll() {
-	c.Data["json"] = map[string]string{"version": "1"}
+	c.Data["json"] = map[string]string{
+		"service": "oc-datacenter",
+		"version": "1",
+	}
 	c.ServeJSON()
 }
 

datacenter.json

@@ -1,5 +1,7 @@
 {
-    "port": 8080,
-    "MONGO_URL":"mongodb://localhost:27017/", 
-    "MONGO_DATABASE":"DC_myDC"
+    "MONGO_URL": "mongodb://mongo:27017/",
+    "NATS_URL": "nats://localhost:4222",
+    "MONGO_DATABASE": "DC_myDC",
+    "KUBERNETES_SERVICE_HOST": "172.16.0.183",
+    "port": "8092"
 }

docker-compose.base.yml

@@ -1,34 +0,0 @@
-version: '3.4'
-
-services:
-  mongo:
-    image: 'mongo:latest'
-    networks: 
-      - catalog
-    ports:
-      - 27017:27017
-    container_name: mongo
-    volumes: 
-      - oc-catalog-data:/data/db
-      - oc-catalog-data:/data/configdb
-  
-  mongo-express:
-    image: "mongo-express:latest"
-    restart: always
-    depends_on: 
-      - mongo
-    networks: 
-      - catalog
-    ports:
-      - 8081:8081
-    environment:
-      - ME_CONFIG_BASICAUTH_USERNAME=test
-      - ME_CONFIG_BASICAUTH_PASSWORD=test
-
-volumes:
-  oc-catalog-data:
-
-networks: 
-  catalog:
-    external: true
-    # name: catalog

docker-compose.yml

@@ -2,15 +2,31 @@ version: '3.4'
 
 services:
   oc-datacenter:
+    env_file:
+    - path: ./env.env
+      required: false
     environment: 
       - MONGO_DATABASE=DC_myDC
     image: 'oc-datacenter:latest'
     ports:
       - 8092:8080
+    labels:
+        - "traefik.enable=true"
+        - "traefik.http.routers.datacenter.entrypoints=web"
+        - "traefik.http.routers.datacenter.rule=PathPrefix(`/datacenter`)"
+        - "traefik.http.services.datacenter.loadbalancer.server.port=8080"
+        - "traefik.http.middlewares.datacenter-rewrite.replacepathregex.regex=^/datacenter(.*)"
+        - "traefik.http.middlewares.datacenter-rewrite.replacepathregex.replacement=/oc$$1"
+        - "traefik.http.routers.datacenter.middlewares=datacenter-rewrite,auth-datacenter"
+        
+        - "traefik.http.middlewares.auth-datacenter.forwardauth.address=http://oc-auth:8080/oc/forward"
+        - "traefik.http.middlewares.auth-datacenter.forwardauth.trustForwardHeader=true"
+        - "traefik.http.middlewares.auth-datacenter.forwardauth.authResponseHeaders=X-Auth-Request-User,X-Auth-Request-Email"
     container_name: oc-datacenter
     networks: 
-      - catalog
+      - oc
+
 
 networks: 
-  catalog:
+  oc:
     external: true

docker_datacenter.json

@@ -1,4 +1,5 @@
 {
     "MONGO_URL":"mongodb://mongo:27017/", 
-    "MONGO_DATABASE":"DC_myDC"
+    "NATS_URL":"nats://nats:4222",
+    "MONGO_DATABASE":"DC_myDC"    
 }

docs/admiralty_setup.puml

@@ -0,0 +1,21 @@
+@startuml
+
+boundary "oc-workflow" as workflow
+boundary "oc-monitord" as monitord
+boundary "local oc-datacenter" as locdc
+boundary "remote oc-datacenter" as rocdc
+
+workflow --> locdc : POST /booking/ {booking object}
+locdc --> locdc : create Namespace + ServiceAccount
+workflow --> rocdc : POST /boking/
+rocdc --> rocdc : create \nNamespace + \nServiceAccount
+monitord --> monitord : retrieves a Workflow to execute
+monitord --> monitord : workflow needs repartited execution
+' monitord --> rocdc : POST /????? (route that use the same \nmethods as /booking/ to create NS & SA)
+monitord --> rocdc : POST /admiralty/source
+monitord --> rocdc : GET /admiralty/kubeconfig/:execution_id
+rocdc -> monitord : base64 encoded edited kubeconfig with token (**how to make it secure** ???)
+monitord --> locdc : POST /admiralty/secret/:execution_id
+monitord --> locdc : POST /admiralty/target/:execution_id
+monitord --> locdc : GET /admiralty/nodes/:execution_id \n(if the node is up it means ALL GOOD)
+@enduml

env.env

@@ -0,0 +1,4 @@
+KUBERNETES_SERVICE_HOST=192.168.47.20
+KUBE_CA="LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJkekNDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdGMyVnkKZG1WeUxXTmhRREUzTWpNeE1USXdNell3SGhjTk1qUXdPREE0TVRBeE16VTJXaGNOTXpRd09EQTJNVEF4TXpVMgpXakFqTVNFd0h3WURWUVFEREJock0zTXRjMlZ5ZG1WeUxXTmhRREUzTWpNeE1USXdNell3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFTVlk3ZHZhNEdYTVdkMy9jMlhLN3JLYjlnWXgyNSthaEE0NmkyNVBkSFAKRktQL2UxSVMyWVF0dzNYZW1TTUQxaStZdzJSaVppNUQrSVZUamNtNHdhcnFvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVWtlUVJpNFJiODduME5yRnZaWjZHClc2SU55NnN3Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUlnRXA5ck04WmdNclRZSHYxZjNzOW5DZXZZeWVVa3lZUk4KWjUzazdoaytJS1FDSVFDbk05TnVGKzlTakIzNDFacGZ5ays2NEpWdkpSM3BhcmVaejdMd2lhNm9kdz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
+KUBE_CERT="LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrVENDQVRlZ0F3SUJBZ0lJWUxWNkFPQkdrU1F3Q2dZSUtvWkl6ajBFQXdJd0l6RWhNQjhHQTFVRUF3d1kKYXpOekxXTnNhV1Z1ZEMxallVQXhOekl6TVRFeU1ETTJNQjRYRFRJME1EZ3dPREV3TVRNMU5sb1hEVEkxTURndwpPREV3TVRNMU5sb3dNREVYTUJVR0ExVUVDaE1PYzNsemRHVnRPbTFoYzNSbGNuTXhGVEFUQmdOVkJBTVRESE41CmMzUmxiVHBoWkcxcGJqQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJGQ2Q1MFdPeWdlQ2syQzcKV2FrOWY4MVAvSkJieVRIajRWOXBsTEo0ck5HeHFtSjJOb2xROFYxdUx5RjBtOTQ2Nkc0RmRDQ2dqaXFVSk92Swp3NVRPNnd5alNEQkdNQTRHQTFVZER3RUIvd1FFQXdJRm9EQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0RBakFmCkJnTlZIU01FR0RBV2dCVFJkOFI5cXVWK2pjeUVmL0ovT1hQSzMyS09XekFLQmdncWhrak9QUVFEQWdOSUFEQkYKQWlFQTArbThqTDBJVldvUTZ0dnB4cFo4NVlMalF1SmpwdXM0aDdnSXRxS3NmUVVDSUI2M2ZNdzFBMm5OVWU1TgpIUGZOcEQwSEtwcVN0Wnk4djIyVzliYlJUNklZCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdFkyeHAKWlc1MExXTmhRREUzTWpNeE1USXdNell3SGhjTk1qUXdPREE0TVRBeE16VTJXaGNOTXpRd09EQTJNVEF4TXpVMgpXakFqTVNFd0h3WURWUVFEREJock0zTXRZMnhwWlc1MExXTmhRREUzTWpNeE1USXdNell3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFRc3hXWk9pbnIrcVp4TmFEQjVGMGsvTDF5cE01VHAxOFRaeU92ektJazQKRTFsZWVqUm9STW0zNmhPeVljbnN3d3JoNnhSUnBpMW5RdGhyMzg0S0Z6MlBvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTBYZkVmYXJsZm8zTWhIL3lmemx6Cnl0OWlqbHN3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUxJL2dNYnNMT3MvUUpJa3U2WHVpRVMwTEE2cEJHMXgKcnBlTnpGdlZOekZsQWlFQW1wdjBubjZqN3M0MVI0QzFNMEpSL0djNE53MHdldlFmZWdEVGF1R2p3cFk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
+KUBE_DATA="LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU5ZS1BFb1dhd1NKUzJlRW5oWmlYMk5VZlY1ZlhKV2krSVNnV09TNFE5VTlvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFVUozblJZN0tCNEtUWUx0WnFUMS96VS84a0Z2Sk1lUGhYMm1Vc25pczBiR3FZblkyaVZEeApYVzR2SVhTYjNqcm9iZ1YwSUtDT0twUWs2OHJEbE03ckRBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo="

go.mod

@@ -1,57 +1,112 @@
 module oc-datacenter
 
-go 1.22.0
-
-toolchain go1.22.4
+go 1.25.0
 
 require (
-	cloud.o-forge.io/core/oc-lib v0.0.0-20240904135449-4f0ab6a3760f
-	github.com/beego/beego/v2 v2.3.0
+	cloud.o-forge.io/core/oc-lib v0.0.0-20260319071818-28b5b7d39ffe
+	github.com/beego/beego/v2 v2.3.8
+	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
+	github.com/minio/madmin-go/v4 v4.1.1
+	github.com/minio/minio-go/v7 v7.0.94
+	github.com/necmettindev/randomstring v0.1.0
+	go.mongodb.org/mongo-driver v1.17.4
+	k8s.io/api v0.35.1
+	k8s.io/apimachinery v0.35.1
+	k8s.io/client-go v0.35.1
 )
 
 require (
 	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/biter777/countries v1.7.5 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/gabriel-vasile/mimetype v1.4.5 // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/ebitengine/purego v0.8.4 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.9 // indirect
+	github.com/go-ini/ini v1.67.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-ole/go-ole v1.3.0 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/go-playground/validator/v10 v10.22.0 // indirect
-	github.com/golang/snappy v0.0.4 // indirect
+	github.com/go-playground/validator/v10 v10.27.0 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
+	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/golang/snappy v1.0.0 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/goraz/onion v0.1.3 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
-	github.com/klauspost/compress v1.17.9 // indirect
-	github.com/kr/text v0.2.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/libp2p/go-libp2p/core v0.43.0-rc2 // indirect
+	github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
+	github.com/minio/crc64nvme v1.0.2 // indirect
+	github.com/minio/md5-simd v1.1.2 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/montanaflynn/stats v0.7.1 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/nats-io/nats.go v1.37.0 // indirect
-	github.com/nats-io/nkeys v0.4.7 // indirect
+	github.com/nats-io/nats.go v1.43.0 // indirect
+	github.com/nats-io/nkeys v0.4.11 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_golang v1.20.2 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.58.0 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
-	github.com/robfig/cron/v3 v3.0.1 // indirect
-	github.com/rogpeppe/go-internal v1.11.0 // indirect
-	github.com/rs/zerolog v1.33.0 // indirect
+	github.com/philhofer/fwd v1.1.3-0.20240916144458-20a13a1f6b7c // indirect
+	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
+	github.com/prometheus/client_golang v1.22.0 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.65.0 // indirect
+	github.com/prometheus/procfs v0.17.0 // indirect
+	github.com/prometheus/prom2json v1.4.2 // indirect
+	github.com/prometheus/prometheus v0.304.1 // indirect
+	github.com/rs/xid v1.6.0 // indirect
+	github.com/rs/zerolog v1.34.0 // indirect
+	github.com/safchain/ethtool v0.6.1 // indirect
+	github.com/secure-io/sio-go v0.3.1 // indirect
 	github.com/shiena/ansicolor v0.0.0-20230509054315-a9deabde6e02 // indirect
+	github.com/shirou/gopsutil/v4 v4.25.5 // indirect
 	github.com/smartystreets/goconvey v1.7.2 // indirect
+	github.com/tinylib/msgp v1.3.0 // indirect
+	github.com/tklauser/go-sysconf v0.3.15 // indirect
+	github.com/tklauser/numcpus v0.10.0 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xdg-go/pbkdf2 v1.0.0 // indirect
 	github.com/xdg-go/scram v1.1.2 // indirect
 	github.com/xdg-go/stringprep v1.0.4 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
-	go.mongodb.org/mongo-driver v1.16.1 // indirect
-	golang.org/x/crypto v0.26.0 // indirect
-	golang.org/x/net v0.28.0 // indirect
-	golang.org/x/sync v0.8.0 // indirect
-	golang.org/x/sys v0.25.0 // indirect
-	golang.org/x/text v0.18.0 // indirect
-	google.golang.org/protobuf v1.34.2 // indirect
+	github.com/yusufpapurcu/wmi v1.2.4 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/crypto v0.44.0 // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
+	golang.org/x/sync v0.18.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/term v0.37.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
+	golang.org/x/time v0.11.0 // indirect
+	google.golang.org/protobuf v1.36.8 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
+	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )

go.sum

@@ -1,54 +1,106 @@
-cloud.o-forge.io/core/oc-lib v0.0.0-20240904135449-4f0ab6a3760f h1:v9mw3uNg/DJswOvHooMu8/BMedA+vIXbma+8iUwsjUI=
-cloud.o-forge.io/core/oc-lib v0.0.0-20240904135449-4f0ab6a3760f/go.mod h1:FIJD0taWLJ5pjQLJ6sfE2KlTkvbmk5SMcyrxdjsaVz0=
+cloud.o-forge.io/core/oc-lib v0.0.0-20260319071818-28b5b7d39ffe h1:CHiWQAX7j/bMfbytCWGL2mUgSWYoDY4+bFQbCHEfypk=
+cloud.o-forge.io/core/oc-lib v0.0.0-20260319071818-28b5b7d39ffe/go.mod h1:+ENuvBfZdESSvecoqGY/wSvRlT3vinEolxKgwbOhUpA=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/beego/beego/v2 v2.3.0 h1:iECVwzm6egw6iw6tkWrEDqXG4NQtKLQ6QBSYqlM6T/I=
-github.com/beego/beego/v2 v2.3.0/go.mod h1:Ob/5BJ9fIKZLd4s9ZV3o9J6odkkIyL83et+p98gyYXo=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/beego/beego/v2 v2.3.8 h1:wplhB1pF4TxR+2SS4PUej8eDoH4xGfxuHfS7wAk9VBc=
+github.com/beego/beego/v2 v2.3.8/go.mod h1:8vl9+RrXqvodrl9C8yivX1e6le6deCK6RWeq8R7gTTg=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/biter777/countries v1.7.5 h1:MJ+n3+rSxWQdqVJU8eBy9RqcdH6ePPn4PJHocVWUa+Q=
+github.com/biter777/countries v1.7.5/go.mod h1:1HSpZ526mYqKJcpT5Ti1kcGQ0L0SrXWIaptUWjFfv2E=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/coreos/etcd v3.3.17+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/decred/dcrd/crypto/blake256 v1.1.0 h1:zPMNGQCm0g4QTY27fOCorQW7EryeQ/U0x++OzVrdms8=
+github.com/decred/dcrd/crypto/blake256 v1.1.0/go.mod h1:2OfgNZ5wDpcsFmHmCK5gZTPcCXqlm2ArzUIkw9czNJo=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 h1:NMZiJj8QnKe1LgsbDayM4UoHwbvwDRwnI3hwNaAHRnc=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/ebitengine/purego v0.8.4 h1:CF7LEKg5FFOsASUj0+QwaXf8Ht6TlFxg09+S9wz0omw=
+github.com/ebitengine/purego v0.8.4/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/elazarl/go-bindata-assetfs v1.0.1 h1:m0kkaHRKEu7tUIUFVwhGGGYClXvyl4RE03qmvRTNfbw=
 github.com/elazarl/go-bindata-assetfs v1.0.1/go.mod h1:v+YaWX3bdea5J/mo8dSETolEo7R71Vk1u8bnjau5yw4=
+github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
+github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/etcd-io/etcd v3.3.17+incompatible/go.mod h1:cdZ77EstHBwVtD6iTgzgvogwcjo9m4iOqoijouPJ4bs=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/gabriel-vasile/mimetype v1.4.5 h1:J7wGKdGu33ocBOhGy0z653k/lFKLFDPJMG8Gql0kxn4=
-github.com/gabriel-vasile/mimetype v1.4.5/go.mod h1:ibHel+/kbxn9x2407k1izTA1S81ku1z/DlgOW2QE0M4=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/gabriel-vasile/mimetype v1.4.9 h1:5k+WDwEsD9eTLL8Tz3L0VnmVh9QxGjRmjBvAG7U/oYY=
+github.com/gabriel-vasile/mimetype v1.4.9/go.mod h1:WnSQhFKJuBlRyLiKohA/2DtIlPFAbguNaG7QCHcyGok=
+github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
+github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
+github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
+github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
+github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
+github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
+github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
 github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
 github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
 github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
 github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
 github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.22.0 h1:k6HsTZ0sTnROkhS//R0O+55JgM8C4Bx7ia+JlgcnOao=
-github.com/go-playground/validator/v10 v10.22.0/go.mod h1:dbuPbCMFw/DrkbEynArYaCwl3amGuJotoKCe95atGMM=
+github.com/go-playground/validator/v10 v10.27.0 h1:w8+XrWVMhGkxOaaowyKH35gFydVHOvC0/uWoy2Fzwn4=
+github.com/go-playground/validator/v10 v10.27.0/go.mod h1:I5QpIEbmr8On7W0TktmJAumgzX4CA1XNl4ZmDuVHKKo=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
+github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
+github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
-github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
+github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/golang/snappy v1.0.0 h1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs=
+github.com/golang/snappy v1.0.0/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/goraz/onion v0.1.3 h1:KhyvbDA2b70gcz/d5izfwTiOH8SmrvV43AsVzpng3n0=
 github.com/goraz/onion v0.1.3/go.mod h1:XEmz1XoBz+wxTgWB8NwuvRm4RAu3vKxvrmYtzK+XCuQ=
+github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
+github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
 github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c=
 github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/imdario/mergo v0.3.8/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
+github.com/ipfs/go-cid v0.5.0 h1:goEKKhaGm0ul11IHA7I6p1GmKz8kEYniqFopaB5Otwg=
+github.com/ipfs/go-cid v0.5.0/go.mod h1:0L7vmeNXpQpUS9vt+yEARkJ8rOg43DF3iPgn4GIN0mk=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.8/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
-github.com/klauspost/compress v1.17.9 h1:6KIumPrER1LHsvBVuDa0r5xaG0Es51mhhB9BQB2qeMA=
-github.com/klauspost/compress v1.17.9/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
+github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
+github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -57,53 +109,113 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
+github.com/libp2p/go-buffer-pool v0.1.0 h1:oK4mSFcQz7cTQIfqbe4MIj9gLW+mnanjyFtc6cdF0Y8=
+github.com/libp2p/go-buffer-pool v0.1.0/go.mod h1:N+vh8gMqimBzdKkSMVuydVDq+UV5QTWy5HSiZacSbPg=
+github.com/libp2p/go-libp2p/core v0.43.0-rc2 h1:1X1aDJNWhMfodJ/ynbaGLkgnC8f+hfBIqQDrzxFZOqI=
+github.com/libp2p/go-libp2p/core v0.43.0-rc2/go.mod h1:NYeJ9lvyBv9nbDk2IuGb8gFKEOkIv/W5YRIy1pAJB2Q=
+github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35 h1:PpXWgLPs+Fqr325bN2FD2ISlRRztXibcX6e8f5FR5Dc=
+github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
 github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
+github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
+github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
+github.com/minio/crc64nvme v1.0.2 h1:6uO1UxGAD+kwqWWp7mBFsi5gAse66C4NXO8cmcVculg=
+github.com/minio/crc64nvme v1.0.2/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
+github.com/minio/madmin-go/v4 v4.1.1 h1:Y7JHamjTwnyvXO9aike5SC0c0sNsbs/NpG37c525oe4=
+github.com/minio/madmin-go/v4 v4.1.1/go.mod h1:16tMDVIHWcp1zrmL6XrgCwPlZC7kB3UNNs5GDNnjYLQ=
+github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
+github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
+github.com/minio/minio-go/v7 v7.0.94 h1:1ZoksIKPyaSt64AVOyaQvhDOgVC3MfZsWM6mZXRUGtM=
+github.com/minio/minio-go/v7 v7.0.94/go.mod h1:71t2CqDt3ThzESgZUlU1rBN54mksGGlkLcFgguDnnAc=
+github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dzMM=
+github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5xJjtbRSN8=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/montanaflynn/stats v0.7.1 h1:etflOAAHORrCC44V+aR6Ftzort912ZU+YLiSTuV8eaE=
 github.com/montanaflynn/stats v0.7.1/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
+github.com/mr-tron/base58 v1.2.0 h1:T/HDJBh4ZCPbU39/+c3rRvE0uKBQlU27+QI8LJ4t64o=
+github.com/mr-tron/base58 v1.2.0/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
+github.com/multiformats/go-base32 v0.1.0 h1:pVx9xoSPqEIQG8o+UbAe7DNi51oej1NtK+aGkbLYxPE=
+github.com/multiformats/go-base32 v0.1.0/go.mod h1:Kj3tFY6zNr+ABYMqeUNeGvkIC/UYgtWibDcT0rExnbI=
+github.com/multiformats/go-base36 v0.2.0 h1:lFsAbNOGeKtuKozrtBsAkSVhv1p9D0/qedU9rQyccr0=
+github.com/multiformats/go-base36 v0.2.0/go.mod h1:qvnKE++v+2MWCfePClUEjE78Z7P2a1UV0xHgWc0hkp4=
+github.com/multiformats/go-multiaddr v0.16.0 h1:oGWEVKioVQcdIOBlYM8BH1rZDWOGJSqr9/BKl6zQ4qc=
+github.com/multiformats/go-multiaddr v0.16.0/go.mod h1:JSVUmXDjsVFiW7RjIFMP7+Ev+h1DTbiJgVeTV/tcmP0=
+github.com/multiformats/go-multibase v0.2.0 h1:isdYCVLvksgWlMW9OZRYJEa9pZETFivncJHmHnnd87g=
+github.com/multiformats/go-multibase v0.2.0/go.mod h1:bFBZX4lKCA/2lyOFSAoKH5SS6oPyjtnzK/XTFDPkNuk=
+github.com/multiformats/go-multicodec v0.9.1 h1:x/Fuxr7ZuR4jJV4Os5g444F7xC4XmyUaT/FWtE+9Zjo=
+github.com/multiformats/go-multicodec v0.9.1/go.mod h1:LLWNMtyV5ithSBUo3vFIMaeDy+h3EbkMTek1m+Fybbo=
+github.com/multiformats/go-multihash v0.2.3 h1:7Lyc8XfX/IY2jWb/gI7JP+o7JEq9hOa7BFvVU9RSh+U=
+github.com/multiformats/go-multihash v0.2.3/go.mod h1:dXgKXCXjBzdscBLk9JkjINiEsCKRVch90MdaGiKsvSM=
+github.com/multiformats/go-varint v0.0.7 h1:sWSGR+f/eu5ABZA2ZpYKBILXTTs9JWpdEM/nEGOHFS8=
+github.com/multiformats/go-varint v0.0.7/go.mod h1:r8PUYw/fD/SjBCiKOoDlGF6QawOELpZAu9eioSos/OU=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/nats-io/nats.go v1.37.0 h1:07rauXbVnnJvv1gfIyghFEo6lUcYRY0WXc3x7x0vUxE=
-github.com/nats-io/nats.go v1.37.0/go.mod h1:Ubdu4Nh9exXdSz0RVWRFBbRfrbSxOYd26oF0wkWclB8=
-github.com/nats-io/nkeys v0.4.7 h1:RwNJbbIdYCoClSDNY7QVKZlyb/wfT6ugvFCiKy6vDvI=
-github.com/nats-io/nkeys v0.4.7/go.mod h1:kqXRgRDPlGy7nGaEDMuYzmiJCIAAWDK0IMBtDmGD0nc=
+github.com/nats-io/nats.go v1.43.0 h1:uRFZ2FEoRvP64+UUhaTokyS18XBCR/xM2vQZKO4i8ug=
+github.com/nats-io/nats.go v1.43.0/go.mod h1:iRWIPokVIFbVijxuMQq4y9ttaBTMe0SFdlZfMDd+33g=
+github.com/nats-io/nkeys v0.4.11 h1:q44qGV008kYd9W1b1nEBkNzvnWxtRSQ7A8BoqRrcfa0=
+github.com/nats-io/nkeys v0.4.11/go.mod h1:szDimtgmfOi9n25JpfIdGw12tZFYXqhGxjhVxsatHVE=
 github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
 github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
+github.com/necmettindev/randomstring v0.1.0 h1:HeU/mfLCd/5E9At7xznbTeEw5YldGW92fvK8lWtvPwE=
+github.com/necmettindev/randomstring v0.1.0/go.mod h1:h2nX9Jl0TLImuMt++XfLStVr8N76BmmP5D5EhLq0KEQ=
 github.com/ogier/pflag v0.0.1/go.mod h1:zkFki7tvTa0tafRvTBIZTvzYyAu6kQhPZFnshFFPE+g=
+github.com/onsi/ginkgo/v2 v2.27.2 h1:LzwLj0b89qtIy6SSASkzlNvX6WktqurSHwkk2ipF/Ns=
+github.com/onsi/ginkgo/v2 v2.27.2/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
+github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
+github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
 github.com/pelletier/go-toml v1.6.0/go.mod h1:5N711Q9dKgbdkxHL+MEfF31hpT7l0S0s/t2kKREewys=
+github.com/philhofer/fwd v1.1.3-0.20240916144458-20a13a1f6b7c h1:dAMKvw0MlJT1GshSTtih8C2gDs04w8dReiOGXrGLNoY=
+github.com/philhofer/fwd v1.1.3-0.20240916144458-20a13a1f6b7c/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.20.2 h1:5ctymQzZlyOON1666svgwn3s6IKWgfbjsejTMiXIyjg=
-github.com/prometheus/client_golang v1.20.2/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
-github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
-github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
-github.com/prometheus/common v0.58.0 h1:N+N8vY4/23r6iYfD3UQZUoJPnUYAo7v6LG5XZxjZTXo=
-github.com/prometheus/common v0.58.0/go.mod h1:GpWM7dewqmVYcd7SmRaiWVe9SSqjf0UrwnYnpEZNuT0=
-github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
-github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
-github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
-github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
-github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
-github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
-github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
-github.com/rs/zerolog v1.33.0 h1:1cU2KZkvPxNyfgEmhHAz/1A9Bz+llsdYzklWFzgp0r8=
-github.com/rs/zerolog v1.33.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
+github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
+github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
+github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
+github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
+github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
+github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0=
+github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUOVhe0wYB2zw=
+github.com/prometheus/prom2json v1.4.2 h1:PxCTM+Whqi/eykO1MKsEL0p/zMpxp9ybpsmdFamw6po=
+github.com/prometheus/prom2json v1.4.2/go.mod h1:zuvPm7u3epZSbXPWHny6G+o8ETgu6eAK3oPr6yFkRWE=
+github.com/prometheus/prometheus v0.304.1 h1:e4kpJMb2Vh/PcR6LInake+ofcvFYHT+bCfmBvOkaZbY=
+github.com/prometheus/prometheus v0.304.1/go.mod h1:ioGx2SGKTY+fLnJSQCdTHqARVldGNS8OlIe3kvp98so=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rs/xid v1.6.0 h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=
+github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
+github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
+github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
+github.com/safchain/ethtool v0.6.1 h1:mhRnXE1H8fV8TTXh/HdqE4tXtb57r//BQh5pPYMuM5k=
+github.com/safchain/ethtool v0.6.1/go.mod h1:JzoNbG8xeg/BeVeVoMCtCb3UPWoppZZbFpA+1WFh+M0=
+github.com/secure-io/sio-go v0.3.1 h1:dNvY9awjabXTYGsTF1PiCySl9Ltofk9GA3VdWlo7rRc=
+github.com/secure-io/sio-go v0.3.1/go.mod h1:+xbkjDzPjwh4Axd07pRKSNriS9SCiYksWnZqdnfpQxs=
 github.com/shiena/ansicolor v0.0.0-20230509054315-a9deabde6e02 h1:v9ezJDHA1XGxViAUSIoO/Id7Fl63u6d0YmsAm+/p2hs=
 github.com/shiena/ansicolor v0.0.0-20230509054315-a9deabde6e02/go.mod h1:RF16/A3L0xSa0oSERcnhd8Pu3IXSDZSK2gmGIMsttFE=
+github.com/shirou/gopsutil/v4 v4.25.5 h1:rtd9piuSMGeU8g1RMXjZs9y9luK5BwtnG7dZaQUJAsc=
+github.com/shirou/gopsutil/v4 v4.25.5/go.mod h1:PfybzyydfZcN+JMMjkF6Zb8Mq1A/VcogFFg7hj50W9c=
 github.com/skarademir/naturalsort v0.0.0-20150715044055-69a5d87bef62/go.mod h1:oIdVclZaltY1Nf7OQUkg1/2jImBJ+ZfKZuDIRSwk3p0=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/assertions v1.2.0 h1:42S6lae5dvLc7BrLu/0ugRtcFVjoJNMC/N3yZFZkDFs=
@@ -111,10 +223,24 @@ github.com/smartystreets/assertions v1.2.0/go.mod h1:tcbTF8ujkAEcZ8TElKY+i30BzYl
 github.com/smartystreets/goconvey v0.0.0-20190731233626-505e41936337/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/smartystreets/goconvey v1.7.2 h1:9RBaZCeXEQ3UselpuwUQHltGVXvdwm6cv1hgR6gDIPg=
 github.com/smartystreets/goconvey v1.7.2/go.mod h1:Vw0tHAZW6lzCRk3xgdin6fKYcG+G3Pg9vgXWeJpQFMM=
+github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI=
+github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
+github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/tinylib/msgp v1.3.0 h1:ULuf7GPooDaIlbyvgAxBV/FI7ynli6LZ1/nVUNu+0ww=
+github.com/tinylib/msgp v1.3.0/go.mod h1:ykjzy2wzgrlvpDCRc4LA8UXy6D8bzMSuAF3WD57Gok0=
+github.com/tklauser/go-sysconf v0.3.15 h1:VE89k0criAymJ/Os65CSn1IXaol+1wrsFHEB8Ol49K4=
+github.com/tklauser/go-sysconf v0.3.15/go.mod h1:Dmjwr6tYFIseJw7a3dRLJfsHAMXZ3nEnL/aZY+0IuI4=
+github.com/tklauser/numcpus v0.10.0 h1:18njr6LDBk1zuna922MgdjQuJFjrdppsZG60sHGfjso=
+github.com/tklauser/numcpus v0.10.0/go.mod h1:BiTKazU708GQTYF4mB+cmlpT2Is1gLk7XVuEeem8LsQ=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
 github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
 github.com/xdg-go/scram v1.1.2 h1:FHX5I5B4i4hKRVRBCFRxq1iQRej7WO3hhBuJf+UUySY=
@@ -124,56 +250,106 @@ github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gi
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-go.mongodb.org/mongo-driver v1.16.1 h1:rIVLL3q0IHM39dvE+z2ulZLp9ENZKThVfuvN/IiN4l8=
-go.mongodb.org/mongo-driver v1.16.1/go.mod h1:oB6AhJQvFQL4LEHyXi6aJzQJtBiTQHiAd83l0GdFaiw=
+github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
+github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
+go.mongodb.org/mongo-driver v1.17.4 h1:jUorfmVzljjr0FLzYQsGP8cgN/qzzxlY9Vh0C9KFXVw=
+go.mongodb.org/mongo-driver v1.17.4/go.mod h1:Hy04i7O2kC4RS06ZrhPRqj/u4DTYkFDAAccj+rVKqgQ=
+go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
+go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191112222119-e1110fd1c708/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw=
-golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
+golang.org/x/crypto v0.44.0 h1:A97SsFvM3AIwEEmTBiaxPPTYpDC47w720rdiiUvgoAU=
+golang.org/x/crypto v0.44.0/go.mod h1:013i+Nw79BMiQiMsOPcVCB5ZIJbYkerPrGnOa00tvmc=
+golang.org/x/exp v0.0.0-20250606033433-dcc06ee1d476 h1:bsqhLWFR6G6xiQcb+JoGqdKdRU6WzPWmK8E0jxTjzo4=
+golang.org/x/exp v0.0.0-20250606033433-dcc06ee1d476/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
+golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.28.0 h1:a9JDOJc5GMUJ0+UDqmLT86WiEy7iWyIhz8gz8E4e5hE=
-golang.org/x/net v0.28.0/go.mod h1:yqtgsTWOOnlGLG9GFRrK3++bGOUEkNBoHZc8MEDWPNg=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
-golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
+golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191115151921-52ab43148777/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
-golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
-golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
-golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
+golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
-google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+k8s.io/api v0.35.1 h1:0PO/1FhlK/EQNVK5+txc4FuhQibV25VLSdLMmGpDE/Q=
+k8s.io/api v0.35.1/go.mod h1:28uR9xlXWml9eT0uaGo6y71xK86JBELShLy4wR1XtxM=
+k8s.io/apimachinery v0.35.1 h1:yxO6gV555P1YV0SANtnTjXYfiivaTPvCTKX6w6qdDsU=
+k8s.io/apimachinery v0.35.1/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
+k8s.io/client-go v0.35.1 h1:+eSfZHwuo/I19PaSxqumjqZ9l5XiTEKbIaJ+j1wLcLM=
+k8s.io/client-go v0.35.1/go.mod h1:1p1KxDt3a0ruRfc/pG4qT/3oHmUj1AhSHEcxNSGg+OA=
+k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
+k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=
+k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
+k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzkbzn+gDM4X9T4Ck=
+k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+lukechampine.com/blake3 v1.4.1 h1:I3Smz7gso8w4/TunLKec6K2fn+kyKtDxr/xcQEN84Wg=
+lukechampine.com/blake3 v1.4.1/go.mod h1:QFosUxmjB8mnrWFSNwKmvxHpfY72bmD2tQ0kBMM3kwo=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=

infrastructure/admiralty.go

@@ -0,0 +1,350 @@
+package infrastructure
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"sync"
+	"time"
+
+	"oc-datacenter/conf"
+	"oc-datacenter/infrastructure/monitor"
+	"oc-datacenter/models"
+
+	oclib "cloud.o-forge.io/core/oc-lib"
+	"cloud.o-forge.io/core/oc-lib/tools"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// kubeconfigChannels holds channels waiting for kubeconfig delivery (keyed by executionID).
+var kubeconfigChannels sync.Map
+
+// kubeconfigEvent is the NATS payload used to transfer the kubeconfig from the source peer to the target peer.
+type KubeconfigEvent struct {
+	DestPeerID   string `json:"dest_peer_id"`
+	ExecutionsID string `json:"executions_id"`
+	Kubeconfig   string `json:"kubeconfig"`
+	SourcePeerID string `json:"source_peer_id"`
+	// OriginID is the peer that initiated the provisioning request.
+	// The PB_CONSIDERS response is routed back to this peer.
+	OriginID string `json:"origin_id"`
+}
+
+// admiraltyConsidersPayload is the PB_CONSIDERS payload emitted after admiralty provisioning.
+type admiraltyConsidersPayload struct {
+	OriginID     string  `json:"origin_id"`
+	ExecutionsID string  `json:"executions_id"`
+	Secret       string  `json:"secret,omitempty"`
+	Error        *string `json:"error,omitempty"`
+}
+
+// emitAdmiraltyConsiders publishes a PB_CONSIDERS back to OriginID with the result
+// of the admiralty provisioning. secret is the base64-encoded kubeconfig; err is nil on success.
+func emitAdmiraltyConsiders(executionsID, originID, secret string, provErr error) {
+	var errStr *string
+	if provErr != nil {
+		s := provErr.Error()
+		errStr = &s
+	}
+	payload, _ := json.Marshal(admiraltyConsidersPayload{
+		OriginID:     originID,
+		ExecutionsID: executionsID,
+		Secret:       secret,
+		Error:        errStr,
+	})
+	b, _ := json.Marshal(&tools.PropalgationMessage{
+		DataType: tools.COMPUTE_RESOURCE.EnumIndex(),
+		Action:   tools.PB_CONSIDERS,
+		Payload:  payload,
+	})
+	go tools.NewNATSCaller().SetNATSPub(tools.PROPALGATION_EVENT, tools.NATSResponse{
+		FromApp:  "oc-datacenter",
+		Datatype: -1,
+		Method:   int(tools.PROPALGATION_EVENT),
+		Payload:  b,
+	})
+}
+
+// AdmiraltySetter carries the execution context for an admiralty pairing.
+type AdmiraltySetter struct {
+	ExecutionsID string // execution ID, used as the Kubernetes namespace
+	NodeName     string // name of the virtual node created by Admiralty on the target cluster
+}
+
+func NewAdmiraltySetter(execIDS string) *AdmiraltySetter {
+	return &AdmiraltySetter{
+		ExecutionsID: execIDS,
+	}
+}
+
+// InitializeAsSource is called on the peer that acts as the SOURCE cluster (compute provider).
+// It creates the AdmiraltySource resource, generates a kubeconfig for the target peer,
+// and publishes it on NATS so the target peer can complete its side of the setup.
+func (s *AdmiraltySetter) InitializeAsSource(ctx context.Context, localPeerID string, destPeerID string, originID string) {
+	logger := oclib.GetLogger()
+
+	serv, err := tools.NewKubernetesService(conf.GetConfig().KubeHost+":"+conf.GetConfig().KubePort,
+		conf.GetConfig().KubeCA, conf.GetConfig().KubeCert, conf.GetConfig().KubeData)
+	if err != nil {
+		logger.Error().Msg("InitializeAsSource: failed to create service: " + err.Error())
+		return
+	}
+
+	// Create the AdmiraltySource resource on this cluster (inlined from CreateAdmiraltySource controller)
+	logger.Info().Msg("Creating AdmiraltySource ns-" + s.ExecutionsID)
+	_, err = serv.CreateAdmiraltySource(ctx, s.ExecutionsID)
+	if err != nil && !apierrors.IsAlreadyExists(err) {
+		logger.Error().Msg("InitializeAsSource: failed to create source: " + err.Error())
+		return
+	}
+
+	// Generate a service-account token for the namespace (inlined from GetAdmiraltyKubeconfig controller)
+	token, err := serv.GenerateToken(ctx, s.ExecutionsID, 3600)
+	if err != nil {
+		logger.Error().Msg("InitializeAsSource: failed to generate token for ns-" + s.ExecutionsID + ": " + err.Error())
+		return
+	}
+
+	kubeconfig, err := buildHostKubeWithToken(token)
+	if err != nil {
+		logger.Error().Msg("InitializeAsSource: " + err.Error())
+		return
+	}
+
+	b, err := json.Marshal(kubeconfig)
+	if err != nil {
+		logger.Error().Msg("InitializeAsSource: failed to marshal kubeconfig: " + err.Error())
+		return
+	}
+	encodedKubeconfig := base64.StdEncoding.EncodeToString(b)
+	kube := KubeconfigEvent{
+		ExecutionsID: s.ExecutionsID,
+		Kubeconfig:   encodedKubeconfig,
+		SourcePeerID: localPeerID,
+		DestPeerID:   destPeerID,
+		OriginID:     originID,
+	}
+	if destPeerID == localPeerID {
+		s.InitializeAsTarget(ctx, kube)
+		return
+	}
+	// Publish the kubeconfig on NATS so the target peer can proceed
+	payload, err := json.Marshal(kube)
+	if err != nil {
+		logger.Error().Msg("InitializeAsSource: failed to marshal kubeconfig event: " + err.Error())
+		return
+	}
+
+	if b, err := json.Marshal(&tools.PropalgationMessage{
+		DataType: -1,
+		Action:   tools.PB_ADMIRALTY_CONFIG,
+		Payload:  payload,
+	}); err == nil {
+		go tools.NewNATSCaller().SetNATSPub(tools.PROPALGATION_EVENT, tools.NATSResponse{
+			FromApp:  "oc-datacenter",
+			Datatype: -1,
+			User:     "",
+			Method:   int(tools.PROPALGATION_EVENT),
+			Payload:  b,
+		})
+	}
+	logger.Info().Msg("InitializeAsSource: kubeconfig published for ns-" + s.ExecutionsID)
+}
+
+// InitializeAsTarget is called on the peer that acts as the TARGET cluster (scheduler).
+// It waits for the kubeconfig published by the source peer via NATS, then creates
+// the Secret, AdmiraltyTarget, and polls until the virtual node appears.
+// kubeconfigCh must be obtained from RegisterKubeconfigWaiter before this goroutine starts.
+func (s *AdmiraltySetter) InitializeAsTarget(ctx context.Context, kubeconfigObj KubeconfigEvent) {
+	logger := oclib.GetLogger()
+	defer kubeconfigChannels.Delete(s.ExecutionsID)
+
+	logger.Info().Msg("InitializeAsTarget: waiting for kubeconfig from source peer ns-" + s.ExecutionsID)
+	kubeconfigData := kubeconfigObj.Kubeconfig
+
+	serv, err := tools.NewKubernetesService(conf.GetConfig().KubeHost+":"+conf.GetConfig().KubePort,
+		conf.GetConfig().KubeCA, conf.GetConfig().KubeCert, conf.GetConfig().KubeData)
+	if err != nil {
+		logger.Error().Msg("InitializeAsTarget: failed to create service: " + err.Error())
+		return
+	}
+
+	// 1. Create the namespace
+	logger.Info().Msg("InitializeAsTarget: creating Namespace " + s.ExecutionsID)
+	if err := serv.CreateNamespace(ctx, s.ExecutionsID); err != nil && !apierrors.IsAlreadyExists(err) {
+		logger.Error().Msg("InitializeAsTarget: failed to create namespace: " + err.Error())
+		emitAdmiraltyConsiders(s.ExecutionsID, kubeconfigObj.OriginID, "", err)
+		return
+	}
+
+	// 2. Create the ServiceAccount sa-{executionID}
+	logger.Info().Msg("InitializeAsTarget: creating ServiceAccount sa-" + s.ExecutionsID)
+	if err := serv.CreateServiceAccount(ctx, s.ExecutionsID); err != nil && !apierrors.IsAlreadyExists(err) {
+		logger.Error().Msg("InitializeAsTarget: failed to create service account: " + err.Error())
+		emitAdmiraltyConsiders(s.ExecutionsID, kubeconfigObj.OriginID, "", err)
+		return
+	}
+
+	// 3. Create the Role
+	roleName := "role-" + s.ExecutionsID
+	logger.Info().Msg("InitializeAsTarget: creating Role " + roleName)
+	if err := serv.CreateRole(ctx, s.ExecutionsID, roleName,
+		[][]string{
+			{"coordination.k8s.io"},
+			{""},
+			{""}},
+		[][]string{
+			{"leases"},
+			{"secrets"},
+			{"pods"}},
+		[][]string{
+			{"get", "create", "update"},
+			{"get"},
+			{"patch"}},
+	); err != nil && !apierrors.IsAlreadyExists(err) {
+		logger.Error().Msg("InitializeAsTarget: failed to create role: " + err.Error())
+		emitAdmiraltyConsiders(s.ExecutionsID, kubeconfigObj.OriginID, "", err)
+		return
+	}
+
+	// 4. Create the RoleBinding
+	rbName := "rb-" + s.ExecutionsID
+	logger.Info().Msg("InitializeAsTarget: creating RoleBinding " + rbName)
+	if err := serv.CreateRoleBinding(ctx, s.ExecutionsID, rbName, roleName); err != nil && !apierrors.IsAlreadyExists(err) {
+		logger.Error().Msg("InitializeAsTarget: failed to create role binding: " + err.Error())
+		emitAdmiraltyConsiders(s.ExecutionsID, kubeconfigObj.OriginID, "", err)
+		return
+	}
+
+	// Create the Secret from the source peer's kubeconfig (inlined from CreateKubeSecret controller)
+	logger.Info().Msg("InitializeAsTarget: creating Secret ns-" + s.ExecutionsID)
+	if _, err := serv.CreateKubeconfigSecret(ctx, kubeconfigData, s.ExecutionsID, kubeconfigObj.SourcePeerID); err != nil {
+		logger.Error().Msg("InitializeAsTarget: failed to create kubeconfig secret: " + err.Error())
+		emitAdmiraltyConsiders(s.ExecutionsID, kubeconfigObj.OriginID, "", err)
+		return
+	}
+
+	// Create the AdmiraltyTarget resource (inlined from CreateAdmiraltyTarget controller)
+	logger.Info().Msg("InitializeAsTarget: creating AdmiraltyTarget ns-" + s.ExecutionsID)
+	resp, err := serv.CreateAdmiraltyTarget(ctx, s.ExecutionsID, kubeconfigObj.SourcePeerID)
+	if err != nil || resp == nil {
+		logger.Error().Msg(fmt.Sprintf("InitializeAsTarget: failed to create admiralty target: %v", err))
+		if err == nil {
+			err = fmt.Errorf("CreateAdmiraltyTarget returned nil response")
+		}
+		emitAdmiraltyConsiders(s.ExecutionsID, kubeconfigObj.OriginID, "", err)
+		return
+	}
+
+	// Poll until the virtual node appears (inlined from GetNodeReady controller)
+	logger.Info().Msg("InitializeAsTarget: waiting for virtual node ns-" + s.ExecutionsID)
+	s.waitForNode(ctx, serv, kubeconfigObj.SourcePeerID)
+	emitAdmiraltyConsiders(s.ExecutionsID, kubeconfigObj.OriginID, kubeconfigData, nil)
+}
+
+// waitForNode polls GetOneNode until the Admiralty virtual node appears on this cluster.
+func (s *AdmiraltySetter) waitForNode(ctx context.Context, serv *tools.KubernetesService, sourcePeerID string) {
+	logger := oclib.GetLogger()
+	for i := range 5 {
+		time.Sleep(10 * time.Second)
+		node, err := serv.GetOneNode(ctx, s.ExecutionsID, sourcePeerID)
+		if err == nil && node != nil {
+			s.NodeName = node.Name
+			logger.Info().Msg("waitForNode: node ready: " + s.NodeName)
+			return
+		}
+		if i == 4 {
+			logger.Error().Msg("waitForNode: node never appeared for ns-" + s.ExecutionsID)
+			return
+		}
+		logger.Info().Msg("waitForNode: node not ready yet, retrying...")
+	}
+}
+
+// TeardownAsTarget destroys all Admiralty resources created by InitializeAsTarget on the
+// target (scheduler) cluster: the AdmiraltyTarget CRD, the ServiceAccount, the Role,
+// the RoleBinding, and the namespace (namespace deletion cascades the rest).
+func (s *AdmiraltySetter) TeardownAsTarget(ctx context.Context, originID string) {
+	logger := oclib.GetLogger()
+	serv, err := tools.NewKubernetesService(conf.GetConfig().KubeHost+":"+conf.GetConfig().KubePort,
+		conf.GetConfig().KubeCA, conf.GetConfig().KubeCert, conf.GetConfig().KubeData)
+	if err != nil {
+		logger.Error().Msg("TeardownAsTarget: failed to create k8s service: " + err.Error())
+		return
+	}
+	if err := serv.DeleteNamespace(ctx, s.ExecutionsID, func() {
+		logger.Info().Msg("TeardownAsTarget: namespace " + s.ExecutionsID + " deleted")
+		defer monitor.StreamRegistry.Register(s.ExecutionsID)
+	}); err != nil {
+		logger.Error().Msg("TeardownAsTarget: " + err.Error())
+		return
+	}
+}
+
+// TeardownAsSource destroys all Admiralty resources created by InitializeAsSource on the
+// source (compute) cluster: the AdmiraltySource CRD, the ServiceAccount, and the namespace.
+// The namespace deletion cascades the Role and RoleBinding.
+func (s *AdmiraltySetter) TeardownAsSource(ctx context.Context) {
+	logger := oclib.GetLogger()
+	host := conf.GetConfig().KubeHost + ":" + conf.GetConfig().KubePort
+	ca := conf.GetConfig().KubeCA
+	cert := conf.GetConfig().KubeCert
+	data := conf.GetConfig().KubeData
+
+	// Delete the AdmiraltySource CRD via dynamic client
+	gvrSources := schema.GroupVersionResource{
+		Group: "multicluster.admiralty.io", Version: "v1alpha1", Resource: "sources",
+	}
+	if dyn, err := tools.NewDynamicClient(host, ca, cert, data); err != nil {
+		logger.Error().Msg("TeardownAsSource: failed to create dynamic client: " + err.Error())
+	} else if err := dyn.Resource(gvrSources).Namespace(s.ExecutionsID).Delete(
+		ctx, "source-"+s.ExecutionsID, metav1.DeleteOptions{},
+	); err != nil {
+		logger.Error().Msg("TeardownAsSource: failed to delete AdmiraltySource: " + err.Error())
+	}
+
+	// Delete the namespace (cascades SA, Role, RoleBinding)
+	serv, err := tools.NewKubernetesService(host, ca, cert, data)
+	if err != nil {
+		logger.Error().Msg("TeardownAsSource: failed to create k8s service: " + err.Error())
+		return
+	}
+	if err := serv.Set.CoreV1().Namespaces().Delete(ctx, s.ExecutionsID, metav1.DeleteOptions{}); err != nil {
+		logger.Error().Msg("TeardownAsSource: failed to delete namespace: " + err.Error())
+		return
+	}
+	logger.Info().Msg("TeardownAsSource: namespace " + s.ExecutionsID + " deleted")
+}
+
+// buildHostKubeWithToken builds a kubeconfig pointing to this peer's cluster,
+// authenticated with the provided service-account token.
+func buildHostKubeWithToken(token string) (*models.KubeConfigValue, error) {
+	if len(token) == 0 {
+		return nil, fmt.Errorf("buildHostKubeWithToken: empty token")
+	}
+	encodedCA := base64.StdEncoding.EncodeToString([]byte(conf.GetConfig().KubeCA))
+	return &models.KubeConfigValue{
+		APIVersion:     "v1",
+		CurrentContext: "default",
+		Kind:           "Config",
+		Preferences:    struct{}{},
+		Clusters: []models.KubeconfigNamedCluster{{
+			Name: "default",
+			Cluster: models.KubeconfigCluster{
+				Server:                   "https://" + conf.GetConfig().KubeHost + ":6443",
+				CertificateAuthorityData: encodedCA,
+			},
+		}},
+		Contexts: []models.KubeconfigNamedContext{{
+			Name:    "default",
+			Context: models.KubeconfigContext{Cluster: "default", User: "default"},
+		}},
+		Users: []models.KubeconfigUser{{
+			Name: "default",
+			User: models.KubeconfigUserKeyPair{Token: token},
+		}},
+	}, nil
+}

infrastructure/booking_watchdog.go

@@ -0,0 +1,244 @@
+package infrastructure
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"time"
+
+	"oc-datacenter/infrastructure/minio"
+
+	oclib "cloud.o-forge.io/core/oc-lib"
+	"cloud.o-forge.io/core/oc-lib/dbs"
+	bookingmodel "cloud.o-forge.io/core/oc-lib/models/booking"
+	"cloud.o-forge.io/core/oc-lib/models/common/enum"
+	"cloud.o-forge.io/core/oc-lib/models/workflow_execution"
+	"cloud.o-forge.io/core/oc-lib/tools"
+	"go.mongodb.org/mongo-driver/bson/primitive"
+)
+
+// processedBookings tracks booking IDs whose start-expiry has already been handled.
+// Resets on restart; teardown methods are idempotent so duplicate runs are safe.
+var processedBookings sync.Map
+
+// processedEndBookings tracks booking IDs whose end-expiry (Admiralty source cleanup)
+// has already been triggered in this process lifetime.
+var processedEndBookings sync.Map
+
+// closingStates is the set of terminal booking states after which infra must be torn down.
+var closingStates = map[enum.BookingStatus]bool{
+	enum.FAILURE:   true,
+	enum.SUCCESS:   true,
+	enum.FORGOTTEN: true,
+	enum.CANCELLED: true,
+}
+
+// WatchBookings starts a passive loop that ticks every minute, scans bookings whose
+// ExpectedStartDate + 1 min has passed, transitions them to terminal states when needed,
+// and tears down the associated Kubernetes / Minio infrastructure.
+// Must be launched in a goroutine from main.
+func WatchBookings() {
+	logger := oclib.GetLogger()
+	logger.Info().Msg("BookingWatchdog: started")
+	ticker := time.NewTicker(time.Minute)
+	defer ticker.Stop()
+	for range ticker.C {
+		if err := scanExpiredBookings(); err != nil {
+			logger.Error().Msg("BookingWatchdog: " + err.Error())
+		}
+		if err := scanEndedExec(); err != nil {
+			logger.Error().Msg("BookingWatchdog: " + err.Error())
+		}
+	}
+}
+
+// scanExpiredBookings queries all bookings whose start deadline has passed and
+// dispatches each one to processExpiredBooking.
+func scanExpiredBookings() error {
+	myself, err := oclib.GetMySelf()
+	if err != nil {
+		return fmt.Errorf("could not resolve local peer: %w", err)
+	}
+	peerID := myself.GetID()
+
+	deadline := time.Now().UTC().Add(-time.Minute)
+	res := oclib.NewRequest(oclib.LibDataEnum(oclib.BOOKING), "", peerID, []string{}, nil).
+		Search(&dbs.Filters{
+			And: map[string][]dbs.Filter{
+				"expected_start_date": {{
+					Operator: dbs.LTE.String(),
+					Value:    primitive.NewDateTimeFromTime(deadline),
+				}},
+			},
+		}, "", false)
+
+	if res.Err != "" {
+		return fmt.Errorf("booking search failed: %s", res.Err)
+	}
+
+	for _, dbo := range res.Data {
+		b, ok := dbo.(*bookingmodel.Booking)
+		if !ok {
+			continue
+		}
+		go processExpiredBooking(b, peerID)
+	}
+	return nil
+}
+
+// processExpiredBooking transitions the booking to a terminal state when applicable,
+// then tears down infrastructure based on the resource type:
+//   - LIVE_DATACENTER / COMPUTE_RESOURCE → Admiralty (as target) + Minio (as target)
+//   - LIVE_STORAGE / STORAGE_RESOURCE    → Minio (as source)
+func processExpiredBooking(b *bookingmodel.Booking, peerID string) {
+	logger := oclib.GetLogger()
+	ctx := context.Background()
+
+	// Skip bookings already handled during this process lifetime.
+	if _, done := processedBookings.Load(b.GetID()); done {
+		return
+	}
+
+	// Transition non-terminal bookings.
+	if !closingStates[b.State] {
+		var newState enum.BookingStatus
+		switch b.State {
+		case enum.DRAFT, enum.DELAYED:
+			// DRAFT: never launched; DELAYED: was SCHEDULED but start never arrived.
+			newState = enum.FORGOTTEN
+		case enum.SCHEDULED:
+			// Passed its start date without ever being launched.
+			newState = enum.FAILURE
+		case enum.STARTED:
+			// A running booking is never auto-closed by the watchdog.
+			return
+		default:
+			return
+		}
+
+		upd := oclib.NewRequest(oclib.LibDataEnum(oclib.BOOKING), "", peerID, []string{}, nil).
+			UpdateOne(map[string]any{"state": newState.EnumIndex()}, b.GetID())
+		if upd.Err != "" {
+			logger.Error().Msgf("BookingWatchdog: failed to update booking %s: %s", b.GetID(), upd.Err)
+			return
+		}
+		b.State = newState
+		logger.Info().Msgf("BookingWatchdog: booking %s (exec=%s, type=%s) → %s",
+			b.GetID(), b.ExecutionsID, b.ResourceType, b.State)
+	}
+
+	// Mark as handled before triggering async teardown (avoids double-trigger on next tick).
+	processedBookings.Store(b.GetID(), struct{}{})
+
+	// Tear down infrastructure according to resource type.
+	switch b.ResourceType {
+	case tools.LIVE_DATACENTER, tools.COMPUTE_RESOURCE:
+		logger.Info().Msgf("BookingWatchdog: tearing down compute infra exec=%s", b.ExecutionsID)
+		go NewAdmiraltySetter(b.ExecutionsID).TeardownAsSource(ctx) // i'm the compute units.
+		go teardownMinioForComputeBooking(ctx, b, peerID)
+
+	case tools.LIVE_STORAGE, tools.STORAGE_RESOURCE:
+		logger.Info().Msgf("BookingWatchdog: tearing down storage infra exec=%s", b.ExecutionsID)
+		go teardownMinioSourceBooking(ctx, b, peerID)
+	}
+}
+
+// scanEndedBookings queries LIVE_DATACENTER / COMPUTE_RESOURCE bookings whose
+// ExpectedEndDate + 1 min has passed and triggers TeardownAsSource for Admiralty,
+// cleaning up the compute-side namespace once the execution window is over.
+func scanEndedExec() error {
+	myself, err := oclib.GetMySelf()
+	if err != nil {
+		return fmt.Errorf("could not resolve local peer: %w", err)
+	}
+	peerID := myself.GetID()
+	res := oclib.NewRequest(oclib.LibDataEnum(oclib.WORKFLOW_EXECUTION), "", peerID, []string{}, nil).
+		Search(&dbs.Filters{
+			And: map[string][]dbs.Filter{
+				// Only compute bookings require Admiralty source cleanup.
+				"state": {{
+					Operator: dbs.GT.String(),
+					Value:    2,
+				}},
+			},
+		}, "", false)
+
+	if res.Err != "" {
+		return fmt.Errorf("ended-booking search failed: %s", res.Err)
+	}
+
+	for _, dbo := range res.Data {
+		b, ok := dbo.(*workflow_execution.WorkflowExecution)
+		if !ok {
+			continue
+		}
+		go teardownAdmiraltyTarget(b)
+	}
+	return nil
+}
+
+// teardownAdmiraltySource triggers TeardownAsSource for the compute-side namespace
+// of an execution whose expected end date has passed.
+func teardownAdmiraltyTarget(b *workflow_execution.WorkflowExecution) {
+	logger := oclib.GetLogger()
+
+	// Each executionsID is processed at most once per process lifetime.
+	if _, done := processedEndBookings.Load(b.ExecutionsID); done {
+		return
+	}
+	processedEndBookings.Store(b.ExecutionsID, struct{}{})
+
+	logger.Info().Msgf("BookingWatchdog: tearing down Admiralty source exec=%s (booking=%s)",
+		b.ExecutionsID, b.GetID())
+	if p, err := oclib.GetMySelf(); err == nil {
+		NewAdmiraltySetter(b.ExecutionsID).TeardownAsTarget(context.Background(), p.GetID())
+	}
+}
+
+// teardownMinioForComputeBooking finds the LIVE_STORAGE bookings belonging to the same
+// execution and triggers Minio-as-target teardown for each (K8s secret + configmap).
+// The Minio-as-source side is handled separately by the storage booking's own watchdog pass.
+func teardownMinioForComputeBooking(ctx context.Context, computeBooking *bookingmodel.Booking, localPeerID string) {
+	logger := oclib.GetLogger()
+
+	res := oclib.NewRequest(oclib.LibDataEnum(oclib.BOOKING), "", localPeerID, []string{}, nil).
+		Search(&dbs.Filters{
+			And: map[string][]dbs.Filter{
+				"executions_id": {{Operator: dbs.EQUAL.String(), Value: computeBooking.ExecutionsID}},
+				"resource_type": {{Operator: dbs.EQUAL.String(), Value: tools.LIVE_STORAGE.EnumIndex()}},
+			},
+		}, "", false)
+
+	if res.Err != "" || len(res.Data) == 0 {
+		logger.Warn().Msgf("BookingWatchdog: no storage booking found for exec=%s", computeBooking.ExecutionsID)
+		return
+	}
+
+	for _, dbo := range res.Data {
+		sb, ok := dbo.(*bookingmodel.Booking)
+		if !ok {
+			continue
+		}
+		event := minio.MinioDeleteEvent{
+			ExecutionsID: computeBooking.ExecutionsID,
+			MinioID:      sb.ResourceID,
+			SourcePeerID: sb.DestPeerID, // peer hosting Minio
+			DestPeerID:   localPeerID,   // this peer (compute/target)
+			OriginID:     "",
+		}
+		minio.NewMinioSetter(computeBooking.ExecutionsID, sb.ResourceID).TeardownAsTarget(ctx, event)
+	}
+}
+
+// teardownMinioSourceBooking triggers Minio-as-source teardown for a storage booking:
+// revokes the scoped service account and removes the execution bucket on this Minio host.
+func teardownMinioSourceBooking(ctx context.Context, b *bookingmodel.Booking, localPeerID string) {
+	event := minio.MinioDeleteEvent{
+		ExecutionsID: b.ExecutionsID,
+		MinioID:      b.ResourceID,
+		SourcePeerID: localPeerID, // this peer IS the Minio host
+		DestPeerID:   b.DestPeerID,
+		OriginID:     "",
+	}
+	minio.NewMinioSetter(b.ExecutionsID, b.ResourceID).TeardownAsSource(ctx, event)
+}

infrastructure/minio/minio.go

@@ -0,0 +1,219 @@
+package minio
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"oc-datacenter/conf"
+
+	oclib "cloud.o-forge.io/core/oc-lib"
+	"github.com/minio/madmin-go/v4"
+	"github.com/minio/minio-go/v7"
+	"github.com/minio/minio-go/v7/pkg/credentials"
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+
+	"github.com/necmettindev/randomstring"
+)
+
+type MinioService struct {
+	Url              string
+	RootKey          string
+	RootSecret       string
+	MinioAdminClient *madmin.AdminClient
+}
+
+type StatementEntry struct {
+	Effect   string   `json:"Effect"`
+	Action   []string `json:"Action"`
+	Resource string   `json:"Resource"`
+}
+
+type PolicyDocument struct {
+	Version   string           `json:"Version"`
+	Statement []StatementEntry `json:"Statement"`
+}
+
+func NewMinioService(url string) *MinioService {
+	return &MinioService{
+		Url:        url,
+		RootKey:    conf.GetConfig().MinioRootKey,
+		RootSecret: conf.GetConfig().MinioRootSecret,
+	}
+}
+
+func (m *MinioService) CreateClient() error {
+	cred := credentials.NewStaticV4(m.RootKey, m.RootSecret, "")
+	cli, err := madmin.NewWithOptions(m.Url, &madmin.Options{Creds: cred, Secure: false}) // Maybe in the future we should use the secure option ?
+	if err != nil {
+		return err
+	}
+
+	m.MinioAdminClient = cli
+	return nil
+}
+
+func (m *MinioService) CreateCredentials(executionId string) (string, string, error) {
+
+	policy := PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []StatementEntry{
+			{
+				Effect:   "Allow",
+				Action:   []string{"s3:GetObject", "s3:PutObject"},
+				Resource: "arn:aws:s3:::" + executionId + "/*",
+			},
+		},
+	}
+
+	p, err := json.Marshal(policy)
+	if err != nil {
+		return "", "", err
+	}
+
+	randAccess, randSecret := getRandomCreds()
+
+	req := madmin.AddServiceAccountReq{
+		Policy:     p,
+		TargetUser: m.RootKey,
+		AccessKey:  randAccess,
+		SecretKey:  randSecret,
+	}
+
+	res, err := m.MinioAdminClient.AddServiceAccount(context.Background(), req)
+	if err != nil {
+		return "", "", err
+	}
+
+	return res.AccessKey, res.SecretKey, nil
+
+}
+
+func getRandomCreds() (string, string) {
+	opts := randomstring.GenerationOptions{
+		Length: 20,
+	}
+
+	a, _ := randomstring.GenerateString(opts)
+
+	opts.Length = 40
+	s, _ := randomstring.GenerateString(opts)
+
+	return a, s
+
+}
+func (m *MinioService) CreateMinioConfigMap(minioID string, executionId string, url string) error {
+	config, err := rest.InClusterConfig()
+	if err != nil {
+		return err
+	}
+
+	clientset, err := kubernetes.NewForConfig(config)
+	if err != nil {
+		return err
+	}
+
+	configMap := &v1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      minioID + "artifact-repository",
+			Namespace: executionId,
+		},
+		Data: map[string]string{
+			minioID + "s3-local": fmt.Sprintf(`
+s3:
+  bucket: %s
+  endpoint: %s
+  insecure: true
+  accessKeySecret:
+    name: %s-secret-s3
+    key: accesskey
+  secretKeySecret:
+    name: %s-secret-s3
+    key: secretkey
+`, minioID+"-"+executionId, url, minioID, minioID),
+		},
+	}
+
+	existing, err := clientset.CoreV1().
+		ConfigMaps(executionId).
+		Get(context.Background(), minioID+"artifact-repository", metav1.GetOptions{})
+
+	if err == nil {
+		// Update
+		existing.Data = configMap.Data
+		_, err = clientset.CoreV1().
+			ConfigMaps(executionId).
+			Update(context.Background(), existing, metav1.UpdateOptions{})
+	} else {
+		// Create
+		_, err = clientset.CoreV1().
+			ConfigMaps(executionId).
+			Create(context.Background(), configMap, metav1.CreateOptions{})
+	}
+	return nil
+}
+
+func (m *MinioService) CreateBucket(minioID string, executionId string) error {
+	l := oclib.GetLogger()
+	cred := credentials.NewStaticV4(m.RootKey, m.RootSecret, "")
+	client, err := minio.New(m.Url, &minio.Options{
+		Creds:  cred,
+		Secure: false,
+	})
+	if err != nil {
+		l.Error().Msg("Error when creating the minio client for the data plane")
+		return err
+	}
+
+	err = client.MakeBucket(context.Background(), minioID+"-"+executionId, minio.MakeBucketOptions{})
+	if err != nil {
+		l.Error().Msg("Error when creating the bucket for namespace " + executionId)
+		return err
+	}
+
+	l.Info().Msg("Created the bucket " + minioID + "-" + executionId + " on " + m.Url + " minio")
+	return nil
+}
+
+// DeleteCredentials revokes a scoped Minio service account by its access key.
+func (m *MinioService) DeleteCredentials(accessKey string) error {
+	if err := m.MinioAdminClient.DeleteServiceAccount(context.Background(), accessKey); err != nil {
+		return fmt.Errorf("DeleteCredentials: %w", err)
+	}
+	return nil
+}
+
+// DeleteBucket removes the execution bucket from Minio.
+func (m *MinioService) DeleteBucket(minioID, executionId string) error {
+	l := oclib.GetLogger()
+	cred := credentials.NewStaticV4(m.RootKey, m.RootSecret, "")
+	client, err := minio.New(m.Url, &minio.Options{Creds: cred, Secure: false})
+	if err != nil {
+		l.Error().Msg("Error when creating minio client for bucket deletion")
+		return err
+	}
+	bucketName := minioID + "-" + executionId
+	if err := client.RemoveBucket(context.Background(), bucketName); err != nil {
+		l.Error().Msg("Error when deleting bucket " + bucketName)
+		return err
+	}
+	l.Info().Msg("Deleted bucket " + bucketName + " on " + m.Url)
+	return nil
+}
+
+// DeleteMinioConfigMap removes the artifact-repository ConfigMap from the execution namespace.
+func (m *MinioService) DeleteMinioConfigMap(minioID, executionId string) error {
+	cfg, err := rest.InClusterConfig()
+	if err != nil {
+		return err
+	}
+	clientset, err := kubernetes.NewForConfig(cfg)
+	if err != nil {
+		return err
+	}
+	return clientset.CoreV1().ConfigMaps(executionId).Delete(
+		context.Background(), minioID+"artifact-repository", metav1.DeleteOptions{},
+	)
+}

infrastructure/minio/minio_setter.go

@@ -0,0 +1,297 @@
+package minio
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"slices"
+
+	"oc-datacenter/conf"
+
+	oclib "cloud.o-forge.io/core/oc-lib"
+	"cloud.o-forge.io/core/oc-lib/models/live"
+	"cloud.o-forge.io/core/oc-lib/tools"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// MinioCredentialEvent is the NATS payload used to transfer Minio credentials between peers.
+//
+// Two-phase protocol over PROPALGATION_EVENT (Action = PB_MINIO_CONFIG):
+//   - Phase 1 – role assignment (Access == ""):
+//     oc-discovery routes this to the SOURCE peer (Minio host) → InitializeAsSource.
+//   - Phase 2 – credential delivery (Access != ""):
+//     oc-discovery routes this to the TARGET peer (compute host) → InitializeAsTarget.
+type MinioCredentialEvent struct {
+	ExecutionsID string `json:"executions_id"`
+	MinioID      string `json:"minio_id"`
+	Access       string `json:"access"`
+	Secret       string `json:"secret"`
+	SourcePeerID string `json:"source_peer_id"`
+	DestPeerID   string `json:"dest_peer_id"`
+	URL          string `json:"url"`
+	// OriginID is the peer that initiated the provisioning request.
+	// The PB_CONSIDERS response is routed back to this peer.
+	OriginID string `json:"origin_id"`
+}
+
+// minioConsidersPayload is the PB_CONSIDERS payload emitted after minio provisioning.
+type minioConsidersPayload struct {
+	OriginID     string  `json:"origin_id"`
+	ExecutionsID string  `json:"executions_id"`
+	Secret       string  `json:"secret,omitempty"`
+	Error        *string `json:"error,omitempty"`
+}
+
+// emitConsiders publishes a PB_CONSIDERS back to OriginID with the result of
+// the minio provisioning. secret is the provisioned credential; err is nil on success.
+func emitConsiders(executionsID, originID, secret string, provErr error) {
+	var errStr *string
+	if provErr != nil {
+		s := provErr.Error()
+		errStr = &s
+	}
+	payload, _ := json.Marshal(minioConsidersPayload{
+		OriginID:     originID,
+		ExecutionsID: executionsID,
+		Secret:       secret,
+		Error:        errStr,
+	})
+	b, _ := json.Marshal(&tools.PropalgationMessage{
+		DataType: tools.STORAGE_RESOURCE.EnumIndex(),
+		Action:   tools.PB_CONSIDERS,
+		Payload:  payload,
+	})
+	go tools.NewNATSCaller().SetNATSPub(tools.PROPALGATION_EVENT, tools.NATSResponse{
+		FromApp:  "oc-datacenter",
+		Datatype: -1,
+		Method:   int(tools.PROPALGATION_EVENT),
+		Payload:  b,
+	})
+}
+
+// MinioSetter carries the execution context for a Minio credential provisioning.
+type MinioSetter struct {
+	ExecutionsID string // used as both the bucket name and the K8s namespace suffix
+	MinioID      string // ID of the Minio storage resource
+}
+
+func NewMinioSetter(execID, minioID string) *MinioSetter {
+	return &MinioSetter{ExecutionsID: execID, MinioID: minioID}
+}
+
+// InitializeAsSource is called on the peer that hosts the Minio instance.
+//
+// It:
+//  1. Looks up the live-storage endpoint URL for MinioID.
+//  2. Creates a scoped service account (access + secret limited to the execution bucket).
+//  3. Creates the execution bucket.
+//  4. If source and dest are the same peer, calls InitializeAsTarget directly.
+//     Otherwise, publishes a MinioCredentialEvent via NATS (Phase 2) so that
+//     oc-discovery can route the credentials to the compute peer.
+func (m *MinioSetter) InitializeAsSource(ctx context.Context, localPeerID, destPeerID, originID string) {
+	logger := oclib.GetLogger()
+
+	url, err := m.loadMinioURL(localPeerID)
+	if err != nil {
+		logger.Error().Msg("MinioSetter.InitializeAsSource: " + err.Error())
+		return
+	}
+
+	service := NewMinioService(url)
+	if err := service.CreateClient(); err != nil {
+		logger.Error().Msg("MinioSetter.InitializeAsSource: failed to create admin client: " + err.Error())
+		return
+	}
+
+	access, secret, err := service.CreateCredentials(m.ExecutionsID)
+	if err != nil {
+		logger.Error().Msg("MinioSetter.InitializeAsSource: failed to create service account: " + err.Error())
+		return
+	}
+
+	if err := service.CreateBucket(m.MinioID, m.ExecutionsID); err != nil {
+		logger.Error().Msg("MinioSetter.InitializeAsSource: failed to create bucket: " + err.Error())
+		return
+	}
+
+	logger.Info().Msg("MinioSetter.InitializeAsSource: bucket and service account ready for " + m.ExecutionsID)
+
+	event := MinioCredentialEvent{
+		ExecutionsID: m.ExecutionsID,
+		MinioID:      m.MinioID,
+		Access:       access,
+		Secret:       secret,
+		SourcePeerID: localPeerID,
+		DestPeerID:   destPeerID,
+		OriginID:     originID,
+	}
+
+	if destPeerID == localPeerID {
+		// Same peer: store the secret locally without going through NATS.
+		m.InitializeAsTarget(ctx, event)
+		return
+	}
+
+	// Cross-peer: publish credentials (Phase 2) so oc-discovery routes them to the compute peer.
+	payload, err := json.Marshal(event)
+	if err != nil {
+		logger.Error().Msg("MinioSetter.InitializeAsSource: failed to marshal credential event: " + err.Error())
+		return
+	}
+
+	if b, err := json.Marshal(&tools.PropalgationMessage{
+		DataType: -1,
+		Action:   tools.PB_MINIO_CONFIG,
+		Payload:  payload,
+	}); err == nil {
+		go tools.NewNATSCaller().SetNATSPub(tools.PROPALGATION_EVENT, tools.NATSResponse{
+			FromApp:  "oc-datacenter",
+			Datatype: -1,
+			User:     "",
+			Method:   int(tools.PROPALGATION_EVENT),
+			Payload:  b,
+		})
+		logger.Info().Msg("MinioSetter.InitializeAsSource: credentials published via NATS for " + m.ExecutionsID)
+	}
+}
+
+// InitializeAsTarget is called on the peer that runs the compute workload.
+//
+// It stores the Minio credentials received from the source peer (via NATS or directly)
+// as a Kubernetes secret inside the execution namespace, making them available to pods.
+func (m *MinioSetter) InitializeAsTarget(ctx context.Context, event MinioCredentialEvent) {
+	logger := oclib.GetLogger()
+
+	k, err := tools.NewKubernetesService(
+		conf.GetConfig().KubeHost+":"+conf.GetConfig().KubePort,
+		conf.GetConfig().KubeCA, conf.GetConfig().KubeCert, conf.GetConfig().KubeData,
+	)
+	if err != nil {
+		logger.Error().Msg("MinioSetter.InitializeAsTarget: failed to create k8s service: " + err.Error())
+		return
+	}
+
+	if err := k.CreateSecret(ctx, event.MinioID, event.ExecutionsID, event.Access, event.Secret); err != nil {
+		logger.Error().Msg("MinioSetter.InitializeAsTarget: failed to create k8s secret: " + err.Error())
+		emitConsiders(event.ExecutionsID, event.OriginID, "", err)
+		return
+	}
+
+	if err := NewMinioService(event.URL).CreateMinioConfigMap(event.MinioID, event.ExecutionsID, event.URL); err == nil {
+		logger.Error().Msg("MinioSetter.InitializeAsTarget: failed to create config map: " + err.Error())
+		emitConsiders(event.ExecutionsID, event.OriginID, "", err)
+		return
+	}
+
+	logger.Info().Msg("MinioSetter.InitializeAsTarget: Minio credentials stored in namespace " + event.ExecutionsID)
+	emitConsiders(event.ExecutionsID, event.OriginID, event.Secret, nil)
+}
+
+// MinioDeleteEvent is the NATS payload used to tear down Minio resources.
+// It mirrors MinioCredentialEvent but carries the access key for revocation.
+type MinioDeleteEvent struct {
+	ExecutionsID string `json:"executions_id"`
+	MinioID      string `json:"minio_id"`
+	Access       string `json:"access"` // service account access key to revoke on the Minio host
+	SourcePeerID string `json:"source_peer_id"`
+	DestPeerID   string `json:"dest_peer_id"`
+	OriginID     string `json:"origin_id"`
+}
+
+// TeardownAsTarget is called on the peer that runs the compute workload.
+// It reads the stored access key from the K8s secret, then removes both the secret
+// and the artifact-repository ConfigMap from the execution namespace.
+// For same-peer deployments it calls TeardownAsSource directly; otherwise it
+// publishes a MinioDeleteEvent via NATS (PB_DELETE) so oc-discovery routes it to
+// the Minio host peer.
+func (m *MinioSetter) TeardownAsTarget(ctx context.Context, event MinioDeleteEvent) {
+	logger := oclib.GetLogger()
+
+	k, err := tools.NewKubernetesService(
+		conf.GetConfig().KubeHost+":"+conf.GetConfig().KubePort,
+		conf.GetConfig().KubeCA, conf.GetConfig().KubeCert, conf.GetConfig().KubeData,
+	)
+	if err != nil {
+		logger.Error().Msg("MinioSetter.TeardownAsTarget: failed to create k8s service: " + err.Error())
+		emitConsiders(event.ExecutionsID, event.OriginID, "", err)
+		return
+	}
+
+	// Read the access key from the K8s secret before deleting it.
+	accessKey := event.Access
+	if accessKey == "" {
+		if secret, err := k.Set.CoreV1().Secrets(event.ExecutionsID).Get(
+			ctx, event.MinioID+"-secret-s3", metav1.GetOptions{},
+		); err == nil {
+			accessKey = string(secret.Data["access-key"])
+		}
+	}
+
+	// Delete K8s credentials secret.
+	if err := k.Set.CoreV1().Secrets(event.ExecutionsID).Delete(
+		ctx, event.MinioID+"-secret-s3", metav1.DeleteOptions{},
+	); err != nil {
+		logger.Error().Msg("MinioSetter.TeardownAsTarget: failed to delete secret: " + err.Error())
+	}
+
+	// Delete artifact-repository ConfigMap.
+	if err := NewMinioService("").DeleteMinioConfigMap(event.MinioID, event.ExecutionsID); err != nil {
+		logger.Error().Msg("MinioSetter.TeardownAsTarget: failed to delete configmap: " + err.Error())
+	}
+
+	logger.Info().Msg("MinioSetter.TeardownAsTarget: K8s resources removed for " + event.ExecutionsID)
+
+	// For same-peer deployments the source cleanup runs directly here so the
+	// caller (REMOVE_EXECUTION handler) doesn't have to distinguish roles.
+	if event.SourcePeerID == event.DestPeerID {
+		event.Access = accessKey
+		m.TeardownAsSource(ctx, event)
+	}
+}
+
+// TeardownAsSource is called on the peer that hosts the Minio instance.
+// It revokes the scoped service account and removes the execution bucket.
+func (m *MinioSetter) TeardownAsSource(ctx context.Context, event MinioDeleteEvent) {
+	logger := oclib.GetLogger()
+
+	url, err := m.loadMinioURL(event.SourcePeerID)
+	if err != nil {
+		logger.Error().Msg("MinioSetter.TeardownAsSource: " + err.Error())
+		return
+	}
+
+	svc := NewMinioService(url)
+	if err := svc.CreateClient(); err != nil {
+		logger.Error().Msg("MinioSetter.TeardownAsSource: failed to create admin client: " + err.Error())
+		return
+	}
+
+	if event.Access != "" {
+		if err := svc.DeleteCredentials(event.Access); err != nil {
+			logger.Error().Msg("MinioSetter.TeardownAsSource: failed to delete service account: " + err.Error())
+		}
+	}
+
+	if err := svc.DeleteBucket(event.MinioID, event.ExecutionsID); err != nil {
+		logger.Error().Msg("MinioSetter.TeardownAsSource: failed to delete bucket: " + err.Error())
+	}
+
+	logger.Info().Msg("MinioSetter.TeardownAsSource: Minio resources removed for " + event.ExecutionsID)
+}
+
+// loadMinioURL searches through all live storages accessible by peerID to find
+// the one that references MinioID, and returns its endpoint URL.
+func (m *MinioSetter) loadMinioURL(peerID string) (string, error) {
+	res := oclib.NewRequest(oclib.LibDataEnum(oclib.LIVE_STORAGE), "", peerID, []string{}, nil).LoadAll(false)
+	if res.Err != "" {
+		return "", fmt.Errorf("loadMinioURL: failed to load live storages: %s", res.Err)
+	}
+	for _, dbo := range res.Data {
+		l := dbo.(*live.LiveStorage)
+		if slices.Contains(l.ResourcesID, m.MinioID) {
+			return l.Source, nil
+		}
+
+	}
+	return "", fmt.Errorf("loadMinioURL: no live storage found for minio ID %s", m.MinioID)
+}

infrastructure/monitor/PROMETHEUS_ANALYSIS.md

@@ -0,0 +1,100 @@
+# Analyse de `infrastructure/prometheus.go`
+
+## Ce que fait le fichier
+
+Ce fichier implémente un service de monitoring qui interroge une instance **Prometheus** pour collecter des métriques de conteneurs Kubernetes associés à une réservation (Booking).
+
+### Structures de données
+
+| Struct | Role |
+|---|---|
+| `MetricsSnapshot` | Snapshot de métriques associé à une origine (source). **Note : cette struct locale est déclarée mais jamais utilisée** — le code utilise en réalité `models.MetricsSnapshot` de oc-lib. |
+| `Metric` | Paire nom/valeur d'une métrique. **Même remarque** — le code utilise `models.Metric`. |
+| `PrometheusResponse` | Mapping de la réponse JSON de l'API Prometheus `/api/v1/query`. |
+
+### Métriques collectées (`queriesMetrics`)
+
+| # | Requête PromQL | Mesure |
+|---|---|---|
+| 1 | `rate(container_cpu_usage_seconds_total{namespace}[1m]) * 100` | Utilisation CPU (%) |
+| 2 | `container_memory_usage_bytes{namespace}` | Mémoire utilisée (bytes) |
+| 3 | `container_fs_usage_bytes / container_fs_limit_bytes * 100` | Utilisation disque (%) |
+| 4 | `DCGM_FI_DEV_GPU_UTIL{namespace}` | Utilisation GPU (NVIDIA DCGM) |
+| 5 | `rate(container_fs_reads_bytes_total[1m])` | Débit lecture disque (bytes/s) |
+| 6 | `rate(container_fs_writes_bytes_total[1m])` | Débit écriture disque (bytes/s) |
+| 7 | `rate(container_network_receive_bytes_total[1m])` | Bande passante réseau entrante (bytes/s) |
+| 8 | `rate(container_network_transmit_bytes_total[1m])` | Bande passante réseau sortante (bytes/s) |
+| 9 | `rate(http_requests_total[1m])` | Requêtes HTTP/s |
+| 10 | `rate(http_requests_total{status=~"5.."}[1m]) / rate(http_requests_total[1m]) * 100` | Taux d'erreur HTTP 5xx (%) |
+
+Métriques commentées (non actives) : `system_load_average`, `system_network_latency_ms`, `app_mean_time_to_repair_seconds`, `app_mean_time_between_failure_seconds`.
+
+### Méthodes
+
+#### `queryPrometheus(promURL, expr, namespace) Metric`
+- Construit une requête GET vers `/api/v1/query` de Prometheus.
+- Injecte le namespace dans l'expression PromQL via `fmt.Sprintf`.
+- Parse la réponse JSON et extrait la première valeur du premier résultat.
+- Retourne `-1` si aucun résultat.
+
+#### `Call(book, user, peerID, groups) (Booking, map[string]MetricsSnapshot)`
+- Charge la ressource de calcul (`ComputeResource`) liée au booking.
+- Pour chaque instance de la ressource, cherche le `LiveDatacenter` correspondant.
+- Lance en **goroutine** (parallèle) l'exécution de toutes les requêtes PromQL pour chaque datacenter ayant un `MonitorPath`.
+- Attend toutes les goroutines (`sync.WaitGroup`), puis retourne les métriques groupées par instance.
+
+#### `Stream(bookingID, interval, user, peerID, groups, websocket)`
+- Boucle de monitoring en continu jusqu'à `ExpectedEndDate` du booking ou signal de kill.
+- A chaque tick (`interval`), appelle `Call()` dans une goroutine.
+- Envoie les métriques en temps réel via **WebSocket**.
+- Accumule les métriques en mémoire et les persiste dans le booking tous les `max` (100) cycles.
+- Supporte un mécanisme de kill via la variable globale `Kill`.
+
+---
+
+## Problemes et points d'attention
+
+### Bugs potentiels
+
+1. **Race condition dans `Stream`** — Les variables `mets`, `bookIDS`, `book` sont partagées entre la boucle principale et les goroutines lancées à chaque tick, **sans synchronisation** (pas de mutex). Si `interval` est court, plusieurs goroutines peuvent écrire simultanément dans `mets` et `bookIDS`.
+
+2. **Race condition sur `Kill`** — La variable globale `Kill` est lue dans la boucle sans verrouiller `LockKill`. Le mutex n'est utilisé que pour l'écriture.
+
+3. **Structs locales inutilisées** — `MetricsSnapshot` et `Metric` (lignes 22-31) sont déclarées localement mais le code utilise `models.MetricsSnapshot` et `models.Metric`. Code mort à nettoyer.
+
+4. **Requête PromQL avec double placeholder** — La requête filesystem (ligne 47) contient deux `%s` mais `queryPrometheus` ne fait qu'un seul `fmt.Sprintf(expr, namespace)`. Cela provoque un **`%!s(MISSING)`** dans la requête. Il faut passer le namespace deux fois ou réécrire la fonction.
+
+5. **Pas de timeout HTTP** — `http.Get()` utilise le client par défaut sans timeout. Un Prometheus lent peut bloquer indéfiniment.
+
+6. **Pas de gestion d'erreur sur `WriteJSON`** — Si le WebSocket est fermé côté client, l'écriture échoue silencieusement.
+
+### Améliorations possibles
+
+#### Fiabilité
+- **Ajouter un `context.Context`** à `queryPrometheus` et `Call` pour supporter les timeouts et l'annulation.
+- **Utiliser un `http.Client` avec timeout** au lieu de `http.Get`.
+- **Protéger les accès concurrents** dans `Stream` avec un `sync.Mutex` sur `mets`/`bookIDS`.
+- **Remplacer la variable globale `Kill`** par un `context.WithCancel` ou un channel, plus idiomatique en Go.
+
+#### Métriques supplémentaires envisageables
+- `container_cpu_cfs_throttled_seconds_total` — Throttling CPU (le container est bridé).
+- `kube_pod_container_status_restarts_total` — Nombre de restarts (instabilité).
+- `container_memory_working_set_bytes` — Mémoire réelle utilisée (exclut le cache, plus précis que `memory_usage_bytes`).
+- `kube_pod_status_phase` — Phase du pod (Running, Pending, Failed...).
+- `container_oom_events_total` ou `kube_pod_container_status_last_terminated_reason` — Détection des OOM kills.
+- `kubelet_volume_stats_used_bytes` / `kubelet_volume_stats_capacity_bytes` — Utilisation des PVC.
+- `DCGM_FI_DEV_MEM_COPY_UTIL` — Utilisation mémoire GPU.
+- `DCGM_FI_DEV_GPU_TEMP` — Température GPU.
+- `node_cpu_seconds_total` / `node_memory_MemAvailable_bytes` — Métriques au niveau du noeud (vue globale).
+
+#### Architecture
+- **Range queries** (`/api/v1/query_range`) — Actuellement seul l'instant query est utilisé. Pour le streaming sur une période, `query_range` permettrait de récupérer des séries temporelles complètes et de calculer des moyennes/percentiles.
+- **Labels dans les résultats** — Actuellement seule la première série est lue (`Result[0]`). On perd l'information si plusieurs pods/containers matchent. Agréger ou renvoyer toutes les séries.
+- **Noms de métriques lisibles** — Mapper les expressions PromQL vers des noms humains (`cpu_usage_percent`, `memory_bytes`, etc.) au lieu de stocker l'expression brute comme nom.
+- **Health check Prometheus** — Ajouter une méthode pour vérifier que Prometheus est accessible (`/-/healthy`).
+
+---
+
+## Résumé
+
+Le fichier est **fonctionnel** pour un cas d'usage basique (collecte one-shot + streaming WebSocket), mais présente des **race conditions** dans `Stream`, un **bug sur la requête filesystem** (double `%s`), et du **code mort**. Les améliorations prioritaires sont la correction des accès concurrents et l'ajout de timeouts HTTP.

infrastructure/monitor/monitor.go

@@ -0,0 +1,75 @@
+package monitor
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"oc-datacenter/conf"
+	"sync"
+	"time"
+
+	oclib "cloud.o-forge.io/core/oc-lib"
+	"cloud.o-forge.io/core/oc-lib/dbs"
+	"cloud.o-forge.io/core/oc-lib/models/booking"
+	"cloud.o-forge.io/core/oc-lib/models/common/models"
+	"cloud.o-forge.io/core/oc-lib/models/live"
+	"cloud.o-forge.io/core/oc-lib/models/resources"
+	"github.com/gorilla/websocket"
+)
+
+type MonitorInterface interface {
+	Stream(ctx context.Context, bookingID string, interval time.Duration, ws *websocket.Conn)
+}
+
+var _monitorService = map[string]func() MonitorInterface{
+	"prometheus": func() MonitorInterface { return NewPrometheusService() },
+	"vector":     func() MonitorInterface { return NewVectorService() },
+}
+
+func NewMonitorService() (MonitorInterface, error) {
+	service, ok := _monitorService[conf.GetConfig().MonitorMode]
+	if !ok {
+		return nil, errors.New("monitor service not found")
+	}
+	return service(), nil
+}
+
+func Call(book *booking.Booking,
+	f func(*live.LiveDatacenter, *resources.ComputeResourceInstance,
+		map[string]models.MetricsSnapshot, *sync.WaitGroup, *sync.Mutex)) (*booking.Booking, map[string]models.MetricsSnapshot) {
+	logger := oclib.GetLogger()
+	metrics := map[string]models.MetricsSnapshot{}
+	var wg sync.WaitGroup
+	var mu sync.Mutex
+
+	cUAccess := oclib.NewRequestAdmin(oclib.LibDataEnum(oclib.LIVE_DATACENTER), nil)
+	cRAccess := oclib.NewRequestAdmin(oclib.LibDataEnum(oclib.COMPUTE_RESOURCE), nil)
+
+	rr := cRAccess.LoadOne(book.ResourceID)
+	if rr.Err != "" {
+		logger.Err(fmt.Errorf("can't proceed because of unfound resource %s : %s", book.ResourceID, rr.Err))
+		return book, metrics
+	}
+	computeRes := rr.ToComputeResource()
+	for _, instance := range computeRes.Instances {
+		res := cUAccess.Search(&dbs.Filters{
+			And: map[string][]dbs.Filter{
+				"source":                    {{Operator: dbs.EQUAL.String(), Value: instance.Source}},
+				"abstractlive.resources_id": {{Operator: dbs.EQUAL.String(), Value: computeRes.GetID()}},
+			},
+		}, "", false)
+		if res.Err != "" {
+			continue
+		}
+		for _, r := range res.Data {
+			dc := r.(*live.LiveDatacenter)
+			if dc.MonitorPath == "" {
+				continue
+			}
+			wg.Add(1)
+			go f(dc, instance, metrics, &wg, &mu)
+		}
+	}
+	wg.Wait()
+	return book, metrics
+}

infrastructure/monitor/prometheus.go

@@ -0,0 +1,194 @@
+package monitor
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	oclib "cloud.o-forge.io/core/oc-lib"
+	"cloud.o-forge.io/core/oc-lib/models/booking"
+	"cloud.o-forge.io/core/oc-lib/models/common/models"
+	"cloud.o-forge.io/core/oc-lib/models/live"
+	"cloud.o-forge.io/core/oc-lib/models/resources"
+	"github.com/gorilla/websocket"
+)
+
+type PrometheusResponse struct {
+	Status string `json:"status"`
+	Data   struct {
+		ResultType string `json:"resultType"`
+		Result     []struct {
+			Metric map[string]string `json:"metric"`
+			Value  []interface{}     `json:"value"` // [timestamp, value]
+		} `json:"result"`
+	} `json:"data"`
+}
+
+var queriesMetrics = []string{
+	"rate(container_cpu_usage_seconds_total{namespace=\"%s\"}[1m]) * 100",
+	"container_memory_usage_bytes{namespace=\"%s\"}",
+	"(container_fs_usage_bytes{namespace=\"%s\"}) / (container_fs_limit_bytes{namespace=\"%s\"}) * 100",
+	"DCGM_FI_DEV_GPU_UTIL{namespace=\"%s\"}",
+	"rate(container_fs_reads_bytes_total{namespace=\"%s\"}[1m])",
+	"rate(container_fs_writes_bytes_total{namespace=\"%s\"}[1m])",
+	"rate(container_network_receive_bytes_total{namespace=\"%s\"}[1m])",
+	"rate(container_network_transmit_bytes_total{namespace=\"%s\"}[1m])",
+	"rate(http_requests_total{namespace=\"%s\"}[1m])",
+	"(rate(http_requests_total{status=~\"5..\", namespace=\"%s\"}[1m]) / rate(http_requests_total{namespace=\"%s\"}[1m])) * 100",
+}
+
+var httpClient = &http.Client{
+	Timeout: 10 * time.Second,
+}
+
+// StreamRegistry manages cancellation of active monitoring streams by namespace.
+var StreamRegistry = &streamRegistry{
+	streams: map[string]context.CancelFunc{},
+}
+
+type streamRegistry struct {
+	mu      sync.Mutex
+	streams map[string]context.CancelFunc
+}
+
+func (r *streamRegistry) Register(namespace string) context.Context {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if cancel, ok := r.streams[namespace]; ok {
+		cancel()
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	r.streams[namespace] = cancel
+	return ctx
+}
+
+func (r *streamRegistry) Cancel(namespace string) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if cancel, ok := r.streams[namespace]; ok {
+		cancel()
+		delete(r.streams, namespace)
+	}
+}
+
+type PrometheusService struct {
+}
+
+func NewPrometheusService() *PrometheusService {
+	return &PrometheusService{}
+}
+
+func (p *PrometheusService) queryPrometheus(ctx context.Context, promURL string, expr string, namespace string) models.Metric {
+	metric := models.Metric{Name: expr, Value: -1}
+	query := strings.ReplaceAll(expr, "%s", namespace)
+	reqURL := promURL + "/api/v1/query?query=" + url.QueryEscape(query)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, reqURL, nil)
+	if err != nil {
+		metric.Error = err
+		return metric
+	}
+	resp, err := httpClient.Do(req)
+	if err != nil {
+		metric.Error = err
+		return metric
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		metric.Error = err
+		return metric
+	}
+	var result PrometheusResponse
+	if err = json.Unmarshal(body, &result); err != nil {
+		metric.Error = err
+		return metric
+	}
+	if len(result.Data.Result) > 0 && len(result.Data.Result[0].Value) == 2 {
+		metric.Value, metric.Error = strconv.ParseFloat(fmt.Sprintf("%s", result.Data.Result[0].Value[1]), 64)
+	}
+	return metric
+}
+
+func (p *PrometheusService) Stream(ctx context.Context, bookingID string, interval time.Duration, ws *websocket.Conn) {
+	logger := oclib.GetLogger()
+	max := 100
+	count := 0
+	mets := map[string][]models.MetricsSnapshot{}
+	bAccess := oclib.NewRequestAdmin(oclib.LibDataEnum(oclib.BOOKING), nil)
+	book := bAccess.LoadOne(bookingID)
+	if book.Err != "" {
+		logger.Err(fmt.Errorf("stop because of empty : %s", book.Err))
+		return
+	}
+
+	isActive := func(e *booking.Booking) bool {
+		if e.ExpectedEndDate == nil {
+			return true
+		}
+		return time.Now().UTC().Before(*e.ExpectedEndDate)
+	}
+
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+
+	for isActive(book.Data.(*booking.Booking)) {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+		}
+
+		b, metrics := Call(book.Data.(*booking.Booking),
+			func(dc *live.LiveDatacenter, instance *resources.ComputeResourceInstance,
+				metrics map[string]models.MetricsSnapshot,
+				wg *sync.WaitGroup, mu *sync.Mutex) {
+				defer wg.Done()
+				for _, expr := range queriesMetrics {
+					if mm, ok := metrics[instance.Name]; !ok {
+						mu.Lock()
+						metrics[instance.Name] = models.MetricsSnapshot{
+							From:    instance.Source,
+							Metrics: []models.Metric{p.queryPrometheus(ctx, dc.MonitorPath, expr, book.Data.(*booking.Booking).ExecutionsID)},
+						}
+						mu.Unlock()
+					} else {
+						mu.Lock()
+						mm.Metrics = append(mm.Metrics, p.queryPrometheus(ctx, dc.MonitorPath, expr, book.Data.(*booking.Booking).ExecutionsID))
+						mu.Unlock()
+					}
+				}
+			})
+		_ = b
+		count++
+
+		if ws != nil {
+			if err := ws.WriteJSON(metrics); err != nil {
+				logger.Err(fmt.Errorf("websocket write error: %w", err))
+				return
+			}
+		}
+
+		if count < max {
+			continue
+		}
+
+		bk := book.Data.(*booking.Booking)
+		if bk.ExecutionMetrics == nil {
+			bk.ExecutionMetrics = mets
+		} else {
+			for kk, vv := range mets {
+				bk.ExecutionMetrics[kk] = append(bk.ExecutionMetrics[kk], vv...)
+			}
+		}
+		bk.GetAccessor(nil).UpdateOne(bk.Serialize(bk), bookingID)
+		mets = map[string][]models.MetricsSnapshot{}
+		count = 0
+	}
+}

infrastructure/monitor/vector.go

@@ -0,0 +1,153 @@
+package monitor
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"sync"
+	"time"
+
+	oclib "cloud.o-forge.io/core/oc-lib"
+	"cloud.o-forge.io/core/oc-lib/models/booking"
+	"cloud.o-forge.io/core/oc-lib/models/common/models"
+	"cloud.o-forge.io/core/oc-lib/models/live"
+	"cloud.o-forge.io/core/oc-lib/models/resources"
+	"github.com/gorilla/websocket"
+)
+
+// --- Structure métrique Vector ---
+type VectorMetric struct {
+	Name      string            `json:"name"`
+	Value     float64           `json:"value"`
+	Labels    map[string]string `json:"labels"`
+	Timestamp int64             `json:"timestamp"`
+}
+
+// --- Service Vector ---
+type VectorService struct {
+	mu               sync.Mutex
+	ExecutionMetrics map[string][]models.MetricsSnapshot // bookingID -> snapshots
+	sessions         map[string]context.CancelFunc       // optional: WS clients
+}
+
+func NewVectorService() *VectorService {
+	return &VectorService{
+		ExecutionMetrics: make(map[string][]models.MetricsSnapshot),
+		sessions:         make(map[string]context.CancelFunc),
+	}
+}
+
+// --- Connexion à un flux Vector en WS ---
+func (v *VectorService) ListenVector(ctx context.Context, b *booking.Booking, interval time.Duration, ws *websocket.Conn) error {
+	max := 100
+	count := 0
+	mets := map[string][]models.MetricsSnapshot{}
+	isActive := func() bool {
+		if b.ExpectedEndDate == nil {
+			return true
+		}
+		return time.Now().UTC().Before(*b.ExpectedEndDate)
+	}
+
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+
+	for isActive() {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-ticker.C:
+		}
+
+		bb, metrics := Call(b,
+			func(dc *live.LiveDatacenter, instance *resources.ComputeResourceInstance, metrics map[string]models.MetricsSnapshot,
+				wg *sync.WaitGroup, mu *sync.Mutex) {
+				c, _, err := websocket.DefaultDialer.Dial(dc.MonitorPath, nil)
+				if err != nil {
+					return
+				}
+				defer c.Close()
+				_, msg, err := c.ReadMessage()
+				if err != nil {
+					log.Println("vector ws read error:", err)
+					return
+				}
+
+				var m models.Metric
+				if err := json.Unmarshal(msg, &m); err != nil {
+					log.Println("json unmarshal error:", err)
+					return
+				}
+				mu.Lock()
+				if mm, ok := metrics[instance.Name]; !ok {
+					metrics[instance.Name] = models.MetricsSnapshot{
+						From:    instance.Source,
+						Metrics: []models.Metric{m},
+					}
+				} else {
+					mm.Metrics = append(mm.Metrics, m)
+				}
+
+				mu.Unlock()
+			})
+		_ = bb
+		for k, v := range metrics {
+			mets[k] = append(mets[k], v)
+		}
+		count++
+
+		if ws != nil {
+			if err := ws.WriteJSON(metrics); err != nil {
+				return fmt.Errorf("websocket write error: %w", err)
+			}
+		}
+
+		if count < max {
+			continue
+		}
+
+		if b.ExecutionMetrics == nil {
+			b.ExecutionMetrics = mets
+		} else {
+			for kk, vv := range mets {
+				b.ExecutionMetrics[kk] = append(b.ExecutionMetrics[kk], vv...)
+			}
+		}
+		b.GetAccessor(nil).UpdateOne(b.Serialize(b), b.GetID())
+		mets = map[string][]models.MetricsSnapshot{}
+		count = 0
+	}
+
+	return nil
+}
+
+// --- Permet d'ajouter un front WebSocket pour recevoir les metrics live ---
+// --- Permet de récupérer le cache historique pour un booking ---
+func (v *VectorService) GetCache(bookingID string) []models.MetricsSnapshot {
+	v.mu.Lock()
+	defer v.mu.Unlock()
+	snapshots := v.ExecutionMetrics[bookingID]
+	return snapshots
+}
+
+// --- Exemple d'intégration avec un booking ---
+func (v *VectorService) Stream(ctx context.Context, bookingID string, interval time.Duration, ws *websocket.Conn) {
+	logger := oclib.GetLogger()
+	go func() {
+		bAccess := oclib.NewRequestAdmin(oclib.LibDataEnum(oclib.BOOKING), nil)
+		book := bAccess.LoadOne(bookingID)
+		if book.Err != "" {
+			logger.Err(fmt.Errorf("stop because of empty : %s", book.Err))
+			return
+		}
+		b := book.ToBookings()
+		if b == nil {
+			logger.Err(fmt.Errorf("stop because of empty is not a booking"))
+			return
+		}
+		if err := v.ListenVector(ctx, b, interval, ws); err != nil {
+			log.Printf("Vector listen error for booking %s: %v\n", b.GetID(), err)
+		}
+	}()
+}

infrastructure/namespace.go

@@ -0,0 +1,25 @@
+package infrastructure
+
+import (
+	"context"
+	"oc-datacenter/conf"
+
+	oclib "cloud.o-forge.io/core/oc-lib"
+	"cloud.o-forge.io/core/oc-lib/tools"
+)
+
+// ---------------------------------------------------------------------------
+// Kubernetes namespace helper
+// ---------------------------------------------------------------------------
+
+func CreateNamespace(ns string) error {
+	logger := oclib.GetLogger()
+	serv, err := tools.NewKubernetesService(
+		conf.GetConfig().KubeHost+":"+conf.GetConfig().KubePort, conf.GetConfig().KubeCA,
+		conf.GetConfig().KubeCert, conf.GetConfig().KubeData)
+	if err != nil {
+		logger.Error().Msg("CreateNamespace: failed to init k8s service: " + err.Error())
+		return err
+	}
+	return serv.ProvisionExecutionNamespace(context.Background(), ns)
+}

infrastructure/nats.go

@@ -0,0 +1,167 @@
+package infrastructure
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"oc-datacenter/infrastructure/minio"
+	"sync"
+
+	"cloud.o-forge.io/core/oc-lib/tools"
+)
+
+// roleWaiters maps executionID → channel expecting the role-assignment message from OC discovery.
+var roleWaiters sync.Map
+
+// ArgoKubeEvent carries the peer-routing metadata for a resource provisioning event.
+//
+// When MinioID is non-empty the event concerns Minio credential provisioning;
+// otherwise it concerns Admiralty kubeconfig provisioning.
+type ArgoKubeEvent struct {
+	ExecutionsID string         `json:"executions_id"`
+	DestPeerID   string         `json:"dest_peer_id"`
+	Type         tools.DataType `json:"data_type"`
+	SourcePeerID string         `json:"source_peer_id"`
+	MinioID      string         `json:"minio_id,omitempty"`
+	// OriginID is the peer that initiated the request; the PB_CONSIDERS
+	// response is routed back to this peer once provisioning completes.
+	OriginID string `json:"origin_id,omitempty"`
+}
+
+// ListenNATS starts all NATS subscriptions for the infrastructure layer.
+// Must be launched in a goroutine from main.
+func ListenNATS() {
+	tools.NewNATSCaller().ListenNats(map[tools.NATSMethod]func(tools.NATSResponse){
+		// ─── ARGO_KUBE_EVENT ────────────────────────────────────────────────────────
+		// Triggered by oc-discovery to notify this peer of a provisioning task.
+		// Dispatches to Admiralty or Minio based on whether MinioID is set.
+		tools.ARGO_KUBE_EVENT: func(resp tools.NATSResponse) {
+			argo := &ArgoKubeEvent{}
+			if err := json.Unmarshal(resp.Payload, argo); err != nil {
+				return
+			}
+
+			if argo.Type == tools.STORAGE_RESOURCE {
+				fmt.Println("DETECT STORAGE ARGO_KUBE_EVENT")
+				// ── Minio credential provisioning ──────────────────────────────
+				setter := minio.NewMinioSetter(argo.ExecutionsID, argo.MinioID)
+				if argo.SourcePeerID == argo.DestPeerID {
+					fmt.Println("CONFIG MYSELF")
+					err := CreateNamespace(argo.ExecutionsID)
+					fmt.Println("NS", err)
+					// Same peer: source creates credentials and immediately stores them.
+					go setter.InitializeAsSource(context.Background(), argo.SourcePeerID, argo.DestPeerID, argo.OriginID)
+				} else {
+					// Different peers: publish Phase-1 PB_MINIO_CONFIG (Access == "")
+					// so oc-discovery routes the role-assignment to the Minio host.
+					phase1 := minio.MinioCredentialEvent{
+						ExecutionsID: argo.ExecutionsID,
+						MinioID:      argo.MinioID,
+						SourcePeerID: argo.SourcePeerID,
+						DestPeerID:   argo.DestPeerID,
+						OriginID:     argo.OriginID,
+					}
+					if b, err := json.Marshal(phase1); err == nil {
+						if b2, err := json.Marshal(&tools.PropalgationMessage{
+							Payload: b,
+							Action:  tools.PB_MINIO_CONFIG,
+						}); err == nil {
+							fmt.Println("CONFIG THEM")
+							go tools.NewNATSCaller().SetNATSPub(tools.PROPALGATION_EVENT, tools.NATSResponse{
+								FromApp:  "oc-datacenter",
+								Datatype: -1,
+								User:     resp.User,
+								Method:   int(tools.PROPALGATION_EVENT),
+								Payload:  b2,
+							})
+						}
+					}
+				}
+			} else {
+				fmt.Println("DETECT COMPUTE ARGO_KUBE_EVENT")
+				// ── Admiralty kubeconfig provisioning (existing behaviour) ──────
+				if argo.SourcePeerID == argo.DestPeerID {
+					fmt.Println("CONFIG MYSELF")
+					err := CreateNamespace(argo.ExecutionsID)
+					fmt.Println("NS", err)
+					go NewAdmiraltySetter(argo.ExecutionsID).InitializeAsSource(
+						context.Background(), argo.SourcePeerID, argo.DestPeerID, argo.OriginID)
+				} else if b, err := json.Marshal(argo); err == nil {
+					if b2, err := json.Marshal(&tools.PropalgationMessage{
+						Payload: b,
+						Action:  tools.PB_ADMIRALTY_CONFIG,
+					}); err == nil {
+						fmt.Println("CONFIG THEM")
+						go tools.NewNATSCaller().SetNATSPub(tools.PROPALGATION_EVENT, tools.NATSResponse{
+							FromApp:  "oc-datacenter",
+							Datatype: -1,
+							User:     resp.User,
+							Method:   int(tools.PROPALGATION_EVENT),
+							Payload:  b2,
+						})
+					}
+				}
+			}
+		},
+
+		// ─── ADMIRALTY_CONFIG_EVENT ─────────────────────────────────────────────────
+		// Forwarded by oc-discovery after receiving via libp2p ProtocolAdmiraltyConfigResource.
+		// Payload is a KubeconfigEvent (phase discriminated by Kubeconfig presence).
+		tools.ADMIRALTY_CONFIG_EVENT: func(resp tools.NATSResponse) {
+
+			kubeconfigEvent := KubeconfigEvent{}
+			if err := json.Unmarshal(resp.Payload, &kubeconfigEvent); err == nil {
+				if kubeconfigEvent.Kubeconfig != "" {
+					// Phase 2: kubeconfig present → this peer is the TARGET (scheduler).
+					NewAdmiraltySetter(kubeconfigEvent.ExecutionsID).InitializeAsTarget(
+						context.Background(), kubeconfigEvent)
+				} else {
+					err := CreateNamespace(kubeconfigEvent.ExecutionsID)
+					fmt.Println("NS", err)
+					// Phase 1: no kubeconfig → this peer is the SOURCE (compute).
+					NewAdmiraltySetter(kubeconfigEvent.ExecutionsID).InitializeAsSource(
+						context.Background(), kubeconfigEvent.SourcePeerID, kubeconfigEvent.DestPeerID, kubeconfigEvent.OriginID)
+				}
+			}
+		},
+
+		// ─── MINIO_CONFIG_EVENT ──────────────────────────────────────────────────────
+		// Forwarded by oc-discovery after receiving via libp2p ProtocolMinioConfigResource.
+		// Payload is a MinioCredentialEvent (phase discriminated by Access presence).
+		tools.MINIO_CONFIG_EVENT: func(resp tools.NATSResponse) {
+			minioEvent := minio.MinioCredentialEvent{}
+			if err := json.Unmarshal(resp.Payload, &minioEvent); err == nil {
+				if minioEvent.Access != "" {
+					// Phase 2: credentials present → this peer is the TARGET (compute).
+					minio.NewMinioSetter(minioEvent.ExecutionsID, minioEvent.MinioID).InitializeAsTarget(
+						context.Background(), minioEvent)
+				} else {
+					err := CreateNamespace(minioEvent.ExecutionsID)
+					fmt.Println("NS", err)
+					// Phase 1: no credentials → this peer is the SOURCE (Minio host).
+					minio.NewMinioSetter(minioEvent.ExecutionsID, minioEvent.MinioID).InitializeAsSource(
+						context.Background(), minioEvent.SourcePeerID, minioEvent.DestPeerID, minioEvent.OriginID)
+				}
+			}
+		},
+
+		// ─── REMOVE_RESOURCE ────────────────────────────────────────────────────────
+		// Routed by oc-discovery via ProtocolDeleteResource for datacenter teardown.
+		// Only STORAGE_RESOURCE and COMPUTE_RESOURCE deletions are handled here.
+		tools.REMOVE_RESOURCE: func(resp tools.NATSResponse) {
+			switch resp.Datatype {
+			case tools.STORAGE_RESOURCE:
+				deleteEvent := minio.MinioDeleteEvent{}
+				if err := json.Unmarshal(resp.Payload, &deleteEvent); err == nil && deleteEvent.ExecutionsID != "" {
+					go minio.NewMinioSetter(deleteEvent.ExecutionsID, deleteEvent.MinioID).
+						TeardownAsSource(context.Background(), deleteEvent)
+				}
+			case tools.COMPUTE_RESOURCE:
+				argo := &ArgoKubeEvent{}
+				if err := json.Unmarshal(resp.Payload, argo); err == nil && argo.ExecutionsID != "" {
+					go NewAdmiraltySetter(argo.ExecutionsID).TeardownAsSource(context.Background())
+				}
+			}
+		},
+	})
+}

main.go

@@ -1,7 +1,11 @@
 package main
 
 import (
+	"encoding/base64"
+	"oc-datacenter/conf"
+	"oc-datacenter/infrastructure"
 	_ "oc-datacenter/routers"
+	"os"
 
 	oclib "cloud.o-forge.io/core/oc-lib"
 	beego "github.com/beego/beego/v2/server/web"
@@ -10,26 +14,32 @@ import (
 const appname = "oc-datacenter"
 
 func main() {
-	// Init the oc-lib
-	oclib.Init(appname)
-
 	// Load the right config file
-	o := oclib.GetConfLoader()
+	o := oclib.GetConfLoader(appname)
+	conf.GetConfig().Mode = o.GetStringDefault("MODE", "kubernetes")
+	conf.GetConfig().KubeHost = o.GetStringDefault("KUBERNETES_SERVICE_HOST", os.Getenv("KUBERNETES_SERVICE_HOST"))
+	conf.GetConfig().KubePort = o.GetStringDefault("KUBERNETES_SERVICE_PORT", "6443")
 
-	// feed the library with the loaded config
-	oclib.SetConfig(
-		o.GetStringDefault("MONGO_URL", "mongodb://127.0.0.1:27017"),
-		o.GetStringDefault("MONGO_DATABASE", "DC_myDC"),
-		"",
-		o.GetStringDefault("lokiurl", ""),
-		o.GetStringDefault("loglevel", "info"),
-	)
+	sDec, err := base64.StdEncoding.DecodeString(o.GetStringDefault("KUBE_CA", ""))
+	if err == nil {
+		conf.GetConfig().KubeCA = string(sDec)
+	}
+	sDec, err = base64.StdEncoding.DecodeString(o.GetStringDefault("KUBE_CERT", ""))
+	if err == nil {
+		conf.GetConfig().KubeCert = string(sDec)
+	}
+	sDec, err = base64.StdEncoding.DecodeString(o.GetStringDefault("KUBE_DATA", ""))
+	if err == nil {
+		conf.GetConfig().KubeData = string(sDec)
+	}
 
-	// Beego init
-	beego.BConfig.AppName = appname
-	beego.BConfig.Listen.HTTPPort = o.GetIntDefault("port", 8080)
-	beego.BConfig.WebConfig.DirectoryIndex = true
-	beego.BConfig.WebConfig.StaticDir["/swagger"] = "swagger"
+	conf.GetConfig().MonitorMode = o.GetStringDefault("MONITOR_MODE", "prometheus")
+	conf.GetConfig().MinioRootKey = o.GetStringDefault("MINIO_ADMIN_ACCESS", "")
+	conf.GetConfig().MinioRootSecret = o.GetStringDefault("MINIO_ADMIN_SECRET", "")
+	oclib.InitAPI(appname)
+
+	go infrastructure.ListenNATS()
+	go infrastructure.WatchBookings()
 
 	beego.Run()
 }

models/kubeconfig.go

@@ -0,0 +1,56 @@
+package models
+
+// KubeConfigValue is a struct used to create a kubectl configuration YAML file.
+type KubeConfigValue struct {
+	APIVersion     string                   `yaml:"apiVersion" json:"apiVersion"`
+	Kind           string                   `yaml:"kind" json:"kind"`
+	Clusters       []KubeconfigNamedCluster `yaml:"clusters" json:"clusters"`
+	Users          []KubeconfigUser         `yaml:"users" json:"users"`
+	Contexts       []KubeconfigNamedContext `yaml:"contexts" json:"contexts"`
+	CurrentContext string                   `yaml:"current-context" json:"current-context"`
+	Preferences    struct{}                 `yaml:"preferences" json:"preferences"`
+}
+
+// KubeconfigUser is a struct used to create a kubectl configuration YAML file
+type KubeconfigUser struct {
+	Name string                `yaml:"name" json:"name"`
+	User KubeconfigUserKeyPair `yaml:"user" json:"user"`
+
+}
+
+// KubeconfigUserKeyPair is a struct used to create a kubectl configuration YAML file
+type KubeconfigUserKeyPair struct {
+	Token				  string				 `yaml:"token" json:"token"`
+}
+
+// KubeconfigAuthProvider is a struct used to create a kubectl authentication provider
+type KubeconfigAuthProvider struct {
+	Name   string            `yaml:"name" json:"name"`
+	Config map[string]string `yaml:"config" json:"config"`
+}
+
+// KubeconfigNamedCluster is a struct used to create a kubectl configuration YAML file
+type KubeconfigNamedCluster struct {
+	Name    string            `yaml:"name" json:"name"`
+	Cluster KubeconfigCluster `yaml:"cluster" json:"cluster"`
+}
+
+// KubeconfigCluster is a struct used to create a kubectl configuration YAML file
+type KubeconfigCluster struct {
+	Server                   string `yaml:"server" json:"server"`
+	CertificateAuthorityData string `yaml:"certificate-authority-data" json:"certificate-authority-data"`
+	CertificateAuthority     string `yaml:"certificate-authority" json:"certificate-authority"`
+}
+
+// KubeconfigNamedContext is a struct used to create a kubectl configuration YAML file
+type KubeconfigNamedContext struct {
+	Name    string            `yaml:"name" json:"name"`
+	Context KubeconfigContext `yaml:"context" json:"context"`
+}
+
+// KubeconfigContext is a struct used to create a kubectl configuration YAML file
+type KubeconfigContext struct {
+	Cluster   string `yaml:"cluster" json:"cluster"`
+	Namespace string `yaml:"namespace,omitempty" json:"namespace,omitempty"`
+	User      string `yaml:"user" json:"user"`
+}

routers/commentsRouter.go

@@ -7,6 +7,42 @@ import (
 
 func init() {
 
+    beego.GlobalControllerRouter["oc-datacenter/controllers:AdmiraltyController"] = append(beego.GlobalControllerRouter["oc-datacenter/controllers:AdmiraltyController"],
+        beego.ControllerComments{
+            Method: "GetKubeSecret",
+            Router: `/secret/:execution/:peer`,
+            AllowHTTPMethods: []string{"get"},
+            MethodParams: param.Make(),
+            Filters: nil,
+            Params: nil})
+
+    beego.GlobalControllerRouter["oc-datacenter/controllers:AdmiraltyController"] = append(beego.GlobalControllerRouter["oc-datacenter/controllers:AdmiraltyController"],
+        beego.ControllerComments{
+            Method: "GetAllTargets",
+            Router: `/targets`,
+            AllowHTTPMethods: []string{"get"},
+            MethodParams: param.Make(),
+            Filters: nil,
+            Params: nil})
+
+    beego.GlobalControllerRouter["oc-datacenter/controllers:AdmiraltyController"] = append(beego.GlobalControllerRouter["oc-datacenter/controllers:AdmiraltyController"],
+        beego.ControllerComments{
+            Method: "GetOneTarget",
+            Router: `/targets/:execution`,
+            AllowHTTPMethods: []string{"get"},
+            MethodParams: param.Make(),
+            Filters: nil,
+            Params: nil})
+
+    beego.GlobalControllerRouter["oc-datacenter/controllers:AdmiraltyController"] = append(beego.GlobalControllerRouter["oc-datacenter/controllers:AdmiraltyController"],
+        beego.ControllerComments{
+            Method: "DeleteAdmiraltySession",
+            Router: `/targets/:execution`,
+            AllowHTTPMethods: []string{"delete"},
+            MethodParams: param.Make(),
+            Filters: nil,
+            Params: nil})
+
     beego.GlobalControllerRouter["oc-datacenter/controllers:BookingController"] = append(beego.GlobalControllerRouter["oc-datacenter/controllers:BookingController"],
         beego.ControllerComments{
             Method: "GetAll",
@@ -36,8 +72,8 @@ func init() {
 
     beego.GlobalControllerRouter["oc-datacenter/controllers:BookingController"] = append(beego.GlobalControllerRouter["oc-datacenter/controllers:BookingController"],
         beego.ControllerComments{
-            Method: "Check",
-            Router: `/check/:datacenter_id/:start_date/:end_date`,
+            Method: "Log",
+            Router: `/:id`,
             AllowHTTPMethods: []string{"get"},
             MethodParams: param.Make(),
             Filters: nil,
@@ -45,13 +81,103 @@ func init() {
 
     beego.GlobalControllerRouter["oc-datacenter/controllers:BookingController"] = append(beego.GlobalControllerRouter["oc-datacenter/controllers:BookingController"],
         beego.ControllerComments{
-            Method: "Search",
-            Router: `/search/:search`,
+            Method: "Put",
+            Router: `/:id`,
+            AllowHTTPMethods: []string{"put"},
+            MethodParams: param.Make(),
+            Filters: nil,
+            Params: nil})
+
+    beego.GlobalControllerRouter["oc-datacenter/controllers:BookingController"] = append(beego.GlobalControllerRouter["oc-datacenter/controllers:BookingController"],
+        beego.ControllerComments{
+            Method: "Check",
+            Router: `/check/:id/:start_date/:end_date`,
             AllowHTTPMethods: []string{"get"},
             MethodParams: param.Make(),
             Filters: nil,
             Params: nil})
 
+    beego.GlobalControllerRouter["oc-datacenter/controllers:BookingController"] = append(beego.GlobalControllerRouter["oc-datacenter/controllers:BookingController"],
+        beego.ControllerComments{
+            Method: "ExtendForExecution",
+            Router: `/extend/:resource_id/from_execution/:execution_id/to/:duration`,
+            AllowHTTPMethods: []string{"post"},
+            MethodParams: param.Make(),
+            Filters: nil,
+            Params: nil})
+
+    beego.GlobalControllerRouter["oc-datacenter/controllers:BookingController"] = append(beego.GlobalControllerRouter["oc-datacenter/controllers:BookingController"],
+        beego.ControllerComments{
+            Method: "ExtendForNamespace",
+            Router: `/extend/:resource_id/from_namespace/:namespace/to/:duration`,
+            AllowHTTPMethods: []string{"post"},
+            MethodParams: param.Make(),
+            Filters: nil,
+            Params: nil})
+
+    beego.GlobalControllerRouter["oc-datacenter/controllers:BookingController"] = append(beego.GlobalControllerRouter["oc-datacenter/controllers:BookingController"],
+        beego.ControllerComments{
+            Method: "Search",
+            Router: `/search/:start_date/:end_date`,
+            AllowHTTPMethods: []string{"get"},
+            MethodParams: param.Make(),
+            Filters: nil,
+            Params: nil})
+
+    beego.GlobalControllerRouter["oc-datacenter/controllers:BookingController"] = append(beego.GlobalControllerRouter["oc-datacenter/controllers:BookingController"],
+        beego.ControllerComments{
+            Method: "ExecutionSearch",
+            Router: `/search/execution/:id`,
+            AllowHTTPMethods: []string{"get"},
+            MethodParams: param.Make(),
+            Filters: nil,
+            Params: nil})
+
+    beego.GlobalControllerRouter["oc-datacenter/controllers:DatacenterController"] = append(beego.GlobalControllerRouter["oc-datacenter/controllers:DatacenterController"],
+        beego.ControllerComments{
+            Method: "GetAll",
+            Router: `/`,
+            AllowHTTPMethods: []string{"get"},
+            MethodParams: param.Make(),
+            Filters: nil,
+            Params: nil})
+
+    beego.GlobalControllerRouter["oc-datacenter/controllers:DatacenterController"] = append(beego.GlobalControllerRouter["oc-datacenter/controllers:DatacenterController"],
+        beego.ControllerComments{
+            Method: "Get",
+            Router: `/:id`,
+            AllowHTTPMethods: []string{"get"},
+            MethodParams: param.Make(),
+            Filters: nil,
+            Params: nil})
+
+    beego.GlobalControllerRouter["oc-datacenter/controllers:MinioController"] = append(beego.GlobalControllerRouter["oc-datacenter/controllers:MinioController"],
+        beego.ControllerComments{
+            Method: "CreateServiceAccount",
+            Router: `/serviceaccount/:minioId/:executions`,
+            AllowHTTPMethods: []string{"post"},
+            MethodParams: param.Make(),
+            Filters: nil,
+            Params: nil})
+
+    beego.GlobalControllerRouter["oc-datacenter/controllers:SessionController"] = append(beego.GlobalControllerRouter["oc-datacenter/controllers:SessionController"],
+        beego.ControllerComments{
+            Method: "GetToken",
+            Router: `/token/:id/:duration`,
+            AllowHTTPMethods: []string{"get"},
+            MethodParams: param.Make(),
+            Filters: nil,
+            Params: nil})
+
+    beego.GlobalControllerRouter["oc-datacenter/controllers:VectorController"] = append(beego.GlobalControllerRouter["oc-datacenter/controllers:VectorController"],
+        beego.ControllerComments{
+            Method: "Receive",
+            Router: `/`,
+            AllowHTTPMethods: []string{"post"},
+            MethodParams: param.Make(),
+            Filters: nil,
+            Params: nil})
+
     beego.GlobalControllerRouter["oc-datacenter/controllers:VersionController"] = append(beego.GlobalControllerRouter["oc-datacenter/controllers:VersionController"],
         beego.ControllerComments{
             Method: "GetAll",

routers/router.go

@@ -3,8 +3,8 @@
 // @Description Monitor owned datacenter activity
 // @Contact admin@o-cloud.io
 // @TermsOfServiceUrl http://cloud.o-forge.io/
-// @License MIT
-// @LicenseUrl https://opensource.org/license/mit
+// @License AGPL
+// @LicenseUrl https://www.gnu.org/licenses/agpl-3.0.html
 package routers
 
 import (
@@ -15,9 +15,13 @@ import (
 
 func init() {
 	ns := beego.NewNamespace("/oc/",
-		beego.NSNamespace("/booking",
+		beego.NSInclude(
+			&controllers.DatacenterController{},
+		),
+
+		beego.NSNamespace("/session",
 			beego.NSInclude(
-				&controllers.BookingController{},
+				&controllers.SessionController{},
 			),
 		),
 		beego.NSNamespace("/version",

swagger/index.html

@@ -39,7 +39,7 @@
     window.onload = function() {
       // Begin Swagger UI call region
       const ui = SwaggerUIBundle({
-        url: "swagger.json",
+        url: "https://petstore.swagger.io/v2/swagger.json",
         dom_id: '#swagger-ui',
         deepLinking: true,
         presets: [

swagger/swagger.json

@@ -9,12 +9,208 @@
             "email": "admin@o-cloud.io"
         },
         "license": {
-            "name": "MIT",
-            "url": "https://opensource.org/license/mit"
+            "name": "AGPL",
+            "url": "https://www.gnu.org/licenses/agpl-3.0.html"
         }
     },
     "basePath": "/oc/",
     "paths": {
+        "/": {
+            "get": {
+                "tags": [
+                    "oc-datacenter/controllersDatacenterController"
+                ],
+                "description": "find booking by id\n\u003cbr\u003e",
+                "operationId": "DatacenterController.GetAll",
+                "parameters": [
+                    {
+                        "in": "query",
+                        "name": "is_draft",
+                        "description": "draft wished",
+                        "type": "string"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "{booking} models.booking"
+                    }
+                }
+            }
+        },
+        "/admiralty/kubeconfig/{execution}": {
+            "get": {
+                "tags": [
+                    "admiralty"
+                ],
+                "parameters": [
+                    {
+                        "in": "path",
+                        "name": "execution",
+                        "description": "execution id of the workflow",
+                        "required": true,
+                        "type": "string"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        },
+        "/admiralty/node/{execution}": {
+            "get": {
+                "tags": [
+                    "admiralty"
+                ],
+                "parameters": [
+                    {
+                        "in": "path",
+                        "name": "execution",
+                        "description": "execution id of the workflow",
+                        "required": true,
+                        "type": "string"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        },
+        "/admiralty/secret/{execution}": {
+            "get": {
+                "tags": [
+                    "admiralty"
+                ],
+                "parameters": [
+                    {
+                        "in": "path",
+                        "name": "execution",
+                        "description": "execution id of the workflow",
+                        "required": true,
+                        "type": "string"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            },
+            "post": {
+                "tags": [
+                    "admiralty"
+                ],
+                "parameters": [
+                    {
+                        "in": "path",
+                        "name": "execution",
+                        "description": "execution id of the workflow",
+                        "required": true,
+                        "type": "string"
+                    },
+                    {
+                        "in": "body",
+                        "name": "kubeconfig",
+                        "description": "Kubeconfig to use when creating secret",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/controllers.RemoteKubeconfig"
+                        }
+                    }
+                ],
+                "responses": {
+                    "201": {
+                        "description": ""
+                    }
+                }
+            }
+        },
+        "/admiralty/source/{execution}": {
+            "post": {
+                "tags": [
+                    "admiralty"
+                ],
+                "description": "Create an Admiralty Source on remote cluster\n\u003cbr\u003e",
+                "operationId": "AdmiraltyController.CreateSource",
+                "parameters": [
+                    {
+                        "in": "path",
+                        "name": "execution",
+                        "description": "execution id of the workflow",
+                        "required": true,
+                        "type": "string"
+                    }
+                ],
+                "responses": {
+                    "201": {
+                        "description": ""
+                    }
+                }
+            }
+        },
+        "/admiralty/target/{execution}": {
+            "post": {
+                "tags": [
+                    "admiralty"
+                ],
+                "description": "Create an Admiralty Target in the namespace associated to the executionID\n\u003cbr\u003e",
+                "operationId": "AdmiraltyController.CreateAdmiraltyTarget",
+                "parameters": [
+                    {
+                        "in": "path",
+                        "name": "execution",
+                        "description": "execution id of the workflow",
+                        "required": true,
+                        "type": "string"
+                    }
+                ],
+                "responses": {
+                    "201": {
+                        "description": ""
+                    }
+                }
+            }
+        },
+        "/admiralty/targets": {
+            "get": {
+                "tags": [
+                    "admiralty"
+                ],
+                "description": "find all Admiralty Target\n\u003cbr\u003e",
+                "operationId": "AdmiraltyController.GetAllTargets",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        },
+        "/admiralty/targets/{execution}": {
+            "get": {
+                "tags": [
+                    "admiralty"
+                ],
+                "description": "find one Admiralty Target\n\u003cbr\u003e",
+                "operationId": "AdmiraltyController.GetOneTarget",
+                "parameters": [
+                    {
+                        "in": "path",
+                        "name": "id",
+                        "description": "the name of the target to get",
+                        "required": true,
+                        "type": "string"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        },
         "/booking/": {
             "get": {
                 "tags": [
@@ -22,6 +218,14 @@
                 ],
                 "description": "find booking by id\n\u003cbr\u003e",
                 "operationId": "BookingController.GetAll",
+                "parameters": [
+                    {
+                        "in": "query",
+                        "name": "is_draft",
+                        "description": "draft wished",
+                        "type": "string"
+                    }
+                ],
                 "responses": {
                     "200": {
                         "description": "{booking} models.booking"
@@ -33,7 +237,7 @@
                     "booking"
                 ],
                 "description": "create booking\n\u003cbr\u003e",
-                "operationId": "BookingController.Post",
+                "operationId": "BookingController.Post.",
                 "parameters": [
                     {
                         "in": "body",
@@ -44,6 +248,12 @@
                             "type": "string"
                         },
                         "type": "string"
+                    },
+                    {
+                        "in": "query",
+                        "name": "is_draft",
+                        "description": "draft wished",
+                        "type": "string"
                     }
                 ],
                 "responses": {
@@ -83,6 +293,12 @@
                         "description": "2006-01-02T15:04:05",
                         "type": "string",
                         "default": "the booking end date"
+                    },
+                    {
+                        "in": "query",
+                        "name": "is_draft",
+                        "description": "draft wished",
+                        "type": "string"
                     }
                 ],
                 "responses": {
@@ -95,25 +311,67 @@
                 }
             }
         },
-        "/booking/search/{search}": {
+        "/booking/search/execution/{id}": {
             "get": {
                 "tags": [
                     "booking"
                 ],
-                "description": "search booking\n\u003cbr\u003e",
+                "description": "search bookings by execution\n\u003cbr\u003e",
                 "operationId": "BookingController.Search",
                 "parameters": [
                     {
                         "in": "path",
-                        "name": "search",
-                        "description": "the word search you want to get",
+                        "name": "id",
+                        "description": "id execution",
                         "required": true,
                         "type": "string"
+                    },
+                    {
+                        "in": "query",
+                        "name": "is_draft",
+                        "description": "draft wished",
+                        "type": "string"
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "{booking} models.booking"
+                        "description": "{workspace} models.workspace"
+                    }
+                }
+            }
+        },
+        "/booking/search/{start_date}/{end_date}": {
+            "get": {
+                "tags": [
+                    "booking"
+                ],
+                "description": "search bookings\n\u003cbr\u003e",
+                "operationId": "BookingController.Search",
+                "parameters": [
+                    {
+                        "in": "path",
+                        "name": "start_date",
+                        "description": "the word search you want to get",
+                        "required": true,
+                        "type": "string"
+                    },
+                    {
+                        "in": "path",
+                        "name": "end_date",
+                        "description": "the word search you want to get",
+                        "required": true,
+                        "type": "string"
+                    },
+                    {
+                        "in": "query",
+                        "name": "is_draft",
+                        "description": "draft wished",
+                        "type": "string"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "{workspace} models.workspace"
                     }
                 }
             }
@@ -139,6 +397,64 @@
                         "description": "{booking} models.booking"
                     }
                 }
+            },
+            "put": {
+                "tags": [
+                    "booking"
+                ],
+                "description": "create computes\n\u003cbr\u003e",
+                "operationId": "BookingController.Update",
+                "parameters": [
+                    {
+                        "in": "path",
+                        "name": "id",
+                        "description": "the compute id you want to get",
+                        "required": true,
+                        "type": "string"
+                    },
+                    {
+                        "in": "body",
+                        "name": "body",
+                        "description": "The compute content",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/models.compute"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "{compute} models.compute"
+                    }
+                }
+            }
+        },
+        "/session/token/{id}/{duration}": {
+            "get": {
+                "tags": [
+                    "session"
+                ],
+                "description": "find booking by id\n\u003cbr\u003e",
+                "operationId": "SessionController.GetToken",
+                "parameters": [
+                    {
+                        "in": "path",
+                        "name": "id",
+                        "description": "id of the datacenter",
+                        "type": "string"
+                    },
+                    {
+                        "in": "path",
+                        "name": "duration",
+                        "description": "duration of the token",
+                        "type": "string"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "{booking} models.booking"
+                    }
+                }
             }
         },
         "/version/": {
@@ -168,15 +484,61 @@
                     }
                 }
             }
+        },
+        "/{id}": {
+            "get": {
+                "tags": [
+                    "oc-datacenter/controllersDatacenterController"
+                ],
+                "description": "find booking by id\n\u003cbr\u003e",
+                "operationId": "DatacenterController.Get",
+                "parameters": [
+                    {
+                        "in": "path",
+                        "name": "id",
+                        "description": "the id you want to get",
+                        "required": true,
+                        "type": "string"
+                    },
+                    {
+                        "in": "query",
+                        "name": "is_draft",
+                        "description": "draft wished",
+                        "type": "string"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "{booking} models.booking"
+                    }
+                }
+            }
         }
     },
     "definitions": {
+        "controllers.RemoteKubeconfig": {
+            "title": "RemoteKubeconfig",
+            "type": "object",
+            "properties": {
+                "Data": {
+                    "type": "string"
+                }
+            }
+        },
+        "models.compute": {
+            "title": "compute",
+            "type": "object"
+        },
         "models.object": {
             "title": "object",
             "type": "object"
         }
     },
     "tags": [
+        {
+            "name": "oc-datacenter/controllersDatacenterController",
+            "description": "Operations about workspace\n"
+        },
         {
             "name": "booking",
             "description": "Operations about workspace\n"
@@ -184,6 +546,10 @@
         {
             "name": "version",
             "description": "VersionController operations for Version\n"
+        },
+        {
+            "name": "admiralty",
+            "description": "Operations about the admiralty objects of the datacenter\n"
         }
     ]
 }

swagger/swagger.yml

@@ -8,10 +8,166 @@ info:
   contact:
     email: admin@o-cloud.io
   license:
-    name: MIT
-    url: https://opensource.org/license/mit
+    name: AGPL
+    url: https://www.gnu.org/licenses/agpl-3.0.html
 basePath: /oc/
 paths:
+  /:
+    get:
+      tags:
+      - oc-datacenter/controllersDatacenterController
+      description: |-
+        find booking by id
+        <br>
+      operationId: DatacenterController.GetAll
+      parameters:
+      - in: query
+        name: is_draft
+        description: draft wished
+        type: string
+      responses:
+        "200":
+          description: '{booking} models.booking'
+  /{id}:
+    get:
+      tags:
+      - oc-datacenter/controllersDatacenterController
+      description: |-
+        find booking by id
+        <br>
+      operationId: DatacenterController.Get
+      parameters:
+      - in: path
+        name: id
+        description: the id you want to get
+        required: true
+        type: string
+      - in: query
+        name: is_draft
+        description: draft wished
+        type: string
+      responses:
+        "200":
+          description: '{booking} models.booking'
+  /admiralty/kubeconfig/{execution}:
+    get:
+      tags:
+      - admiralty
+      parameters:
+      - in: path
+        name: execution
+        description: execution id of the workflow
+        required: true
+        type: string
+      responses:
+        "200":
+          description: ""
+  /admiralty/node/{execution}:
+    get:
+      tags:
+      - admiralty
+      parameters:
+      - in: path
+        name: execution
+        description: execution id of the workflow
+        required: true
+        type: string
+      responses:
+        "200":
+          description: ""
+  /admiralty/secret/{execution}:
+    get:
+      tags:
+      - admiralty
+      parameters:
+      - in: path
+        name: execution
+        description: execution id of the workflow
+        required: true
+        type: string
+      responses:
+        "200":
+          description: ""
+    post:
+      tags:
+      - admiralty
+      parameters:
+      - in: path
+        name: execution
+        description: execution id of the workflow
+        required: true
+        type: string
+      - in: body
+        name: kubeconfig
+        description: Kubeconfig to use when creating secret
+        required: true
+        schema:
+          $ref: '#/definitions/controllers.RemoteKubeconfig'
+      responses:
+        "201":
+          description: ""
+  /admiralty/source/{execution}:
+    post:
+      tags:
+      - admiralty
+      description: |-
+        Create an Admiralty Source on remote cluster
+        <br>
+      operationId: AdmiraltyController.CreateSource
+      parameters:
+      - in: path
+        name: execution
+        description: execution id of the workflow
+        required: true
+        type: string
+      responses:
+        "201":
+          description: ""
+  /admiralty/target/{execution}:
+    post:
+      tags:
+      - admiralty
+      description: |-
+        Create an Admiralty Target in the namespace associated to the executionID
+        <br>
+      operationId: AdmiraltyController.CreateAdmiraltyTarget
+      parameters:
+      - in: path
+        name: execution
+        description: execution id of the workflow
+        required: true
+        type: string
+      responses:
+        "201":
+          description: ""
+  /admiralty/targets:
+    get:
+      tags:
+      - admiralty
+      description: |-
+        find all Admiralty Target
+        <br>
+      operationId: AdmiraltyController.GetAllTargets
+      responses:
+        "200":
+          description: ""
+  /admiralty/targets/{execution}:
+    get:
+      tags:
+      - admiralty
+      description: |-
+        find one Admiralty Target
+        <br>
+      operationId: AdmiraltyController.GetOneTarget
+      parameters:
+      - in: path
+        name: id
+        description: the name of the target to get
+        required: true
+        type: string
+      responses:
+        "200":
+          description: ""
   /booking/:
     get:
       tags:
@@ -20,6 +176,11 @@ paths:
         find booking by id
         <br>
       operationId: BookingController.GetAll
+      parameters:
+      - in: query
+        name: is_draft
+        description: draft wished
+        type: string
       responses:
         "200":
           description: '{booking} models.booking'
@@ -29,7 +190,7 @@ paths:
       description: |-
         create booking
         <br>
-      operationId: BookingController.Post
+      operationId: BookingController.Post.
       parameters:
       - in: body
         name: booking
@@ -38,6 +199,10 @@ paths:
         schema:
           type: string
         type: string
+      - in: query
+        name: is_draft
+        description: draft wished
+        type: string
       responses:
         "200":
           description: ""
@@ -60,6 +225,28 @@ paths:
       responses:
         "200":
           description: '{booking} models.booking'
+    put:
+      tags:
+      - booking
+      description: |-
+        create computes
+        <br>
+      operationId: BookingController.Update
+      parameters:
+      - in: path
+        name: id
+        description: the compute id you want to get
+        required: true
+        type: string
+      - in: body
+        name: body
+        description: The compute content
+        required: true
+        schema:
+          $ref: '#/definitions/models.compute'
+      responses:
+        "200":
+          description: '{compute} models.compute'
   /booking/check/{id}/{start_date}/{end_date}:
     get:
       tags:
@@ -83,25 +270,79 @@ paths:
         description: 2006-01-02T15:04:05
         type: string
         default: the booking end date
+      - in: query
+        name: is_draft
+        description: draft wished
+        type: string
       responses:
         "200":
           description: ""
           schema:
             $ref: '#/definitions/models.object'
-  /booking/search/{search}:
+  /booking/search/{start_date}/{end_date}:
     get:
       tags:
       - booking
       description: |-
-        search booking
+        search bookings
         <br>
       operationId: BookingController.Search
       parameters:
       - in: path
-        name: search
+        name: start_date
         description: the word search you want to get
         required: true
         type: string
+      - in: path
+        name: end_date
+        description: the word search you want to get
+        required: true
+        type: string
+      - in: query
+        name: is_draft
+        description: draft wished
+        type: string
+      responses:
+        "200":
+          description: '{workspace} models.workspace'
+  /booking/search/execution/{id}:
+    get:
+      tags:
+      - booking
+      description: |-
+        search bookings by execution
+        <br>
+      operationId: BookingController.Search
+      parameters:
+      - in: path
+        name: id
+        description: id execution
+        required: true
+        type: string
+      - in: query
+        name: is_draft
+        description: draft wished
+        type: string
+      responses:
+        "200":
+          description: '{workspace} models.workspace'
+  /session/token/{id}/{duration}:
+    get:
+      tags:
+      - session
+      description: |-
+        find booking by id
+        <br>
+      operationId: SessionController.GetToken
+      parameters:
+      - in: path
+        name: id
+        description: id of the datacenter
+        type: string
+      - in: path
+        name: duration
+        description: duration of the token
+        type: string
       responses:
         "200":
           description: '{booking} models.booking'
@@ -128,13 +369,28 @@ paths:
         "200":
           description: ""
 definitions:
+  controllers.RemoteKubeconfig:
+    title: RemoteKubeconfig
+    type: object
+    properties:
+      Data:
+        type: string
+  models.compute:
+    title: compute
+    type: object
   models.object:
     title: object
     type: object
 tags:
+- name: oc-datacenter/controllersDatacenterController
+  description: |
+    Operations about workspace
 - name: booking
   description: |
     Operations about workspace
 - name: version
   description: |
     VersionController operations for Version
+- name: admiralty
+  description: |
+    Operations about the admiralty objects of the datacenter