diff --git a/BUILD.bazel b/BUILD.bazel index 69c4b6702..394c39f25 100644 --- a/BUILD.bazel +++ b/BUILD.bazel @@ -50,7 +50,6 @@ filegroup( "//cmd/controller:all-srcs", "//cmd/webhook:all-srcs", "//deploy:all-srcs", - "//docs/generated/reference:all-srcs", "//hack:all-srcs", "//pkg/acme:all-srcs", "//pkg/api:all-srcs", diff --git a/WORKSPACE b/WORKSPACE index b558c28b4..b506fbd45 100644 --- a/WORKSPACE +++ b/WORKSPACE @@ -103,30 +103,6 @@ load( install_e2e_images() -# Load and define targets used for reference doc generation -load( - "//docs/generated/reference:deps.bzl", - install_docs_dependencies = "install", -) - -install_docs_dependencies() - -# The npm_install rule runs yarn anytime the package.json or package-lock.json file changes. -# It also extracts any Bazel rules distributed in an npm package. -load("@build_bazel_rules_nodejs//:defs.bzl", "npm_install") - -npm_install( - # Name this npm so that Bazel Label references look like @brodocs_modules//package - name = "brodocs_modules", - package_json = "@brodocs//:package.json", - package_lock_json = "//docs/generated/reference/generate/bin:package-lock.json", -) - -# Install any Bazel rules which were extracted earlier by the npm_install rule. -load("@brodocs_modules//:install_bazel_dependencies.bzl", "install_bazel_dependencies") - -install_bazel_dependencies() - load("//hack/build:repos.bzl", "go_repositories") go_repositories() diff --git a/docs/_ext/externalredirect.py b/docs/_ext/externalredirect.py new file mode 100644 index 000000000..86099ec7f --- /dev/null +++ b/docs/_ext/externalredirect.py @@ -0,0 +1,84 @@ +""" + externalredirect + ~~~~~~~~~~~~~~~~~~~~~~~ + + Generate redirects to external files based on a single 'external_redirects' file +""" + +import os + +from sphinx.builders import html as builders +from sphinx.builders import linkcheck as linkcheckbuilders +from sphinx.util import logging + +TEMPLATE = """ + + +""" + +SRC_TEMPLATE = """========== +File moved +========== + +This document has moved to %s. +This placeholder file will be removed in a later release. +""" + +def generate_external_redirects(app, exception): + logger = logging.getLogger(__name__) + + path = os.path.join(app.srcdir, app.config.external_redirects_file) + if not os.path.exists(path): + logger.info("Could not find redirects file at '%s'" % path) + return + + in_suffix = app.config.source_suffix + if isinstance(in_suffix, list): + in_suffix = in_suffix[0] + if isinstance(in_suffix, dict): + logger.info("app.config.source_suffix is a dictionary type. " + "Defaulting source_suffix to '.rst'") + in_suffix = ".rst" + + if type(app.builder) == linkcheckbuilders.CheckExternalLinksBuilder: + logger.info("Detected 'linkcheck' builder in use so skipping generating redirects") + return + + if not (type(app.builder) == builders.StandaloneHTMLBuilder or type(app.builder) == builders.DirectoryHTMLBuilder): + logger.warn("The 'sphinxcontib-redirects' plugin is only supported " + "by the 'html' and 'dirhtml' builder, but you are using '%s'. Skipping..." % type(app.builder)) + + dirhtml = False + if type(app.builder) == builders.DirectoryHTMLBuilder: + dirhtml = True + + with open(path) as redirects: + for line in redirects.readlines(): + from_path, to_url = line.rstrip().split(' ') + orig_from_path = from_path + logger.info("Redirecting '%s' to '%s'" % (from_path, to_url)) + + if dirhtml: + from_path = from_path.replace(in_suffix, '/index.html') + else: + from_path = from_path.replace(in_suffix, '.html') + + logger.info("Resolved redirect '%s' to '%s'" % (from_path, to_url)) + + redirected_filename = os.path.join(app.builder.outdir, from_path) + redirected_directory = os.path.dirname(redirected_filename) + if not os.path.exists(redirected_directory): + os.makedirs(redirected_directory) + + logger.info("Writing to '%s'" % redirected_filename) + with open(redirected_filename, 'w') as f: + f.write(TEMPLATE % to_url) + + input_rst_filename = os.path.join(app.srcdir, orig_from_path) + with open(input_rst_filename, 'w') as f: + f.write(SRC_TEMPLATE % to_url) + + +def setup(app): + app.add_config_value('external_redirects_file', 'external_redirects', 'env') + app.connect('build-finished', generate_external_redirects) diff --git a/docs/conf.py b/docs/conf.py index 2caa4d642..d92870236 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -26,8 +26,8 @@ # add these directories to sys.path here. If the directory is relative to the # documentation root, use os.path.abspath to make it absolute, like shown here. # -# import os -# import sys +import os +import sys # sys.path.insert(0, os.path.abspath('.')) # -- Project information ----------------------------------------------------- @@ -48,12 +48,15 @@ release = u'' # # needs_sphinx = '1.0' +sys.path.append(os.path.abspath("./_ext")) + # Add any Sphinx extension module names here, as strings. They can be # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom # ones. extensions = [ 'sphinx.ext.todo', 'sphinxcontrib.redirects', + "externalredirect", ] # Add any paths that contain templates here, relative to this directory. diff --git a/docs/design/index.rst b/docs/design/index.rst index 3feefaf21..eda4b39c0 100644 --- a/docs/design/index.rst +++ b/docs/design/index.rst @@ -1,7 +1,6 @@ -==================== -Design and Proposals -==================== +========== +File moved +========== -To view design documents please visit the link here_. - -.. _here: https://github.com/jetstack/cert-manager/tree/master/design +This document has moved to https://cert-manager.netlify.com/docs. +This placeholder file will be removed in a later release. diff --git a/docs/devel/dco-sign-off.rst b/docs/devel/dco-sign-off.rst index e383a8b63..4be00c52a 100644 --- a/docs/devel/dco-sign-off.rst +++ b/docs/devel/dco-sign-off.rst @@ -1,63 +1,6 @@ -============ -DCO Sign off -============ +========== +File moved +========== -All authors to the project retain copyright to their work. However, to ensure -that they are only submitting work that they have rights to, we are requiring -everyone to acknowledge this by signing their work. - -Any copyright notices in this repo should specify the authors as "the Jetstack -cert-manager contributors". - -To sign your work, just add a line like this at the end of your commit message: - -.. code:: - - Signed-off-by: Joe Bloggs - -This can easily be done with the ``--signoff`` option to ``git commit``. -You can also mass sign-off a whole PR with ``git rebase --signoff master``, -replacing ``master`` with the branch you are creating a pull request again if -not master. - -By doing this you state that you certify the following (from https://developercertificate.org/): - -.. code:: - - Developer Certificate of Origin - Version 1.1 - - Copyright (C) 2004, 2006 The Linux Foundation and its contributors. - 1 Letterman Drive - Suite D4700 - San Francisco, CA, 94129 - - Everyone is permitted to copy and distribute verbatim copies of this - license document, but changing it is not allowed. - - - Developer's Certificate of Origin 1.1 - - By making a contribution to this project, I certify that: - - (a) The contribution was created in whole or in part by me and I - have the right to submit it under the open source license - indicated in the file; or - - (b) The contribution is based upon previous work that, to the best - of my knowledge, is covered under an appropriate open source - license and I have the right under that license to submit that - work with modifications, whether created in whole or in part - by me, under the same open source license (unless I am - permitted to submit under a different license), as indicated - in the file; or - - (c) The contribution was provided directly to me by some other - person who certified (a), (b) or (c) and I have not modified - it. - - (d) I understand and agree that this project and the contribution - are public and that a record of the contribution (including all - personal information I submit with it, including my sign-off) is - maintained indefinitely and may be redistributed consistent with - this project or the open source license(s) involved. +This document has moved to https://cert-manager.netlify.com/docs/contributing/sign-off/. +This placeholder file will be removed in a later release. diff --git a/docs/devel/develop-with-minikube.rst b/docs/devel/develop-with-minikube.rst index bd896dff9..7feb92af8 100644 --- a/docs/devel/develop-with-minikube.rst +++ b/docs/devel/develop-with-minikube.rst @@ -1,109 +1,6 @@ -===================== -Develop with minikube -===================== +========== +File moved +========== -Minikube is a tool to quickly provision a local Kubernetes cluster on many -platforms. It can be used to test and develop cert-manager. This guide will -walk you through getting started using Minikube for development. - -Start minikube -============== - -First, run minikube, and configure your local kubectl command to work with minikube; minikube typically does this automatically. - -.. code-block:: shell - - # Check your locally installed minikube version - $ minikube version - minikube version: v0.25.0 - - # Start a local cluster - # If using Minikube v0.25.0 or older: - $ minikube start --extra-config=apiserver.Authorization.Mode=RBAC - # Otherwise: - $ minikube start - - # Verify it works. This should output a local apiserver IP - $ kubectl cluster-info - - # Create a cluster role binding so Tiller has cluster-admin access rights - $ kubectl create clusterrolebinding default-admin --clusterrole=cluster-admin --serviceaccount=kube-system:default - - # Install helm - $ helm init - - -Install local development tools -=============================== - -You will need the following tools to build cert-manager: - -* Bazel_ -* Docker_ (and enable for non-root user) - -These instructions have only been tested on Linux and MacOS; Windows may -require further changes. - -If you need to add dependencies, you will additionally need: - -* Git_ -* Mercurial_ - -You can then run ``./hack/update-vendor.sh`` to regenerate any -dependencies, and ``make build`` to build the docker images. - -Build a dev version of cert-manager -=================================== - -.. code-block:: shell - - # Configure your local docker client to use the minikube docker daemon - $ eval "$(minikube docker-env)" - - # Build cert-manager binaries and docker images. Full output omitted for brevity - $ make build - Successfully tagged quay.io/jetstack/cert-manager-controller:canary - - -Deploy that version with helm -============================= - -.. code-block:: shell - - # Install custom resources before running helm - $ kubectl apply -f deploy/manifests/00-crds.yaml - - # Install our freshly built cert-manager image - $ helm install \ - --set image.tag=canary \ - --set image.pullPolicy=Never \ - --set cainjector.image.tag=canary \ - --set cainjector.pullPolicy=Never \ - --set webhook.image.tag=canary \ - --set webhook.pullPolicy=Never \ - --name cert-manager \ - ./deploy/charts/cert-manager - -From here, you should be able to do whatever manual testing or development you wish to. - -Deploy a new version -==================== - -In general, upgrading can be done simply by running `make build`, and then deleting the deployed pod using `kubectl delete pod`. - -However, if you make changes to the helm chart or wish to change the controller's arguments, such as to change the logging level, you may also update it with the following: - -.. code-block:: shell - - helm upgrade \ - cert-manager \ - --reuse-values \ - --set extraArgs="{-v=5}" - --set image.tag=build - ./contrib/charts/cert-manager - - -.. _Bazel: https://docs.bazel.build/versions/master/install.html -.. _Docker: https://store.docker.com/search?type=edition&offering=community -.. _Git: https://git-scm.com/downloads -.. _Mercurial: https://www.mercurial-scm.org/ +This document has moved to https://cert-manager.netlify.com/docs/contributing/kind/. +This placeholder file will be removed in a later release. diff --git a/docs/devel/dns01-providers.rst b/docs/devel/dns01-providers.rst index 147547173..9f4a0d021 100644 --- a/docs/devel/dns01-providers.rst +++ b/docs/devel/dns01-providers.rst @@ -1,48 +1,6 @@ -============================ -Contributing DNS01 providers -============================ +========== +File moved +========== ----------- - WARNING ----------- - -Because of the overwhelming number of PRs for new DNS providers, We're changing how we handle the DNS01 contributions. See `this post `_ on the mailing list for more information. - -Steps to add a ``FooDNS`` DNS-01 provider: - -1. Create a new package under ``pkg/issuer/acme/dns/foodns``. - This is where all the code to interact with the DNS providers API will live. -2. Implement functions to match the solver interface (``Present``, ``CleanUp`` and ``Timeout``). - Use an existing provider for reference. - Most of the cert-manager providers are based off - https://github.com/xenolf/lego, so if lego supports the DNS provider you - want to add, it's fairly easy to copy it over and make modifications to fit - with the cert-manager codebase. Examples of the changes required: - - - replace uses of ``github.com/xenolf/lego/acme`` with ``github.com/jetstack/cert-manager/pkg/issuer/acme/dns/util``. - - replace uses of ``github.com/xenolf/lego/log`` with ``github.com/golang/glog``. - - remove references to ``github.com/xenolf/lego/platform/config/env``. - cert-manager does not use environment variables for internal configuration, so calls to this package should not be required. - -3. Add unit test coverage for this package. -4. Add your provider configuration types to the API (located in ``pkg/apis/certmanager/v1alpha2/types.go``) and regenerate code (run ``./hack/update-codegen.sh``). - New API types should have an associated short documentation string, - which is added to the reference API documentation (run ``./hack/update-reference-docs-dockerized.sh`` to update the API documentation). -5. Register the provider in ``pkg/issuer/acme/dns``: - - - The constructor for the provider needs adding to ``dnsProviderConstructors``, - - ``solverForIssuerProvider`` must be updated to handle retrieving any information for the new provider (for example, fetching credentials from a secret) - and constructing a new instance of the provider. - -6. Add coverage for the provider to ``pkg/issuer/acme/dns/dns_test.go``. -7. Add example configuration for the new provider to ``docs/tasks/acme/configuring-dns01/``. - The more information here the better, - this example and corresponding documentation should inform users how to use and configure this backend, - as well as mentioning any nuances with using this particular provider. -8. Test your provider out against a real account, and make sure you can issue a Certificate. -9. Submit your new provider to cert-manager! - -Things to watch out for: - -- Assume that at any point the cert-manager process may restart. - Make sure values required for operations like ``CleanUp`` are not solely stored in memory. +This document has moved to https://cert-manager.netlify.com/docs/contributing/dns-providers/. +This placeholder file will be removed in a later release. diff --git a/docs/devel/end-to-end-tests.rst b/docs/devel/end-to-end-tests.rst index a86448c45..7feb92af8 100644 --- a/docs/devel/end-to-end-tests.rst +++ b/docs/devel/end-to-end-tests.rst @@ -1,46 +1,6 @@ -======================== -Running end-to-end tests -======================== +========== +File moved +========== -cert-manager has an end-to-end test suite that verifies functionality against a -real Kubernetes cluster. - -This document explains how you can run the end-to-end tests yourself. -This is useful when you have added or changed functionality in cert-manager and -want to verify the software still works as expected. - -Requirements -============ - -Currently, a number of tools **must** be installed on your machine in order to -run the tests: - -* ``bazel`` - As with all other development, Bazel is required to actually - build the project as well as end-to-end test framework. Bazel will also - retrieve appropriate versions of any other dependencies depending on what - 'target' you choose to run. - -* ``docker`` - We provision a whole Kubernetes cluster within Docker, and so - an up to date version of Docker must be installed. The oldest Docker version - we have tested is 17.09. - -* ``kubectl`` - If you are running the tests on Linux, this step is - technically not required. For non-Linux hosts (i.e. OSX), you will need to - ensure you have a relatively new version of kubectl available on your PATH. - -* An internet connection - tests require access to DNS, and optionally - Cloudflare APIs (if a Cloudflare API token is provided). - -Bazel, Docker and Kubectl should be installed through your preferred means. - -Run end-to-end tests -==================== - -You can run the end-to-end tests by executing the following: - -.. code-block:: shell - - ./hack/ci/run-e2e-kind.sh - -The full suite may take up to 10 minutes to run. -You can monitor output of this command to track progress. +This document has moved to https://cert-manager.netlify.com/docs/contributing/kind/. +This placeholder file will be removed in a later release. diff --git a/docs/devel/generate-docs.rst b/docs/devel/generate-docs.rst index e56663036..0840a54d3 100644 --- a/docs/devel/generate-docs.rst +++ b/docs/devel/generate-docs.rst @@ -1,41 +1,6 @@ -======================== -Generating Documentation -======================== +========== +File moved +========== -The documentation is generated from `reStructured Text`_ by `Sphinx`_ -(via `Read The Docs`_). If you're unfamiliar with `reStructured Text`_, -the files typically have the extension `.rst`. You can find more details -in the `reStructured Text Basics`_. - -Installation instructions -========================= - -To install the sphinx tools, you'll need ``python`` (and ``pip``) installed: - -.. code-block:: shell - - pip install --user -r requirements.txt - -Generating documentation locally -================================ - -You can generate the documentation locally with the following command: - -.. code-block:: shell - - make html - -This will create documentation in the ``_build`` directory which you can -open with your browser. - -.. code-block:: shell - - open _build/html/index.html - -Note that you do not need to add these files to your git client, as -*Read The Docs* will generate the HTML on the fly. - -.. _`Sphinx`: https://www.sphinx-doc.org/ -.. _`Read The Docs`: https://readthedocs.org/ -.. _`reStructured Text`: https://www.sphinx-doc.org/en/master/usage/restructuredtext/index.html -.. _`reStructured Text Basics`: https://www.sphinx-doc.org/en/master/usage/restructuredtext/basics.html +This document has moved to https://cert-manager.netlify.com/docs/contributing/. +This placeholder file will be removed in a later release. diff --git a/docs/devel/index.rst b/docs/devel/index.rst index 34d309f13..0840a54d3 100644 --- a/docs/devel/index.rst +++ b/docs/devel/index.rst @@ -1,12 +1,6 @@ -Development documentation -========================= +========== +File moved +========== -.. toctree:: - :maxdepth: 1 - - develop-with-minikube - end-to-end-tests - dns01-providers - dco-sign-off - release-process - generate-docs +This document has moved to https://cert-manager.netlify.com/docs/contributing/. +This placeholder file will be removed in a later release. diff --git a/docs/devel/release-process.rst b/docs/devel/release-process.rst index de8967b49..8e0f86cc0 100644 --- a/docs/devel/release-process.rst +++ b/docs/devel/release-process.rst @@ -1,107 +1,6 @@ -=============== -Release process -=============== +========== +File moved +========== -This document aims to outline the process that should be followed for cutting a -new release of cert-manager. - -Minor releases -============== - -A minor release is a backwards-compatible 'feature' release. -It can contain new features and bugfixes. - -Release schedule ----------------- - -We aim to cut a new minor release once per month. -The rough goals for each release are outlined as part of a GitHub milestone. -We cut a release even if some of these goals are missed, in order to keep up -release velocity. - -Process -------- - -.. note:: - This process document is WIP and may be incomplete - -The process for cutting a minor release is as follows: - -#. Ensure upgrading document exists in docs/tasks/upgrading - -#. Ensure all strings of versions have been updated: - - * deploy/charts/cert-manager/README.md - * docs/getting-started/install/kubernetes.rst - * docs/getting-started/install/openshift.rst - * docs/getting-started/webhook.rst - * docs/tutorials/acme/quick-start/index.rst -#. Create a new release branch (e.g. ```release-0.5```) - -#. Push it to the ```jetstack/cert-manager`` repository - -#. Gather release notes since the previous release: - - * Download, install and run the latest version of release-notes: - -.. code:: - - * $ go get k8s.io/release; go install $GOPATH/src/k8s.io/release/cmd/release-notes/. - * $ mkdir -p design/release-notes/release-*X.Y* - * $ export GITHUB_TOKEN=*your-token* - * $ $GOPATH/bin/release-notes -release-version v*X.Y* -github-repo cert-manager -github-org jetstack -requiredAuthor "" -start-sha=$(git rev-parse *X.Y-1.0*) -end-sha=$(git rev-parse HEAD) -output design/release-notes/release-*X.Y*/draft-release-notes.md - * # Add additional blurb, notable items and characterise Changelog. - -Finally, create a new tag taken from the release branch, e.g. ```v0.5.0```. - -Patch releases -============== - -A patch release contains critical bugfixes for the project. -They are managed on an ad-hoc basis, and should only be required when critical -bugs/regressions are found in the release. - -We will only perform patch release for the **current** version of cert-manager. - -Once a new minor release has been cut, we will stop providing patches for the -version before it. - -Release schedule ----------------- - -Patch releases are cut on an ad-hoc basis, depending on recent activity on the -release branch. - -Process -------- - -.. note:: - This process document is WIP and may be incomplete - -Bugs that need to be fixed in a patch release should be cherry picked into the -appropriate release branch using the ```./hack/cherry-pick-pr.sh``` script in -this repository. - -The process for cutting a patch release is as follows: - -#. Ensure all strings of versions have been updated: - - * deploy/charts/cert-manager/README.md - * docs/getting-started/install/kubernetes.rst - * docs/getting-started/install/openshift.rst - * docs/getting-started/webhook.rst - * docs/tutorials/acme/quick-start/index.rst -#. Iterate on review feedback (hopefully this will be minimal) and submit - changes to ```master``` of cert-manager, performing a rebase of release-x.y. - -#. Gather release notes since the previous release: - -.. code:: - - * $ go get k8s.io/release; go install $GOPATH/src/k8s.io/release/cmd/release-notes/. - * $ mkdir -p design/release-notes/release-*X.Y* - * $ export GITHUB_TOKEN=*your-token* - * $ $GOPATH/bin/release-notes -release-version v*X.Y* -github-repo cert-manager -github-org jetstack -requiredAuthor "" -start-sha=$(git rev-parse *X.Y.Z-1*) -end-sha=$(git rev-parse release-*X.Y*) -output design/release-notes/release-*X.Y*/draft-release-notes-*Z*.md - * # Add additional blurb, notable items and characterise Changelog. - -Finally, create a new tag taken from the release branch, e.g. ```v0.5.1```. +This document has moved to https://cert-manager.netlify.com/docs/contributing/release-process/. +This placeholder file will be removed in a later release. diff --git a/docs/external_redirects b/docs/external_redirects new file mode 100644 index 000000000..580ffdac6 --- /dev/null +++ b/docs/external_redirects @@ -0,0 +1,64 @@ +devel/index.rst https://cert-manager.netlify.com/docs/contributing/ +devel/release-process.rst https://cert-manager.netlify.com/docs/contributing/release-process/ +devel/generate-docs.rst https://cert-manager.netlify.com/docs/contributing/ +devel/end-to-end-tests.rst https://cert-manager.netlify.com/docs/contributing/kind/ +devel/dco-sign-off.rst https://cert-manager.netlify.com/docs/contributing/sign-off/ +devel/dns01-providers.rst https://cert-manager.netlify.com/docs/contributing/dns-providers/ +devel/develop-with-minikube.rst https://cert-manager.netlify.com/docs/contributing/kind/ +index.rst https://cert-manager.netlify.com/docs/ +design/index.rst https://cert-manager.netlify.com/docs +tasks/index.rst https://cert-manager.netlify.com/docs/configuration/ +tasks/uninstall/kubernetes.rst https://cert-manager.netlify.com/docs/tutorials/uninstall/kubernetes/ +tasks/uninstall/index.rst https://cert-manager.netlify.com/docs/tutorials/uninstall/ +tasks/uninstall/openshift.rst https://cert-manager.netlify.com/docs/tutorials/uninstall/openshift/ +tasks/issuers/index.rst https://cert-manager.netlify.com/docs/configuration/ +tasks/issuers/setup-ca.rst https://cert-manager.netlify.com/docs/configuration/ca/ +tasks/issuers/setup-selfsigned.rst https://cert-manager.netlify.com/docs/configuration/selfsigned/ +tasks/issuers/setup-acme/index.rst https://cert-manager.netlify.com/docs/configuration/acme/ +tasks/issuers/setup-acme/dns01/azuredns.rst https://cert-manager.netlify.com/docs/configuration/acme/dns01/azuredns/ +tasks/issuers/setup-acme/dns01/index.rst https://cert-manager.netlify.com/docs/configuration/acme/dns01/ +tasks/issuers/setup-acme/dns01/cloudflare.rst https://cert-manager.netlify.com/docs/configuration/acme/dns01/cloudflare/ +tasks/issuers/setup-acme/dns01/rfc2136.rst https://cert-manager.netlify.com/docs/configuration/acme/dns01/rfc2136/ +tasks/issuers/setup-acme/dns01/acme-dns.rst https://cert-manager.netlify.com/docs/configuration/acme/dns01/acme-dns/ +tasks/issuers/setup-acme/dns01/route53.rst https://cert-manager.netlify.com/docs/configuration/acme/dns01/route53/ +tasks/issuers/setup-acme/dns01/akamai.rst https://cert-manager.netlify.com/docs/configuration/acme/dns01/akamai/ +tasks/issuers/setup-acme/dns01/digitalocean.rst https://cert-manager.netlify.com/docs/configuration/acme/dns01/digitalocean/ +tasks/issuers/setup-acme/dns01/webhook.rst https://cert-manager.netlify.com/docs/configuration/acme/dns01/webhook/ +tasks/issuers/setup-acme/dns01/google.rst https://cert-manager.netlify.com/docs/configuration/acme/dns01/google/ +tasks/issuers/setup-acme/http01/index.rst https://cert-manager.netlify.com/docs/configuration/acme/http01/ +tasks/issuers/setup-vault.rst https://cert-manager.netlify.com/docs/configuration/vault/ +tasks/issuers/setup-venafi.rst https://cert-manager.netlify.com/docs/configuration/venafi/ +tasks/upgrading/index.rst https://cert-manager.netlify.com/docs/TODO +tasks/upgrading/upgrading-0.4-0.5.rst https://cert-manager.netlify.com/docs/TODO +tasks/upgrading/upgrading-0.8-0.9.rst https://cert-manager.netlify.com/docs/TODO +tasks/upgrading/upgrading-0.5-0.6.rst https://cert-manager.netlify.com/docs/TODO +tasks/upgrading/upgrading-0.6-0.7.rst https://cert-manager.netlify.com/docs/TODO +tasks/upgrading/upgrading-0.2-0.3.rst https://cert-manager.netlify.com/docs/TODO +tasks/upgrading/upgrading-0.3-0.4.rst https://cert-manager.netlify.com/docs/TODO +tasks/upgrading/upgrading-0.9-0.10.rst https://cert-manager.netlify.com/docs/TODO +tasks/upgrading/upgrading-0.7-0.8.rst https://cert-manager.netlify.com/docs/TODO +tasks/upgrading/upgrading-0.10-0.11.rst https://cert-manager.netlify.com/docs/TODO +tasks/backup-restore-crds.rst https://cert-manager.netlify.com/docs/tutorials/backup/ +tasks/issuing-certificates/index.rst https://cert-manager.netlify.com/docs/usage/certificate/ +tasks/issuing-certificates/ingress-shim.rst https://cert-manager.netlify.com/docs/usage/ingress/ +getting-started/index.rst https://cert-manager.netlify.com/docs/installation/ +getting-started/install/kubernetes.rst https://cert-manager.netlify.com/docs/installation/kubernetes/ +getting-started/install/index.rst https://cert-manager.netlify.com/docs/installation/ +getting-started/install/openshift.rst https://cert-manager.netlify.com/docs/installation/openshift/ +getting-started/webhook.rst https://cert-manager.netlify.com/docs/faq/webhook/ +tutorials/index.rst https://cert-manager.netlify.com/docs/tutorials/ +tutorials/venafi/securing-ingress.rst https://cert-manager.netlify.com/docs/tutorials/venafi/venafi/ +tutorials/acme/index.rst https://cert-manager.netlify.com/docs/tutorials/acme/ingress/ +tutorials/acme/dns-validation.rst https://cert-manager.netlify.com/docs/tutorials/acme/dns-validation/ +tutorials/acme/migrating-from-kube-lego.rst https://cert-manager.netlify.com/docs/tutorials/acme/migrating-from-kube-lego/ +tutorials/acme/http-validation.rst https://cert-manager.netlify.com/docs/tutorials/acme/http-validation/ +tutorials/acme/quick-start/index.rst https://cert-manager.netlify.com/docs/tutorials/acme/ingress/ +reference/index.rst https://cert-manager.netlify.com/docs/concepts/ +reference/challenges.rst https://cert-manager.netlify.com/docs/concepts/acme-orders-challenges/ +reference/clusterissuers.rst https://cert-manager.netlify.com/docs/concepts/issuer/ +reference/cainjector.rst https://cert-manager.netlify.com/docs/concepts/ca-injector/ +reference/issuers.rst https://cert-manager.netlify.com/docs/concepts/issuer/ +reference/certificaterequests.rst https://cert-manager.netlify.com/docs/concepts/certificaterequest/ +reference/certificates.rst https://cert-manager.netlify.com/docs/concepts/certificate/ +reference/orders.rst https://cert-manager.netlify.com/docs/concepts/acme-orders-challenges/ +reference/api-docs/index.rst https://cert-manager.netlify.com/docs/reference/api-docs/ diff --git a/docs/generated/reference/BUILD.bazel b/docs/generated/reference/BUILD.bazel deleted file mode 100644 index 6f8a177a0..000000000 --- a/docs/generated/reference/BUILD.bazel +++ /dev/null @@ -1,22 +0,0 @@ -filegroup( - name = "package-srcs", - srcs = glob(["**"]), - tags = ["automanaged"], - visibility = ["//visibility:private"], -) - -filegroup( - name = "all-srcs", - srcs = [ - ":package-srcs", - "//docs/generated/reference/generate:all-srcs", - ], - tags = ["automanaged"], - visibility = ["//visibility:public"], -) - -filegroup( - name = "output", - srcs = glob(["output/**/*"]), - visibility = ["//visibility:public"], -) diff --git a/docs/generated/reference/deps.bzl b/docs/generated/reference/deps.bzl deleted file mode 100644 index 88552269f..000000000 --- a/docs/generated/reference/deps.bzl +++ /dev/null @@ -1,168 +0,0 @@ -# Copyright 2019 The Jetstack cert-manager contributors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") -load("@bazel_tools//tools/build_defs/repo:git.bzl", "new_git_repository") -load("@bazel_gazelle//:deps.bzl", "go_repository") - -# Install brodocs and related dependencies -def install(): - install_brodocs() - install_reference_docs_deps() - -def install_brodocs(): - ## Brodocs and associated dependencies - new_git_repository( - name = "brodocs", - remote = "https://github.com/munnerz/brodocs.git", - # We use this specific revision as it contains changes that allow us to - # specify custom paths when building documentation. - commit = "28714834053271ebb5a6a5fe22af29f98fc0b6d0", - shallow_since = "1556994488 +0100", - build_file_content = """ -exports_files(["brodoc.js"]) - -filegroup( - name = "all-srcs", - srcs = glob(["**/*"]), - visibility = ["//visibility:public"], -) - -filegroup( - name = "static", - srcs = [ - "stylesheet.css", - "scroll.js", - "actions.js", - "tabvisibility.js", - ], - visibility = ["//visibility:public"], -) -""", - ) - - # Install the nodejs "bootstrap" package - # This provides the basic tools for running and packaging nodejs programs in Bazel - http_archive( - name = "build_bazel_rules_nodejs", - sha256 = "395b7568f20822c13fc5abc65b1eced637446389181fda3a108fdd6ff2cac1e9", - urls = ["https://github.com/bazelbuild/rules_nodejs/releases/download/0.29.2/rules_nodejs-0.29.2.tar.gz"], - ) - -def install_reference_docs_deps(): - # Load kubernetes-incubator/reference-docs, to be used as part of the docs - # generation pipeline. - # This involves quite a few dependencies, hence the long list of go_repository - # rules. - # We include them here instead of in Gopkg.{toml,lock} to save extra sources in - # the repository. - # These were all taken from the HEAD of each repositories 'master' branch. - go_repository( - name = "io_kubernetes_incubator_reference_docs", - # Points to HEAD of the 'kubebuilder' branch - commit = "1959039a016c77efe6786b19f3f55f7b3042604f", - importpath = "github.com/kubernetes-incubator/reference-docs", - ) - - go_repository( - name = "in_gopkg_yaml_v2", - commit = "5420a8b6744d3b0345ab293f6fcba19c978f1183", - remote = "https://github.com/go-yaml/yaml", - vcs = "git", - importpath = "gopkg.in/yaml.v2", - ) - - go_repository( - name = "com_github_go_openapi_spec", - commit = "f1468acb3b29cdd5c5f6fa29435d2d2d6e6c9ff1", - importpath = "github.com/go-openapi/spec", - ) - - go_repository( - name = "com_github_go_openapi_loads", - commit = "fd899182a268dcf25de088722375311d9dee2662", - importpath = "github.com/go-openapi/loads", - ) - - go_repository( - name = "com_github_go_openapi_swag", - commit = "dd0dad036e67ae93c27dc64337b3f76296f3a5f0", - importpath = "github.com/go-openapi/swag", - ) - - go_repository( - name = "com_github_go_openapi_analysis", - commit = "b006789cd277d4fa4d16767046d694a256c6a218", - importpath = "github.com/go-openapi/analysis", - ) - - go_repository( - name = "com_github_go_openapi_jsonreference", - commit = "1c6a3fa339f2743b7b0fd2b842fc455eca2fa9eb", - importpath = "github.com/go-openapi/jsonreference", - ) - - go_repository( - name = "com_github_go_openapi_jsonpointer", - commit = "52eb3d4b47c6a51ce2693c8e614a15a07c1af435", - importpath = "github.com/go-openapi/jsonpointer", - ) - - go_repository( - name = "com_github_go_openapi_strfmt", - commit = "776114108ccc228238641096ea5be3d24842d4ea", - importpath = "github.com/go-openapi/strfmt", - ) - - go_repository( - name = "com_github_go_openapi_errors", - commit = "87bb653288778f8b0d922c5c3fb8b3f00a47ff28", - importpath = "github.com/go-openapi/errors", - ) - - go_repository( - name = "com_github_mailru_easyjson", - commit = "60711f1a8329503b04e1c88535f419d0bb440bff", - importpath = "github.com/mailru/easyjson", - ) - - go_repository( - name = "com_github_puerkitobio_purell", - commit = "975f53781597ed779763b7b65566e74c4004d8de", - importpath = "github.com/PuerkitoBio/purell", - ) - - go_repository( - name = "com_github_puerkitobio_urlesc", - commit = "de5bf2ad457846296e2031421a34e2568e304e35", - importpath = "github.com/PuerkitoBio/urlesc", - ) - - go_repository( - name = "com_github_globalsign_mgo", - commit = "1ca0a4f7cbcbe61c005d1bd43fdd8bb8b71df6bc", - importpath = "github.com/globalsign/mgo", - ) - - go_repository( - name = "com_github_mitchellh_mapstructure", - commit = "fa473d140ef3c6adf42d6b391fe76707f1f243c8", - importpath = "github.com/mitchellh/mapstructure", - ) - - go_repository( - name = "com_github_asaskevich_govalidator", - commit = "f9ffefc3facfbe0caee3fea233cbb6e8208f4541", - importpath = "github.com/asaskevich/govalidator", - ) diff --git a/docs/generated/reference/generate/BUILD.bazel b/docs/generated/reference/generate/BUILD.bazel deleted file mode 100644 index 76b1c2819..000000000 --- a/docs/generated/reference/generate/BUILD.bazel +++ /dev/null @@ -1,104 +0,0 @@ -genrule( - name = "__internal_markdown_tar", - srcs = [ - "//docs/generated/reference/generate:config.yaml", - "//docs/generated/reference/generate/static_includes:all-srcs", - "//docs/generated/reference/generate/json_swagger:swagger.json", - ], - outs = ["defs.tar.gz"], - cmd = "; ".join([ - "tmpdir=$$(mktemp -d)", - "mkdir -p \"$$tmpdir/static_includes/\"", - "mkdir -p \"$$tmpdir/includes/\"", - "mkdir -p \"$$tmpdir/openapi-spec/\"", - "cp -L \"$(location //docs/generated/reference/generate/json_swagger:swagger.json)\" \"$$tmpdir/openapi-spec/\"", - "cp -L \"$(location //docs/generated/reference/generate:config.yaml)\" \"$$tmpdir/\"", - "cp -LR $(locations //docs/generated/reference/generate/static_includes:all-srcs) \"$$tmpdir/static_includes/\"", - "rm \"$$tmpdir/static_includes/BUILD.bazel\"", - "$(location @io_kubernetes_incubator_reference_docs//gen-apidocs) --copyright \"Copyright 2018 Jetstack Ltd.\" --title \"Cert-manager API Reference\" -config-dir $$tmpdir", - "orig=$$(pwd)", - "cd $$tmpdir", - "tar -cf \"$$orig/$@\" ./manifest.json ./includes/", - ]), - tools = [ - "@io_kubernetes_incubator_reference_docs//gen-apidocs", - ], - visibility = ["//visibility:private"], -) - -genrule( - name = "__internal_brodocs_out", - srcs = [ - "//docs/generated/reference/generate:__internal_markdown_tar", - ], - outs = [ - "index.html", - "navData.js", - ], - cmd = "; ".join([ - "input=$$(mktemp -d)", - "output=$$(mktemp -d)", - "tar -C \"$$input\" -xf $(location //docs/generated/reference/generate:__internal_markdown_tar)", - "$(location //docs/generated/reference/generate/bin:brodocs) \"$$input/manifest.json\" \"$$input/includes\" \"$$output\"", - "cp $$output/index.html $(@D)", - "cp $$output/navData.js $(@D)", - ]), - tools = [ - "//docs/generated/reference/generate/bin:brodocs", - ], - visibility = ["//visibility:private"], -) - -# This file constructs an archive containing the full generated reference docs -# website, including all required node_modules. -# The output this script is then consumed by the hack/update-reference-docs.sh -# to place the data into the correct directory to be displayed by readthedocs. -genrule( - name = "generate", - srcs = [ - ":__internal_brodocs_out", - "@brodocs//:static", - "@brodocs_modules//jquery:jquery__contents", - "@brodocs_modules//bootstrap:bootstrap__contents", - "@brodocs_modules//font-awesome:font-awesome__contents", - "@brodocs_modules//highlight.js:highlight.js__contents", - "@brodocs_modules//jquery.scrollto:jquery.scrollto__contents", - ], - outs = ["generated.tar.gz"], - cmd = "; ".join([ - "bm=external/brodocs_modules", - "out=$$(mktemp -d)", - "cp -L $(locations :__internal_brodocs_out) $$out", - "cp -L $(locations @brodocs//:static) $$out", - "p=node_modules/jquery/dist; mkdir -p $$out/$$p && cp -L $$bm/$$p/jquery.min.js $$out/$$p", - "p=node_modules/bootstrap/dist/css; mkdir -p $$out/$$p && cp -L $$bm/$$p/bootstrap.min.css $$out/$$p", - "p=node_modules/font-awesome/css; mkdir -p $$out/$$p && cp -L $$bm/$$p/* $$out/$$p", - "p=node_modules/font-awesome/fonts; mkdir -p $$out/$$p && cp -L $$bm/$$p/* $$out/$$p", - "p=node_modules/highlight.js/styles; mkdir -p $$out/$$p && cp -L $$bm/$$p/default.css $$out/$$p", - "p=node_modules/jquery.scrollto; mkdir -p $$out/$$p && cp -L $$bm/$$p/jquery.scrollTo.min.js $$out/$$p", - "orig=$$(pwd)", - "cd $$out", - "tar -cf $$orig/$@ ./", - ]), - visibility = ["//visibility:public"], -) - -filegroup( - name = "package-srcs", - srcs = glob(["**"]), - tags = ["automanaged"], - visibility = ["//visibility:private"], -) - -filegroup( - name = "all-srcs", - srcs = [ - ":package-srcs", - "//docs/generated/reference/generate/bin:all-srcs", - "//docs/generated/reference/generate/go_openapi:all-srcs", - "//docs/generated/reference/generate/json_swagger:all-srcs", - "//docs/generated/reference/generate/static_includes:all-srcs", - ], - tags = ["automanaged"], - visibility = ["//visibility:public"], -) diff --git a/docs/generated/reference/generate/bin/BUILD.bazel b/docs/generated/reference/generate/bin/BUILD.bazel deleted file mode 100644 index 8a08e8716..000000000 --- a/docs/generated/reference/generate/bin/BUILD.bazel +++ /dev/null @@ -1,26 +0,0 @@ -load("@build_bazel_rules_nodejs//:defs.bzl", "nodejs_binary") - -nodejs_binary( - name = "brodocs", - data = [ - "@brodocs//:all-srcs", - ], - entry_point = "brodocs/brodoc", - # Ordinarily this defaults to //:node_modules - node_modules = "@brodocs_modules//:node_modules", - visibility = ["//visibility:public"], -) - -filegroup( - name = "package-srcs", - srcs = glob(["**"]), - tags = ["automanaged"], - visibility = ["//visibility:private"], -) - -filegroup( - name = "all-srcs", - srcs = [":package-srcs"], - tags = ["automanaged"], - visibility = ["//visibility:public"], -) diff --git a/docs/generated/reference/generate/bin/package-lock.json b/docs/generated/reference/generate/bin/package-lock.json deleted file mode 100644 index f854e3690..000000000 --- a/docs/generated/reference/generate/bin/package-lock.json +++ /dev/null @@ -1,88 +0,0 @@ -{ - "name": "brodocs", - "version": "1.0.0", - "lockfileVersion": 1, - "requires": true, - "dependencies": { - "bootstrap": { - "version": "3.4.1", - "resolved": "https://registry.npmjs.org/bootstrap/-/bootstrap-3.4.1.tgz", - "integrity": "sha512-yN5oZVmRCwe5aKwzRj6736nSmKDX7pLYwsXiCj/EYmo16hODaBiT4En5btW/jhBF/seV+XMx3aYwukYC3A49DA==" - }, - "colors": { - "version": "1.3.3", - "resolved": "https://registry.npmjs.org/colors/-/colors-1.3.3.tgz", - "integrity": "sha512-mmGt/1pZqYRjMxB1axhTo16/snVZ5krrKkcmMeVKxzECMMXoCgnvTPp10QgHfcbQZw8Dq2jMNG6je4JlWU0gWg==" - }, - "ejs": { - "version": "2.6.1", - "resolved": "https://registry.npmjs.org/ejs/-/ejs-2.6.1.tgz", - "integrity": "sha512-0xy4A/twfrRCnkhfk8ErDi5DqdAsAqeGxht4xkCUrsvhhbQNs7E+4jV0CN7+NKIY0aHE72+XvqtBIXzD31ZbXQ==", - "dev": true - }, - "font-awesome": { - "version": "4.7.0", - "resolved": "https://registry.npmjs.org/font-awesome/-/font-awesome-4.7.0.tgz", - "integrity": "sha1-j6jPBBGhoxr9B7BtKQK7n8gVoTM=" - }, - "highlight.js": { - "version": "9.15.6", - "resolved": "https://registry.npmjs.org/highlight.js/-/highlight.js-9.15.6.tgz", - "integrity": "sha512-zozTAWM1D6sozHo8kqhfYgsac+B+q0PmsjXeyDrYIHHcBN0zTVT66+s2GW1GZv7DbyaROdLXKdabwS/WqPyIdQ==", - "dev": true - }, - "jquery": { - "version": "3.4.1", - "resolved": "https://registry.npmjs.org/jquery/-/jquery-3.4.1.tgz", - "integrity": "sha512-36+AdBzCL+y6qjw5Tx7HgzeGCzC81MDDgaUP8ld2zhx58HdqXGoBd+tHdrBMiyjGQs0Hxs/MLZTu/eHNJJuWPw==" - }, - "jquery.scrollto": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/jquery.scrollto/-/jquery.scrollto-2.1.2.tgz", - "integrity": "sha1-51gNnHrEbvW7JTGUg/b0VxP9fGw=", - "requires": { - "jquery": ">=1.8" - } - }, - "marked": { - "version": "0.6.2", - "resolved": "https://registry.npmjs.org/marked/-/marked-0.6.2.tgz", - "integrity": "sha512-LqxwVH3P/rqKX4EKGz7+c2G9r98WeM/SW34ybhgNGhUQNKtf1GmmSkJ6cDGJ/t6tiyae49qRkpyTw2B9HOrgUA==", - "dev": true - }, - "mime": { - "version": "1.6.0", - "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz", - "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==" - }, - "minimist": { - "version": "0.0.10", - "resolved": "https://registry.npmjs.org/minimist/-/minimist-0.0.10.tgz", - "integrity": "sha1-3j+YVD2/lggr5IrRoMfNqDYwHc8=" - }, - "node-static": { - "version": "0.7.11", - "resolved": "https://registry.npmjs.org/node-static/-/node-static-0.7.11.tgz", - "integrity": "sha512-zfWC/gICcqb74D9ndyvxZWaI1jzcoHmf4UTHWQchBNuNMxdBLJMDiUgZ1tjGLEIe/BMhj2DxKD8HOuc2062pDQ==", - "requires": { - "colors": ">=0.6.0", - "mime": "^1.2.9", - "optimist": ">=0.3.4" - } - }, - "optimist": { - "version": "0.6.1", - "resolved": "https://registry.npmjs.org/optimist/-/optimist-0.6.1.tgz", - "integrity": "sha1-2j6nRob6IaGaERwybpDrFaAZZoY=", - "requires": { - "minimist": "~0.0.1", - "wordwrap": "~0.0.2" - } - }, - "wordwrap": { - "version": "0.0.3", - "resolved": "https://registry.npmjs.org/wordwrap/-/wordwrap-0.0.3.tgz", - "integrity": "sha1-o9XabNXAvAAI03I0u68b7WMFkQc=" - } - } -} diff --git a/docs/generated/reference/generate/config.yaml b/docs/generated/reference/generate/config.yaml deleted file mode 100644 index 03ce31d97..000000000 --- a/docs/generated/reference/generate/config.yaml +++ /dev/null @@ -1,26 +0,0 @@ -example_location: "examples" -api_groups: - - "Certmanager" - - "ACME" -resource_categories: -- name: "Certmanager" - include: "certmanager" - resources: - - name: "Certificate" - version: "v1alpha2" - group: "certmanager" - - name: "ClusterIssuer" - version: "v1alpha2" - group: "certmanager" - - name: "Issuer" - version: "v1alpha2" - group: "certmanager" -- name: "ACME" - include: "acme" - resources: - - name: "Order" - version: "v1alpha2" - group: "acme" - - name: "Challenge" - version: "v1alpha2" - group: "acme" diff --git a/docs/generated/reference/generate/go_openapi/BUILD.bazel b/docs/generated/reference/generate/go_openapi/BUILD.bazel deleted file mode 100644 index f8ff2e4e3..000000000 --- a/docs/generated/reference/generate/go_openapi/BUILD.bazel +++ /dev/null @@ -1,42 +0,0 @@ -# gazelle:exclude doc.go - -package(default_visibility = ["//visibility:public"]) - -load("//docs/generated/reference/generate/go_openapi:def.bzl", "openapi_library") - -openapi_library( - name = "go_default_library", - srcs = ["doc.go"], - dependency_targets = [ - "@io_k8s_api//core/v1:go_default_library", - "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library", - "@io_k8s_apimachinery//pkg/runtime:go_default_library", - "@io_k8s_apimachinery//pkg/version:go_default_library", - ], - go_prefix = "github.com/jetstack/cert-manager", - openapi_extra_targets = [ - "k8s.io/api/core/v1", - "k8s.io/apimachinery/pkg/apis/meta/v1", - "k8s.io/apimachinery/pkg/runtime", - "k8s.io/apimachinery/pkg/version", - ], - openapi_targets = [ - "pkg/apis/certmanager/v1alpha2", - "pkg/apis/acme/v1alpha2", - "pkg/apis/meta/v1", - ], - tags = ["docs"], -) - -filegroup( - name = "package-srcs", - srcs = glob(["**"]), - tags = ["automanaged"], - visibility = ["//visibility:private"], -) - -filegroup( - name = "all-srcs", - srcs = [":package-srcs"], - tags = ["automanaged"], -) diff --git a/docs/generated/reference/generate/go_openapi/def.bzl b/docs/generated/reference/generate/go_openapi/def.bzl deleted file mode 100644 index 5cba684f4..000000000 --- a/docs/generated/reference/generate/go_openapi/def.bzl +++ /dev/null @@ -1,50 +0,0 @@ -# Copyright 2019 The Jetstack cert-manager contributors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -load("@io_bazel_rules_go//go:def.bzl", "go_library") -load("@io_k8s_repo_infra//defs:go.bzl", "go_genrule") - -def openapi_library(name, tags, srcs, go_prefix, openapi_targets = [], openapi_extra_targets = [], dependency_targets = []): - deps = [ - "@com_github_go_openapi_spec//:go_default_library", - "@io_k8s_kube_openapi//pkg/common:go_default_library", - ] + ["//%s:go_default_library" % target for target in openapi_targets] + dependency_targets - go_library( - name = name, - srcs = srcs + [":zz_generated.openapi"], - importpath = go_prefix + "/docs/generated/reference/generate/go_openapi", - tags = tags, - deps = deps, - ) - go_genrule( - name = "zz_generated.openapi", - srcs = ["//hack/boilerplate:boilerplate.go.txt"], - outs = ["zz_generated.openapi.go"], - # In order for vendored dependencies to be imported correctly, - # the generator must run from the repo root inside the generated GOPATH. - # All of bazel's $(location)s are relative to the original working directory, however, - # so we must save it first. - cmd = " ".join([ - "$(location @io_k8s_kube_openapi//cmd/openapi-gen)", - "--v 1", - "--logtostderr", - "--go-header-file $(location //hack/boilerplate:boilerplate.go.txt)", - "--output-file-base zz_generated.openapi", - "--output-package " + go_prefix + "/docs/generated/reference/generate/go_openapi", - "--input-dirs " + ",".join([go_prefix + "/" + target for target in openapi_targets] + openapi_extra_targets), - "&& cp $$GOPATH/src/" + go_prefix + "/docs/generated/reference/generate/go_openapi/zz_generated.openapi.go $(location :zz_generated.openapi.go)", - ]), - go_deps = deps, - tools = ["@io_k8s_kube_openapi//cmd/openapi-gen"], - ) diff --git a/docs/generated/reference/generate/go_openapi/doc.go b/docs/generated/reference/generate/go_openapi/doc.go deleted file mode 100644 index 1b125fa36..000000000 --- a/docs/generated/reference/generate/go_openapi/doc.go +++ /dev/null @@ -1,18 +0,0 @@ -/* -Copyright 2019 The Jetstack cert-manager contributors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Package go_openapi describes OpenAPI type defintions for cert-manager APIs -package go_openapi diff --git a/docs/generated/reference/generate/json_swagger/BUILD.bazel b/docs/generated/reference/generate/json_swagger/BUILD.bazel deleted file mode 100644 index 0fda1193b..000000000 --- a/docs/generated/reference/generate/json_swagger/BUILD.bazel +++ /dev/null @@ -1,45 +0,0 @@ -load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library") - -filegroup( - name = "package-srcs", - srcs = glob(["**"]), - tags = ["automanaged"], - visibility = ["//visibility:private"], -) - -filegroup( - name = "all-srcs", - srcs = [":package-srcs"], - tags = ["automanaged"], - visibility = ["//visibility:public"], -) - -go_library( - name = "go_default_library", - srcs = ["main.go"], - importpath = "github.com/jetstack/cert-manager/docs/generated/reference/generate/json_swagger", - tags = ["manual"], - visibility = ["//visibility:private"], - deps = [ - "//docs/generated/reference/generate/go_openapi:go_default_library", - "@com_github_go_openapi_spec//:go_default_library", - "@io_k8s_kube_openapi//pkg/common:go_default_library", - ], -) - -go_binary( - name = "generator", - embed = [":go_default_library"], - tags = ["manual"], - visibility = ["//visibility:private"], -) - -genrule( - name = "swagger", - outs = ["swagger.json"], - cmd = "; ".join([ - "$(locations //docs/generated/reference/generate/json_swagger:generator) > $@", - ]), - tools = [":generator"], - visibility = ["//visibility:public"], -) diff --git a/docs/generated/reference/generate/json_swagger/main.go b/docs/generated/reference/generate/json_swagger/main.go deleted file mode 100644 index 58eb87b8e..000000000 --- a/docs/generated/reference/generate/json_swagger/main.go +++ /dev/null @@ -1,54 +0,0 @@ -/* -Copyright 2019 The Jetstack cert-manager contributors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package main - -import ( - "encoding/json" - "fmt" - "log" - "os" - "strings" - - "github.com/go-openapi/spec" - "k8s.io/kube-openapi/pkg/common" - - openapi "github.com/jetstack/cert-manager/docs/generated/reference/generate/go_openapi" -) - -func main() { - WriteOpenAPI(openapi.GetOpenAPIDefinitions) -} - -// WriteOpenAPI writes the openapi json to docs/reference/openapi-spec/swagger.json -func WriteOpenAPI(openapi func(ref common.ReferenceCallback) map[string]common.OpenAPIDefinition) { - defs := openapi(func(name string) spec.Ref { - parts := strings.Split(name, "/") - return spec.MustCreateRef(fmt.Sprintf("#/definitions/%s.%s", - common.EscapeJsonPointer(parts[len(parts)-2]), - common.EscapeJsonPointer(parts[len(parts)-1]))) - }) - - o, err := json.MarshalIndent(defs, "", " ") - if err != nil { - log.Fatalf("Could not Marshal JSON %v\n%v", err, defs) - } - - _, err = os.Stdout.Write(o) - if err != nil { - log.Fatalf("%v", err) - } -} diff --git a/docs/generated/reference/generate/static_includes/BUILD.bazel b/docs/generated/reference/generate/static_includes/BUILD.bazel deleted file mode 100644 index 6df04e38c..000000000 --- a/docs/generated/reference/generate/static_includes/BUILD.bazel +++ /dev/null @@ -1,13 +0,0 @@ -filegroup( - name = "package-srcs", - srcs = glob(["**"]), - tags = ["automanaged"], - visibility = ["//visibility:private"], -) - -filegroup( - name = "all-srcs", - srcs = [":package-srcs"], - tags = ["automanaged"], - visibility = ["//visibility:public"], -) diff --git a/docs/generated/reference/generate/static_includes/_certmanager.md b/docs/generated/reference/generate/static_includes/_certmanager.md deleted file mode 100644 index 5bc0cc8e5..000000000 --- a/docs/generated/reference/generate/static_includes/_certmanager.md +++ /dev/null @@ -1,9 +0,0 @@ - -# cert-manager - ------------- - -This page contains reference documentation for cert-manager API types. - -For full documentation on how to use cert-manager, please view our -[official documentation](https://docs.cert-manager.io/). diff --git a/docs/generated/reference/generate/static_includes/_definitions.md b/docs/generated/reference/generate/static_includes/_definitions.md deleted file mode 100644 index 091e5a53d..000000000 --- a/docs/generated/reference/generate/static_includes/_definitions.md +++ /dev/null @@ -1,5 +0,0 @@ - -# Field Definitions - ------------- - diff --git a/docs/generated/reference/generate/static_includes/_oldversions.md b/docs/generated/reference/generate/static_includes/_oldversions.md deleted file mode 100644 index 5b434aeaf..000000000 --- a/docs/generated/reference/generate/static_includes/_oldversions.md +++ /dev/null @@ -1,5 +0,0 @@ - -# Old API Versions - ------------- - diff --git a/docs/generated/reference/generate/static_includes/_overview.md b/docs/generated/reference/generate/static_includes/_overview.md deleted file mode 100644 index e2584e964..000000000 --- a/docs/generated/reference/generate/static_includes/_overview.md +++ /dev/null @@ -1,6 +0,0 @@ - -# Overview - ------------- - -Some kind of overview here \ No newline at end of file diff --git a/docs/generated/reference/output/reference/api-docs/actions.js b/docs/generated/reference/output/reference/api-docs/actions.js deleted file mode 100644 index ce2b504b9..000000000 --- a/docs/generated/reference/output/reference/api-docs/actions.js +++ /dev/null @@ -1,58 +0,0 @@ -// https://jsfiddle.net/upqwhou2/ - -$(document).ready(function() { - var navigationLinks = $('#sidebar-wrapper > ul li a'); - var navigationSections = $('#sidebar-wrapper > ul > ul'); - var sectionIdTonavigationLink = {}; - var sections = $('#page-content-wrapper').find('h1, h2').map(function(index, node) { - if (node.id) { - sectionIdTonavigationLink[node.id] = $('#sidebar-wrapper > ul li a[href="#' + node.id + '"]'); - return node; - } - }); - var sectionIdToNavContainerLink = {}; - var topLevelSections = $('#page-content-wrapper').find('h1').map(function(index, node) { - if (node.id) { - sectionIdToNavContainerLink[node.id] = $('#sidebar-wrapper > ul > ul[id="' + node.id + '-nav' +'"]'); - return node; - } - }); - - var firstLevelNavs = $('#sidebar-wrapper > li'); - var secondLevelNavs = $('#sidebar-wrapper > ul > ul'); - var secondLevelNavContents = $('#sidebar-wrapper > ul > ul > li'); - var thirdLevelNavs = null; // TODO: When compile provides 3 level nav, implement - - var sectionsReversed = $(sections.get().reverse()); - - function checkScroll(event) { - var scrollPosition = $(window).scrollTop(); - var offset = 50; - scrollPosition += offset; - sections.each(function() { - var currentSection = $(this); - var sectionTop = $(this).offset().top; - var id = $(this).attr('id'); - if (scrollPosition >= sectionTop) { - navigationLinks.removeClass('selected'); - sectionIdTonavigationLink[id].addClass('selected'); - var sectionNavContainer = sectionIdToNavContainerLink[id]; - var sectionNavContainerDisplay; - if (sectionNavContainer) { - sectionNavContainerDisplay = sectionNavContainer.css('display'); - } - if (sectionNavContainer && sectionNavContainerDisplay === 'none') { - navigationSections.toggle(false); - sectionNavContainer.toggle(true); - } - } - if (($(this).offset().top < window.pageYOffset + 50) && $(this).offset().top + $(this).height() > window.pageYOffset) { - window.location.hash = id; - } - }); - } - checkScroll(); - $(window).on('scroll', function(event) { - checkScroll(event); - }); -}); \ No newline at end of file diff --git a/docs/generated/reference/output/reference/api-docs/index.html b/docs/generated/reference/output/reference/api-docs/index.html deleted file mode 100755 index e68d6d8a3..000000000 --- a/docs/generated/reference/output/reference/api-docs/index.html +++ /dev/null @@ -1,2879 +0,0 @@ - - - - -Cert-manager API Reference - - - - - - - - - -
-
    -

    cert-manager

    -
    -

    This page contains reference documentation for cert-manager API types.

    -

    For full documentation on how to use cert-manager, please view our -official documentation.

    -
    -

    Certificate v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    certmanagerv1alpha2Certificate
    -

    Certificate is a type to represent a Certificate from ACME

    - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    apiVersion
    string    		APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string    		Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    *ObjectMeta*
    spec
    *CertificateSpec*
    status
    *CertificateStatus*
    -

    CertificateSpec v1alpha2

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    commonName
    string    		CommonName is a common name to be used on the Certificate. The CommonName should have a length of 64 characters or fewer to avoid generating invalid CSRs.
    dnsNames
    string array    		DNSNames is a list of subject alt names to be used on the Certificate.
    duration
    *Duration*    		Certificate default Duration
    ipAddresses
    string array    		IPAddresses is a list of IP addresses to be used on the Certificate
    isCA
    boolean    		IsCA will mark this Certificate as valid for signing. This implies that the 'cert sign' usage is set
    issuerRef
    *ObjectReference*    		IssuerRef is a reference to the issuer for this certificate. If the 'kind' field is not set, or set to 'Issuer', an Issuer resource with the given name in the same namespace as the Certificate will be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer with the provided name will be used. The 'name' field in this stanza is required at all times.
    keyAlgorithm
    string    		KeyAlgorithm is the private key algorithm of the corresponding private key for this certificate. If provided, allowed values are either "rsa" or "ecdsa" If KeyAlgorithm is specified and KeySize is not provided, key size of 256 will be used for "ecdsa" key algorithm and key size of 2048 will be used for "rsa" key algorithm.
    keyEncoding
    string    		KeyEncoding is the private key cryptography standards (PKCS) for this certificate's private key to be encoded in. If provided, allowed values are "pkcs1" and "pkcs8" standing for PKCS#1 and PKCS#8, respectively. If KeyEncoding is not specified, then PKCS#1 will be used by default.
    keySize
    integer    		KeySize is the key bit size of the corresponding private key for this certificate. If provided, value must be between 2048 and 8192 inclusive when KeyAlgorithm is empty or is set to "rsa", and value must be one of (256, 384, 521) when KeyAlgorithm is set to "ecdsa".
    organization
    string array    		Organization is the organization to be used on the Certificate
    renewBefore
    *Duration*    		Certificate renew before expiration duration
    secretName
    string    		SecretName is the name of the secret resource to store this secret in
    uriSANs
    string array    		URISANs is a list of URI Subject Alternative Names to be set on this Certificate.
    usages
    string array    		Usages is the set of x509 actions that are enabled for a given key. Defaults are ('digital signature', 'key encipherment') if empty
    -

    CertificateStatus v1alpha2

    - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    conditions
    *CertificateCondition array*
    lastFailureTime
    *Time*
    notAfter
    *Time*    		The expiration time of the certificate stored in the secret named by this resource in spec.secretName.
    -
    -

    ClusterIssuer v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    certmanagerv1alpha2ClusterIssuer
    - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    apiVersion
    string    		APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string    		Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    *ObjectMeta*
    spec
    *IssuerSpec*
    status
    *IssuerStatus*
    -
    -

    Issuer v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    certmanagerv1alpha2Issuer
    - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    apiVersion
    string    		APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string    		Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    *ObjectMeta*
    spec
    *IssuerSpec*
    status
    *IssuerStatus*
    -

    IssuerSpec v1alpha2

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    acme
    *ACMEIssuer*
    ca
    *CAIssuer*
    selfSigned
    *SelfSignedIssuer*
    vault
    *VaultIssuer*
    venafi
    *VenafiIssuer*
    -

    IssuerStatus v1alpha2

    - - - - - - - - - - - - - - - - - -
    FieldDescription
    acme
    *ACMEIssuerStatus*
    conditions
    *IssuerCondition array*
    -

    Acme

    -
    -
    -

    Order v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2Order
    -

    Order is a type to represent an Order with an ACME server

    - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    apiVersion
    string    		APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string    		Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    *ObjectMeta*
    spec
    *OrderSpec*
    status
    *OrderStatus*
    -

    OrderSpec v1alpha2

    - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    commonName
    string    		CommonName is the common name as specified on the DER encoded CSR. If CommonName is not specified, the first DNSName specified will be used as the CommonName. At least one of CommonName or a DNSNames must be set. This field must match the corresponding field on the DER encoded CSR.
    csr
    string    		Certificate signing request bytes in DER encoding. This will be used when finalizing the order. This field must be set on the order.
    dnsNames
    string array    		DNSNames is a list of DNS names that should be included as part of the Order validation process. If CommonName is not specified, the first DNSName specified will be used as the CommonName. At least one of CommonName or a DNSNames must be set. This field must match the corresponding field on the DER encoded CSR.
    issuerRef
    *ObjectReference*    		IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Order will be marked as failed.
    -

    OrderStatus v1alpha2

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    authorizations
    *ACMEAuthorization array*    		Authorizations contains data returned from the ACME server on what authoriations must be completed in order to validate the DNS names specified on the Order.
    certificate
    string    		Certificate is a copy of the PEM encoded certificate for this Order. This field will be populated after the order has been successfully finalized with the ACME server, and the order has transitioned to the 'valid' state.
    failureTime
    *Time*    		FailureTime stores the time that this order failed. This is used to influence garbage collection and back-off.
    finalizeURL
    string    		FinalizeURL of the Order. This is used to obtain certificates for this order once it has been completed.
    reason
    string    		Reason optionally provides more information about a why the order is in the current state.
    state
    string    		State contains the current state of this Order resource. States 'success' and 'expired' are 'final'
    url
    string    		URL of the Order. This will initially be empty when the resource is first created. The Order controller will populate this field when the Order is first processed. This field will be immutable after it is initially set.
    -
    -

    Challenge v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2Challenge
    -

    Challenge is a type to represent a Challenge request with an ACME server

    - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    apiVersion
    string    		APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string    		Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    *ObjectMeta*
    spec
    *ChallengeSpec*
    status
    *ChallengeStatus*
    -

    ChallengeSpec v1alpha2

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    authzURL
    string    		AuthzURL is the URL to the ACME Authorization resource that this challenge is a part of.
    dnsName
    string    		DNSName is the identifier that this challenge is for, e.g. example.com.
    issuerRef
    *ObjectReference*    		IssuerRef references a properly configured ACME-type Issuer which should be used to create this Challenge. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Challenge will be marked as failed.
    key
    string    		Key is the ACME challenge key for this challenge
    solver
    *ACMEChallengeSolver*    		Solver contains the domain solving configuration that should be used to solve this challenge resource.
    token
    string    		Token is the ACME challenge token for this challenge.
    type
    string    		Type is the type of ACME challenge this resource represents, e.g. "dns01" or "http01"
    url
    string    		URL is the URL of the ACME Challenge resource for this challenge. This can be used to lookup details about the status of this challenge.
    wildcard
    boolean    		Wildcard will be true if this challenge is for a wildcard identifier, for example '*.example.com'
    -

    ChallengeStatus v1alpha2

    - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    presented
    boolean    		Presented will be set to true if the challenge values for this challenge are currently 'presented'. This does not imply the self check is passing. Only that the values have been 'submitted' for the appropriate challenge mechanism (i.e. the DNS01 TXT record has been presented, or the HTTP01 configuration has been configured).
    processing
    boolean    		Processing is used to denote whether this challenge should be processed or not. This field will only be set to true by the 'scheduling' component. It will only be set to false by the 'challenges' controller, after the challenge has reached a final state or timed out. If this field is set to false, the challenge controller will not take any more action.
    reason
    string    		Reason contains human readable information on why the Challenge is in the current state.
    state
    string    		State contains the current 'state' of the challenge. If not set, the state of the challenge is unknown.
    -

    Old API Versions

    -
    -

    Field Definitions

    -
    -

    ACMEAuthorization v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2ACMEAuthorization
    -

    ACMEAuthorization contains data returned from the ACME server on an authorization that must be completed in order validate a DNS name on an ACME Order resource.

    - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    challenges
    *ACMEChallenge array*    		Challenges specifies the challenge types offered by the ACME server. One of these challenge types will be selected when validating the DNS name and an appropriate Challenge resource will be created to perform the ACME challenge process.
    identifier
    string    		Identifier is the DNS name to be validated as part of this authorization
    url
    string    		URL is the URL of the Authorization that must be completed
    wildcard
    boolean    		Wildcard will be true if this authorization is for a wildcard DNS name. If this is true, the identifier will be the non-wildcard version of the DNS name. For example, if '*.example.com' is the DNS name being validated, this field will be 'true' and the 'identifier' field will be 'example.com'.
    -

    ACMEChallenge v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2ACMEChallenge
    -

    Challenge specifies a challenge offered by the ACME server for an Order. An appropriate Challenge resource can be created to perform the ACME challenge process.

    - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    token
    string    		Token is the token that must be presented for this challenge. This is used to compute the 'key' that must also be presented.
    type
    string    		Type is the type of challenge being offered, e.g. http-01, dns-01
    url
    string    		URL is the URL of this challenge. It can be used to retrieve additional metadata about the Challenge from the ACME server.
    -

    ACMEChallengeSolver v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2ACMEChallengeSolver
    - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    dns01
    *ACMEChallengeSolverDNS01*
    http01
    *ACMEChallengeSolverHTTP01*
    selector
    *CertificateDNSNameSelector*    		Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver.
    -

    ACMEChallengeSolverDNS01 v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2ACMEChallengeSolverDNS01
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    acmedns
    *ACMEIssuerDNS01ProviderAcmeDNS*
    akamai
    *ACMEIssuerDNS01ProviderAkamai*
    azuredns
    *ACMEIssuerDNS01ProviderAzureDNS*
    clouddns
    *ACMEIssuerDNS01ProviderCloudDNS*
    cloudflare
    *ACMEIssuerDNS01ProviderCloudflare*
    cnameStrategy
    string    		CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones.
    digitalocean
    *ACMEIssuerDNS01ProviderDigitalOcean*
    rfc2136
    *ACMEIssuerDNS01ProviderRFC2136*
    route53
    *ACMEIssuerDNS01ProviderRoute53*
    webhook
    *ACMEIssuerDNS01ProviderWebhook*
    -

    ACMEChallengeSolverHTTP01 v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2ACMEChallengeSolverHTTP01
    -

    ACMEChallengeSolverHTTP01 contains configuration detailing how to solve HTTP01 challenges within a Kubernetes cluster. Typically this is accomplished through creating 'routes' of some description that configure ingress controllers to direct traffic to 'solver pods', which are responsible for responding to the ACME server's HTTP requests.

    - - - - - - - - - - - - - -
    FieldDescription
    ingress
    *ACMEChallengeSolverHTTP01Ingress*    		The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed.
    -

    ACMEChallengeSolverHTTP01Ingress v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2ACMEChallengeSolverHTTP01Ingress
    - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    class
    string    		The ingress class to use when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of 'class' or 'name' may be specified.
    name
    string    		The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources.
    podTemplate
    *ACMEChallengeSolverHTTP01IngressPodTemplate*    		Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges
    serviceType
    string    		Optional service type for Kubernetes solver service
    -

    ACMEChallengeSolverHTTP01IngressPodSpec v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2ACMEChallengeSolverHTTP01IngressPodSpec
    - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    affinity
    *Affinity*    		If specified, the pod's scheduling constraints
    nodeSelector
    object    		NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
    tolerations
    *Toleration array*    		If specified, the pod's tolerations.
    -

    ACMEChallengeSolverHTTP01IngressPodTemplate v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2ACMEChallengeSolverHTTP01IngressPodTemplate
    - - - - - - - - - - - - - - - - - -
    FieldDescription
    metadata
    *ObjectMeta*    		ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values.
    spec
    *ACMEChallengeSolverHTTP01IngressPodSpec*    		PodSpec defines overrides for the HTTP01 challenge solver pod. Only the 'nodeSelector', 'affinity' and 'tolerations' fields are supported currently. All other fields will be ignored.
    -

    ACMEIssuer v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2ACMEIssuer
    -

    ACMEIssuer contains the specification for an ACME issuer

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    email
    string    		Email is the email for this account
    privateKeySecretRef
    *SecretKeySelector*    		PrivateKey is the name of a secret containing the private key for this user account.
    server
    string    		Server is the ACME server URL
    skipTLSVerify
    boolean    		If true, skip verifying the ACME server TLS certificate
    solvers
    *ACMEChallengeSolver array*    		Solvers is a list of challenge solvers that will be used to solve ACME challenges for the matching domains.
    -

    ACMEIssuerDNS01ProviderAcmeDNS v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2ACMEIssuerDNS01ProviderAcmeDNS
    -

    ACMEIssuerDNS01ProviderAcmeDNS is a structure containing the configuration for ACME-DNS servers

    - - - - - - - - - - - - - - - - - -
    FieldDescription
    accountSecretRef
    *SecretKeySelector*
    host
    string
    -

    ACMEIssuerDNS01ProviderAkamai v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2ACMEIssuerDNS01ProviderAkamai
    -

    ACMEIssuerDNS01ProviderAkamai is a structure containing the DNS configuration for Akamai DNS—Zone Record Management API

    - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    accessTokenSecretRef
    *SecretKeySelector*
    clientSecretSecretRef
    *SecretKeySelector*
    clientTokenSecretRef
    *SecretKeySelector*
    serviceConsumerDomain
    string
    -

    ACMEIssuerDNS01ProviderAzureDNS v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2ACMEIssuerDNS01ProviderAzureDNS
    -

    ACMEIssuerDNS01ProviderAzureDNS is a structure containing the configuration for Azure DNS

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    clientID
    string
    clientSecretSecretRef
    *SecretKeySelector*
    environment
    string
    hostedZoneName
    string
    resourceGroupName
    string
    subscriptionID
    string
    tenantID
    string
    -

    ACMEIssuerDNS01ProviderCloudDNS v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2ACMEIssuerDNS01ProviderCloudDNS
    -

    ACMEIssuerDNS01ProviderCloudDNS is a structure containing the DNS configuration for Google Cloud DNS

    - - - - - - - - - - - - - - - - - -
    FieldDescription
    project
    string
    serviceAccountSecretRef
    *SecretKeySelector*
    -

    ACMEIssuerDNS01ProviderCloudflare v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2ACMEIssuerDNS01ProviderCloudflare
    -

    ACMEIssuerDNS01ProviderCloudflare is a structure containing the DNS configuration for Cloudflare

    - - - - - - - - - - - - - - - - - -
    FieldDescription
    apiKeySecretRef
    *SecretKeySelector*
    email
    string
    -

    ACMEIssuerDNS01ProviderDigitalOcean v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2ACMEIssuerDNS01ProviderDigitalOcean
    -

    ACMEIssuerDNS01ProviderDigitalOcean is a structure containing the DNS configuration for DigitalOcean Domains

    - - - - - - - - - - - - - -
    FieldDescription
    tokenSecretRef
    *SecretKeySelector*
    -

    ACMEIssuerDNS01ProviderRFC2136 v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2ACMEIssuerDNS01ProviderRFC2136
    -

    ACMEIssuerDNS01ProviderRFC2136 is a structure containing the configuration for RFC2136 DNS

    - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    nameserver
    string    		The IP address of the DNS supporting RFC2136. Required. Note: FQDN is not a valid value, only IP.
    tsigAlgorithm
    string    		The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when tsigSecretSecretRef and tsigKeyName are defined. Supported values are (case-insensitive): HMACMD5 (default), HMACSHA1, HMACSHA256 or HMACSHA512.
    tsigKeyName
    string    		The TSIG Key name configured in the DNS. If tsigSecretSecretRef is defined, this field is required.
    tsigSecretSecretRef
    *SecretKeySelector*    		The name of the secret containing the TSIG value. If tsigKeyName is defined, this field is required.
    -

    ACMEIssuerDNS01ProviderRoute53 v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2ACMEIssuerDNS01ProviderRoute53
    -

    ACMEIssuerDNS01ProviderRoute53 is a structure containing the Route 53 configuration for AWS

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    accessKeyID
    string    		The AccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
    hostedZoneID
    string    		If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call.
    region
    string    		Always set the region when using AccessKeyID and SecretAccessKey
    role
    string    		Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
    secretAccessKeySecretRef
    *SecretKeySelector*    		The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
    -

    ACMEIssuerDNS01ProviderWebhook v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2ACMEIssuerDNS01ProviderWebhook
    -

    ACMEIssuerDNS01ProviderWebhook specifies configuration for a webhook DNS01 provider, including where to POST ChallengePayload resources.

    - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    config
    JSON    		Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation.
    groupName
    string    		The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation.
    solverName
    string    		The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'.
    -

    Affinity v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    corev1Affinity
    -

    Affinity is a group of affinity scheduling rules.

    - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    nodeAffinity
    *NodeAffinity*    		Describes node affinity scheduling rules for the pod.
    podAffinity
    *PodAffinity*    		Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
    podAntiAffinity
    *PodAntiAffinity*    		Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
    -

    CAIssuer v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    certmanagerv1alpha2CAIssuer
    - - - - - - - - - - - - - -
    FieldDescription
    secretName
    string    		SecretName is the name of the secret used to sign Certificates issued by this Issuer.
    -

    CertificateCondition v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    certmanagerv1alpha2CertificateCondition
    -

    CertificateCondition contains condition information for an Certificate.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    lastTransitionTime
    *Time*    		LastTransitionTime is the timestamp corresponding to the last status change of this condition.
    message
    string    		Message is a human readable description of the details of the last transition, complementing reason.
    reason
    string    		Reason is a brief machine readable explanation for the condition's last transition.
    status
    string    		Status of the condition, one of ('True', 'False', 'Unknown').
    type
    string    		Type of the condition, currently ('Ready').
    -

    CertificateDNSNameSelector v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    acmev1alpha2CertificateDNSNameSelector
    -

    CertificateDomainSelector selects certificates using a label selector, and can optionally select individual DNS names within those certificates. If both MatchLabels and DNSNames are empty, this selector will match all certificates and DNS names within them.

    - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    dnsNames
    string array    		List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected.
    dnsZones
    string array    		List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected.
    matchLabels
    object    		A label selector that is used to refine the set of certificate's that this challenge solver will apply to.
    -

    Duration v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    metav1Duration
    -

    Duration is a wrapper around time.Duration which supports correct marshaling to YAML and JSON. In particular, it marshals into strings, which can be used as map keys in json.

    - - - - - - - - - -
    FieldDescription
    -

    FieldsV1 v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    metav1FieldsV1
    -

    FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.

    -

    Each key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:<name>', where <name> is the name of a field in a struct, or key in a map 'v:<value>', where <value> is the exact json formatted value of a list item 'i:<index>', where <index> is position of a item in a list 'k:<keys>', where <keys> is a map of a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.

    -

    The exact format is defined in sigs.k8s.io/structured-merge-diff

    - - - - - - - - - -
    FieldDescription
    -

    IssuerCondition v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    certmanagerv1alpha2IssuerCondition
    -

    IssuerCondition contains condition information for an Issuer.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    lastTransitionTime
    *Time*    		LastTransitionTime is the timestamp corresponding to the last status change of this condition.
    message
    string    		Message is a human readable description of the details of the last transition, complementing reason.
    reason
    string    		Reason is a brief machine readable explanation for the condition's last transition.
    status
    string    		Status of the condition, one of ('True', 'False', 'Unknown').
    type
    string    		Type of the condition, currently ('Ready').
    -

    LabelSelector v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    metav1LabelSelector
    -

    A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.

    - - - - - - - - - - - - - - - - - -
    FieldDescription
    matchExpressions
    *LabelSelectorRequirement array*    		matchExpressions is a list of label selector requirements. The requirements are ANDed.
    matchLabels
    object    		matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
    -

    LabelSelectorRequirement v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    metav1LabelSelectorRequirement
    -

    A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

    - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    key
    string
    patch type: merge
    patch merge key: key    		key is the label key that the selector applies to.
    operator
    string    		operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
    values
    string array    		values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
    -

    LocalObjectReference v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    metav1LocalObjectReference
    - - - - - - - - - - - - - -
    FieldDescription
    name
    string    		Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    -

    ManagedFieldsEntry v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    metav1ManagedFieldsEntry
    -

    ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    apiVersion
    string    		APIVersion defines the version of this resource that this field set applies to. The format is "group/version" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.
    fieldsType
    string    		FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: "FieldsV1"
    fieldsV1
    *FieldsV1*    		FieldsV1 holds the first JSON version format as described in the "FieldsV1" type.
    manager
    string    		Manager is an identifier of the workflow managing these fields.
    operation
    string    		Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.
    time
    *Time*    		Time is timestamp of when these fields were set. It should always be empty if Operation is 'Apply'
    -

    NodeAffinity v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    corev1NodeAffinity
    -

    Node affinity is a group of node affinity scheduling rules.

    - - - - - - - - - - - - - - - - - -
    FieldDescription
    preferredDuringSchedulingIgnoredDuringExecution
    *PreferredSchedulingTerm array*    		The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.
    requiredDuringSchedulingIgnoredDuringExecution
    *NodeSelector*    		If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.
    -

    NodeSelector v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    corev1NodeSelector
    -

    A node selector represents the union of the results of one or more label queries over a set of nodes; that is, it represents the OR of the selectors represented by the node selector terms.

    - - - - - - - - - - - - - -
    FieldDescription
    nodeSelectorTerms
    *NodeSelectorTerm array*    		Required. A list of node selector terms. The terms are ORed.
    -

    NodeSelectorRequirement v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    corev1NodeSelectorRequirement
    -

    A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

    - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    key
    string    		The label key that the selector applies to.
    operator
    string    		Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
    values
    string array    		An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
    -

    NodeSelectorTerm v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    corev1NodeSelectorTerm
    -

    A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.

    - - - - - - - - - - - - - - - - - -
    FieldDescription
    matchExpressions
    *NodeSelectorRequirement array*    		A list of node selector requirements by node's labels.
    matchFields
    *NodeSelectorRequirement array*    		A list of node selector requirements by node's fields.
    -

    ObjectMeta v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    metav1ObjectMeta
    -

    ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    annotations
    object    		Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations
    clusterName
    string    		The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.
    creationTimestamp
    *Time*    		CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    deletionGracePeriodSeconds
    integer    		Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.
    deletionTimestamp
    *Time*    		DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested. Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    finalizers
    string array
    patch type: merge    		Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed.
    generateName
    string    		GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server. If this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header). Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency
    generation
    integer    		A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.
    labels
    object    		Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels
    managedFields
    *ManagedFieldsEntry array*    		ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object.
    name
    string    		Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names
    namespace
    string    		Namespace defines the space within each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. Must be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces
    ownerReferences
    *OwnerReference array*
    patch type: merge
    patch merge key: uid    		List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.
    resourceVersion
    string    		An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources. Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
    selfLink
    string    		SelfLink is a URL representing this object. Populated by the system. Read-only. DEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release.
    uid
    string    		UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids
    -

    ObjectReference v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    metav1ObjectReference
    -

    ObjectReference is a reference to an object with a given name, kind and group.

    - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    group
    string
    kind
    string
    name
    string
    -

    OwnerReference v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    metav1OwnerReference
    -

    OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    apiVersion
    string    		API version of the referent.
    blockOwnerDeletion
    boolean    		If true, AND if the owner has the "foregroundDeletion" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. Defaults to false. To set this field, a user needs "delete" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.
    controller
    boolean    		If true, this reference points to the managing controller.
    kind
    string    		Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    name
    string    		Name of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#names
    uid
    string    		UID of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#uids
    -

    PodAffinity v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    corev1PodAffinity
    -

    Pod affinity is a group of inter pod affinity scheduling rules.

    - - - - - - - - - - - - - - - - - -
    FieldDescription
    preferredDuringSchedulingIgnoredDuringExecution
    *WeightedPodAffinityTerm array*    		The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
    requiredDuringSchedulingIgnoredDuringExecution
    *PodAffinityTerm array*    		If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
    -

    PodAffinityTerm v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    corev1PodAffinityTerm
    -

    Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key <topologyKey> matches that of any node on which a pod of the set of pods is running

    - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    labelSelector
    *LabelSelector*    		A label query over a set of resources, in this case pods.
    namespaces
    string array    		namespaces specifies which namespaces the labelSelector applies to (matches against); null or empty list means "this pod's namespace"
    topologyKey
    string    		This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
    -

    PodAntiAffinity v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    corev1PodAntiAffinity
    -

    Pod anti affinity is a group of inter pod anti affinity scheduling rules.

    - - - - - - - - - - - - - - - - - -
    FieldDescription
    preferredDuringSchedulingIgnoredDuringExecution
    *WeightedPodAffinityTerm array*    		The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
    requiredDuringSchedulingIgnoredDuringExecution
    *PodAffinityTerm array*    		If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
    -

    PreferredSchedulingTerm v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    corev1PreferredSchedulingTerm
    -

    An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).

    - - - - - - - - - - - - - - - - - -
    FieldDescription
    preference
    *NodeSelectorTerm*    		A node selector term, associated with the corresponding weight.
    weight
    integer    		Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
    -

    SecretKeySelector v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    metav1SecretKeySelector
    - - - - - - - - - - - - - - - - - -
    FieldDescription
    key
    string    		The key of the secret to select from. Must be a valid secret key.
    name
    string    		Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    -

    SelfSignedIssuer v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    certmanagerv1alpha2SelfSignedIssuer
    - - - - - - - - - -
    FieldDescription
    -

    Time v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    metav1Time
    -

    Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.

    - - - - - - - - - -
    FieldDescription
    -

    Toleration v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    corev1Toleration
    -

    The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator <operator>.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    effect
    string    		Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
    key
    string    		Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.
    operator
    string    		Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category.
    tolerationSeconds
    integer    		TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system.
    value
    string    		Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.
    -

    VaultAppRole v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    certmanagerv1alpha2VaultAppRole
    - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    path
    string    		Where the authentication path is mounted in Vault.
    roleId
    string
    secretRef
    *SecretKeySelector*
    -

    VaultAuth v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    certmanagerv1alpha2VaultAuth
    -

    Vault authentication can be configured: - With a secret containing a token. Cert-manager is using this token as-is. - With a secret containing a AppRole. This AppRole is used to authenticate to - Vault and retrieve a token.

    - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    appRole
    *VaultAppRole*    		This Secret contains a AppRole and Secret
    kubernetes
    *VaultKubernetesAuth*    		This contains a Role and Secret with a ServiceAccount token to authenticate with vault.
    tokenSecretRef
    *SecretKeySelector*    		This Secret contains the Vault token key
    -

    VaultIssuer v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    certmanagerv1alpha2VaultIssuer
    - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    auth
    *VaultAuth*    		Vault authentication
    caBundle
    string    		Base64 encoded CA bundle to validate Vault server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection.
    path
    string    		Vault URL path to the certificate role
    server
    string    		Server is the vault connection address
    -

    VaultKubernetesAuth v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    certmanagerv1alpha2VaultKubernetesAuth
    -

    Authenticate against Vault using a Kubernetes ServiceAccount token stored in a Secret.

    - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    mountPath
    string    		The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to /v1/auth/foo, will use the path /v1/auth/foo/login to authenticate with Vault. If unspecified, the default value "/v1/auth/kubernetes" will be used.
    role
    string    		A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies.
    secretRef
    *SecretKeySelector*    		The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported.
    -

    VenafiCloud v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    certmanagerv1alpha2VenafiCloud
    -

    VenafiCloud defines connection configuration details for Venafi Cloud

    - - - - - - - - - - - - - - - - - -
    FieldDescription
    apiTokenSecretRef
    *SecretKeySelector*    		APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
    url
    string    		URL is the base URL for Venafi Cloud
    -

    VenafiIssuer v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    certmanagerv1alpha2VenafiIssuer
    -

    VenafiIssuer describes issuer configuration details for Venafi Cloud.

    - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    cloud
    *VenafiCloud*    		Cloud specifies the Venafi cloud configuration settings. Only one of TPP or Cloud may be specified.
    tpp
    *VenafiTPP*    		TPP specifies Trust Protection Platform configuration settings. Only one of TPP or Cloud may be specified.
    zone
    string    		Zone is the Venafi Policy Zone to use for this issuer. All requests made to the Venafi platform will be restricted by the named zone policy. This field is required.
    -

    VenafiTPP v1alpha2

    - - - - - - - - - - - - - -
    GroupVersionKind
    certmanagerv1alpha2VenafiTPP
    -

    VenafiTPP defines connection configuration details for a Venafi TPP instance

    - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    caBundle
    string    		CABundle is a PEM encoded TLS certifiate to use to verify connections to the TPP instance. If specified, system roots will not be used and the issuing CA for the TPP instance must be verifiable using the provided root. If not specified, the connection will be verified using the cert-manager system root certificates.
    credentialsRef
    *LocalObjectReference*    		CredentialsRef is a reference to a Secret containing the username and password for the TPP server. The secret must contain two keys, 'username' and 'password'.
    url
    string    		URL is the base URL for the Venafi TPP instance
    -

    WeightedPodAffinityTerm v1

    - - - - - - - - - - - - - -
    GroupVersionKind
    corev1WeightedPodAffinityTerm
    -

    The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

    - - - - - - - - - - - - - - - - - -
    FieldDescription
    podAffinityTerm
    *PodAffinityTerm*    		Required. A pod affinity term, associated with the corresponding weight.
    weight
    integer    		weight associated with matching the corresponding podAffinityTerm, in the range 1-100.
    -
    -
    - - - - - - - - \ No newline at end of file diff --git a/docs/generated/reference/output/reference/api-docs/navData.js b/docs/generated/reference/output/reference/api-docs/navData.js deleted file mode 100755 index 53510e575..000000000 --- a/docs/generated/reference/output/reference/api-docs/navData.js +++ /dev/null @@ -1 +0,0 @@ -(function(){navData = {"toc":[{"section":"-strong-field-definitions-strong-","subsections":[{"section":"weightedpodaffinityterm-v1"},{"section":"venafitpp-v1alpha2"},{"section":"venafiissuer-v1alpha2"},{"section":"venaficloud-v1alpha2"},{"section":"vaultkubernetesauth-v1alpha2"},{"section":"vaultissuer-v1alpha2"},{"section":"vaultauth-v1alpha2"},{"section":"vaultapprole-v1alpha2"},{"section":"toleration-v1"},{"section":"time-v1"},{"section":"selfsignedissuer-v1alpha2"},{"section":"secretkeyselector-v1"},{"section":"preferredschedulingterm-v1"},{"section":"podantiaffinity-v1"},{"section":"podaffinityterm-v1"},{"section":"podaffinity-v1"},{"section":"ownerreference-v1"},{"section":"objectreference-v1"},{"section":"objectmeta-v1"},{"section":"nodeselectorterm-v1"},{"section":"nodeselectorrequirement-v1"},{"section":"nodeselector-v1"},{"section":"nodeaffinity-v1"},{"section":"managedfieldsentry-v1"},{"section":"localobjectreference-v1"},{"section":"labelselectorrequirement-v1"},{"section":"labelselector-v1"},{"section":"issuercondition-v1alpha2"},{"section":"fieldsv1-v1"},{"section":"duration-v1"},{"section":"certificatednsnameselector-v1alpha2"},{"section":"certificatecondition-v1alpha2"},{"section":"caissuer-v1alpha2"},{"section":"affinity-v1"},{"section":"acmeissuerdns01providerwebhook-v1alpha2"},{"section":"acmeissuerdns01providerroute53-v1alpha2"},{"section":"acmeissuerdns01providerrfc2136-v1alpha2"},{"section":"acmeissuerdns01providerdigitalocean-v1alpha2"},{"section":"acmeissuerdns01providercloudflare-v1alpha2"},{"section":"acmeissuerdns01providerclouddns-v1alpha2"},{"section":"acmeissuerdns01providerazuredns-v1alpha2"},{"section":"acmeissuerdns01providerakamai-v1alpha2"},{"section":"acmeissuerdns01provideracmedns-v1alpha2"},{"section":"acmeissuer-v1alpha2"},{"section":"acmechallengesolverhttp01ingresspodtemplate-v1alpha2"},{"section":"acmechallengesolverhttp01ingresspodspec-v1alpha2"},{"section":"acmechallengesolverhttp01ingress-v1alpha2"},{"section":"acmechallengesolverhttp01-v1alpha2"},{"section":"acmechallengesolverdns01-v1alpha2"},{"section":"acmechallengesolver-v1alpha2"},{"section":"acmechallenge-v1alpha2"},{"section":"acmeauthorization-v1alpha2"}]},{"section":"-strong-old-api-versions-strong-","subsections":[]},{"section":"challenge-v1alpha2","subsections":[]},{"section":"order-v1alpha2","subsections":[]},{"section":"-strong-acme-strong-","subsections":[]},{"section":"issuer-v1alpha2","subsections":[]},{"section":"clusterissuer-v1alpha2","subsections":[]},{"section":"certificate-v1alpha2","subsections":[]},{"section":"-strong-cert-manager-strong-","subsections":[]}],"flatToc":["weightedpodaffinityterm-v1","venafitpp-v1alpha2","venafiissuer-v1alpha2","venaficloud-v1alpha2","vaultkubernetesauth-v1alpha2","vaultissuer-v1alpha2","vaultauth-v1alpha2","vaultapprole-v1alpha2","toleration-v1","time-v1","selfsignedissuer-v1alpha2","secretkeyselector-v1","preferredschedulingterm-v1","podantiaffinity-v1","podaffinityterm-v1","podaffinity-v1","ownerreference-v1","objectreference-v1","objectmeta-v1","nodeselectorterm-v1","nodeselectorrequirement-v1","nodeselector-v1","nodeaffinity-v1","managedfieldsentry-v1","localobjectreference-v1","labelselectorrequirement-v1","labelselector-v1","issuercondition-v1alpha2","fieldsv1-v1","duration-v1","certificatednsnameselector-v1alpha2","certificatecondition-v1alpha2","caissuer-v1alpha2","affinity-v1","acmeissuerdns01providerwebhook-v1alpha2","acmeissuerdns01providerroute53-v1alpha2","acmeissuerdns01providerrfc2136-v1alpha2","acmeissuerdns01providerdigitalocean-v1alpha2","acmeissuerdns01providercloudflare-v1alpha2","acmeissuerdns01providerclouddns-v1alpha2","acmeissuerdns01providerazuredns-v1alpha2","acmeissuerdns01providerakamai-v1alpha2","acmeissuerdns01provideracmedns-v1alpha2","acmeissuer-v1alpha2","acmechallengesolverhttp01ingresspodtemplate-v1alpha2","acmechallengesolverhttp01ingresspodspec-v1alpha2","acmechallengesolverhttp01ingress-v1alpha2","acmechallengesolverhttp01-v1alpha2","acmechallengesolverdns01-v1alpha2","acmechallengesolver-v1alpha2","acmechallenge-v1alpha2","acmeauthorization-v1alpha2","-strong-field-definitions-strong-","-strong-old-api-versions-strong-","challenge-v1alpha2","order-v1alpha2","-strong-acme-strong-","issuer-v1alpha2","clusterissuer-v1alpha2","certificate-v1alpha2","-strong-cert-manager-strong-"]};})(); \ No newline at end of file diff --git a/docs/generated/reference/output/reference/api-docs/node_modules/bootstrap/dist/css/bootstrap.min.css b/docs/generated/reference/output/reference/api-docs/node_modules/bootstrap/dist/css/bootstrap.min.css deleted file mode 100644 index 5b96335ff..000000000 --- a/docs/generated/reference/output/reference/api-docs/node_modules/bootstrap/dist/css/bootstrap.min.css +++ /dev/null @@ -1,6 +0,0 @@ -/*! - * Bootstrap v3.4.1 (https://getbootstrap.com/) - * Copyright 2011-2019 Twitter, Inc. - * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) - *//*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:none;text-decoration:underline;-webkit-text-decoration:underline dotted;-moz-text-decoration:underline dotted;text-decoration:underline dotted}b,strong{font-weight:700}dfn{font-style:italic}h1{font-size:2em;margin:.67em 0}mark{background:#ff0;color:#000}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:1em 40px}hr{-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;height:0}pre{overflow:auto}code,kbd,pre,samp{font-family:monospace,monospace;font-size:1em}button,input,optgroup,select,textarea{color:inherit;font:inherit;margin:0}button{overflow:visible}button,select{text-transform:none}button,html input[type=button],input[type=reset],input[type=submit]{-webkit-appearance:button;cursor:pointer}button[disabled],html input[disabled]{cursor:default}button::-moz-focus-inner,input::-moz-focus-inner{border:0;padding:0}input{line-height:normal}input[type=checkbox],input[type=radio]{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box;padding:0}input[type=number]::-webkit-inner-spin-button,input[type=number]::-webkit-outer-spin-button{height:auto}input[type=search]{-webkit-appearance:textfield;-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box}input[type=search]::-webkit-search-cancel-button,input[type=search]::-webkit-search-decoration{-webkit-appearance:none}fieldset{border:1px solid silver;margin:0 2px;padding:.35em .625em .75em}legend{border:0;padding:0}textarea{overflow:auto}optgroup{font-weight:700}table{border-collapse:collapse;border-spacing:0}td,th{padding:0}/*! Source: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css */@media print{*,:after,:before{color:#000!important;text-shadow:none!important;background:0 0!important;-webkit-box-shadow:none!important;box-shadow:none!important}a,a:visited{text-decoration:underline}a[href]:after{content:" (" attr(href) ")"}abbr[title]:after{content:" (" attr(title) ")"}a[href^="#"]:after,a[href^="javascript:"]:after{content:""}blockquote,pre{border:1px solid #999;page-break-inside:avoid}thead{display:table-header-group}img,tr{page-break-inside:avoid}img{max-width:100%!important}h2,h3,p{orphans:3;widows:3}h2,h3{page-break-after:avoid}.navbar{display:none}.btn>.caret,.dropup>.btn>.caret{border-top-color:#000!important}.label{border:1px solid #000}.table{border-collapse:collapse!important}.table td,.table th{background-color:#fff!important}.table-bordered td,.table-bordered th{border:1px solid #ddd!important}}@font-face{font-family:"Glyphicons Halflings";src:url(../fonts/glyphicons-halflings-regular.eot);src:url(../fonts/glyphicons-halflings-regular.eot?#iefix) format("embedded-opentype"),url(../fonts/glyphicons-halflings-regular.woff2) format("woff2"),url(../fonts/glyphicons-halflings-regular.woff) format("woff"),url(../fonts/glyphicons-halflings-regular.ttf) format("truetype"),url(../fonts/glyphicons-halflings-regular.svg#glyphicons_halflingsregular) format("svg")}.glyphicon{position:relative;top:1px;display:inline-block;font-family:"Glyphicons Halflings";font-style:normal;font-weight:400;line-height:1;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.glyphicon-asterisk:before{content:"\002a"}.glyphicon-plus:before{content:"\002b"}.glyphicon-eur:before,.glyphicon-euro:before{content:"\20ac"}.glyphicon-minus:before{content:"\2212"}.glyphicon-cloud:before{content:"\2601"}.glyphicon-envelope:before{content:"\2709"}.glyphicon-pencil:before{content:"\270f"}.glyphicon-glass:before{content:"\e001"}.glyphicon-music:before{content:"\e002"}.glyphicon-search:before{content:"\e003"}.glyphicon-heart:before{content:"\e005"}.glyphicon-star:before{content:"\e006"}.glyphicon-star-empty:before{content:"\e007"}.glyphicon-user:before{content:"\e008"}.glyphicon-film:before{content:"\e009"}.glyphicon-th-large:before{content:"\e010"}.glyphicon-th:before{content:"\e011"}.glyphicon-th-list:before{content:"\e012"}.glyphicon-ok:before{content:"\e013"}.glyphicon-remove:before{content:"\e014"}.glyphicon-zoom-in:before{content:"\e015"}.glyphicon-zoom-out:before{content:"\e016"}.glyphicon-off:before{content:"\e017"}.glyphicon-signal:before{content:"\e018"}.glyphicon-cog:before{content:"\e019"}.glyphicon-trash:before{content:"\e020"}.glyphicon-home:before{content:"\e021"}.glyphicon-file:before{content:"\e022"}.glyphicon-time:before{content:"\e023"}.glyphicon-road:before{content:"\e024"}.glyphicon-download-alt:before{content:"\e025"}.glyphicon-download:before{content:"\e026"}.glyphicon-upload:before{content:"\e027"}.glyphicon-inbox:before{content:"\e028"}.glyphicon-play-circle:before{content:"\e029"}.glyphicon-repeat:before{content:"\e030"}.glyphicon-refresh:before{content:"\e031"}.glyphicon-list-alt:before{content:"\e032"}.glyphicon-lock:before{content:"\e033"}.glyphicon-flag:before{content:"\e034"}.glyphicon-headphones:before{content:"\e035"}.glyphicon-volume-off:before{content:"\e036"}.glyphicon-volume-down:before{content:"\e037"}.glyphicon-volume-up:before{content:"\e038"}.glyphicon-qrcode:before{content:"\e039"}.glyphicon-barcode:before{content:"\e040"}.glyphicon-tag:before{content:"\e041"}.glyphicon-tags:before{content:"\e042"}.glyphicon-book:before{content:"\e043"}.glyphicon-bookmark:before{content:"\e044"}.glyphicon-print:before{content:"\e045"}.glyphicon-camera:before{content:"\e046"}.glyphicon-font:before{content:"\e047"}.glyphicon-bold:before{content:"\e048"}.glyphicon-italic:before{content:"\e049"}.glyphicon-text-height:before{content:"\e050"}.glyphicon-text-width:before{content:"\e051"}.glyphicon-align-left:before{content:"\e052"}.glyphicon-align-center:before{content:"\e053"}.glyphicon-align-right:before{content:"\e054"}.glyphicon-align-justify:before{content:"\e055"}.glyphicon-list:before{content:"\e056"}.glyphicon-indent-left:before{content:"\e057"}.glyphicon-indent-right:before{content:"\e058"}.glyphicon-facetime-video:before{content:"\e059"}.glyphicon-picture:before{content:"\e060"}.glyphicon-map-marker:before{content:"\e062"}.glyphicon-adjust:before{content:"\e063"}.glyphicon-tint:before{content:"\e064"}.glyphicon-edit:before{content:"\e065"}.glyphicon-share:before{content:"\e066"}.glyphicon-check:before{content:"\e067"}.glyphicon-move:before{content:"\e068"}.glyphicon-step-backward:before{content:"\e069"}.glyphicon-fast-backward:before{content:"\e070"}.glyphicon-backward:before{content:"\e071"}.glyphicon-play:before{content:"\e072"}.glyphicon-pause:before{content:"\e073"}.glyphicon-stop:before{content:"\e074"}.glyphicon-forward:before{content:"\e075"}.glyphicon-fast-forward:before{content:"\e076"}.glyphicon-step-forward:before{content:"\e077"}.glyphicon-eject:before{content:"\e078"}.glyphicon-chevron-left:before{content:"\e079"}.glyphicon-chevron-right:before{content:"\e080"}.glyphicon-plus-sign:before{content:"\e081"}.glyphicon-minus-sign:before{content:"\e082"}.glyphicon-remove-sign:before{content:"\e083"}.glyphicon-ok-sign:before{content:"\e084"}.glyphicon-question-sign:before{content:"\e085"}.glyphicon-info-sign:before{content:"\e086"}.glyphicon-screenshot:before{content:"\e087"}.glyphicon-remove-circle:before{content:"\e088"}.glyphicon-ok-circle:before{content:"\e089"}.glyphicon-ban-circle:before{content:"\e090"}.glyphicon-arrow-left:before{content:"\e091"}.glyphicon-arrow-right:before{content:"\e092"}.glyphicon-arrow-up:before{content:"\e093"}.glyphicon-arrow-down:before{content:"\e094"}.glyphicon-share-alt:before{content:"\e095"}.glyphicon-resize-full:before{content:"\e096"}.glyphicon-resize-small:before{content:"\e097"}.glyphicon-exclamation-sign:before{content:"\e101"}.glyphicon-gift:before{content:"\e102"}.glyphicon-leaf:before{content:"\e103"}.glyphicon-fire:before{content:"\e104"}.glyphicon-eye-open:before{content:"\e105"}.glyphicon-eye-close:before{content:"\e106"}.glyphicon-warning-sign:before{content:"\e107"}.glyphicon-plane:before{content:"\e108"}.glyphicon-calendar:before{content:"\e109"}.glyphicon-random:before{content:"\e110"}.glyphicon-comment:before{content:"\e111"}.glyphicon-magnet:before{content:"\e112"}.glyphicon-chevron-up:before{content:"\e113"}.glyphicon-chevron-down:before{content:"\e114"}.glyphicon-retweet:before{content:"\e115"}.glyphicon-shopping-cart:before{content:"\e116"}.glyphicon-folder-close:before{content:"\e117"}.glyphicon-folder-open:before{content:"\e118"}.glyphicon-resize-vertical:before{content:"\e119"}.glyphicon-resize-horizontal:before{content:"\e120"}.glyphicon-hdd:before{content:"\e121"}.glyphicon-bullhorn:before{content:"\e122"}.glyphicon-bell:before{content:"\e123"}.glyphicon-certificate:before{content:"\e124"}.glyphicon-thumbs-up:before{content:"\e125"}.glyphicon-thumbs-down:before{content:"\e126"}.glyphicon-hand-right:before{content:"\e127"}.glyphicon-hand-left:before{content:"\e128"}.glyphicon-hand-up:before{content:"\e129"}.glyphicon-hand-down:before{content:"\e130"}.glyphicon-circle-arrow-right:before{content:"\e131"}.glyphicon-circle-arrow-left:before{content:"\e132"}.glyphicon-circle-arrow-up:before{content:"\e133"}.glyphicon-circle-arrow-down:before{content:"\e134"}.glyphicon-globe:before{content:"\e135"}.glyphicon-wrench:before{content:"\e136"}.glyphicon-tasks:before{content:"\e137"}.glyphicon-filter:before{content:"\e138"}.glyphicon-briefcase:before{content:"\e139"}.glyphicon-fullscreen:before{content:"\e140"}.glyphicon-dashboard:before{content:"\e141"}.glyphicon-paperclip:before{content:"\e142"}.glyphicon-heart-empty:before{content:"\e143"}.glyphicon-link:before{content:"\e144"}.glyphicon-phone:before{content:"\e145"}.glyphicon-pushpin:before{content:"\e146"}.glyphicon-usd:before{content:"\e148"}.glyphicon-gbp:before{content:"\e149"}.glyphicon-sort:before{content:"\e150"}.glyphicon-sort-by-alphabet:before{content:"\e151"}.glyphicon-sort-by-alphabet-alt:before{content:"\e152"}.glyphicon-sort-by-order:before{content:"\e153"}.glyphicon-sort-by-order-alt:before{content:"\e154"}.glyphicon-sort-by-attributes:before{content:"\e155"}.glyphicon-sort-by-attributes-alt:before{content:"\e156"}.glyphicon-unchecked:before{content:"\e157"}.glyphicon-expand:before{content:"\e158"}.glyphicon-collapse-down:before{content:"\e159"}.glyphicon-collapse-up:before{content:"\e160"}.glyphicon-log-in:before{content:"\e161"}.glyphicon-flash:before{content:"\e162"}.glyphicon-log-out:before{content:"\e163"}.glyphicon-new-window:before{content:"\e164"}.glyphicon-record:before{content:"\e165"}.glyphicon-save:before{content:"\e166"}.glyphicon-open:before{content:"\e167"}.glyphicon-saved:before{content:"\e168"}.glyphicon-import:before{content:"\e169"}.glyphicon-export:before{content:"\e170"}.glyphicon-send:before{content:"\e171"}.glyphicon-floppy-disk:before{content:"\e172"}.glyphicon-floppy-saved:before{content:"\e173"}.glyphicon-floppy-remove:before{content:"\e174"}.glyphicon-floppy-save:before{content:"\e175"}.glyphicon-floppy-open:before{content:"\e176"}.glyphicon-credit-card:before{content:"\e177"}.glyphicon-transfer:before{content:"\e178"}.glyphicon-cutlery:before{content:"\e179"}.glyphicon-header:before{content:"\e180"}.glyphicon-compressed:before{content:"\e181"}.glyphicon-earphone:before{content:"\e182"}.glyphicon-phone-alt:before{content:"\e183"}.glyphicon-tower:before{content:"\e184"}.glyphicon-stats:before{content:"\e185"}.glyphicon-sd-video:before{content:"\e186"}.glyphicon-hd-video:before{content:"\e187"}.glyphicon-subtitles:before{content:"\e188"}.glyphicon-sound-stereo:before{content:"\e189"}.glyphicon-sound-dolby:before{content:"\e190"}.glyphicon-sound-5-1:before{content:"\e191"}.glyphicon-sound-6-1:before{content:"\e192"}.glyphicon-sound-7-1:before{content:"\e193"}.glyphicon-copyright-mark:before{content:"\e194"}.glyphicon-registration-mark:before{content:"\e195"}.glyphicon-cloud-download:before{content:"\e197"}.glyphicon-cloud-upload:before{content:"\e198"}.glyphicon-tree-conifer:before{content:"\e199"}.glyphicon-tree-deciduous:before{content:"\e200"}.glyphicon-cd:before{content:"\e201"}.glyphicon-save-file:before{content:"\e202"}.glyphicon-open-file:before{content:"\e203"}.glyphicon-level-up:before{content:"\e204"}.glyphicon-copy:before{content:"\e205"}.glyphicon-paste:before{content:"\e206"}.glyphicon-alert:before{content:"\e209"}.glyphicon-equalizer:before{content:"\e210"}.glyphicon-king:before{content:"\e211"}.glyphicon-queen:before{content:"\e212"}.glyphicon-pawn:before{content:"\e213"}.glyphicon-bishop:before{content:"\e214"}.glyphicon-knight:before{content:"\e215"}.glyphicon-baby-formula:before{content:"\e216"}.glyphicon-tent:before{content:"\26fa"}.glyphicon-blackboard:before{content:"\e218"}.glyphicon-bed:before{content:"\e219"}.glyphicon-apple:before{content:"\f8ff"}.glyphicon-erase:before{content:"\e221"}.glyphicon-hourglass:before{content:"\231b"}.glyphicon-lamp:before{content:"\e223"}.glyphicon-duplicate:before{content:"\e224"}.glyphicon-piggy-bank:before{content:"\e225"}.glyphicon-scissors:before{content:"\e226"}.glyphicon-bitcoin:before{content:"\e227"}.glyphicon-btc:before{content:"\e227"}.glyphicon-xbt:before{content:"\e227"}.glyphicon-yen:before{content:"\00a5"}.glyphicon-jpy:before{content:"\00a5"}.glyphicon-ruble:before{content:"\20bd"}.glyphicon-rub:before{content:"\20bd"}.glyphicon-scale:before{content:"\e230"}.glyphicon-ice-lolly:before{content:"\e231"}.glyphicon-ice-lolly-tasted:before{content:"\e232"}.glyphicon-education:before{content:"\e233"}.glyphicon-option-horizontal:before{content:"\e234"}.glyphicon-option-vertical:before{content:"\e235"}.glyphicon-menu-hamburger:before{content:"\e236"}.glyphicon-modal-window:before{content:"\e237"}.glyphicon-oil:before{content:"\e238"}.glyphicon-grain:before{content:"\e239"}.glyphicon-sunglasses:before{content:"\e240"}.glyphicon-text-size:before{content:"\e241"}.glyphicon-text-color:before{content:"\e242"}.glyphicon-text-background:before{content:"\e243"}.glyphicon-object-align-top:before{content:"\e244"}.glyphicon-object-align-bottom:before{content:"\e245"}.glyphicon-object-align-horizontal:before{content:"\e246"}.glyphicon-object-align-left:before{content:"\e247"}.glyphicon-object-align-vertical:before{content:"\e248"}.glyphicon-object-align-right:before{content:"\e249"}.glyphicon-triangle-right:before{content:"\e250"}.glyphicon-triangle-left:before{content:"\e251"}.glyphicon-triangle-bottom:before{content:"\e252"}.glyphicon-triangle-top:before{content:"\e253"}.glyphicon-console:before{content:"\e254"}.glyphicon-superscript:before{content:"\e255"}.glyphicon-subscript:before{content:"\e256"}.glyphicon-menu-left:before{content:"\e257"}.glyphicon-menu-right:before{content:"\e258"}.glyphicon-menu-down:before{content:"\e259"}.glyphicon-menu-up:before{content:"\e260"}*{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}:after,:before{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}html{font-size:10px;-webkit-tap-highlight-color:rgba(0,0,0,0)}body{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;line-height:1.42857143;color:#333;background-color:#fff}button,input,select,textarea{font-family:inherit;font-size:inherit;line-height:inherit}a{color:#337ab7;text-decoration:none}a:focus,a:hover{color:#23527c;text-decoration:underline}a:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}figure{margin:0}img{vertical-align:middle}.carousel-inner>.item>a>img,.carousel-inner>.item>img,.img-responsive,.thumbnail a>img,.thumbnail>img{display:block;max-width:100%;height:auto}.img-rounded{border-radius:6px}.img-thumbnail{padding:4px;line-height:1.42857143;background-color:#fff;border:1px solid #ddd;border-radius:4px;-webkit-transition:all .2s ease-in-out;-o-transition:all .2s ease-in-out;transition:all .2s ease-in-out;display:inline-block;max-width:100%;height:auto}.img-circle{border-radius:50%}hr{margin-top:20px;margin-bottom:20px;border:0;border-top:1px solid #eee}.sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);border:0}.sr-only-focusable:active,.sr-only-focusable:focus{position:static;width:auto;height:auto;margin:0;overflow:visible;clip:auto}[role=button]{cursor:pointer}.h1,.h2,.h3,.h4,.h5,.h6,h1,h2,h3,h4,h5,h6{font-family:inherit;font-weight:500;line-height:1.1;color:inherit}.h1 .small,.h1 small,.h2 .small,.h2 small,.h3 .small,.h3 small,.h4 .small,.h4 small,.h5 .small,.h5 small,.h6 .small,.h6 small,h1 .small,h1 small,h2 .small,h2 small,h3 .small,h3 small,h4 .small,h4 small,h5 .small,h5 small,h6 .small,h6 small{font-weight:400;line-height:1;color:#777}.h1,.h2,.h3,h1,h2,h3{margin-top:20px;margin-bottom:10px}.h1 .small,.h1 small,.h2 .small,.h2 small,.h3 .small,.h3 small,h1 .small,h1 small,h2 .small,h2 small,h3 .small,h3 small{font-size:65%}.h4,.h5,.h6,h4,h5,h6{margin-top:10px;margin-bottom:10px}.h4 .small,.h4 small,.h5 .small,.h5 small,.h6 .small,.h6 small,h4 .small,h4 small,h5 .small,h5 small,h6 .small,h6 small{font-size:75%}.h1,h1{font-size:36px}.h2,h2{font-size:30px}.h3,h3{font-size:24px}.h4,h4{font-size:18px}.h5,h5{font-size:14px}.h6,h6{font-size:12px}p{margin:0 0 10px}.lead{margin-bottom:20px;font-size:16px;font-weight:300;line-height:1.4}@media (min-width:768px){.lead{font-size:21px}}.small,small{font-size:85%}.mark,mark{padding:.2em;background-color:#fcf8e3}.text-left{text-align:left}.text-right{text-align:right}.text-center{text-align:center}.text-justify{text-align:justify}.text-nowrap{white-space:nowrap}.text-lowercase{text-transform:lowercase}.text-uppercase{text-transform:uppercase}.text-capitalize{text-transform:capitalize}.text-muted{color:#777}.text-primary{color:#337ab7}a.text-primary:focus,a.text-primary:hover{color:#286090}.text-success{color:#3c763d}a.text-success:focus,a.text-success:hover{color:#2b542c}.text-info{color:#31708f}a.text-info:focus,a.text-info:hover{color:#245269}.text-warning{color:#8a6d3b}a.text-warning:focus,a.text-warning:hover{color:#66512c}.text-danger{color:#a94442}a.text-danger:focus,a.text-danger:hover{color:#843534}.bg-primary{color:#fff;background-color:#337ab7}a.bg-primary:focus,a.bg-primary:hover{background-color:#286090}.bg-success{background-color:#dff0d8}a.bg-success:focus,a.bg-success:hover{background-color:#c1e2b3}.bg-info{background-color:#d9edf7}a.bg-info:focus,a.bg-info:hover{background-color:#afd9ee}.bg-warning{background-color:#fcf8e3}a.bg-warning:focus,a.bg-warning:hover{background-color:#f7ecb5}.bg-danger{background-color:#f2dede}a.bg-danger:focus,a.bg-danger:hover{background-color:#e4b9b9}.page-header{padding-bottom:9px;margin:40px 0 20px;border-bottom:1px solid #eee}ol,ul{margin-top:0;margin-bottom:10px}ol ol,ol ul,ul ol,ul ul{margin-bottom:0}.list-unstyled{padding-left:0;list-style:none}.list-inline{padding-left:0;list-style:none;margin-left:-5px}.list-inline>li{display:inline-block;padding-right:5px;padding-left:5px}dl{margin-top:0;margin-bottom:20px}dd,dt{line-height:1.42857143}dt{font-weight:700}dd{margin-left:0}@media (min-width:768px){.dl-horizontal dt{float:left;width:160px;clear:left;text-align:right;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.dl-horizontal dd{margin-left:180px}}abbr[data-original-title],abbr[title]{cursor:help}.initialism{font-size:90%;text-transform:uppercase}blockquote{padding:10px 20px;margin:0 0 20px;font-size:17.5px;border-left:5px solid #eee}blockquote ol:last-child,blockquote p:last-child,blockquote ul:last-child{margin-bottom:0}blockquote .small,blockquote footer,blockquote small{display:block;font-size:80%;line-height:1.42857143;color:#777}blockquote .small:before,blockquote footer:before,blockquote small:before{content:"\2014 \00A0"}.blockquote-reverse,blockquote.pull-right{padding-right:15px;padding-left:0;text-align:right;border-right:5px solid #eee;border-left:0}.blockquote-reverse .small:before,.blockquote-reverse footer:before,.blockquote-reverse small:before,blockquote.pull-right .small:before,blockquote.pull-right footer:before,blockquote.pull-right small:before{content:""}.blockquote-reverse .small:after,.blockquote-reverse footer:after,.blockquote-reverse small:after,blockquote.pull-right .small:after,blockquote.pull-right footer:after,blockquote.pull-right small:after{content:"\00A0 \2014"}address{margin-bottom:20px;font-style:normal;line-height:1.42857143}code,kbd,pre,samp{font-family:Menlo,Monaco,Consolas,"Courier New",monospace}code{padding:2px 4px;font-size:90%;color:#c7254e;background-color:#f9f2f4;border-radius:4px}kbd{padding:2px 4px;font-size:90%;color:#fff;background-color:#333;border-radius:3px;-webkit-box-shadow:inset 0 -1px 0 rgba(0,0,0,.25);box-shadow:inset 0 -1px 0 rgba(0,0,0,.25)}kbd kbd{padding:0;font-size:100%;font-weight:700;-webkit-box-shadow:none;box-shadow:none}pre{display:block;padding:9.5px;margin:0 0 10px;font-size:13px;line-height:1.42857143;color:#333;word-break:break-all;word-wrap:break-word;background-color:#f5f5f5;border:1px solid #ccc;border-radius:4px}pre code{padding:0;font-size:inherit;color:inherit;white-space:pre-wrap;background-color:transparent;border-radius:0}.pre-scrollable{max-height:340px;overflow-y:scroll}.container{padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}@media (min-width:768px){.container{width:750px}}@media (min-width:992px){.container{width:970px}}@media (min-width:1200px){.container{width:1170px}}.container-fluid{padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}.row{margin-right:-15px;margin-left:-15px}.row-no-gutters{margin-right:0;margin-left:0}.row-no-gutters [class*=col-]{padding-right:0;padding-left:0}.col-lg-1,.col-lg-10,.col-lg-11,.col-lg-12,.col-lg-2,.col-lg-3,.col-lg-4,.col-lg-5,.col-lg-6,.col-lg-7,.col-lg-8,.col-lg-9,.col-md-1,.col-md-10,.col-md-11,.col-md-12,.col-md-2,.col-md-3,.col-md-4,.col-md-5,.col-md-6,.col-md-7,.col-md-8,.col-md-9,.col-sm-1,.col-sm-10,.col-sm-11,.col-sm-12,.col-sm-2,.col-sm-3,.col-sm-4,.col-sm-5,.col-sm-6,.col-sm-7,.col-sm-8,.col-sm-9,.col-xs-1,.col-xs-10,.col-xs-11,.col-xs-12,.col-xs-2,.col-xs-3,.col-xs-4,.col-xs-5,.col-xs-6,.col-xs-7,.col-xs-8,.col-xs-9{position:relative;min-height:1px;padding-right:15px;padding-left:15px}.col-xs-1,.col-xs-10,.col-xs-11,.col-xs-12,.col-xs-2,.col-xs-3,.col-xs-4,.col-xs-5,.col-xs-6,.col-xs-7,.col-xs-8,.col-xs-9{float:left}.col-xs-12{width:100%}.col-xs-11{width:91.66666667%}.col-xs-10{width:83.33333333%}.col-xs-9{width:75%}.col-xs-8{width:66.66666667%}.col-xs-7{width:58.33333333%}.col-xs-6{width:50%}.col-xs-5{width:41.66666667%}.col-xs-4{width:33.33333333%}.col-xs-3{width:25%}.col-xs-2{width:16.66666667%}.col-xs-1{width:8.33333333%}.col-xs-pull-12{right:100%}.col-xs-pull-11{right:91.66666667%}.col-xs-pull-10{right:83.33333333%}.col-xs-pull-9{right:75%}.col-xs-pull-8{right:66.66666667%}.col-xs-pull-7{right:58.33333333%}.col-xs-pull-6{right:50%}.col-xs-pull-5{right:41.66666667%}.col-xs-pull-4{right:33.33333333%}.col-xs-pull-3{right:25%}.col-xs-pull-2{right:16.66666667%}.col-xs-pull-1{right:8.33333333%}.col-xs-pull-0{right:auto}.col-xs-push-12{left:100%}.col-xs-push-11{left:91.66666667%}.col-xs-push-10{left:83.33333333%}.col-xs-push-9{left:75%}.col-xs-push-8{left:66.66666667%}.col-xs-push-7{left:58.33333333%}.col-xs-push-6{left:50%}.col-xs-push-5{left:41.66666667%}.col-xs-push-4{left:33.33333333%}.col-xs-push-3{left:25%}.col-xs-push-2{left:16.66666667%}.col-xs-push-1{left:8.33333333%}.col-xs-push-0{left:auto}.col-xs-offset-12{margin-left:100%}.col-xs-offset-11{margin-left:91.66666667%}.col-xs-offset-10{margin-left:83.33333333%}.col-xs-offset-9{margin-left:75%}.col-xs-offset-8{margin-left:66.66666667%}.col-xs-offset-7{margin-left:58.33333333%}.col-xs-offset-6{margin-left:50%}.col-xs-offset-5{margin-left:41.66666667%}.col-xs-offset-4{margin-left:33.33333333%}.col-xs-offset-3{margin-left:25%}.col-xs-offset-2{margin-left:16.66666667%}.col-xs-offset-1{margin-left:8.33333333%}.col-xs-offset-0{margin-left:0}@media (min-width:768px){.col-sm-1,.col-sm-10,.col-sm-11,.col-sm-12,.col-sm-2,.col-sm-3,.col-sm-4,.col-sm-5,.col-sm-6,.col-sm-7,.col-sm-8,.col-sm-9{float:left}.col-sm-12{width:100%}.col-sm-11{width:91.66666667%}.col-sm-10{width:83.33333333%}.col-sm-9{width:75%}.col-sm-8{width:66.66666667%}.col-sm-7{width:58.33333333%}.col-sm-6{width:50%}.col-sm-5{width:41.66666667%}.col-sm-4{width:33.33333333%}.col-sm-3{width:25%}.col-sm-2{width:16.66666667%}.col-sm-1{width:8.33333333%}.col-sm-pull-12{right:100%}.col-sm-pull-11{right:91.66666667%}.col-sm-pull-10{right:83.33333333%}.col-sm-pull-9{right:75%}.col-sm-pull-8{right:66.66666667%}.col-sm-pull-7{right:58.33333333%}.col-sm-pull-6{right:50%}.col-sm-pull-5{right:41.66666667%}.col-sm-pull-4{right:33.33333333%}.col-sm-pull-3{right:25%}.col-sm-pull-2{right:16.66666667%}.col-sm-pull-1{right:8.33333333%}.col-sm-pull-0{right:auto}.col-sm-push-12{left:100%}.col-sm-push-11{left:91.66666667%}.col-sm-push-10{left:83.33333333%}.col-sm-push-9{left:75%}.col-sm-push-8{left:66.66666667%}.col-sm-push-7{left:58.33333333%}.col-sm-push-6{left:50%}.col-sm-push-5{left:41.66666667%}.col-sm-push-4{left:33.33333333%}.col-sm-push-3{left:25%}.col-sm-push-2{left:16.66666667%}.col-sm-push-1{left:8.33333333%}.col-sm-push-0{left:auto}.col-sm-offset-12{margin-left:100%}.col-sm-offset-11{margin-left:91.66666667%}.col-sm-offset-10{margin-left:83.33333333%}.col-sm-offset-9{margin-left:75%}.col-sm-offset-8{margin-left:66.66666667%}.col-sm-offset-7{margin-left:58.33333333%}.col-sm-offset-6{margin-left:50%}.col-sm-offset-5{margin-left:41.66666667%}.col-sm-offset-4{margin-left:33.33333333%}.col-sm-offset-3{margin-left:25%}.col-sm-offset-2{margin-left:16.66666667%}.col-sm-offset-1{margin-left:8.33333333%}.col-sm-offset-0{margin-left:0}}@media (min-width:992px){.col-md-1,.col-md-10,.col-md-11,.col-md-12,.col-md-2,.col-md-3,.col-md-4,.col-md-5,.col-md-6,.col-md-7,.col-md-8,.col-md-9{float:left}.col-md-12{width:100%}.col-md-11{width:91.66666667%}.col-md-10{width:83.33333333%}.col-md-9{width:75%}.col-md-8{width:66.66666667%}.col-md-7{width:58.33333333%}.col-md-6{width:50%}.col-md-5{width:41.66666667%}.col-md-4{width:33.33333333%}.col-md-3{width:25%}.col-md-2{width:16.66666667%}.col-md-1{width:8.33333333%}.col-md-pull-12{right:100%}.col-md-pull-11{right:91.66666667%}.col-md-pull-10{right:83.33333333%}.col-md-pull-9{right:75%}.col-md-pull-8{right:66.66666667%}.col-md-pull-7{right:58.33333333%}.col-md-pull-6{right:50%}.col-md-pull-5{right:41.66666667%}.col-md-pull-4{right:33.33333333%}.col-md-pull-3{right:25%}.col-md-pull-2{right:16.66666667%}.col-md-pull-1{right:8.33333333%}.col-md-pull-0{right:auto}.col-md-push-12{left:100%}.col-md-push-11{left:91.66666667%}.col-md-push-10{left:83.33333333%}.col-md-push-9{left:75%}.col-md-push-8{left:66.66666667%}.col-md-push-7{left:58.33333333%}.col-md-push-6{left:50%}.col-md-push-5{left:41.66666667%}.col-md-push-4{left:33.33333333%}.col-md-push-3{left:25%}.col-md-push-2{left:16.66666667%}.col-md-push-1{left:8.33333333%}.col-md-push-0{left:auto}.col-md-offset-12{margin-left:100%}.col-md-offset-11{margin-left:91.66666667%}.col-md-offset-10{margin-left:83.33333333%}.col-md-offset-9{margin-left:75%}.col-md-offset-8{margin-left:66.66666667%}.col-md-offset-7{margin-left:58.33333333%}.col-md-offset-6{margin-left:50%}.col-md-offset-5{margin-left:41.66666667%}.col-md-offset-4{margin-left:33.33333333%}.col-md-offset-3{margin-left:25%}.col-md-offset-2{margin-left:16.66666667%}.col-md-offset-1{margin-left:8.33333333%}.col-md-offset-0{margin-left:0}}@media (min-width:1200px){.col-lg-1,.col-lg-10,.col-lg-11,.col-lg-12,.col-lg-2,.col-lg-3,.col-lg-4,.col-lg-5,.col-lg-6,.col-lg-7,.col-lg-8,.col-lg-9{float:left}.col-lg-12{width:100%}.col-lg-11{width:91.66666667%}.col-lg-10{width:83.33333333%}.col-lg-9{width:75%}.col-lg-8{width:66.66666667%}.col-lg-7{width:58.33333333%}.col-lg-6{width:50%}.col-lg-5{width:41.66666667%}.col-lg-4{width:33.33333333%}.col-lg-3{width:25%}.col-lg-2{width:16.66666667%}.col-lg-1{width:8.33333333%}.col-lg-pull-12{right:100%}.col-lg-pull-11{right:91.66666667%}.col-lg-pull-10{right:83.33333333%}.col-lg-pull-9{right:75%}.col-lg-pull-8{right:66.66666667%}.col-lg-pull-7{right:58.33333333%}.col-lg-pull-6{right:50%}.col-lg-pull-5{right:41.66666667%}.col-lg-pull-4{right:33.33333333%}.col-lg-pull-3{right:25%}.col-lg-pull-2{right:16.66666667%}.col-lg-pull-1{right:8.33333333%}.col-lg-pull-0{right:auto}.col-lg-push-12{left:100%}.col-lg-push-11{left:91.66666667%}.col-lg-push-10{left:83.33333333%}.col-lg-push-9{left:75%}.col-lg-push-8{left:66.66666667%}.col-lg-push-7{left:58.33333333%}.col-lg-push-6{left:50%}.col-lg-push-5{left:41.66666667%}.col-lg-push-4{left:33.33333333%}.col-lg-push-3{left:25%}.col-lg-push-2{left:16.66666667%}.col-lg-push-1{left:8.33333333%}.col-lg-push-0{left:auto}.col-lg-offset-12{margin-left:100%}.col-lg-offset-11{margin-left:91.66666667%}.col-lg-offset-10{margin-left:83.33333333%}.col-lg-offset-9{margin-left:75%}.col-lg-offset-8{margin-left:66.66666667%}.col-lg-offset-7{margin-left:58.33333333%}.col-lg-offset-6{margin-left:50%}.col-lg-offset-5{margin-left:41.66666667%}.col-lg-offset-4{margin-left:33.33333333%}.col-lg-offset-3{margin-left:25%}.col-lg-offset-2{margin-left:16.66666667%}.col-lg-offset-1{margin-left:8.33333333%}.col-lg-offset-0{margin-left:0}}table{background-color:transparent}table col[class*=col-]{position:static;display:table-column;float:none}table td[class*=col-],table th[class*=col-]{position:static;display:table-cell;float:none}caption{padding-top:8px;padding-bottom:8px;color:#777;text-align:left}th{text-align:left}.table{width:100%;max-width:100%;margin-bottom:20px}.table>tbody>tr>td,.table>tbody>tr>th,.table>tfoot>tr>td,.table>tfoot>tr>th,.table>thead>tr>td,.table>thead>tr>th{padding:8px;line-height:1.42857143;vertical-align:top;border-top:1px solid #ddd}.table>thead>tr>th{vertical-align:bottom;border-bottom:2px solid #ddd}.table>caption+thead>tr:first-child>td,.table>caption+thead>tr:first-child>th,.table>colgroup+thead>tr:first-child>td,.table>colgroup+thead>tr:first-child>th,.table>thead:first-child>tr:first-child>td,.table>thead:first-child>tr:first-child>th{border-top:0}.table>tbody+tbody{border-top:2px solid #ddd}.table .table{background-color:#fff}.table-condensed>tbody>tr>td,.table-condensed>tbody>tr>th,.table-condensed>tfoot>tr>td,.table-condensed>tfoot>tr>th,.table-condensed>thead>tr>td,.table-condensed>thead>tr>th{padding:5px}.table-bordered{border:1px solid #ddd}.table-bordered>tbody>tr>td,.table-bordered>tbody>tr>th,.table-bordered>tfoot>tr>td,.table-bordered>tfoot>tr>th,.table-bordered>thead>tr>td,.table-bordered>thead>tr>th{border:1px solid #ddd}.table-bordered>thead>tr>td,.table-bordered>thead>tr>th{border-bottom-width:2px}.table-striped>tbody>tr:nth-of-type(odd){background-color:#f9f9f9}.table-hover>tbody>tr:hover{background-color:#f5f5f5}.table>tbody>tr.active>td,.table>tbody>tr.active>th,.table>tbody>tr>td.active,.table>tbody>tr>th.active,.table>tfoot>tr.active>td,.table>tfoot>tr.active>th,.table>tfoot>tr>td.active,.table>tfoot>tr>th.active,.table>thead>tr.active>td,.table>thead>tr.active>th,.table>thead>tr>td.active,.table>thead>tr>th.active{background-color:#f5f5f5}.table-hover>tbody>tr.active:hover>td,.table-hover>tbody>tr.active:hover>th,.table-hover>tbody>tr:hover>.active,.table-hover>tbody>tr>td.active:hover,.table-hover>tbody>tr>th.active:hover{background-color:#e8e8e8}.table>tbody>tr.success>td,.table>tbody>tr.success>th,.table>tbody>tr>td.success,.table>tbody>tr>th.success,.table>tfoot>tr.success>td,.table>tfoot>tr.success>th,.table>tfoot>tr>td.success,.table>tfoot>tr>th.success,.table>thead>tr.success>td,.table>thead>tr.success>th,.table>thead>tr>td.success,.table>thead>tr>th.success{background-color:#dff0d8}.table-hover>tbody>tr.success:hover>td,.table-hover>tbody>tr.success:hover>th,.table-hover>tbody>tr:hover>.success,.table-hover>tbody>tr>td.success:hover,.table-hover>tbody>tr>th.success:hover{background-color:#d0e9c6}.table>tbody>tr.info>td,.table>tbody>tr.info>th,.table>tbody>tr>td.info,.table>tbody>tr>th.info,.table>tfoot>tr.info>td,.table>tfoot>tr.info>th,.table>tfoot>tr>td.info,.table>tfoot>tr>th.info,.table>thead>tr.info>td,.table>thead>tr.info>th,.table>thead>tr>td.info,.table>thead>tr>th.info{background-color:#d9edf7}.table-hover>tbody>tr.info:hover>td,.table-hover>tbody>tr.info:hover>th,.table-hover>tbody>tr:hover>.info,.table-hover>tbody>tr>td.info:hover,.table-hover>tbody>tr>th.info:hover{background-color:#c4e3f3}.table>tbody>tr.warning>td,.table>tbody>tr.warning>th,.table>tbody>tr>td.warning,.table>tbody>tr>th.warning,.table>tfoot>tr.warning>td,.table>tfoot>tr.warning>th,.table>tfoot>tr>td.warning,.table>tfoot>tr>th.warning,.table>thead>tr.warning>td,.table>thead>tr.warning>th,.table>thead>tr>td.warning,.table>thead>tr>th.warning{background-color:#fcf8e3}.table-hover>tbody>tr.warning:hover>td,.table-hover>tbody>tr.warning:hover>th,.table-hover>tbody>tr:hover>.warning,.table-hover>tbody>tr>td.warning:hover,.table-hover>tbody>tr>th.warning:hover{background-color:#faf2cc}.table>tbody>tr.danger>td,.table>tbody>tr.danger>th,.table>tbody>tr>td.danger,.table>tbody>tr>th.danger,.table>tfoot>tr.danger>td,.table>tfoot>tr.danger>th,.table>tfoot>tr>td.danger,.table>tfoot>tr>th.danger,.table>thead>tr.danger>td,.table>thead>tr.danger>th,.table>thead>tr>td.danger,.table>thead>tr>th.danger{background-color:#f2dede}.table-hover>tbody>tr.danger:hover>td,.table-hover>tbody>tr.danger:hover>th,.table-hover>tbody>tr:hover>.danger,.table-hover>tbody>tr>td.danger:hover,.table-hover>tbody>tr>th.danger:hover{background-color:#ebcccc}.table-responsive{min-height:.01%;overflow-x:auto}@media screen and (max-width:767px){.table-responsive{width:100%;margin-bottom:15px;overflow-y:hidden;-ms-overflow-style:-ms-autohiding-scrollbar;border:1px solid #ddd}.table-responsive>.table{margin-bottom:0}.table-responsive>.table>tbody>tr>td,.table-responsive>.table>tbody>tr>th,.table-responsive>.table>tfoot>tr>td,.table-responsive>.table>tfoot>tr>th,.table-responsive>.table>thead>tr>td,.table-responsive>.table>thead>tr>th{white-space:nowrap}.table-responsive>.table-bordered{border:0}.table-responsive>.table-bordered>tbody>tr>td:first-child,.table-responsive>.table-bordered>tbody>tr>th:first-child,.table-responsive>.table-bordered>tfoot>tr>td:first-child,.table-responsive>.table-bordered>tfoot>tr>th:first-child,.table-responsive>.table-bordered>thead>tr>td:first-child,.table-responsive>.table-bordered>thead>tr>th:first-child{border-left:0}.table-responsive>.table-bordered>tbody>tr>td:last-child,.table-responsive>.table-bordered>tbody>tr>th:last-child,.table-responsive>.table-bordered>tfoot>tr>td:last-child,.table-responsive>.table-bordered>tfoot>tr>th:last-child,.table-responsive>.table-bordered>thead>tr>td:last-child,.table-responsive>.table-bordered>thead>tr>th:last-child{border-right:0}.table-responsive>.table-bordered>tbody>tr:last-child>td,.table-responsive>.table-bordered>tbody>tr:last-child>th,.table-responsive>.table-bordered>tfoot>tr:last-child>td,.table-responsive>.table-bordered>tfoot>tr:last-child>th{border-bottom:0}}fieldset{min-width:0;padding:0;margin:0;border:0}legend{display:block;width:100%;padding:0;margin-bottom:20px;font-size:21px;line-height:inherit;color:#333;border:0;border-bottom:1px solid #e5e5e5}label{display:inline-block;max-width:100%;margin-bottom:5px;font-weight:700}input[type=search]{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box;-webkit-appearance:none;-moz-appearance:none;appearance:none}input[type=checkbox],input[type=radio]{margin:4px 0 0;margin-top:1px\9;line-height:normal}fieldset[disabled] input[type=checkbox],fieldset[disabled] input[type=radio],input[type=checkbox].disabled,input[type=checkbox][disabled],input[type=radio].disabled,input[type=radio][disabled]{cursor:not-allowed}input[type=file]{display:block}input[type=range]{display:block;width:100%}select[multiple],select[size]{height:auto}input[type=checkbox]:focus,input[type=file]:focus,input[type=radio]:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}output{display:block;padding-top:7px;font-size:14px;line-height:1.42857143;color:#555}.form-control{display:block;width:100%;height:34px;padding:6px 12px;font-size:14px;line-height:1.42857143;color:#555;background-color:#fff;background-image:none;border:1px solid #ccc;border-radius:4px;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 1px rgba(0,0,0,.075);-webkit-transition:border-color ease-in-out .15s,box-shadow ease-in-out .15s;-o-transition:border-color ease-in-out .15s,box-shadow ease-in-out .15s;-webkit-transition:border-color ease-in-out .15s,-webkit-box-shadow ease-in-out .15s;transition:border-color ease-in-out .15s,-webkit-box-shadow ease-in-out .15s;transition:border-color ease-in-out .15s,box-shadow ease-in-out .15s;transition:border-color ease-in-out .15s,box-shadow ease-in-out .15s,-webkit-box-shadow ease-in-out .15s}.form-control:focus{border-color:#66afe9;outline:0;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 8px rgba(102,175,233,.6);box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 8px rgba(102,175,233,.6)}.form-control::-moz-placeholder{color:#999;opacity:1}.form-control:-ms-input-placeholder{color:#999}.form-control::-webkit-input-placeholder{color:#999}.form-control::-ms-expand{background-color:transparent;border:0}.form-control[disabled],.form-control[readonly],fieldset[disabled] .form-control{background-color:#eee;opacity:1}.form-control[disabled],fieldset[disabled] .form-control{cursor:not-allowed}textarea.form-control{height:auto}@media screen and (-webkit-min-device-pixel-ratio:0){input[type=date].form-control,input[type=datetime-local].form-control,input[type=month].form-control,input[type=time].form-control{line-height:34px}.input-group-sm input[type=date],.input-group-sm input[type=datetime-local],.input-group-sm input[type=month],.input-group-sm input[type=time],input[type=date].input-sm,input[type=datetime-local].input-sm,input[type=month].input-sm,input[type=time].input-sm{line-height:30px}.input-group-lg input[type=date],.input-group-lg input[type=datetime-local],.input-group-lg input[type=month],.input-group-lg input[type=time],input[type=date].input-lg,input[type=datetime-local].input-lg,input[type=month].input-lg,input[type=time].input-lg{line-height:46px}}.form-group{margin-bottom:15px}.checkbox,.radio{position:relative;display:block;margin-top:10px;margin-bottom:10px}.checkbox.disabled label,.radio.disabled label,fieldset[disabled] .checkbox label,fieldset[disabled] .radio label{cursor:not-allowed}.checkbox label,.radio label{min-height:20px;padding-left:20px;margin-bottom:0;font-weight:400;cursor:pointer}.checkbox input[type=checkbox],.checkbox-inline input[type=checkbox],.radio input[type=radio],.radio-inline input[type=radio]{position:absolute;margin-top:4px\9;margin-left:-20px}.checkbox+.checkbox,.radio+.radio{margin-top:-5px}.checkbox-inline,.radio-inline{position:relative;display:inline-block;padding-left:20px;margin-bottom:0;font-weight:400;vertical-align:middle;cursor:pointer}.checkbox-inline.disabled,.radio-inline.disabled,fieldset[disabled] .checkbox-inline,fieldset[disabled] .radio-inline{cursor:not-allowed}.checkbox-inline+.checkbox-inline,.radio-inline+.radio-inline{margin-top:0;margin-left:10px}.form-control-static{min-height:34px;padding-top:7px;padding-bottom:7px;margin-bottom:0}.form-control-static.input-lg,.form-control-static.input-sm{padding-right:0;padding-left:0}.input-sm{height:30px;padding:5px 10px;font-size:12px;line-height:1.5;border-radius:3px}select.input-sm{height:30px;line-height:30px}select[multiple].input-sm,textarea.input-sm{height:auto}.form-group-sm .form-control{height:30px;padding:5px 10px;font-size:12px;line-height:1.5;border-radius:3px}.form-group-sm select.form-control{height:30px;line-height:30px}.form-group-sm select[multiple].form-control,.form-group-sm textarea.form-control{height:auto}.form-group-sm .form-control-static{height:30px;min-height:32px;padding:6px 10px;font-size:12px;line-height:1.5}.input-lg{height:46px;padding:10px 16px;font-size:18px;line-height:1.3333333;border-radius:6px}select.input-lg{height:46px;line-height:46px}select[multiple].input-lg,textarea.input-lg{height:auto}.form-group-lg .form-control{height:46px;padding:10px 16px;font-size:18px;line-height:1.3333333;border-radius:6px}.form-group-lg select.form-control{height:46px;line-height:46px}.form-group-lg select[multiple].form-control,.form-group-lg textarea.form-control{height:auto}.form-group-lg .form-control-static{height:46px;min-height:38px;padding:11px 16px;font-size:18px;line-height:1.3333333}.has-feedback{position:relative}.has-feedback .form-control{padding-right:42.5px}.form-control-feedback{position:absolute;top:0;right:0;z-index:2;display:block;width:34px;height:34px;line-height:34px;text-align:center;pointer-events:none}.form-group-lg .form-control+.form-control-feedback,.input-group-lg+.form-control-feedback,.input-lg+.form-control-feedback{width:46px;height:46px;line-height:46px}.form-group-sm .form-control+.form-control-feedback,.input-group-sm+.form-control-feedback,.input-sm+.form-control-feedback{width:30px;height:30px;line-height:30px}.has-success .checkbox,.has-success .checkbox-inline,.has-success .control-label,.has-success .help-block,.has-success .radio,.has-success .radio-inline,.has-success.checkbox label,.has-success.checkbox-inline label,.has-success.radio label,.has-success.radio-inline label{color:#3c763d}.has-success .form-control{border-color:#3c763d;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 1px rgba(0,0,0,.075)}.has-success .form-control:focus{border-color:#2b542c;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #67b168;box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #67b168}.has-success .input-group-addon{color:#3c763d;background-color:#dff0d8;border-color:#3c763d}.has-success .form-control-feedback{color:#3c763d}.has-warning .checkbox,.has-warning .checkbox-inline,.has-warning .control-label,.has-warning .help-block,.has-warning .radio,.has-warning .radio-inline,.has-warning.checkbox label,.has-warning.checkbox-inline label,.has-warning.radio label,.has-warning.radio-inline label{color:#8a6d3b}.has-warning .form-control{border-color:#8a6d3b;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 1px rgba(0,0,0,.075)}.has-warning .form-control:focus{border-color:#66512c;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #c0a16b;box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #c0a16b}.has-warning .input-group-addon{color:#8a6d3b;background-color:#fcf8e3;border-color:#8a6d3b}.has-warning .form-control-feedback{color:#8a6d3b}.has-error .checkbox,.has-error .checkbox-inline,.has-error .control-label,.has-error .help-block,.has-error .radio,.has-error .radio-inline,.has-error.checkbox label,.has-error.checkbox-inline label,.has-error.radio label,.has-error.radio-inline label{color:#a94442}.has-error .form-control{border-color:#a94442;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 1px rgba(0,0,0,.075)}.has-error .form-control:focus{border-color:#843534;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #ce8483;box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #ce8483}.has-error .input-group-addon{color:#a94442;background-color:#f2dede;border-color:#a94442}.has-error .form-control-feedback{color:#a94442}.has-feedback label~.form-control-feedback{top:25px}.has-feedback label.sr-only~.form-control-feedback{top:0}.help-block{display:block;margin-top:5px;margin-bottom:10px;color:#737373}@media (min-width:768px){.form-inline .form-group{display:inline-block;margin-bottom:0;vertical-align:middle}.form-inline .form-control{display:inline-block;width:auto;vertical-align:middle}.form-inline .form-control-static{display:inline-block}.form-inline .input-group{display:inline-table;vertical-align:middle}.form-inline .input-group .form-control,.form-inline .input-group .input-group-addon,.form-inline .input-group .input-group-btn{width:auto}.form-inline .input-group>.form-control{width:100%}.form-inline .control-label{margin-bottom:0;vertical-align:middle}.form-inline .checkbox,.form-inline .radio{display:inline-block;margin-top:0;margin-bottom:0;vertical-align:middle}.form-inline .checkbox label,.form-inline .radio label{padding-left:0}.form-inline .checkbox input[type=checkbox],.form-inline .radio input[type=radio]{position:relative;margin-left:0}.form-inline .has-feedback .form-control-feedback{top:0}}.form-horizontal .checkbox,.form-horizontal .checkbox-inline,.form-horizontal .radio,.form-horizontal .radio-inline{padding-top:7px;margin-top:0;margin-bottom:0}.form-horizontal .checkbox,.form-horizontal .radio{min-height:27px}.form-horizontal .form-group{margin-right:-15px;margin-left:-15px}@media (min-width:768px){.form-horizontal .control-label{padding-top:7px;margin-bottom:0;text-align:right}}.form-horizontal .has-feedback .form-control-feedback{right:15px}@media (min-width:768px){.form-horizontal .form-group-lg .control-label{padding-top:11px;font-size:18px}}@media (min-width:768px){.form-horizontal .form-group-sm .control-label{padding-top:6px;font-size:12px}}.btn{display:inline-block;margin-bottom:0;font-weight:400;text-align:center;white-space:nowrap;vertical-align:middle;-ms-touch-action:manipulation;touch-action:manipulation;cursor:pointer;background-image:none;border:1px solid transparent;padding:6px 12px;font-size:14px;line-height:1.42857143;border-radius:4px;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none}.btn.active.focus,.btn.active:focus,.btn.focus,.btn:active.focus,.btn:active:focus,.btn:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}.btn.focus,.btn:focus,.btn:hover{color:#333;text-decoration:none}.btn.active,.btn:active{background-image:none;outline:0;-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125);box-shadow:inset 0 3px 5px rgba(0,0,0,.125)}.btn.disabled,.btn[disabled],fieldset[disabled] .btn{cursor:not-allowed;filter:alpha(opacity=65);opacity:.65;-webkit-box-shadow:none;box-shadow:none}a.btn.disabled,fieldset[disabled] a.btn{pointer-events:none}.btn-default{color:#333;background-color:#fff;border-color:#ccc}.btn-default.focus,.btn-default:focus{color:#333;background-color:#e6e6e6;border-color:#8c8c8c}.btn-default:hover{color:#333;background-color:#e6e6e6;border-color:#adadad}.btn-default.active,.btn-default:active,.open>.dropdown-toggle.btn-default{color:#333;background-color:#e6e6e6;background-image:none;border-color:#adadad}.btn-default.active.focus,.btn-default.active:focus,.btn-default.active:hover,.btn-default:active.focus,.btn-default:active:focus,.btn-default:active:hover,.open>.dropdown-toggle.btn-default.focus,.open>.dropdown-toggle.btn-default:focus,.open>.dropdown-toggle.btn-default:hover{color:#333;background-color:#d4d4d4;border-color:#8c8c8c}.btn-default.disabled.focus,.btn-default.disabled:focus,.btn-default.disabled:hover,.btn-default[disabled].focus,.btn-default[disabled]:focus,.btn-default[disabled]:hover,fieldset[disabled] .btn-default.focus,fieldset[disabled] .btn-default:focus,fieldset[disabled] .btn-default:hover{background-color:#fff;border-color:#ccc}.btn-default .badge{color:#fff;background-color:#333}.btn-primary{color:#fff;background-color:#337ab7;border-color:#2e6da4}.btn-primary.focus,.btn-primary:focus{color:#fff;background-color:#286090;border-color:#122b40}.btn-primary:hover{color:#fff;background-color:#286090;border-color:#204d74}.btn-primary.active,.btn-primary:active,.open>.dropdown-toggle.btn-primary{color:#fff;background-color:#286090;background-image:none;border-color:#204d74}.btn-primary.active.focus,.btn-primary.active:focus,.btn-primary.active:hover,.btn-primary:active.focus,.btn-primary:active:focus,.btn-primary:active:hover,.open>.dropdown-toggle.btn-primary.focus,.open>.dropdown-toggle.btn-primary:focus,.open>.dropdown-toggle.btn-primary:hover{color:#fff;background-color:#204d74;border-color:#122b40}.btn-primary.disabled.focus,.btn-primary.disabled:focus,.btn-primary.disabled:hover,.btn-primary[disabled].focus,.btn-primary[disabled]:focus,.btn-primary[disabled]:hover,fieldset[disabled] .btn-primary.focus,fieldset[disabled] .btn-primary:focus,fieldset[disabled] .btn-primary:hover{background-color:#337ab7;border-color:#2e6da4}.btn-primary .badge{color:#337ab7;background-color:#fff}.btn-success{color:#fff;background-color:#5cb85c;border-color:#4cae4c}.btn-success.focus,.btn-success:focus{color:#fff;background-color:#449d44;border-color:#255625}.btn-success:hover{color:#fff;background-color:#449d44;border-color:#398439}.btn-success.active,.btn-success:active,.open>.dropdown-toggle.btn-success{color:#fff;background-color:#449d44;background-image:none;border-color:#398439}.btn-success.active.focus,.btn-success.active:focus,.btn-success.active:hover,.btn-success:active.focus,.btn-success:active:focus,.btn-success:active:hover,.open>.dropdown-toggle.btn-success.focus,.open>.dropdown-toggle.btn-success:focus,.open>.dropdown-toggle.btn-success:hover{color:#fff;background-color:#398439;border-color:#255625}.btn-success.disabled.focus,.btn-success.disabled:focus,.btn-success.disabled:hover,.btn-success[disabled].focus,.btn-success[disabled]:focus,.btn-success[disabled]:hover,fieldset[disabled] .btn-success.focus,fieldset[disabled] .btn-success:focus,fieldset[disabled] .btn-success:hover{background-color:#5cb85c;border-color:#4cae4c}.btn-success .badge{color:#5cb85c;background-color:#fff}.btn-info{color:#fff;background-color:#5bc0de;border-color:#46b8da}.btn-info.focus,.btn-info:focus{color:#fff;background-color:#31b0d5;border-color:#1b6d85}.btn-info:hover{color:#fff;background-color:#31b0d5;border-color:#269abc}.btn-info.active,.btn-info:active,.open>.dropdown-toggle.btn-info{color:#fff;background-color:#31b0d5;background-image:none;border-color:#269abc}.btn-info.active.focus,.btn-info.active:focus,.btn-info.active:hover,.btn-info:active.focus,.btn-info:active:focus,.btn-info:active:hover,.open>.dropdown-toggle.btn-info.focus,.open>.dropdown-toggle.btn-info:focus,.open>.dropdown-toggle.btn-info:hover{color:#fff;background-color:#269abc;border-color:#1b6d85}.btn-info.disabled.focus,.btn-info.disabled:focus,.btn-info.disabled:hover,.btn-info[disabled].focus,.btn-info[disabled]:focus,.btn-info[disabled]:hover,fieldset[disabled] .btn-info.focus,fieldset[disabled] .btn-info:focus,fieldset[disabled] .btn-info:hover{background-color:#5bc0de;border-color:#46b8da}.btn-info .badge{color:#5bc0de;background-color:#fff}.btn-warning{color:#fff;background-color:#f0ad4e;border-color:#eea236}.btn-warning.focus,.btn-warning:focus{color:#fff;background-color:#ec971f;border-color:#985f0d}.btn-warning:hover{color:#fff;background-color:#ec971f;border-color:#d58512}.btn-warning.active,.btn-warning:active,.open>.dropdown-toggle.btn-warning{color:#fff;background-color:#ec971f;background-image:none;border-color:#d58512}.btn-warning.active.focus,.btn-warning.active:focus,.btn-warning.active:hover,.btn-warning:active.focus,.btn-warning:active:focus,.btn-warning:active:hover,.open>.dropdown-toggle.btn-warning.focus,.open>.dropdown-toggle.btn-warning:focus,.open>.dropdown-toggle.btn-warning:hover{color:#fff;background-color:#d58512;border-color:#985f0d}.btn-warning.disabled.focus,.btn-warning.disabled:focus,.btn-warning.disabled:hover,.btn-warning[disabled].focus,.btn-warning[disabled]:focus,.btn-warning[disabled]:hover,fieldset[disabled] .btn-warning.focus,fieldset[disabled] .btn-warning:focus,fieldset[disabled] .btn-warning:hover{background-color:#f0ad4e;border-color:#eea236}.btn-warning .badge{color:#f0ad4e;background-color:#fff}.btn-danger{color:#fff;background-color:#d9534f;border-color:#d43f3a}.btn-danger.focus,.btn-danger:focus{color:#fff;background-color:#c9302c;border-color:#761c19}.btn-danger:hover{color:#fff;background-color:#c9302c;border-color:#ac2925}.btn-danger.active,.btn-danger:active,.open>.dropdown-toggle.btn-danger{color:#fff;background-color:#c9302c;background-image:none;border-color:#ac2925}.btn-danger.active.focus,.btn-danger.active:focus,.btn-danger.active:hover,.btn-danger:active.focus,.btn-danger:active:focus,.btn-danger:active:hover,.open>.dropdown-toggle.btn-danger.focus,.open>.dropdown-toggle.btn-danger:focus,.open>.dropdown-toggle.btn-danger:hover{color:#fff;background-color:#ac2925;border-color:#761c19}.btn-danger.disabled.focus,.btn-danger.disabled:focus,.btn-danger.disabled:hover,.btn-danger[disabled].focus,.btn-danger[disabled]:focus,.btn-danger[disabled]:hover,fieldset[disabled] .btn-danger.focus,fieldset[disabled] .btn-danger:focus,fieldset[disabled] .btn-danger:hover{background-color:#d9534f;border-color:#d43f3a}.btn-danger .badge{color:#d9534f;background-color:#fff}.btn-link{font-weight:400;color:#337ab7;border-radius:0}.btn-link,.btn-link.active,.btn-link:active,.btn-link[disabled],fieldset[disabled] .btn-link{background-color:transparent;-webkit-box-shadow:none;box-shadow:none}.btn-link,.btn-link:active,.btn-link:focus,.btn-link:hover{border-color:transparent}.btn-link:focus,.btn-link:hover{color:#23527c;text-decoration:underline;background-color:transparent}.btn-link[disabled]:focus,.btn-link[disabled]:hover,fieldset[disabled] .btn-link:focus,fieldset[disabled] .btn-link:hover{color:#777;text-decoration:none}.btn-group-lg>.btn,.btn-lg{padding:10px 16px;font-size:18px;line-height:1.3333333;border-radius:6px}.btn-group-sm>.btn,.btn-sm{padding:5px 10px;font-size:12px;line-height:1.5;border-radius:3px}.btn-group-xs>.btn,.btn-xs{padding:1px 5px;font-size:12px;line-height:1.5;border-radius:3px}.btn-block{display:block;width:100%}.btn-block+.btn-block{margin-top:5px}input[type=button].btn-block,input[type=reset].btn-block,input[type=submit].btn-block{width:100%}.fade{opacity:0;-webkit-transition:opacity .15s linear;-o-transition:opacity .15s linear;transition:opacity .15s linear}.fade.in{opacity:1}.collapse{display:none}.collapse.in{display:block}tr.collapse.in{display:table-row}tbody.collapse.in{display:table-row-group}.collapsing{position:relative;height:0;overflow:hidden;-webkit-transition-property:height,visibility;-o-transition-property:height,visibility;transition-property:height,visibility;-webkit-transition-duration:.35s;-o-transition-duration:.35s;transition-duration:.35s;-webkit-transition-timing-function:ease;-o-transition-timing-function:ease;transition-timing-function:ease}.caret{display:inline-block;width:0;height:0;margin-left:2px;vertical-align:middle;border-top:4px dashed;border-top:4px solid\9;border-right:4px solid transparent;border-left:4px solid transparent}.dropdown,.dropup{position:relative}.dropdown-toggle:focus{outline:0}.dropdown-menu{position:absolute;top:100%;left:0;z-index:1000;display:none;float:left;min-width:160px;padding:5px 0;margin:2px 0 0;font-size:14px;text-align:left;list-style:none;background-color:#fff;background-clip:padding-box;border:1px solid #ccc;border:1px solid rgba(0,0,0,.15);border-radius:4px;-webkit-box-shadow:0 6px 12px rgba(0,0,0,.175);box-shadow:0 6px 12px rgba(0,0,0,.175)}.dropdown-menu.pull-right{right:0;left:auto}.dropdown-menu .divider{height:1px;margin:9px 0;overflow:hidden;background-color:#e5e5e5}.dropdown-menu>li>a{display:block;padding:3px 20px;clear:both;font-weight:400;line-height:1.42857143;color:#333;white-space:nowrap}.dropdown-menu>li>a:focus,.dropdown-menu>li>a:hover{color:#262626;text-decoration:none;background-color:#f5f5f5}.dropdown-menu>.active>a,.dropdown-menu>.active>a:focus,.dropdown-menu>.active>a:hover{color:#fff;text-decoration:none;background-color:#337ab7;outline:0}.dropdown-menu>.disabled>a,.dropdown-menu>.disabled>a:focus,.dropdown-menu>.disabled>a:hover{color:#777}.dropdown-menu>.disabled>a:focus,.dropdown-menu>.disabled>a:hover{text-decoration:none;cursor:not-allowed;background-color:transparent;background-image:none;filter:progid:DXImageTransform.Microsoft.gradient(enabled=false)}.open>.dropdown-menu{display:block}.open>a{outline:0}.dropdown-menu-right{right:0;left:auto}.dropdown-menu-left{right:auto;left:0}.dropdown-header{display:block;padding:3px 20px;font-size:12px;line-height:1.42857143;color:#777;white-space:nowrap}.dropdown-backdrop{position:fixed;top:0;right:0;bottom:0;left:0;z-index:990}.pull-right>.dropdown-menu{right:0;left:auto}.dropup .caret,.navbar-fixed-bottom .dropdown .caret{content:"";border-top:0;border-bottom:4px dashed;border-bottom:4px solid\9}.dropup .dropdown-menu,.navbar-fixed-bottom .dropdown .dropdown-menu{top:auto;bottom:100%;margin-bottom:2px}@media (min-width:768px){.navbar-right .dropdown-menu{right:0;left:auto}.navbar-right .dropdown-menu-left{right:auto;left:0}}.btn-group,.btn-group-vertical{position:relative;display:inline-block;vertical-align:middle}.btn-group-vertical>.btn,.btn-group>.btn{position:relative;float:left}.btn-group-vertical>.btn.active,.btn-group-vertical>.btn:active,.btn-group-vertical>.btn:focus,.btn-group-vertical>.btn:hover,.btn-group>.btn.active,.btn-group>.btn:active,.btn-group>.btn:focus,.btn-group>.btn:hover{z-index:2}.btn-group .btn+.btn,.btn-group .btn+.btn-group,.btn-group .btn-group+.btn,.btn-group .btn-group+.btn-group{margin-left:-1px}.btn-toolbar{margin-left:-5px}.btn-toolbar .btn,.btn-toolbar .btn-group,.btn-toolbar .input-group{float:left}.btn-toolbar>.btn,.btn-toolbar>.btn-group,.btn-toolbar>.input-group{margin-left:5px}.btn-group>.btn:not(:first-child):not(:last-child):not(.dropdown-toggle){border-radius:0}.btn-group>.btn:first-child{margin-left:0}.btn-group>.btn:first-child:not(:last-child):not(.dropdown-toggle){border-top-right-radius:0;border-bottom-right-radius:0}.btn-group>.btn:last-child:not(:first-child),.btn-group>.dropdown-toggle:not(:first-child){border-top-left-radius:0;border-bottom-left-radius:0}.btn-group>.btn-group{float:left}.btn-group>.btn-group:not(:first-child):not(:last-child)>.btn{border-radius:0}.btn-group>.btn-group:first-child:not(:last-child)>.btn:last-child,.btn-group>.btn-group:first-child:not(:last-child)>.dropdown-toggle{border-top-right-radius:0;border-bottom-right-radius:0}.btn-group>.btn-group:last-child:not(:first-child)>.btn:first-child{border-top-left-radius:0;border-bottom-left-radius:0}.btn-group .dropdown-toggle:active,.btn-group.open .dropdown-toggle{outline:0}.btn-group>.btn+.dropdown-toggle{padding-right:8px;padding-left:8px}.btn-group>.btn-lg+.dropdown-toggle{padding-right:12px;padding-left:12px}.btn-group.open .dropdown-toggle{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125);box-shadow:inset 0 3px 5px rgba(0,0,0,.125)}.btn-group.open .dropdown-toggle.btn-link{-webkit-box-shadow:none;box-shadow:none}.btn .caret{margin-left:0}.btn-lg .caret{border-width:5px 5px 0;border-bottom-width:0}.dropup .btn-lg .caret{border-width:0 5px 5px}.btn-group-vertical>.btn,.btn-group-vertical>.btn-group,.btn-group-vertical>.btn-group>.btn{display:block;float:none;width:100%;max-width:100%}.btn-group-vertical>.btn-group>.btn{float:none}.btn-group-vertical>.btn+.btn,.btn-group-vertical>.btn+.btn-group,.btn-group-vertical>.btn-group+.btn,.btn-group-vertical>.btn-group+.btn-group{margin-top:-1px;margin-left:0}.btn-group-vertical>.btn:not(:first-child):not(:last-child){border-radius:0}.btn-group-vertical>.btn:first-child:not(:last-child){border-top-left-radius:4px;border-top-right-radius:4px;border-bottom-right-radius:0;border-bottom-left-radius:0}.btn-group-vertical>.btn:last-child:not(:first-child){border-top-left-radius:0;border-top-right-radius:0;border-bottom-right-radius:4px;border-bottom-left-radius:4px}.btn-group-vertical>.btn-group:not(:first-child):not(:last-child)>.btn{border-radius:0}.btn-group-vertical>.btn-group:first-child:not(:last-child)>.btn:last-child,.btn-group-vertical>.btn-group:first-child:not(:last-child)>.dropdown-toggle{border-bottom-right-radius:0;border-bottom-left-radius:0}.btn-group-vertical>.btn-group:last-child:not(:first-child)>.btn:first-child{border-top-left-radius:0;border-top-right-radius:0}.btn-group-justified{display:table;width:100%;table-layout:fixed;border-collapse:separate}.btn-group-justified>.btn,.btn-group-justified>.btn-group{display:table-cell;float:none;width:1%}.btn-group-justified>.btn-group .btn{width:100%}.btn-group-justified>.btn-group .dropdown-menu{left:auto}[data-toggle=buttons]>.btn input[type=checkbox],[data-toggle=buttons]>.btn input[type=radio],[data-toggle=buttons]>.btn-group>.btn input[type=checkbox],[data-toggle=buttons]>.btn-group>.btn input[type=radio]{position:absolute;clip:rect(0,0,0,0);pointer-events:none}.input-group{position:relative;display:table;border-collapse:separate}.input-group[class*=col-]{float:none;padding-right:0;padding-left:0}.input-group .form-control{position:relative;z-index:2;float:left;width:100%;margin-bottom:0}.input-group .form-control:focus{z-index:3}.input-group-lg>.form-control,.input-group-lg>.input-group-addon,.input-group-lg>.input-group-btn>.btn{height:46px;padding:10px 16px;font-size:18px;line-height:1.3333333;border-radius:6px}select.input-group-lg>.form-control,select.input-group-lg>.input-group-addon,select.input-group-lg>.input-group-btn>.btn{height:46px;line-height:46px}select[multiple].input-group-lg>.form-control,select[multiple].input-group-lg>.input-group-addon,select[multiple].input-group-lg>.input-group-btn>.btn,textarea.input-group-lg>.form-control,textarea.input-group-lg>.input-group-addon,textarea.input-group-lg>.input-group-btn>.btn{height:auto}.input-group-sm>.form-control,.input-group-sm>.input-group-addon,.input-group-sm>.input-group-btn>.btn{height:30px;padding:5px 10px;font-size:12px;line-height:1.5;border-radius:3px}select.input-group-sm>.form-control,select.input-group-sm>.input-group-addon,select.input-group-sm>.input-group-btn>.btn{height:30px;line-height:30px}select[multiple].input-group-sm>.form-control,select[multiple].input-group-sm>.input-group-addon,select[multiple].input-group-sm>.input-group-btn>.btn,textarea.input-group-sm>.form-control,textarea.input-group-sm>.input-group-addon,textarea.input-group-sm>.input-group-btn>.btn{height:auto}.input-group .form-control,.input-group-addon,.input-group-btn{display:table-cell}.input-group .form-control:not(:first-child):not(:last-child),.input-group-addon:not(:first-child):not(:last-child),.input-group-btn:not(:first-child):not(:last-child){border-radius:0}.input-group-addon,.input-group-btn{width:1%;white-space:nowrap;vertical-align:middle}.input-group-addon{padding:6px 12px;font-size:14px;font-weight:400;line-height:1;color:#555;text-align:center;background-color:#eee;border:1px solid #ccc;border-radius:4px}.input-group-addon.input-sm{padding:5px 10px;font-size:12px;border-radius:3px}.input-group-addon.input-lg{padding:10px 16px;font-size:18px;border-radius:6px}.input-group-addon input[type=checkbox],.input-group-addon input[type=radio]{margin-top:0}.input-group .form-control:first-child,.input-group-addon:first-child,.input-group-btn:first-child>.btn,.input-group-btn:first-child>.btn-group>.btn,.input-group-btn:first-child>.dropdown-toggle,.input-group-btn:last-child>.btn-group:not(:last-child)>.btn,.input-group-btn:last-child>.btn:not(:last-child):not(.dropdown-toggle){border-top-right-radius:0;border-bottom-right-radius:0}.input-group-addon:first-child{border-right:0}.input-group .form-control:last-child,.input-group-addon:last-child,.input-group-btn:first-child>.btn-group:not(:first-child)>.btn,.input-group-btn:first-child>.btn:not(:first-child),.input-group-btn:last-child>.btn,.input-group-btn:last-child>.btn-group>.btn,.input-group-btn:last-child>.dropdown-toggle{border-top-left-radius:0;border-bottom-left-radius:0}.input-group-addon:last-child{border-left:0}.input-group-btn{position:relative;font-size:0;white-space:nowrap}.input-group-btn>.btn{position:relative}.input-group-btn>.btn+.btn{margin-left:-1px}.input-group-btn>.btn:active,.input-group-btn>.btn:focus,.input-group-btn>.btn:hover{z-index:2}.input-group-btn:first-child>.btn,.input-group-btn:first-child>.btn-group{margin-right:-1px}.input-group-btn:last-child>.btn,.input-group-btn:last-child>.btn-group{z-index:2;margin-left:-1px}.nav{padding-left:0;margin-bottom:0;list-style:none}.nav>li{position:relative;display:block}.nav>li>a{position:relative;display:block;padding:10px 15px}.nav>li>a:focus,.nav>li>a:hover{text-decoration:none;background-color:#eee}.nav>li.disabled>a{color:#777}.nav>li.disabled>a:focus,.nav>li.disabled>a:hover{color:#777;text-decoration:none;cursor:not-allowed;background-color:transparent}.nav .open>a,.nav .open>a:focus,.nav .open>a:hover{background-color:#eee;border-color:#337ab7}.nav .nav-divider{height:1px;margin:9px 0;overflow:hidden;background-color:#e5e5e5}.nav>li>a>img{max-width:none}.nav-tabs{border-bottom:1px solid #ddd}.nav-tabs>li{float:left;margin-bottom:-1px}.nav-tabs>li>a{margin-right:2px;line-height:1.42857143;border:1px solid transparent;border-radius:4px 4px 0 0}.nav-tabs>li>a:hover{border-color:#eee #eee #ddd}.nav-tabs>li.active>a,.nav-tabs>li.active>a:focus,.nav-tabs>li.active>a:hover{color:#555;cursor:default;background-color:#fff;border:1px solid #ddd;border-bottom-color:transparent}.nav-tabs.nav-justified{width:100%;border-bottom:0}.nav-tabs.nav-justified>li{float:none}.nav-tabs.nav-justified>li>a{margin-bottom:5px;text-align:center}.nav-tabs.nav-justified>.dropdown .dropdown-menu{top:auto;left:auto}@media (min-width:768px){.nav-tabs.nav-justified>li{display:table-cell;width:1%}.nav-tabs.nav-justified>li>a{margin-bottom:0}}.nav-tabs.nav-justified>li>a{margin-right:0;border-radius:4px}.nav-tabs.nav-justified>.active>a,.nav-tabs.nav-justified>.active>a:focus,.nav-tabs.nav-justified>.active>a:hover{border:1px solid #ddd}@media (min-width:768px){.nav-tabs.nav-justified>li>a{border-bottom:1px solid #ddd;border-radius:4px 4px 0 0}.nav-tabs.nav-justified>.active>a,.nav-tabs.nav-justified>.active>a:focus,.nav-tabs.nav-justified>.active>a:hover{border-bottom-color:#fff}}.nav-pills>li{float:left}.nav-pills>li>a{border-radius:4px}.nav-pills>li+li{margin-left:2px}.nav-pills>li.active>a,.nav-pills>li.active>a:focus,.nav-pills>li.active>a:hover{color:#fff;background-color:#337ab7}.nav-stacked>li{float:none}.nav-stacked>li+li{margin-top:2px;margin-left:0}.nav-justified{width:100%}.nav-justified>li{float:none}.nav-justified>li>a{margin-bottom:5px;text-align:center}.nav-justified>.dropdown .dropdown-menu{top:auto;left:auto}@media (min-width:768px){.nav-justified>li{display:table-cell;width:1%}.nav-justified>li>a{margin-bottom:0}}.nav-tabs-justified{border-bottom:0}.nav-tabs-justified>li>a{margin-right:0;border-radius:4px}.nav-tabs-justified>.active>a,.nav-tabs-justified>.active>a:focus,.nav-tabs-justified>.active>a:hover{border:1px solid #ddd}@media (min-width:768px){.nav-tabs-justified>li>a{border-bottom:1px solid #ddd;border-radius:4px 4px 0 0}.nav-tabs-justified>.active>a,.nav-tabs-justified>.active>a:focus,.nav-tabs-justified>.active>a:hover{border-bottom-color:#fff}}.tab-content>.tab-pane{display:none}.tab-content>.active{display:block}.nav-tabs .dropdown-menu{margin-top:-1px;border-top-left-radius:0;border-top-right-radius:0}.navbar{position:relative;min-height:50px;margin-bottom:20px;border:1px solid transparent}@media (min-width:768px){.navbar{border-radius:4px}}@media (min-width:768px){.navbar-header{float:left}}.navbar-collapse{padding-right:15px;padding-left:15px;overflow-x:visible;border-top:1px solid transparent;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,.1);box-shadow:inset 0 1px 0 rgba(255,255,255,.1);-webkit-overflow-scrolling:touch}.navbar-collapse.in{overflow-y:auto}@media (min-width:768px){.navbar-collapse{width:auto;border-top:0;-webkit-box-shadow:none;box-shadow:none}.navbar-collapse.collapse{display:block!important;height:auto!important;padding-bottom:0;overflow:visible!important}.navbar-collapse.in{overflow-y:visible}.navbar-fixed-bottom .navbar-collapse,.navbar-fixed-top .navbar-collapse,.navbar-static-top .navbar-collapse{padding-right:0;padding-left:0}}.navbar-fixed-bottom,.navbar-fixed-top{position:fixed;right:0;left:0;z-index:1030}.navbar-fixed-bottom .navbar-collapse,.navbar-fixed-top .navbar-collapse{max-height:340px}@media (max-device-width:480px) and (orientation:landscape){.navbar-fixed-bottom .navbar-collapse,.navbar-fixed-top .navbar-collapse{max-height:200px}}@media (min-width:768px){.navbar-fixed-bottom,.navbar-fixed-top{border-radius:0}}.navbar-fixed-top{top:0;border-width:0 0 1px}.navbar-fixed-bottom{bottom:0;margin-bottom:0;border-width:1px 0 0}.container-fluid>.navbar-collapse,.container-fluid>.navbar-header,.container>.navbar-collapse,.container>.navbar-header{margin-right:-15px;margin-left:-15px}@media (min-width:768px){.container-fluid>.navbar-collapse,.container-fluid>.navbar-header,.container>.navbar-collapse,.container>.navbar-header{margin-right:0;margin-left:0}}.navbar-static-top{z-index:1000;border-width:0 0 1px}@media (min-width:768px){.navbar-static-top{border-radius:0}}.navbar-brand{float:left;height:50px;padding:15px 15px;font-size:18px;line-height:20px}.navbar-brand:focus,.navbar-brand:hover{text-decoration:none}.navbar-brand>img{display:block}@media (min-width:768px){.navbar>.container .navbar-brand,.navbar>.container-fluid .navbar-brand{margin-left:-15px}}.navbar-toggle{position:relative;float:right;padding:9px 10px;margin-right:15px;margin-top:8px;margin-bottom:8px;background-color:transparent;background-image:none;border:1px solid transparent;border-radius:4px}.navbar-toggle:focus{outline:0}.navbar-toggle .icon-bar{display:block;width:22px;height:2px;border-radius:1px}.navbar-toggle .icon-bar+.icon-bar{margin-top:4px}@media (min-width:768px){.navbar-toggle{display:none}}.navbar-nav{margin:7.5px -15px}.navbar-nav>li>a{padding-top:10px;padding-bottom:10px;line-height:20px}@media (max-width:767px){.navbar-nav .open .dropdown-menu{position:static;float:none;width:auto;margin-top:0;background-color:transparent;border:0;-webkit-box-shadow:none;box-shadow:none}.navbar-nav .open .dropdown-menu .dropdown-header,.navbar-nav .open .dropdown-menu>li>a{padding:5px 15px 5px 25px}.navbar-nav .open .dropdown-menu>li>a{line-height:20px}.navbar-nav .open .dropdown-menu>li>a:focus,.navbar-nav .open .dropdown-menu>li>a:hover{background-image:none}}@media (min-width:768px){.navbar-nav{float:left;margin:0}.navbar-nav>li{float:left}.navbar-nav>li>a{padding-top:15px;padding-bottom:15px}}.navbar-form{padding:10px 15px;margin-right:-15px;margin-left:-15px;border-top:1px solid transparent;border-bottom:1px solid transparent;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,.1),0 1px 0 rgba(255,255,255,.1);box-shadow:inset 0 1px 0 rgba(255,255,255,.1),0 1px 0 rgba(255,255,255,.1);margin-top:8px;margin-bottom:8px}@media (min-width:768px){.navbar-form .form-group{display:inline-block;margin-bottom:0;vertical-align:middle}.navbar-form .form-control{display:inline-block;width:auto;vertical-align:middle}.navbar-form .form-control-static{display:inline-block}.navbar-form .input-group{display:inline-table;vertical-align:middle}.navbar-form .input-group .form-control,.navbar-form .input-group .input-group-addon,.navbar-form .input-group .input-group-btn{width:auto}.navbar-form .input-group>.form-control{width:100%}.navbar-form .control-label{margin-bottom:0;vertical-align:middle}.navbar-form .checkbox,.navbar-form .radio{display:inline-block;margin-top:0;margin-bottom:0;vertical-align:middle}.navbar-form .checkbox label,.navbar-form .radio label{padding-left:0}.navbar-form .checkbox input[type=checkbox],.navbar-form .radio input[type=radio]{position:relative;margin-left:0}.navbar-form .has-feedback .form-control-feedback{top:0}}@media (max-width:767px){.navbar-form .form-group{margin-bottom:5px}.navbar-form .form-group:last-child{margin-bottom:0}}@media (min-width:768px){.navbar-form{width:auto;padding-top:0;padding-bottom:0;margin-right:0;margin-left:0;border:0;-webkit-box-shadow:none;box-shadow:none}}.navbar-nav>li>.dropdown-menu{margin-top:0;border-top-left-radius:0;border-top-right-radius:0}.navbar-fixed-bottom .navbar-nav>li>.dropdown-menu{margin-bottom:0;border-top-left-radius:4px;border-top-right-radius:4px;border-bottom-right-radius:0;border-bottom-left-radius:0}.navbar-btn{margin-top:8px;margin-bottom:8px}.navbar-btn.btn-sm{margin-top:10px;margin-bottom:10px}.navbar-btn.btn-xs{margin-top:14px;margin-bottom:14px}.navbar-text{margin-top:15px;margin-bottom:15px}@media (min-width:768px){.navbar-text{float:left;margin-right:15px;margin-left:15px}}@media (min-width:768px){.navbar-left{float:left!important}.navbar-right{float:right!important;margin-right:-15px}.navbar-right~.navbar-right{margin-right:0}}.navbar-default{background-color:#f8f8f8;border-color:#e7e7e7}.navbar-default .navbar-brand{color:#777}.navbar-default .navbar-brand:focus,.navbar-default .navbar-brand:hover{color:#5e5e5e;background-color:transparent}.navbar-default .navbar-text{color:#777}.navbar-default .navbar-nav>li>a{color:#777}.navbar-default .navbar-nav>li>a:focus,.navbar-default .navbar-nav>li>a:hover{color:#333;background-color:transparent}.navbar-default .navbar-nav>.active>a,.navbar-default .navbar-nav>.active>a:focus,.navbar-default .navbar-nav>.active>a:hover{color:#555;background-color:#e7e7e7}.navbar-default .navbar-nav>.disabled>a,.navbar-default .navbar-nav>.disabled>a:focus,.navbar-default .navbar-nav>.disabled>a:hover{color:#ccc;background-color:transparent}.navbar-default .navbar-nav>.open>a,.navbar-default .navbar-nav>.open>a:focus,.navbar-default .navbar-nav>.open>a:hover{color:#555;background-color:#e7e7e7}@media (max-width:767px){.navbar-default .navbar-nav .open .dropdown-menu>li>a{color:#777}.navbar-default .navbar-nav .open .dropdown-menu>li>a:focus,.navbar-default .navbar-nav .open .dropdown-menu>li>a:hover{color:#333;background-color:transparent}.navbar-default .navbar-nav .open .dropdown-menu>.active>a,.navbar-default .navbar-nav .open .dropdown-menu>.active>a:focus,.navbar-default .navbar-nav .open .dropdown-menu>.active>a:hover{color:#555;background-color:#e7e7e7}.navbar-default .navbar-nav .open .dropdown-menu>.disabled>a,.navbar-default .navbar-nav .open .dropdown-menu>.disabled>a:focus,.navbar-default .navbar-nav .open .dropdown-menu>.disabled>a:hover{color:#ccc;background-color:transparent}}.navbar-default .navbar-toggle{border-color:#ddd}.navbar-default .navbar-toggle:focus,.navbar-default .navbar-toggle:hover{background-color:#ddd}.navbar-default .navbar-toggle .icon-bar{background-color:#888}.navbar-default .navbar-collapse,.navbar-default .navbar-form{border-color:#e7e7e7}.navbar-default .navbar-link{color:#777}.navbar-default .navbar-link:hover{color:#333}.navbar-default .btn-link{color:#777}.navbar-default .btn-link:focus,.navbar-default .btn-link:hover{color:#333}.navbar-default .btn-link[disabled]:focus,.navbar-default .btn-link[disabled]:hover,fieldset[disabled] .navbar-default .btn-link:focus,fieldset[disabled] .navbar-default .btn-link:hover{color:#ccc}.navbar-inverse{background-color:#222;border-color:#080808}.navbar-inverse .navbar-brand{color:#9d9d9d}.navbar-inverse .navbar-brand:focus,.navbar-inverse .navbar-brand:hover{color:#fff;background-color:transparent}.navbar-inverse .navbar-text{color:#9d9d9d}.navbar-inverse .navbar-nav>li>a{color:#9d9d9d}.navbar-inverse .navbar-nav>li>a:focus,.navbar-inverse .navbar-nav>li>a:hover{color:#fff;background-color:transparent}.navbar-inverse .navbar-nav>.active>a,.navbar-inverse .navbar-nav>.active>a:focus,.navbar-inverse .navbar-nav>.active>a:hover{color:#fff;background-color:#080808}.navbar-inverse .navbar-nav>.disabled>a,.navbar-inverse .navbar-nav>.disabled>a:focus,.navbar-inverse .navbar-nav>.disabled>a:hover{color:#444;background-color:transparent}.navbar-inverse .navbar-nav>.open>a,.navbar-inverse .navbar-nav>.open>a:focus,.navbar-inverse .navbar-nav>.open>a:hover{color:#fff;background-color:#080808}@media (max-width:767px){.navbar-inverse .navbar-nav .open .dropdown-menu>.dropdown-header{border-color:#080808}.navbar-inverse .navbar-nav .open .dropdown-menu .divider{background-color:#080808}.navbar-inverse .navbar-nav .open .dropdown-menu>li>a{color:#9d9d9d}.navbar-inverse .navbar-nav .open .dropdown-menu>li>a:focus,.navbar-inverse .navbar-nav .open .dropdown-menu>li>a:hover{color:#fff;background-color:transparent}.navbar-inverse .navbar-nav .open .dropdown-menu>.active>a,.navbar-inverse .navbar-nav .open .dropdown-menu>.active>a:focus,.navbar-inverse .navbar-nav .open .dropdown-menu>.active>a:hover{color:#fff;background-color:#080808}.navbar-inverse .navbar-nav .open .dropdown-menu>.disabled>a,.navbar-inverse .navbar-nav .open .dropdown-menu>.disabled>a:focus,.navbar-inverse .navbar-nav .open .dropdown-menu>.disabled>a:hover{color:#444;background-color:transparent}}.navbar-inverse .navbar-toggle{border-color:#333}.navbar-inverse .navbar-toggle:focus,.navbar-inverse .navbar-toggle:hover{background-color:#333}.navbar-inverse .navbar-toggle .icon-bar{background-color:#fff}.navbar-inverse .navbar-collapse,.navbar-inverse .navbar-form{border-color:#101010}.navbar-inverse .navbar-link{color:#9d9d9d}.navbar-inverse .navbar-link:hover{color:#fff}.navbar-inverse .btn-link{color:#9d9d9d}.navbar-inverse .btn-link:focus,.navbar-inverse .btn-link:hover{color:#fff}.navbar-inverse .btn-link[disabled]:focus,.navbar-inverse .btn-link[disabled]:hover,fieldset[disabled] .navbar-inverse .btn-link:focus,fieldset[disabled] .navbar-inverse .btn-link:hover{color:#444}.breadcrumb{padding:8px 15px;margin-bottom:20px;list-style:none;background-color:#f5f5f5;border-radius:4px}.breadcrumb>li{display:inline-block}.breadcrumb>li+li:before{padding:0 5px;color:#ccc;content:"/\00a0"}.breadcrumb>.active{color:#777}.pagination{display:inline-block;padding-left:0;margin:20px 0;border-radius:4px}.pagination>li{display:inline}.pagination>li>a,.pagination>li>span{position:relative;float:left;padding:6px 12px;margin-left:-1px;line-height:1.42857143;color:#337ab7;text-decoration:none;background-color:#fff;border:1px solid #ddd}.pagination>li>a:focus,.pagination>li>a:hover,.pagination>li>span:focus,.pagination>li>span:hover{z-index:2;color:#23527c;background-color:#eee;border-color:#ddd}.pagination>li:first-child>a,.pagination>li:first-child>span{margin-left:0;border-top-left-radius:4px;border-bottom-left-radius:4px}.pagination>li:last-child>a,.pagination>li:last-child>span{border-top-right-radius:4px;border-bottom-right-radius:4px}.pagination>.active>a,.pagination>.active>a:focus,.pagination>.active>a:hover,.pagination>.active>span,.pagination>.active>span:focus,.pagination>.active>span:hover{z-index:3;color:#fff;cursor:default;background-color:#337ab7;border-color:#337ab7}.pagination>.disabled>a,.pagination>.disabled>a:focus,.pagination>.disabled>a:hover,.pagination>.disabled>span,.pagination>.disabled>span:focus,.pagination>.disabled>span:hover{color:#777;cursor:not-allowed;background-color:#fff;border-color:#ddd}.pagination-lg>li>a,.pagination-lg>li>span{padding:10px 16px;font-size:18px;line-height:1.3333333}.pagination-lg>li:first-child>a,.pagination-lg>li:first-child>span{border-top-left-radius:6px;border-bottom-left-radius:6px}.pagination-lg>li:last-child>a,.pagination-lg>li:last-child>span{border-top-right-radius:6px;border-bottom-right-radius:6px}.pagination-sm>li>a,.pagination-sm>li>span{padding:5px 10px;font-size:12px;line-height:1.5}.pagination-sm>li:first-child>a,.pagination-sm>li:first-child>span{border-top-left-radius:3px;border-bottom-left-radius:3px}.pagination-sm>li:last-child>a,.pagination-sm>li:last-child>span{border-top-right-radius:3px;border-bottom-right-radius:3px}.pager{padding-left:0;margin:20px 0;text-align:center;list-style:none}.pager li{display:inline}.pager li>a,.pager li>span{display:inline-block;padding:5px 14px;background-color:#fff;border:1px solid #ddd;border-radius:15px}.pager li>a:focus,.pager li>a:hover{text-decoration:none;background-color:#eee}.pager .next>a,.pager .next>span{float:right}.pager .previous>a,.pager .previous>span{float:left}.pager .disabled>a,.pager .disabled>a:focus,.pager .disabled>a:hover,.pager .disabled>span{color:#777;cursor:not-allowed;background-color:#fff}.label{display:inline;padding:.2em .6em .3em;font-size:75%;font-weight:700;line-height:1;color:#fff;text-align:center;white-space:nowrap;vertical-align:baseline;border-radius:.25em}a.label:focus,a.label:hover{color:#fff;text-decoration:none;cursor:pointer}.label:empty{display:none}.btn .label{position:relative;top:-1px}.label-default{background-color:#777}.label-default[href]:focus,.label-default[href]:hover{background-color:#5e5e5e}.label-primary{background-color:#337ab7}.label-primary[href]:focus,.label-primary[href]:hover{background-color:#286090}.label-success{background-color:#5cb85c}.label-success[href]:focus,.label-success[href]:hover{background-color:#449d44}.label-info{background-color:#5bc0de}.label-info[href]:focus,.label-info[href]:hover{background-color:#31b0d5}.label-warning{background-color:#f0ad4e}.label-warning[href]:focus,.label-warning[href]:hover{background-color:#ec971f}.label-danger{background-color:#d9534f}.label-danger[href]:focus,.label-danger[href]:hover{background-color:#c9302c}.badge{display:inline-block;min-width:10px;padding:3px 7px;font-size:12px;font-weight:700;line-height:1;color:#fff;text-align:center;white-space:nowrap;vertical-align:middle;background-color:#777;border-radius:10px}.badge:empty{display:none}.btn .badge{position:relative;top:-1px}.btn-group-xs>.btn .badge,.btn-xs .badge{top:0;padding:1px 5px}a.badge:focus,a.badge:hover{color:#fff;text-decoration:none;cursor:pointer}.list-group-item.active>.badge,.nav-pills>.active>a>.badge{color:#337ab7;background-color:#fff}.list-group-item>.badge{float:right}.list-group-item>.badge+.badge{margin-right:5px}.nav-pills>li>a>.badge{margin-left:3px}.jumbotron{padding-top:30px;padding-bottom:30px;margin-bottom:30px;color:inherit;background-color:#eee}.jumbotron .h1,.jumbotron h1{color:inherit}.jumbotron p{margin-bottom:15px;font-size:21px;font-weight:200}.jumbotron>hr{border-top-color:#d5d5d5}.container .jumbotron,.container-fluid .jumbotron{padding-right:15px;padding-left:15px;border-radius:6px}.jumbotron .container{max-width:100%}@media screen and (min-width:768px){.jumbotron{padding-top:48px;padding-bottom:48px}.container .jumbotron,.container-fluid .jumbotron{padding-right:60px;padding-left:60px}.jumbotron .h1,.jumbotron h1{font-size:63px}}.thumbnail{display:block;padding:4px;margin-bottom:20px;line-height:1.42857143;background-color:#fff;border:1px solid #ddd;border-radius:4px;-webkit-transition:border .2s ease-in-out;-o-transition:border .2s ease-in-out;transition:border .2s ease-in-out}.thumbnail a>img,.thumbnail>img{margin-right:auto;margin-left:auto}a.thumbnail.active,a.thumbnail:focus,a.thumbnail:hover{border-color:#337ab7}.thumbnail .caption{padding:9px;color:#333}.alert{padding:15px;margin-bottom:20px;border:1px solid transparent;border-radius:4px}.alert h4{margin-top:0;color:inherit}.alert .alert-link{font-weight:700}.alert>p,.alert>ul{margin-bottom:0}.alert>p+p{margin-top:5px}.alert-dismissable,.alert-dismissible{padding-right:35px}.alert-dismissable .close,.alert-dismissible .close{position:relative;top:-2px;right:-21px;color:inherit}.alert-success{color:#3c763d;background-color:#dff0d8;border-color:#d6e9c6}.alert-success hr{border-top-color:#c9e2b3}.alert-success .alert-link{color:#2b542c}.alert-info{color:#31708f;background-color:#d9edf7;border-color:#bce8f1}.alert-info hr{border-top-color:#a6e1ec}.alert-info .alert-link{color:#245269}.alert-warning{color:#8a6d3b;background-color:#fcf8e3;border-color:#faebcc}.alert-warning hr{border-top-color:#f7e1b5}.alert-warning .alert-link{color:#66512c}.alert-danger{color:#a94442;background-color:#f2dede;border-color:#ebccd1}.alert-danger hr{border-top-color:#e4b9c0}.alert-danger .alert-link{color:#843534}@-webkit-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@-o-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}.progress{height:20px;margin-bottom:20px;overflow:hidden;background-color:#f5f5f5;border-radius:4px;-webkit-box-shadow:inset 0 1px 2px rgba(0,0,0,.1);box-shadow:inset 0 1px 2px rgba(0,0,0,.1)}.progress-bar{float:left;width:0%;height:100%;font-size:12px;line-height:20px;color:#fff;text-align:center;background-color:#337ab7;-webkit-box-shadow:inset 0 -1px 0 rgba(0,0,0,.15);box-shadow:inset 0 -1px 0 rgba(0,0,0,.15);-webkit-transition:width .6s ease;-o-transition:width .6s ease;transition:width .6s ease}.progress-bar-striped,.progress-striped .progress-bar{background-image:-webkit-linear-gradient(45deg,rgba(255,255,255,.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,.15) 50%,rgba(255,255,255,.15) 75%,transparent 75%,transparent);background-image:-o-linear-gradient(45deg,rgba(255,255,255,.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,.15) 50%,rgba(255,255,255,.15) 75%,transparent 75%,transparent);background-image:linear-gradient(45deg,rgba(255,255,255,.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,.15) 50%,rgba(255,255,255,.15) 75%,transparent 75%,transparent);-webkit-background-size:40px 40px;background-size:40px 40px}.progress-bar.active,.progress.active .progress-bar{-webkit-animation:progress-bar-stripes 2s linear infinite;-o-animation:progress-bar-stripes 2s linear infinite;animation:progress-bar-stripes 2s linear infinite}.progress-bar-success{background-color:#5cb85c}.progress-striped .progress-bar-success{background-image:-webkit-linear-gradient(45deg,rgba(255,255,255,.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,.15) 50%,rgba(255,255,255,.15) 75%,transparent 75%,transparent);background-image:-o-linear-gradient(45deg,rgba(255,255,255,.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,.15) 50%,rgba(255,255,255,.15) 75%,transparent 75%,transparent);background-image:linear-gradient(45deg,rgba(255,255,255,.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,.15) 50%,rgba(255,255,255,.15) 75%,transparent 75%,transparent)}.progress-bar-info{background-color:#5bc0de}.progress-striped .progress-bar-info{background-image:-webkit-linear-gradient(45deg,rgba(255,255,255,.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,.15) 50%,rgba(255,255,255,.15) 75%,transparent 75%,transparent);background-image:-o-linear-gradient(45deg,rgba(255,255,255,.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,.15) 50%,rgba(255,255,255,.15) 75%,transparent 75%,transparent);background-image:linear-gradient(45deg,rgba(255,255,255,.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,.15) 50%,rgba(255,255,255,.15) 75%,transparent 75%,transparent)}.progress-bar-warning{background-color:#f0ad4e}.progress-striped .progress-bar-warning{background-image:-webkit-linear-gradient(45deg,rgba(255,255,255,.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,.15) 50%,rgba(255,255,255,.15) 75%,transparent 75%,transparent);background-image:-o-linear-gradient(45deg,rgba(255,255,255,.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,.15) 50%,rgba(255,255,255,.15) 75%,transparent 75%,transparent);background-image:linear-gradient(45deg,rgba(255,255,255,.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,.15) 50%,rgba(255,255,255,.15) 75%,transparent 75%,transparent)}.progress-bar-danger{background-color:#d9534f}.progress-striped .progress-bar-danger{background-image:-webkit-linear-gradient(45deg,rgba(255,255,255,.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,.15) 50%,rgba(255,255,255,.15) 75%,transparent 75%,transparent);background-image:-o-linear-gradient(45deg,rgba(255,255,255,.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,.15) 50%,rgba(255,255,255,.15) 75%,transparent 75%,transparent);background-image:linear-gradient(45deg,rgba(255,255,255,.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,.15) 50%,rgba(255,255,255,.15) 75%,transparent 75%,transparent)}.media{margin-top:15px}.media:first-child{margin-top:0}.media,.media-body{overflow:hidden;zoom:1}.media-body{width:10000px}.media-object{display:block}.media-object.img-thumbnail{max-width:none}.media-right,.media>.pull-right{padding-left:10px}.media-left,.media>.pull-left{padding-right:10px}.media-body,.media-left,.media-right{display:table-cell;vertical-align:top}.media-middle{vertical-align:middle}.media-bottom{vertical-align:bottom}.media-heading{margin-top:0;margin-bottom:5px}.media-list{padding-left:0;list-style:none}.list-group{padding-left:0;margin-bottom:20px}.list-group-item{position:relative;display:block;padding:10px 15px;margin-bottom:-1px;background-color:#fff;border:1px solid #ddd}.list-group-item:first-child{border-top-left-radius:4px;border-top-right-radius:4px}.list-group-item:last-child{margin-bottom:0;border-bottom-right-radius:4px;border-bottom-left-radius:4px}.list-group-item.disabled,.list-group-item.disabled:focus,.list-group-item.disabled:hover{color:#777;cursor:not-allowed;background-color:#eee}.list-group-item.disabled .list-group-item-heading,.list-group-item.disabled:focus .list-group-item-heading,.list-group-item.disabled:hover .list-group-item-heading{color:inherit}.list-group-item.disabled .list-group-item-text,.list-group-item.disabled:focus .list-group-item-text,.list-group-item.disabled:hover .list-group-item-text{color:#777}.list-group-item.active,.list-group-item.active:focus,.list-group-item.active:hover{z-index:2;color:#fff;background-color:#337ab7;border-color:#337ab7}.list-group-item.active .list-group-item-heading,.list-group-item.active .list-group-item-heading>.small,.list-group-item.active .list-group-item-heading>small,.list-group-item.active:focus .list-group-item-heading,.list-group-item.active:focus .list-group-item-heading>.small,.list-group-item.active:focus .list-group-item-heading>small,.list-group-item.active:hover .list-group-item-heading,.list-group-item.active:hover .list-group-item-heading>.small,.list-group-item.active:hover .list-group-item-heading>small{color:inherit}.list-group-item.active .list-group-item-text,.list-group-item.active:focus .list-group-item-text,.list-group-item.active:hover .list-group-item-text{color:#c7ddef}a.list-group-item,button.list-group-item{color:#555}a.list-group-item .list-group-item-heading,button.list-group-item .list-group-item-heading{color:#333}a.list-group-item:focus,a.list-group-item:hover,button.list-group-item:focus,button.list-group-item:hover{color:#555;text-decoration:none;background-color:#f5f5f5}button.list-group-item{width:100%;text-align:left}.list-group-item-success{color:#3c763d;background-color:#dff0d8}a.list-group-item-success,button.list-group-item-success{color:#3c763d}a.list-group-item-success .list-group-item-heading,button.list-group-item-success .list-group-item-heading{color:inherit}a.list-group-item-success:focus,a.list-group-item-success:hover,button.list-group-item-success:focus,button.list-group-item-success:hover{color:#3c763d;background-color:#d0e9c6}a.list-group-item-success.active,a.list-group-item-success.active:focus,a.list-group-item-success.active:hover,button.list-group-item-success.active,button.list-group-item-success.active:focus,button.list-group-item-success.active:hover{color:#fff;background-color:#3c763d;border-color:#3c763d}.list-group-item-info{color:#31708f;background-color:#d9edf7}a.list-group-item-info,button.list-group-item-info{color:#31708f}a.list-group-item-info .list-group-item-heading,button.list-group-item-info .list-group-item-heading{color:inherit}a.list-group-item-info:focus,a.list-group-item-info:hover,button.list-group-item-info:focus,button.list-group-item-info:hover{color:#31708f;background-color:#c4e3f3}a.list-group-item-info.active,a.list-group-item-info.active:focus,a.list-group-item-info.active:hover,button.list-group-item-info.active,button.list-group-item-info.active:focus,button.list-group-item-info.active:hover{color:#fff;background-color:#31708f;border-color:#31708f}.list-group-item-warning{color:#8a6d3b;background-color:#fcf8e3}a.list-group-item-warning,button.list-group-item-warning{color:#8a6d3b}a.list-group-item-warning .list-group-item-heading,button.list-group-item-warning .list-group-item-heading{color:inherit}a.list-group-item-warning:focus,a.list-group-item-warning:hover,button.list-group-item-warning:focus,button.list-group-item-warning:hover{color:#8a6d3b;background-color:#faf2cc}a.list-group-item-warning.active,a.list-group-item-warning.active:focus,a.list-group-item-warning.active:hover,button.list-group-item-warning.active,button.list-group-item-warning.active:focus,button.list-group-item-warning.active:hover{color:#fff;background-color:#8a6d3b;border-color:#8a6d3b}.list-group-item-danger{color:#a94442;background-color:#f2dede}a.list-group-item-danger,button.list-group-item-danger{color:#a94442}a.list-group-item-danger .list-group-item-heading,button.list-group-item-danger .list-group-item-heading{color:inherit}a.list-group-item-danger:focus,a.list-group-item-danger:hover,button.list-group-item-danger:focus,button.list-group-item-danger:hover{color:#a94442;background-color:#ebcccc}a.list-group-item-danger.active,a.list-group-item-danger.active:focus,a.list-group-item-danger.active:hover,button.list-group-item-danger.active,button.list-group-item-danger.active:focus,button.list-group-item-danger.active:hover{color:#fff;background-color:#a94442;border-color:#a94442}.list-group-item-heading{margin-top:0;margin-bottom:5px}.list-group-item-text{margin-bottom:0;line-height:1.3}.panel{margin-bottom:20px;background-color:#fff;border:1px solid transparent;border-radius:4px;-webkit-box-shadow:0 1px 1px rgba(0,0,0,.05);box-shadow:0 1px 1px rgba(0,0,0,.05)}.panel-body{padding:15px}.panel-heading{padding:10px 15px;border-bottom:1px solid transparent;border-top-left-radius:3px;border-top-right-radius:3px}.panel-heading>.dropdown .dropdown-toggle{color:inherit}.panel-title{margin-top:0;margin-bottom:0;font-size:16px;color:inherit}.panel-title>.small,.panel-title>.small>a,.panel-title>a,.panel-title>small,.panel-title>small>a{color:inherit}.panel-footer{padding:10px 15px;background-color:#f5f5f5;border-top:1px solid #ddd;border-bottom-right-radius:3px;border-bottom-left-radius:3px}.panel>.list-group,.panel>.panel-collapse>.list-group{margin-bottom:0}.panel>.list-group .list-group-item,.panel>.panel-collapse>.list-group .list-group-item{border-width:1px 0;border-radius:0}.panel>.list-group:first-child .list-group-item:first-child,.panel>.panel-collapse>.list-group:first-child .list-group-item:first-child{border-top:0;border-top-left-radius:3px;border-top-right-radius:3px}.panel>.list-group:last-child .list-group-item:last-child,.panel>.panel-collapse>.list-group:last-child .list-group-item:last-child{border-bottom:0;border-bottom-right-radius:3px;border-bottom-left-radius:3px}.panel>.panel-heading+.panel-collapse>.list-group .list-group-item:first-child{border-top-left-radius:0;border-top-right-radius:0}.panel-heading+.list-group .list-group-item:first-child{border-top-width:0}.list-group+.panel-footer{border-top-width:0}.panel>.panel-collapse>.table,.panel>.table,.panel>.table-responsive>.table{margin-bottom:0}.panel>.panel-collapse>.table caption,.panel>.table caption,.panel>.table-responsive>.table caption{padding-right:15px;padding-left:15px}.panel>.table-responsive:first-child>.table:first-child,.panel>.table:first-child{border-top-left-radius:3px;border-top-right-radius:3px}.panel>.table-responsive:first-child>.table:first-child>tbody:first-child>tr:first-child,.panel>.table-responsive:first-child>.table:first-child>thead:first-child>tr:first-child,.panel>.table:first-child>tbody:first-child>tr:first-child,.panel>.table:first-child>thead:first-child>tr:first-child{border-top-left-radius:3px;border-top-right-radius:3px}.panel>.table-responsive:first-child>.table:first-child>tbody:first-child>tr:first-child td:first-child,.panel>.table-responsive:first-child>.table:first-child>tbody:first-child>tr:first-child th:first-child,.panel>.table-responsive:first-child>.table:first-child>thead:first-child>tr:first-child td:first-child,.panel>.table-responsive:first-child>.table:first-child>thead:first-child>tr:first-child th:first-child,.panel>.table:first-child>tbody:first-child>tr:first-child td:first-child,.panel>.table:first-child>tbody:first-child>tr:first-child th:first-child,.panel>.table:first-child>thead:first-child>tr:first-child td:first-child,.panel>.table:first-child>thead:first-child>tr:first-child th:first-child{border-top-left-radius:3px}.panel>.table-responsive:first-child>.table:first-child>tbody:first-child>tr:first-child td:last-child,.panel>.table-responsive:first-child>.table:first-child>tbody:first-child>tr:first-child th:last-child,.panel>.table-responsive:first-child>.table:first-child>thead:first-child>tr:first-child td:last-child,.panel>.table-responsive:first-child>.table:first-child>thead:first-child>tr:first-child th:last-child,.panel>.table:first-child>tbody:first-child>tr:first-child td:last-child,.panel>.table:first-child>tbody:first-child>tr:first-child th:last-child,.panel>.table:first-child>thead:first-child>tr:first-child td:last-child,.panel>.table:first-child>thead:first-child>tr:first-child th:last-child{border-top-right-radius:3px}.panel>.table-responsive:last-child>.table:last-child,.panel>.table:last-child{border-bottom-right-radius:3px;border-bottom-left-radius:3px}.panel>.table-responsive:last-child>.table:last-child>tbody:last-child>tr:last-child,.panel>.table-responsive:last-child>.table:last-child>tfoot:last-child>tr:last-child,.panel>.table:last-child>tbody:last-child>tr:last-child,.panel>.table:last-child>tfoot:last-child>tr:last-child{border-bottom-right-radius:3px;border-bottom-left-radius:3px}.panel>.table-responsive:last-child>.table:last-child>tbody:last-child>tr:last-child td:first-child,.panel>.table-responsive:last-child>.table:last-child>tbody:last-child>tr:last-child th:first-child,.panel>.table-responsive:last-child>.table:last-child>tfoot:last-child>tr:last-child td:first-child,.panel>.table-responsive:last-child>.table:last-child>tfoot:last-child>tr:last-child th:first-child,.panel>.table:last-child>tbody:last-child>tr:last-child td:first-child,.panel>.table:last-child>tbody:last-child>tr:last-child th:first-child,.panel>.table:last-child>tfoot:last-child>tr:last-child td:first-child,.panel>.table:last-child>tfoot:last-child>tr:last-child th:first-child{border-bottom-left-radius:3px}.panel>.table-responsive:last-child>.table:last-child>tbody:last-child>tr:last-child td:last-child,.panel>.table-responsive:last-child>.table:last-child>tbody:last-child>tr:last-child th:last-child,.panel>.table-responsive:last-child>.table:last-child>tfoot:last-child>tr:last-child td:last-child,.panel>.table-responsive:last-child>.table:last-child>tfoot:last-child>tr:last-child th:last-child,.panel>.table:last-child>tbody:last-child>tr:last-child td:last-child,.panel>.table:last-child>tbody:last-child>tr:last-child th:last-child,.panel>.table:last-child>tfoot:last-child>tr:last-child td:last-child,.panel>.table:last-child>tfoot:last-child>tr:last-child th:last-child{border-bottom-right-radius:3px}.panel>.panel-body+.table,.panel>.panel-body+.table-responsive,.panel>.table+.panel-body,.panel>.table-responsive+.panel-body{border-top:1px solid #ddd}.panel>.table>tbody:first-child>tr:first-child td,.panel>.table>tbody:first-child>tr:first-child th{border-top:0}.panel>.table-bordered,.panel>.table-responsive>.table-bordered{border:0}.panel>.table-bordered>tbody>tr>td:first-child,.panel>.table-bordered>tbody>tr>th:first-child,.panel>.table-bordered>tfoot>tr>td:first-child,.panel>.table-bordered>tfoot>tr>th:first-child,.panel>.table-bordered>thead>tr>td:first-child,.panel>.table-bordered>thead>tr>th:first-child,.panel>.table-responsive>.table-bordered>tbody>tr>td:first-child,.panel>.table-responsive>.table-bordered>tbody>tr>th:first-child,.panel>.table-responsive>.table-bordered>tfoot>tr>td:first-child,.panel>.table-responsive>.table-bordered>tfoot>tr>th:first-child,.panel>.table-responsive>.table-bordered>thead>tr>td:first-child,.panel>.table-responsive>.table-bordered>thead>tr>th:first-child{border-left:0}.panel>.table-bordered>tbody>tr>td:last-child,.panel>.table-bordered>tbody>tr>th:last-child,.panel>.table-bordered>tfoot>tr>td:last-child,.panel>.table-bordered>tfoot>tr>th:last-child,.panel>.table-bordered>thead>tr>td:last-child,.panel>.table-bordered>thead>tr>th:last-child,.panel>.table-responsive>.table-bordered>tbody>tr>td:last-child,.panel>.table-responsive>.table-bordered>tbody>tr>th:last-child,.panel>.table-responsive>.table-bordered>tfoot>tr>td:last-child,.panel>.table-responsive>.table-bordered>tfoot>tr>th:last-child,.panel>.table-responsive>.table-bordered>thead>tr>td:last-child,.panel>.table-responsive>.table-bordered>thead>tr>th:last-child{border-right:0}.panel>.table-bordered>tbody>tr:first-child>td,.panel>.table-bordered>tbody>tr:first-child>th,.panel>.table-bordered>thead>tr:first-child>td,.panel>.table-bordered>thead>tr:first-child>th,.panel>.table-responsive>.table-bordered>tbody>tr:first-child>td,.panel>.table-responsive>.table-bordered>tbody>tr:first-child>th,.panel>.table-responsive>.table-bordered>thead>tr:first-child>td,.panel>.table-responsive>.table-bordered>thead>tr:first-child>th{border-bottom:0}.panel>.table-bordered>tbody>tr:last-child>td,.panel>.table-bordered>tbody>tr:last-child>th,.panel>.table-bordered>tfoot>tr:last-child>td,.panel>.table-bordered>tfoot>tr:last-child>th,.panel>.table-responsive>.table-bordered>tbody>tr:last-child>td,.panel>.table-responsive>.table-bordered>tbody>tr:last-child>th,.panel>.table-responsive>.table-bordered>tfoot>tr:last-child>td,.panel>.table-responsive>.table-bordered>tfoot>tr:last-child>th{border-bottom:0}.panel>.table-responsive{margin-bottom:0;border:0}.panel-group{margin-bottom:20px}.panel-group .panel{margin-bottom:0;border-radius:4px}.panel-group .panel+.panel{margin-top:5px}.panel-group .panel-heading{border-bottom:0}.panel-group .panel-heading+.panel-collapse>.list-group,.panel-group .panel-heading+.panel-collapse>.panel-body{border-top:1px solid #ddd}.panel-group .panel-footer{border-top:0}.panel-group .panel-footer+.panel-collapse .panel-body{border-bottom:1px solid #ddd}.panel-default{border-color:#ddd}.panel-default>.panel-heading{color:#333;background-color:#f5f5f5;border-color:#ddd}.panel-default>.panel-heading+.panel-collapse>.panel-body{border-top-color:#ddd}.panel-default>.panel-heading .badge{color:#f5f5f5;background-color:#333}.panel-default>.panel-footer+.panel-collapse>.panel-body{border-bottom-color:#ddd}.panel-primary{border-color:#337ab7}.panel-primary>.panel-heading{color:#fff;background-color:#337ab7;border-color:#337ab7}.panel-primary>.panel-heading+.panel-collapse>.panel-body{border-top-color:#337ab7}.panel-primary>.panel-heading .badge{color:#337ab7;background-color:#fff}.panel-primary>.panel-footer+.panel-collapse>.panel-body{border-bottom-color:#337ab7}.panel-success{border-color:#d6e9c6}.panel-success>.panel-heading{color:#3c763d;background-color:#dff0d8;border-color:#d6e9c6}.panel-success>.panel-heading+.panel-collapse>.panel-body{border-top-color:#d6e9c6}.panel-success>.panel-heading .badge{color:#dff0d8;background-color:#3c763d}.panel-success>.panel-footer+.panel-collapse>.panel-body{border-bottom-color:#d6e9c6}.panel-info{border-color:#bce8f1}.panel-info>.panel-heading{color:#31708f;background-color:#d9edf7;border-color:#bce8f1}.panel-info>.panel-heading+.panel-collapse>.panel-body{border-top-color:#bce8f1}.panel-info>.panel-heading .badge{color:#d9edf7;background-color:#31708f}.panel-info>.panel-footer+.panel-collapse>.panel-body{border-bottom-color:#bce8f1}.panel-warning{border-color:#faebcc}.panel-warning>.panel-heading{color:#8a6d3b;background-color:#fcf8e3;border-color:#faebcc}.panel-warning>.panel-heading+.panel-collapse>.panel-body{border-top-color:#faebcc}.panel-warning>.panel-heading .badge{color:#fcf8e3;background-color:#8a6d3b}.panel-warning>.panel-footer+.panel-collapse>.panel-body{border-bottom-color:#faebcc}.panel-danger{border-color:#ebccd1}.panel-danger>.panel-heading{color:#a94442;background-color:#f2dede;border-color:#ebccd1}.panel-danger>.panel-heading+.panel-collapse>.panel-body{border-top-color:#ebccd1}.panel-danger>.panel-heading .badge{color:#f2dede;background-color:#a94442}.panel-danger>.panel-footer+.panel-collapse>.panel-body{border-bottom-color:#ebccd1}.embed-responsive{position:relative;display:block;height:0;padding:0;overflow:hidden}.embed-responsive .embed-responsive-item,.embed-responsive embed,.embed-responsive iframe,.embed-responsive object,.embed-responsive video{position:absolute;top:0;bottom:0;left:0;width:100%;height:100%;border:0}.embed-responsive-16by9{padding-bottom:56.25%}.embed-responsive-4by3{padding-bottom:75%}.well{min-height:20px;padding:19px;margin-bottom:20px;background-color:#f5f5f5;border:1px solid #e3e3e3;border-radius:4px;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.05);box-shadow:inset 0 1px 1px rgba(0,0,0,.05)}.well blockquote{border-color:#ddd;border-color:rgba(0,0,0,.15)}.well-lg{padding:24px;border-radius:6px}.well-sm{padding:9px;border-radius:3px}.close{float:right;font-size:21px;font-weight:700;line-height:1;color:#000;text-shadow:0 1px 0 #fff;filter:alpha(opacity=20);opacity:.2}.close:focus,.close:hover{color:#000;text-decoration:none;cursor:pointer;filter:alpha(opacity=50);opacity:.5}button.close{padding:0;cursor:pointer;background:0 0;border:0;-webkit-appearance:none;-moz-appearance:none;appearance:none}.modal-open{overflow:hidden}.modal{position:fixed;top:0;right:0;bottom:0;left:0;z-index:1050;display:none;overflow:hidden;-webkit-overflow-scrolling:touch;outline:0}.modal.fade .modal-dialog{-webkit-transform:translate(0,-25%);-ms-transform:translate(0,-25%);-o-transform:translate(0,-25%);transform:translate(0,-25%);-webkit-transition:-webkit-transform .3s ease-out;-o-transition:-o-transform .3s ease-out;transition:-webkit-transform .3s ease-out;transition:transform .3s ease-out;transition:transform .3s ease-out,-webkit-transform .3s ease-out,-o-transform .3s ease-out}.modal.in .modal-dialog{-webkit-transform:translate(0,0);-ms-transform:translate(0,0);-o-transform:translate(0,0);transform:translate(0,0)}.modal-open .modal{overflow-x:hidden;overflow-y:auto}.modal-dialog{position:relative;width:auto;margin:10px}.modal-content{position:relative;background-color:#fff;background-clip:padding-box;border:1px solid #999;border:1px solid rgba(0,0,0,.2);border-radius:6px;-webkit-box-shadow:0 3px 9px rgba(0,0,0,.5);box-shadow:0 3px 9px rgba(0,0,0,.5);outline:0}.modal-backdrop{position:fixed;top:0;right:0;bottom:0;left:0;z-index:1040;background-color:#000}.modal-backdrop.fade{filter:alpha(opacity=0);opacity:0}.modal-backdrop.in{filter:alpha(opacity=50);opacity:.5}.modal-header{padding:15px;border-bottom:1px solid #e5e5e5}.modal-header .close{margin-top:-2px}.modal-title{margin:0;line-height:1.42857143}.modal-body{position:relative;padding:15px}.modal-footer{padding:15px;text-align:right;border-top:1px solid #e5e5e5}.modal-footer .btn+.btn{margin-bottom:0;margin-left:5px}.modal-footer .btn-group .btn+.btn{margin-left:-1px}.modal-footer .btn-block+.btn-block{margin-left:0}.modal-scrollbar-measure{position:absolute;top:-9999px;width:50px;height:50px;overflow:scroll}@media (min-width:768px){.modal-dialog{width:600px;margin:30px auto}.modal-content{-webkit-box-shadow:0 5px 15px rgba(0,0,0,.5);box-shadow:0 5px 15px rgba(0,0,0,.5)}.modal-sm{width:300px}}@media (min-width:992px){.modal-lg{width:900px}}.tooltip{position:absolute;z-index:1070;display:block;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-style:normal;font-weight:400;line-height:1.42857143;line-break:auto;text-align:left;text-align:start;text-decoration:none;text-shadow:none;text-transform:none;letter-spacing:normal;word-break:normal;word-spacing:normal;word-wrap:normal;white-space:normal;font-size:12px;filter:alpha(opacity=0);opacity:0}.tooltip.in{filter:alpha(opacity=90);opacity:.9}.tooltip.top{padding:5px 0;margin-top:-3px}.tooltip.right{padding:0 5px;margin-left:3px}.tooltip.bottom{padding:5px 0;margin-top:3px}.tooltip.left{padding:0 5px;margin-left:-3px}.tooltip.top .tooltip-arrow{bottom:0;left:50%;margin-left:-5px;border-width:5px 5px 0;border-top-color:#000}.tooltip.top-left .tooltip-arrow{right:5px;bottom:0;margin-bottom:-5px;border-width:5px 5px 0;border-top-color:#000}.tooltip.top-right .tooltip-arrow{bottom:0;left:5px;margin-bottom:-5px;border-width:5px 5px 0;border-top-color:#000}.tooltip.right .tooltip-arrow{top:50%;left:0;margin-top:-5px;border-width:5px 5px 5px 0;border-right-color:#000}.tooltip.left .tooltip-arrow{top:50%;right:0;margin-top:-5px;border-width:5px 0 5px 5px;border-left-color:#000}.tooltip.bottom .tooltip-arrow{top:0;left:50%;margin-left:-5px;border-width:0 5px 5px;border-bottom-color:#000}.tooltip.bottom-left .tooltip-arrow{top:0;right:5px;margin-top:-5px;border-width:0 5px 5px;border-bottom-color:#000}.tooltip.bottom-right .tooltip-arrow{top:0;left:5px;margin-top:-5px;border-width:0 5px 5px;border-bottom-color:#000}.tooltip-inner{max-width:200px;padding:3px 8px;color:#fff;text-align:center;background-color:#000;border-radius:4px}.tooltip-arrow{position:absolute;width:0;height:0;border-color:transparent;border-style:solid}.popover{position:absolute;top:0;left:0;z-index:1060;display:none;max-width:276px;padding:1px;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-style:normal;font-weight:400;line-height:1.42857143;line-break:auto;text-align:left;text-align:start;text-decoration:none;text-shadow:none;text-transform:none;letter-spacing:normal;word-break:normal;word-spacing:normal;word-wrap:normal;white-space:normal;font-size:14px;background-color:#fff;background-clip:padding-box;border:1px solid #ccc;border:1px solid rgba(0,0,0,.2);border-radius:6px;-webkit-box-shadow:0 5px 10px rgba(0,0,0,.2);box-shadow:0 5px 10px rgba(0,0,0,.2)}.popover.top{margin-top:-10px}.popover.right{margin-left:10px}.popover.bottom{margin-top:10px}.popover.left{margin-left:-10px}.popover>.arrow{border-width:11px}.popover>.arrow,.popover>.arrow:after{position:absolute;display:block;width:0;height:0;border-color:transparent;border-style:solid}.popover>.arrow:after{content:"";border-width:10px}.popover.top>.arrow{bottom:-11px;left:50%;margin-left:-11px;border-top-color:#999;border-top-color:rgba(0,0,0,.25);border-bottom-width:0}.popover.top>.arrow:after{bottom:1px;margin-left:-10px;content:" ";border-top-color:#fff;border-bottom-width:0}.popover.right>.arrow{top:50%;left:-11px;margin-top:-11px;border-right-color:#999;border-right-color:rgba(0,0,0,.25);border-left-width:0}.popover.right>.arrow:after{bottom:-10px;left:1px;content:" ";border-right-color:#fff;border-left-width:0}.popover.bottom>.arrow{top:-11px;left:50%;margin-left:-11px;border-top-width:0;border-bottom-color:#999;border-bottom-color:rgba(0,0,0,.25)}.popover.bottom>.arrow:after{top:1px;margin-left:-10px;content:" ";border-top-width:0;border-bottom-color:#fff}.popover.left>.arrow{top:50%;right:-11px;margin-top:-11px;border-right-width:0;border-left-color:#999;border-left-color:rgba(0,0,0,.25)}.popover.left>.arrow:after{right:1px;bottom:-10px;content:" ";border-right-width:0;border-left-color:#fff}.popover-title{padding:8px 14px;margin:0;font-size:14px;background-color:#f7f7f7;border-bottom:1px solid #ebebeb;border-radius:5px 5px 0 0}.popover-content{padding:9px 14px}.carousel{position:relative}.carousel-inner{position:relative;width:100%;overflow:hidden}.carousel-inner>.item{position:relative;display:none;-webkit-transition:.6s ease-in-out left;-o-transition:.6s ease-in-out left;transition:.6s ease-in-out left}.carousel-inner>.item>a>img,.carousel-inner>.item>img{line-height:1}@media all and (transform-3d),(-webkit-transform-3d){.carousel-inner>.item{-webkit-transition:-webkit-transform .6s ease-in-out;-o-transition:-o-transform .6s ease-in-out;transition:-webkit-transform .6s ease-in-out;transition:transform .6s ease-in-out;transition:transform .6s ease-in-out,-webkit-transform .6s ease-in-out,-o-transform .6s ease-in-out;-webkit-backface-visibility:hidden;backface-visibility:hidden;-webkit-perspective:1000px;perspective:1000px}.carousel-inner>.item.active.right,.carousel-inner>.item.next{-webkit-transform:translate3d(100%,0,0);transform:translate3d(100%,0,0);left:0}.carousel-inner>.item.active.left,.carousel-inner>.item.prev{-webkit-transform:translate3d(-100%,0,0);transform:translate3d(-100%,0,0);left:0}.carousel-inner>.item.active,.carousel-inner>.item.next.left,.carousel-inner>.item.prev.right{-webkit-transform:translate3d(0,0,0);transform:translate3d(0,0,0);left:0}}.carousel-inner>.active,.carousel-inner>.next,.carousel-inner>.prev{display:block}.carousel-inner>.active{left:0}.carousel-inner>.next,.carousel-inner>.prev{position:absolute;top:0;width:100%}.carousel-inner>.next{left:100%}.carousel-inner>.prev{left:-100%}.carousel-inner>.next.left,.carousel-inner>.prev.right{left:0}.carousel-inner>.active.left{left:-100%}.carousel-inner>.active.right{left:100%}.carousel-control{position:absolute;top:0;bottom:0;left:0;width:15%;font-size:20px;color:#fff;text-align:center;text-shadow:0 1px 2px rgba(0,0,0,.6);background-color:rgba(0,0,0,0);filter:alpha(opacity=50);opacity:.5}.carousel-control.left{background-image:-webkit-linear-gradient(left,rgba(0,0,0,.5) 0,rgba(0,0,0,.0001) 100%);background-image:-o-linear-gradient(left,rgba(0,0,0,.5) 0,rgba(0,0,0,.0001) 100%);background-image:-webkit-gradient(linear,left top,right top,from(rgba(0,0,0,.5)),to(rgba(0,0,0,.0001)));background-image:linear-gradient(to right,rgba(0,0,0,.5) 0,rgba(0,0,0,.0001) 100%);filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#80000000', endColorstr='#00000000', GradientType=1);background-repeat:repeat-x}.carousel-control.right{right:0;left:auto;background-image:-webkit-linear-gradient(left,rgba(0,0,0,.0001) 0,rgba(0,0,0,.5) 100%);background-image:-o-linear-gradient(left,rgba(0,0,0,.0001) 0,rgba(0,0,0,.5) 100%);background-image:-webkit-gradient(linear,left top,right top,from(rgba(0,0,0,.0001)),to(rgba(0,0,0,.5)));background-image:linear-gradient(to right,rgba(0,0,0,.0001) 0,rgba(0,0,0,.5) 100%);filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#00000000', endColorstr='#80000000', GradientType=1);background-repeat:repeat-x}.carousel-control:focus,.carousel-control:hover{color:#fff;text-decoration:none;outline:0;filter:alpha(opacity=90);opacity:.9}.carousel-control .glyphicon-chevron-left,.carousel-control .glyphicon-chevron-right,.carousel-control .icon-next,.carousel-control .icon-prev{position:absolute;top:50%;z-index:5;display:inline-block;margin-top:-10px}.carousel-control .glyphicon-chevron-left,.carousel-control .icon-prev{left:50%;margin-left:-10px}.carousel-control .glyphicon-chevron-right,.carousel-control .icon-next{right:50%;margin-right:-10px}.carousel-control .icon-next,.carousel-control .icon-prev{width:20px;height:20px;font-family:serif;line-height:1}.carousel-control .icon-prev:before{content:"\2039"}.carousel-control .icon-next:before{content:"\203a"}.carousel-indicators{position:absolute;bottom:10px;left:50%;z-index:15;width:60%;padding-left:0;margin-left:-30%;text-align:center;list-style:none}.carousel-indicators li{display:inline-block;width:10px;height:10px;margin:1px;text-indent:-999px;cursor:pointer;background-color:#000\9;background-color:rgba(0,0,0,0);border:1px solid #fff;border-radius:10px}.carousel-indicators .active{width:12px;height:12px;margin:0;background-color:#fff}.carousel-caption{position:absolute;right:15%;bottom:20px;left:15%;z-index:10;padding-top:20px;padding-bottom:20px;color:#fff;text-align:center;text-shadow:0 1px 2px rgba(0,0,0,.6)}.carousel-caption .btn{text-shadow:none}@media screen and (min-width:768px){.carousel-control .glyphicon-chevron-left,.carousel-control .glyphicon-chevron-right,.carousel-control .icon-next,.carousel-control .icon-prev{width:30px;height:30px;margin-top:-10px;font-size:30px}.carousel-control .glyphicon-chevron-left,.carousel-control .icon-prev{margin-left:-10px}.carousel-control .glyphicon-chevron-right,.carousel-control .icon-next{margin-right:-10px}.carousel-caption{right:20%;left:20%;padding-bottom:30px}.carousel-indicators{bottom:20px}}.btn-group-vertical>.btn-group:after,.btn-group-vertical>.btn-group:before,.btn-toolbar:after,.btn-toolbar:before,.clearfix:after,.clearfix:before,.container-fluid:after,.container-fluid:before,.container:after,.container:before,.dl-horizontal dd:after,.dl-horizontal dd:before,.form-horizontal .form-group:after,.form-horizontal .form-group:before,.modal-footer:after,.modal-footer:before,.modal-header:after,.modal-header:before,.nav:after,.nav:before,.navbar-collapse:after,.navbar-collapse:before,.navbar-header:after,.navbar-header:before,.navbar:after,.navbar:before,.pager:after,.pager:before,.panel-body:after,.panel-body:before,.row:after,.row:before{display:table;content:" "}.btn-group-vertical>.btn-group:after,.btn-toolbar:after,.clearfix:after,.container-fluid:after,.container:after,.dl-horizontal dd:after,.form-horizontal .form-group:after,.modal-footer:after,.modal-header:after,.nav:after,.navbar-collapse:after,.navbar-header:after,.navbar:after,.pager:after,.panel-body:after,.row:after{clear:both}.center-block{display:block;margin-right:auto;margin-left:auto}.pull-right{float:right!important}.pull-left{float:left!important}.hide{display:none!important}.show{display:block!important}.invisible{visibility:hidden}.text-hide{font:0/0 a;color:transparent;text-shadow:none;background-color:transparent;border:0}.hidden{display:none!important}.affix{position:fixed}@-ms-viewport{width:device-width}.visible-lg,.visible-md,.visible-sm,.visible-xs{display:none!important}.visible-lg-block,.visible-lg-inline,.visible-lg-inline-block,.visible-md-block,.visible-md-inline,.visible-md-inline-block,.visible-sm-block,.visible-sm-inline,.visible-sm-inline-block,.visible-xs-block,.visible-xs-inline,.visible-xs-inline-block{display:none!important}@media (max-width:767px){.visible-xs{display:block!important}table.visible-xs{display:table!important}tr.visible-xs{display:table-row!important}td.visible-xs,th.visible-xs{display:table-cell!important}}@media (max-width:767px){.visible-xs-block{display:block!important}}@media (max-width:767px){.visible-xs-inline{display:inline!important}}@media (max-width:767px){.visible-xs-inline-block{display:inline-block!important}}@media (min-width:768px) and (max-width:991px){.visible-sm{display:block!important}table.visible-sm{display:table!important}tr.visible-sm{display:table-row!important}td.visible-sm,th.visible-sm{display:table-cell!important}}@media (min-width:768px) and (max-width:991px){.visible-sm-block{display:block!important}}@media (min-width:768px) and (max-width:991px){.visible-sm-inline{display:inline!important}}@media (min-width:768px) and (max-width:991px){.visible-sm-inline-block{display:inline-block!important}}@media (min-width:992px) and (max-width:1199px){.visible-md{display:block!important}table.visible-md{display:table!important}tr.visible-md{display:table-row!important}td.visible-md,th.visible-md{display:table-cell!important}}@media (min-width:992px) and (max-width:1199px){.visible-md-block{display:block!important}}@media (min-width:992px) and (max-width:1199px){.visible-md-inline{display:inline!important}}@media (min-width:992px) and (max-width:1199px){.visible-md-inline-block{display:inline-block!important}}@media (min-width:1200px){.visible-lg{display:block!important}table.visible-lg{display:table!important}tr.visible-lg{display:table-row!important}td.visible-lg,th.visible-lg{display:table-cell!important}}@media (min-width:1200px){.visible-lg-block{display:block!important}}@media (min-width:1200px){.visible-lg-inline{display:inline!important}}@media (min-width:1200px){.visible-lg-inline-block{display:inline-block!important}}@media (max-width:767px){.hidden-xs{display:none!important}}@media (min-width:768px) and (max-width:991px){.hidden-sm{display:none!important}}@media (min-width:992px) and (max-width:1199px){.hidden-md{display:none!important}}@media (min-width:1200px){.hidden-lg{display:none!important}}.visible-print{display:none!important}@media print{.visible-print{display:block!important}table.visible-print{display:table!important}tr.visible-print{display:table-row!important}td.visible-print,th.visible-print{display:table-cell!important}}.visible-print-block{display:none!important}@media print{.visible-print-block{display:block!important}}.visible-print-inline{display:none!important}@media print{.visible-print-inline{display:inline!important}}.visible-print-inline-block{display:none!important}@media print{.visible-print-inline-block{display:inline-block!important}}@media print{.hidden-print{display:none!important}} -/*# sourceMappingURL=bootstrap.min.css.map */ \ No newline at end of file diff --git a/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/css/font-awesome.css b/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/css/font-awesome.css deleted file mode 100644 index ee906a819..000000000 --- a/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/css/font-awesome.css +++ /dev/null @@ -1,2337 +0,0 @@ -/*! - * Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome - * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) - */ -/* FONT PATH - * -------------------------- */ -@font-face { - font-family: 'FontAwesome'; - src: url('../fonts/fontawesome-webfont.eot?v=4.7.0'); - src: url('../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'), url('../fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'), url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'), url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'), url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg'); - font-weight: normal; - font-style: normal; -} -.fa { - display: inline-block; - font: normal normal normal 14px/1 FontAwesome; - font-size: inherit; - text-rendering: auto; - -webkit-font-smoothing: antialiased; - -moz-osx-font-smoothing: grayscale; -} -/* makes the font 33% larger relative to the icon container */ -.fa-lg { - font-size: 1.33333333em; - line-height: 0.75em; - vertical-align: -15%; -} -.fa-2x { - font-size: 2em; -} -.fa-3x { - font-size: 3em; -} -.fa-4x { - font-size: 4em; -} -.fa-5x { - font-size: 5em; -} -.fa-fw { - width: 1.28571429em; - text-align: center; -} -.fa-ul { - padding-left: 0; - margin-left: 2.14285714em; - list-style-type: none; -} -.fa-ul > li { - position: relative; -} -.fa-li { - position: absolute; - left: -2.14285714em; - width: 2.14285714em; - top: 0.14285714em; - text-align: center; -} -.fa-li.fa-lg { - left: -1.85714286em; -} -.fa-border { - padding: .2em .25em .15em; - border: solid 0.08em #eeeeee; - border-radius: .1em; -} -.fa-pull-left { - float: left; -} -.fa-pull-right { - float: right; -} -.fa.fa-pull-left { - margin-right: .3em; -} -.fa.fa-pull-right { - margin-left: .3em; -} -/* Deprecated as of 4.4.0 */ -.pull-right { - float: right; -} -.pull-left { - float: left; -} -.fa.pull-left { - margin-right: .3em; -} -.fa.pull-right { - margin-left: .3em; -} -.fa-spin { - -webkit-animation: fa-spin 2s infinite linear; - animation: fa-spin 2s infinite linear; -} -.fa-pulse { - -webkit-animation: fa-spin 1s infinite steps(8); - animation: fa-spin 1s infinite steps(8); -} -@-webkit-keyframes fa-spin { - 0% { - -webkit-transform: rotate(0deg); - transform: rotate(0deg); - } - 100% { - -webkit-transform: rotate(359deg); - transform: rotate(359deg); - } -} -@keyframes fa-spin { - 0% { - -webkit-transform: rotate(0deg); - transform: rotate(0deg); - } - 100% { - -webkit-transform: rotate(359deg); - transform: rotate(359deg); - } -} -.fa-rotate-90 { - -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=1)"; - -webkit-transform: rotate(90deg); - -ms-transform: rotate(90deg); - transform: rotate(90deg); -} -.fa-rotate-180 { - -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=2)"; - -webkit-transform: rotate(180deg); - -ms-transform: rotate(180deg); - transform: rotate(180deg); -} -.fa-rotate-270 { - -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=3)"; - -webkit-transform: rotate(270deg); - -ms-transform: rotate(270deg); - transform: rotate(270deg); -} -.fa-flip-horizontal { - -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=0, mirror=1)"; - -webkit-transform: scale(-1, 1); - -ms-transform: scale(-1, 1); - transform: scale(-1, 1); -} -.fa-flip-vertical { - -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=2, mirror=1)"; - -webkit-transform: scale(1, -1); - -ms-transform: scale(1, -1); - transform: scale(1, -1); -} -:root .fa-rotate-90, -:root .fa-rotate-180, -:root .fa-rotate-270, -:root .fa-flip-horizontal, -:root .fa-flip-vertical { - filter: none; -} -.fa-stack { - position: relative; - display: inline-block; - width: 2em; - height: 2em; - line-height: 2em; - vertical-align: middle; -} -.fa-stack-1x, -.fa-stack-2x { - position: absolute; - left: 0; - width: 100%; - text-align: center; -} -.fa-stack-1x { - line-height: inherit; -} -.fa-stack-2x { - font-size: 2em; -} -.fa-inverse { - color: #ffffff; -} -/* Font Awesome uses the Unicode Private Use Area (PUA) to ensure screen - readers do not read off random characters that represent icons */ -.fa-glass:before { - content: "\f000"; -} -.fa-music:before { - content: "\f001"; -} -.fa-search:before { - content: "\f002"; -} -.fa-envelope-o:before { - content: "\f003"; -} -.fa-heart:before { - content: "\f004"; -} -.fa-star:before { - content: "\f005"; -} -.fa-star-o:before { - content: "\f006"; -} -.fa-user:before { - content: "\f007"; -} -.fa-film:before { - content: "\f008"; -} -.fa-th-large:before { - content: "\f009"; -} -.fa-th:before { - content: "\f00a"; -} -.fa-th-list:before { - content: "\f00b"; -} -.fa-check:before { - content: "\f00c"; -} -.fa-remove:before, -.fa-close:before, -.fa-times:before { - content: "\f00d"; -} -.fa-search-plus:before { - content: "\f00e"; -} -.fa-search-minus:before { - content: "\f010"; -} -.fa-power-off:before { - content: "\f011"; -} -.fa-signal:before { - content: "\f012"; -} -.fa-gear:before, -.fa-cog:before { - content: "\f013"; -} -.fa-trash-o:before { - content: "\f014"; -} -.fa-home:before { - content: "\f015"; -} -.fa-file-o:before { - content: "\f016"; -} -.fa-clock-o:before { - content: "\f017"; -} -.fa-road:before { - content: "\f018"; -} -.fa-download:before { - content: "\f019"; -} -.fa-arrow-circle-o-down:before { - content: "\f01a"; -} -.fa-arrow-circle-o-up:before { - content: "\f01b"; -} -.fa-inbox:before { - content: "\f01c"; -} -.fa-play-circle-o:before { - content: "\f01d"; -} -.fa-rotate-right:before, -.fa-repeat:before { - content: "\f01e"; -} -.fa-refresh:before { - content: "\f021"; -} -.fa-list-alt:before { - content: "\f022"; -} -.fa-lock:before { - content: "\f023"; -} -.fa-flag:before { - content: "\f024"; -} -.fa-headphones:before { - content: "\f025"; -} -.fa-volume-off:before { - content: "\f026"; -} -.fa-volume-down:before { - content: "\f027"; -} -.fa-volume-up:before { - content: "\f028"; -} -.fa-qrcode:before { - content: "\f029"; -} -.fa-barcode:before { - content: "\f02a"; -} -.fa-tag:before { - content: "\f02b"; -} -.fa-tags:before { - content: "\f02c"; -} -.fa-book:before { - content: "\f02d"; -} -.fa-bookmark:before { - content: "\f02e"; -} -.fa-print:before { - content: "\f02f"; -} -.fa-camera:before { - content: "\f030"; -} -.fa-font:before { - content: "\f031"; -} -.fa-bold:before { - content: "\f032"; -} -.fa-italic:before { - content: "\f033"; -} -.fa-text-height:before { - content: "\f034"; -} -.fa-text-width:before { - content: "\f035"; -} -.fa-align-left:before { - content: "\f036"; -} -.fa-align-center:before { - content: "\f037"; -} -.fa-align-right:before { - content: "\f038"; -} -.fa-align-justify:before { - content: "\f039"; -} -.fa-list:before { - content: "\f03a"; -} -.fa-dedent:before, -.fa-outdent:before { - content: "\f03b"; -} -.fa-indent:before { - content: "\f03c"; -} -.fa-video-camera:before { - content: "\f03d"; -} -.fa-photo:before, -.fa-image:before, -.fa-picture-o:before { - content: "\f03e"; -} -.fa-pencil:before { - content: "\f040"; -} -.fa-map-marker:before { - content: "\f041"; -} -.fa-adjust:before { - content: "\f042"; -} -.fa-tint:before { - content: "\f043"; -} -.fa-edit:before, -.fa-pencil-square-o:before { - content: "\f044"; -} -.fa-share-square-o:before { - content: "\f045"; -} -.fa-check-square-o:before { - content: "\f046"; -} -.fa-arrows:before { - content: "\f047"; -} -.fa-step-backward:before { - content: "\f048"; -} -.fa-fast-backward:before { - content: "\f049"; -} -.fa-backward:before { - content: "\f04a"; -} -.fa-play:before { - content: "\f04b"; -} -.fa-pause:before { - content: "\f04c"; -} -.fa-stop:before { - content: "\f04d"; -} -.fa-forward:before { - content: "\f04e"; -} -.fa-fast-forward:before { - content: "\f050"; -} -.fa-step-forward:before { - content: "\f051"; -} -.fa-eject:before { - content: "\f052"; -} -.fa-chevron-left:before { - content: "\f053"; -} -.fa-chevron-right:before { - content: "\f054"; -} -.fa-plus-circle:before { - content: "\f055"; -} -.fa-minus-circle:before { - content: "\f056"; -} -.fa-times-circle:before { - content: "\f057"; -} -.fa-check-circle:before { - content: "\f058"; -} -.fa-question-circle:before { - content: "\f059"; -} -.fa-info-circle:before { - content: "\f05a"; -} -.fa-crosshairs:before { - content: "\f05b"; -} -.fa-times-circle-o:before { - content: "\f05c"; -} -.fa-check-circle-o:before { - content: "\f05d"; -} -.fa-ban:before { - content: "\f05e"; -} -.fa-arrow-left:before { - content: "\f060"; -} -.fa-arrow-right:before { - content: "\f061"; -} -.fa-arrow-up:before { - content: "\f062"; -} -.fa-arrow-down:before { - content: "\f063"; -} -.fa-mail-forward:before, -.fa-share:before { - content: "\f064"; -} -.fa-expand:before { - content: "\f065"; -} -.fa-compress:before { - content: "\f066"; -} -.fa-plus:before { - content: "\f067"; -} -.fa-minus:before { - content: "\f068"; -} -.fa-asterisk:before { - content: "\f069"; -} -.fa-exclamation-circle:before { - content: "\f06a"; -} -.fa-gift:before { - content: "\f06b"; -} -.fa-leaf:before { - content: "\f06c"; -} -.fa-fire:before { - content: "\f06d"; -} -.fa-eye:before { - content: "\f06e"; -} -.fa-eye-slash:before { - content: "\f070"; -} -.fa-warning:before, -.fa-exclamation-triangle:before { - content: "\f071"; -} -.fa-plane:before { - content: "\f072"; -} -.fa-calendar:before { - content: "\f073"; -} -.fa-random:before { - content: "\f074"; -} -.fa-comment:before { - content: "\f075"; -} -.fa-magnet:before { - content: "\f076"; -} -.fa-chevron-up:before { - content: "\f077"; -} -.fa-chevron-down:before { - content: "\f078"; -} -.fa-retweet:before { - content: "\f079"; -} -.fa-shopping-cart:before { - content: "\f07a"; -} -.fa-folder:before { - content: "\f07b"; -} -.fa-folder-open:before { - content: "\f07c"; -} -.fa-arrows-v:before { - content: "\f07d"; -} -.fa-arrows-h:before { - content: "\f07e"; -} -.fa-bar-chart-o:before, -.fa-bar-chart:before { - content: "\f080"; -} -.fa-twitter-square:before { - content: "\f081"; -} -.fa-facebook-square:before { - content: "\f082"; -} -.fa-camera-retro:before { - content: "\f083"; -} -.fa-key:before { - content: "\f084"; -} -.fa-gears:before, -.fa-cogs:before { - content: "\f085"; -} -.fa-comments:before { - content: "\f086"; -} -.fa-thumbs-o-up:before { - content: "\f087"; -} -.fa-thumbs-o-down:before { - content: "\f088"; -} -.fa-star-half:before { - content: "\f089"; -} -.fa-heart-o:before { - content: "\f08a"; -} -.fa-sign-out:before { - content: "\f08b"; -} -.fa-linkedin-square:before { - content: "\f08c"; -} -.fa-thumb-tack:before { - content: "\f08d"; -} -.fa-external-link:before { - content: "\f08e"; -} -.fa-sign-in:before { - content: "\f090"; -} -.fa-trophy:before { - content: "\f091"; -} -.fa-github-square:before { - content: "\f092"; -} -.fa-upload:before { - content: "\f093"; -} -.fa-lemon-o:before { - content: "\f094"; -} -.fa-phone:before { - content: "\f095"; -} -.fa-square-o:before { - content: "\f096"; -} -.fa-bookmark-o:before { - content: "\f097"; -} -.fa-phone-square:before { - content: "\f098"; -} -.fa-twitter:before { - content: "\f099"; -} -.fa-facebook-f:before, -.fa-facebook:before { - content: "\f09a"; -} -.fa-github:before { - content: "\f09b"; -} -.fa-unlock:before { - content: "\f09c"; -} -.fa-credit-card:before { - content: "\f09d"; -} -.fa-feed:before, -.fa-rss:before { - content: "\f09e"; -} -.fa-hdd-o:before { - content: "\f0a0"; -} -.fa-bullhorn:before { - content: "\f0a1"; -} -.fa-bell:before { - content: "\f0f3"; -} -.fa-certificate:before { - content: "\f0a3"; -} -.fa-hand-o-right:before { - content: "\f0a4"; -} -.fa-hand-o-left:before { - content: "\f0a5"; -} -.fa-hand-o-up:before { - content: "\f0a6"; -} -.fa-hand-o-down:before { - content: "\f0a7"; -} -.fa-arrow-circle-left:before { - content: "\f0a8"; -} -.fa-arrow-circle-right:before { - content: "\f0a9"; -} -.fa-arrow-circle-up:before { - content: "\f0aa"; -} -.fa-arrow-circle-down:before { - content: "\f0ab"; -} -.fa-globe:before { - content: "\f0ac"; -} -.fa-wrench:before { - content: "\f0ad"; -} -.fa-tasks:before { - content: "\f0ae"; -} -.fa-filter:before { - content: "\f0b0"; -} -.fa-briefcase:before { - content: "\f0b1"; -} -.fa-arrows-alt:before { - content: "\f0b2"; -} -.fa-group:before, -.fa-users:before { - content: "\f0c0"; -} -.fa-chain:before, -.fa-link:before { - content: "\f0c1"; -} -.fa-cloud:before { - content: "\f0c2"; -} -.fa-flask:before { - content: "\f0c3"; -} -.fa-cut:before, -.fa-scissors:before { - content: "\f0c4"; -} -.fa-copy:before, -.fa-files-o:before { - content: "\f0c5"; -} -.fa-paperclip:before { - content: "\f0c6"; -} -.fa-save:before, -.fa-floppy-o:before { - content: "\f0c7"; -} -.fa-square:before { - content: "\f0c8"; -} -.fa-navicon:before, -.fa-reorder:before, -.fa-bars:before { - content: "\f0c9"; -} -.fa-list-ul:before { - content: "\f0ca"; -} -.fa-list-ol:before { - content: "\f0cb"; -} -.fa-strikethrough:before { - content: "\f0cc"; -} -.fa-underline:before { - content: "\f0cd"; -} -.fa-table:before { - content: "\f0ce"; -} -.fa-magic:before { - content: "\f0d0"; -} -.fa-truck:before { - content: "\f0d1"; -} -.fa-pinterest:before { - content: "\f0d2"; -} -.fa-pinterest-square:before { - content: "\f0d3"; -} -.fa-google-plus-square:before { - content: "\f0d4"; -} -.fa-google-plus:before { - content: "\f0d5"; -} -.fa-money:before { - content: "\f0d6"; -} -.fa-caret-down:before { - content: "\f0d7"; -} -.fa-caret-up:before { - content: "\f0d8"; -} -.fa-caret-left:before { - content: "\f0d9"; -} -.fa-caret-right:before { - content: "\f0da"; -} -.fa-columns:before { - content: "\f0db"; -} -.fa-unsorted:before, -.fa-sort:before { - content: "\f0dc"; -} -.fa-sort-down:before, -.fa-sort-desc:before { - content: "\f0dd"; -} -.fa-sort-up:before, -.fa-sort-asc:before { - content: "\f0de"; -} -.fa-envelope:before { - content: "\f0e0"; -} -.fa-linkedin:before { - content: "\f0e1"; -} -.fa-rotate-left:before, -.fa-undo:before { - content: "\f0e2"; -} -.fa-legal:before, -.fa-gavel:before { - content: "\f0e3"; -} -.fa-dashboard:before, -.fa-tachometer:before { - content: "\f0e4"; -} -.fa-comment-o:before { - content: "\f0e5"; -} -.fa-comments-o:before { - content: "\f0e6"; -} -.fa-flash:before, -.fa-bolt:before { - content: "\f0e7"; -} -.fa-sitemap:before { - content: "\f0e8"; -} -.fa-umbrella:before { - content: "\f0e9"; -} -.fa-paste:before, -.fa-clipboard:before { - content: "\f0ea"; -} -.fa-lightbulb-o:before { - content: "\f0eb"; -} -.fa-exchange:before { - content: "\f0ec"; -} -.fa-cloud-download:before { - content: "\f0ed"; -} -.fa-cloud-upload:before { - content: "\f0ee"; -} -.fa-user-md:before { - content: "\f0f0"; -} -.fa-stethoscope:before { - content: "\f0f1"; -} -.fa-suitcase:before { - content: "\f0f2"; -} -.fa-bell-o:before { - content: "\f0a2"; -} -.fa-coffee:before { - content: "\f0f4"; -} -.fa-cutlery:before { - content: "\f0f5"; -} -.fa-file-text-o:before { - content: "\f0f6"; -} -.fa-building-o:before { - content: "\f0f7"; -} -.fa-hospital-o:before { - content: "\f0f8"; -} -.fa-ambulance:before { - content: "\f0f9"; -} -.fa-medkit:before { - content: "\f0fa"; -} -.fa-fighter-jet:before { - content: "\f0fb"; -} -.fa-beer:before { - content: "\f0fc"; -} -.fa-h-square:before { - content: "\f0fd"; -} -.fa-plus-square:before { - content: "\f0fe"; -} -.fa-angle-double-left:before { - content: "\f100"; -} -.fa-angle-double-right:before { - content: "\f101"; -} -.fa-angle-double-up:before { - content: "\f102"; -} -.fa-angle-double-down:before { - content: "\f103"; -} -.fa-angle-left:before { - content: "\f104"; -} -.fa-angle-right:before { - content: "\f105"; -} -.fa-angle-up:before { - content: "\f106"; -} -.fa-angle-down:before { - content: "\f107"; -} -.fa-desktop:before { - content: "\f108"; -} -.fa-laptop:before { - content: "\f109"; -} -.fa-tablet:before { - content: "\f10a"; -} -.fa-mobile-phone:before, -.fa-mobile:before { - content: "\f10b"; -} -.fa-circle-o:before { - content: "\f10c"; -} -.fa-quote-left:before { - content: "\f10d"; -} -.fa-quote-right:before { - content: "\f10e"; -} -.fa-spinner:before { - content: "\f110"; -} -.fa-circle:before { - content: "\f111"; -} -.fa-mail-reply:before, -.fa-reply:before { - content: "\f112"; -} -.fa-github-alt:before { - content: "\f113"; -} -.fa-folder-o:before { - content: "\f114"; -} -.fa-folder-open-o:before { - content: "\f115"; -} -.fa-smile-o:before { - content: "\f118"; -} -.fa-frown-o:before { - content: "\f119"; -} -.fa-meh-o:before { - content: "\f11a"; -} -.fa-gamepad:before { - content: "\f11b"; -} -.fa-keyboard-o:before { - content: "\f11c"; -} -.fa-flag-o:before { - content: "\f11d"; -} -.fa-flag-checkered:before { - content: "\f11e"; -} -.fa-terminal:before { - content: "\f120"; -} -.fa-code:before { - content: "\f121"; -} -.fa-mail-reply-all:before, -.fa-reply-all:before { - content: "\f122"; -} -.fa-star-half-empty:before, -.fa-star-half-full:before, -.fa-star-half-o:before { - content: "\f123"; -} -.fa-location-arrow:before { - content: "\f124"; -} -.fa-crop:before { - content: "\f125"; -} -.fa-code-fork:before { - content: "\f126"; -} -.fa-unlink:before, -.fa-chain-broken:before { - content: "\f127"; -} -.fa-question:before { - content: "\f128"; -} -.fa-info:before { - content: "\f129"; -} -.fa-exclamation:before { - content: "\f12a"; -} -.fa-superscript:before { - content: "\f12b"; -} -.fa-subscript:before { - content: "\f12c"; -} -.fa-eraser:before { - content: "\f12d"; -} -.fa-puzzle-piece:before { - content: "\f12e"; -} -.fa-microphone:before { - content: "\f130"; -} -.fa-microphone-slash:before { - content: "\f131"; -} -.fa-shield:before { - content: "\f132"; -} -.fa-calendar-o:before { - content: "\f133"; -} -.fa-fire-extinguisher:before { - content: "\f134"; -} -.fa-rocket:before { - content: "\f135"; -} -.fa-maxcdn:before { - content: "\f136"; -} -.fa-chevron-circle-left:before { - content: "\f137"; -} -.fa-chevron-circle-right:before { - content: "\f138"; -} -.fa-chevron-circle-up:before { - content: "\f139"; -} -.fa-chevron-circle-down:before { - content: "\f13a"; -} -.fa-html5:before { - content: "\f13b"; -} -.fa-css3:before { - content: "\f13c"; -} -.fa-anchor:before { - content: "\f13d"; -} -.fa-unlock-alt:before { - content: "\f13e"; -} -.fa-bullseye:before { - content: "\f140"; -} -.fa-ellipsis-h:before { - content: "\f141"; -} -.fa-ellipsis-v:before { - content: "\f142"; -} -.fa-rss-square:before { - content: "\f143"; -} -.fa-play-circle:before { - content: "\f144"; -} -.fa-ticket:before { - content: "\f145"; -} -.fa-minus-square:before { - content: "\f146"; -} -.fa-minus-square-o:before { - content: "\f147"; -} -.fa-level-up:before { - content: "\f148"; -} -.fa-level-down:before { - content: "\f149"; -} -.fa-check-square:before { - content: "\f14a"; -} -.fa-pencil-square:before { - content: "\f14b"; -} -.fa-external-link-square:before { - content: "\f14c"; -} -.fa-share-square:before { - content: "\f14d"; -} -.fa-compass:before { - content: "\f14e"; -} -.fa-toggle-down:before, -.fa-caret-square-o-down:before { - content: "\f150"; -} -.fa-toggle-up:before, -.fa-caret-square-o-up:before { - content: "\f151"; -} -.fa-toggle-right:before, -.fa-caret-square-o-right:before { - content: "\f152"; -} -.fa-euro:before, -.fa-eur:before { - content: "\f153"; -} -.fa-gbp:before { - content: "\f154"; -} -.fa-dollar:before, -.fa-usd:before { - content: "\f155"; -} -.fa-rupee:before, -.fa-inr:before { - content: "\f156"; -} -.fa-cny:before, -.fa-rmb:before, -.fa-yen:before, -.fa-jpy:before { - content: "\f157"; -} -.fa-ruble:before, -.fa-rouble:before, -.fa-rub:before { - content: "\f158"; -} -.fa-won:before, -.fa-krw:before { - content: "\f159"; -} -.fa-bitcoin:before, -.fa-btc:before { - content: "\f15a"; -} -.fa-file:before { - content: "\f15b"; -} -.fa-file-text:before { - content: "\f15c"; -} -.fa-sort-alpha-asc:before { - content: "\f15d"; -} -.fa-sort-alpha-desc:before { - content: "\f15e"; -} -.fa-sort-amount-asc:before { - content: "\f160"; -} -.fa-sort-amount-desc:before { - content: "\f161"; -} -.fa-sort-numeric-asc:before { - content: "\f162"; -} -.fa-sort-numeric-desc:before { - content: "\f163"; -} -.fa-thumbs-up:before { - content: "\f164"; -} -.fa-thumbs-down:before { - content: "\f165"; -} -.fa-youtube-square:before { - content: "\f166"; -} -.fa-youtube:before { - content: "\f167"; -} -.fa-xing:before { - content: "\f168"; -} -.fa-xing-square:before { - content: "\f169"; -} -.fa-youtube-play:before { - content: "\f16a"; -} -.fa-dropbox:before { - content: "\f16b"; -} -.fa-stack-overflow:before { - content: "\f16c"; -} -.fa-instagram:before { - content: "\f16d"; -} -.fa-flickr:before { - content: "\f16e"; -} -.fa-adn:before { - content: "\f170"; -} -.fa-bitbucket:before { - content: "\f171"; -} -.fa-bitbucket-square:before { - content: "\f172"; -} -.fa-tumblr:before { - content: "\f173"; -} -.fa-tumblr-square:before { - content: "\f174"; -} -.fa-long-arrow-down:before { - content: "\f175"; -} -.fa-long-arrow-up:before { - content: "\f176"; -} -.fa-long-arrow-left:before { - content: "\f177"; -} -.fa-long-arrow-right:before { - content: "\f178"; -} -.fa-apple:before { - content: "\f179"; -} -.fa-windows:before { - content: "\f17a"; -} -.fa-android:before { - content: "\f17b"; -} -.fa-linux:before { - content: "\f17c"; -} -.fa-dribbble:before { - content: "\f17d"; -} -.fa-skype:before { - content: "\f17e"; -} -.fa-foursquare:before { - content: "\f180"; -} -.fa-trello:before { - content: "\f181"; -} -.fa-female:before { - content: "\f182"; -} -.fa-male:before { - content: "\f183"; -} -.fa-gittip:before, -.fa-gratipay:before { - content: "\f184"; -} -.fa-sun-o:before { - content: "\f185"; -} -.fa-moon-o:before { - content: "\f186"; -} -.fa-archive:before { - content: "\f187"; -} -.fa-bug:before { - content: "\f188"; -} -.fa-vk:before { - content: "\f189"; -} -.fa-weibo:before { - content: "\f18a"; -} -.fa-renren:before { - content: "\f18b"; -} -.fa-pagelines:before { - content: "\f18c"; -} -.fa-stack-exchange:before { - content: "\f18d"; -} -.fa-arrow-circle-o-right:before { - content: "\f18e"; -} -.fa-arrow-circle-o-left:before { - content: "\f190"; -} -.fa-toggle-left:before, -.fa-caret-square-o-left:before { - content: "\f191"; -} -.fa-dot-circle-o:before { - content: "\f192"; -} -.fa-wheelchair:before { - content: "\f193"; -} -.fa-vimeo-square:before { - content: "\f194"; -} -.fa-turkish-lira:before, -.fa-try:before { - content: "\f195"; -} -.fa-plus-square-o:before { - content: "\f196"; -} -.fa-space-shuttle:before { - content: "\f197"; -} -.fa-slack:before { - content: "\f198"; -} -.fa-envelope-square:before { - content: "\f199"; -} -.fa-wordpress:before { - content: "\f19a"; -} -.fa-openid:before { - content: "\f19b"; -} -.fa-institution:before, -.fa-bank:before, -.fa-university:before { - content: "\f19c"; -} -.fa-mortar-board:before, -.fa-graduation-cap:before { - content: "\f19d"; -} -.fa-yahoo:before { - content: "\f19e"; -} -.fa-google:before { - content: "\f1a0"; -} -.fa-reddit:before { - content: "\f1a1"; -} -.fa-reddit-square:before { - content: "\f1a2"; -} -.fa-stumbleupon-circle:before { - content: "\f1a3"; -} -.fa-stumbleupon:before { - content: "\f1a4"; -} -.fa-delicious:before { - content: "\f1a5"; -} -.fa-digg:before { - content: "\f1a6"; -} -.fa-pied-piper-pp:before { - content: "\f1a7"; -} -.fa-pied-piper-alt:before { - content: "\f1a8"; -} -.fa-drupal:before { - content: "\f1a9"; -} -.fa-joomla:before { - content: "\f1aa"; -} -.fa-language:before { - content: "\f1ab"; -} -.fa-fax:before { - content: "\f1ac"; -} -.fa-building:before { - content: "\f1ad"; -} -.fa-child:before { - content: "\f1ae"; -} -.fa-paw:before { - content: "\f1b0"; -} -.fa-spoon:before { - content: "\f1b1"; -} -.fa-cube:before { - content: "\f1b2"; -} -.fa-cubes:before { - content: "\f1b3"; -} -.fa-behance:before { - content: "\f1b4"; -} -.fa-behance-square:before { - content: "\f1b5"; -} -.fa-steam:before { - content: "\f1b6"; -} -.fa-steam-square:before { - content: "\f1b7"; -} -.fa-recycle:before { - content: "\f1b8"; -} -.fa-automobile:before, -.fa-car:before { - content: "\f1b9"; -} -.fa-cab:before, -.fa-taxi:before { - content: "\f1ba"; -} -.fa-tree:before { - content: "\f1bb"; -} -.fa-spotify:before { - content: "\f1bc"; -} -.fa-deviantart:before { - content: "\f1bd"; -} -.fa-soundcloud:before { - content: "\f1be"; -} -.fa-database:before { - content: "\f1c0"; -} -.fa-file-pdf-o:before { - content: "\f1c1"; -} -.fa-file-word-o:before { - content: "\f1c2"; -} -.fa-file-excel-o:before { - content: "\f1c3"; -} -.fa-file-powerpoint-o:before { - content: "\f1c4"; -} -.fa-file-photo-o:before, -.fa-file-picture-o:before, -.fa-file-image-o:before { - content: "\f1c5"; -} -.fa-file-zip-o:before, -.fa-file-archive-o:before { - content: "\f1c6"; -} -.fa-file-sound-o:before, -.fa-file-audio-o:before { - content: "\f1c7"; -} -.fa-file-movie-o:before, -.fa-file-video-o:before { - content: "\f1c8"; -} -.fa-file-code-o:before { - content: "\f1c9"; -} -.fa-vine:before { - content: "\f1ca"; -} -.fa-codepen:before { - content: "\f1cb"; -} -.fa-jsfiddle:before { - content: "\f1cc"; -} -.fa-life-bouy:before, -.fa-life-buoy:before, -.fa-life-saver:before, -.fa-support:before, -.fa-life-ring:before { - content: "\f1cd"; -} -.fa-circle-o-notch:before { - content: "\f1ce"; -} -.fa-ra:before, -.fa-resistance:before, -.fa-rebel:before { - content: "\f1d0"; -} -.fa-ge:before, -.fa-empire:before { - content: "\f1d1"; -} -.fa-git-square:before { - content: "\f1d2"; -} -.fa-git:before { - content: "\f1d3"; -} -.fa-y-combinator-square:before, -.fa-yc-square:before, -.fa-hacker-news:before { - content: "\f1d4"; -} -.fa-tencent-weibo:before { - content: "\f1d5"; -} -.fa-qq:before { - content: "\f1d6"; -} -.fa-wechat:before, -.fa-weixin:before { - content: "\f1d7"; -} -.fa-send:before, -.fa-paper-plane:before { - content: "\f1d8"; -} -.fa-send-o:before, -.fa-paper-plane-o:before { - content: "\f1d9"; -} -.fa-history:before { - content: "\f1da"; -} -.fa-circle-thin:before { - content: "\f1db"; -} -.fa-header:before { - content: "\f1dc"; -} -.fa-paragraph:before { - content: "\f1dd"; -} -.fa-sliders:before { - content: "\f1de"; -} -.fa-share-alt:before { - content: "\f1e0"; -} -.fa-share-alt-square:before { - content: "\f1e1"; -} -.fa-bomb:before { - content: "\f1e2"; -} -.fa-soccer-ball-o:before, -.fa-futbol-o:before { - content: "\f1e3"; -} -.fa-tty:before { - content: "\f1e4"; -} -.fa-binoculars:before { - content: "\f1e5"; -} -.fa-plug:before { - content: "\f1e6"; -} -.fa-slideshare:before { - content: "\f1e7"; -} -.fa-twitch:before { - content: "\f1e8"; -} -.fa-yelp:before { - content: "\f1e9"; -} -.fa-newspaper-o:before { - content: "\f1ea"; -} -.fa-wifi:before { - content: "\f1eb"; -} -.fa-calculator:before { - content: "\f1ec"; -} -.fa-paypal:before { - content: "\f1ed"; -} -.fa-google-wallet:before { - content: "\f1ee"; -} -.fa-cc-visa:before { - content: "\f1f0"; -} -.fa-cc-mastercard:before { - content: "\f1f1"; -} -.fa-cc-discover:before { - content: "\f1f2"; -} -.fa-cc-amex:before { - content: "\f1f3"; -} -.fa-cc-paypal:before { - content: "\f1f4"; -} -.fa-cc-stripe:before { - content: "\f1f5"; -} -.fa-bell-slash:before { - content: "\f1f6"; -} -.fa-bell-slash-o:before { - content: "\f1f7"; -} -.fa-trash:before { - content: "\f1f8"; -} -.fa-copyright:before { - content: "\f1f9"; -} -.fa-at:before { - content: "\f1fa"; -} -.fa-eyedropper:before { - content: "\f1fb"; -} -.fa-paint-brush:before { - content: "\f1fc"; -} -.fa-birthday-cake:before { - content: "\f1fd"; -} -.fa-area-chart:before { - content: "\f1fe"; -} -.fa-pie-chart:before { - content: "\f200"; -} -.fa-line-chart:before { - content: "\f201"; -} -.fa-lastfm:before { - content: "\f202"; -} -.fa-lastfm-square:before { - content: "\f203"; -} -.fa-toggle-off:before { - content: "\f204"; -} -.fa-toggle-on:before { - content: "\f205"; -} -.fa-bicycle:before { - content: "\f206"; -} -.fa-bus:before { - content: "\f207"; -} -.fa-ioxhost:before { - content: "\f208"; -} -.fa-angellist:before { - content: "\f209"; -} -.fa-cc:before { - content: "\f20a"; -} -.fa-shekel:before, -.fa-sheqel:before, -.fa-ils:before { - content: "\f20b"; -} -.fa-meanpath:before { - content: "\f20c"; -} -.fa-buysellads:before { - content: "\f20d"; -} -.fa-connectdevelop:before { - content: "\f20e"; -} -.fa-dashcube:before { - content: "\f210"; -} -.fa-forumbee:before { - content: "\f211"; -} -.fa-leanpub:before { - content: "\f212"; -} -.fa-sellsy:before { - content: "\f213"; -} -.fa-shirtsinbulk:before { - content: "\f214"; -} -.fa-simplybuilt:before { - content: "\f215"; -} -.fa-skyatlas:before { - content: "\f216"; -} -.fa-cart-plus:before { - content: "\f217"; -} -.fa-cart-arrow-down:before { - content: "\f218"; -} -.fa-diamond:before { - content: "\f219"; -} -.fa-ship:before { - content: "\f21a"; -} -.fa-user-secret:before { - content: "\f21b"; -} -.fa-motorcycle:before { - content: "\f21c"; -} -.fa-street-view:before { - content: "\f21d"; -} -.fa-heartbeat:before { - content: "\f21e"; -} -.fa-venus:before { - content: "\f221"; -} -.fa-mars:before { - content: "\f222"; -} -.fa-mercury:before { - content: "\f223"; -} -.fa-intersex:before, -.fa-transgender:before { - content: "\f224"; -} -.fa-transgender-alt:before { - content: "\f225"; -} -.fa-venus-double:before { - content: "\f226"; -} -.fa-mars-double:before { - content: "\f227"; -} -.fa-venus-mars:before { - content: "\f228"; -} -.fa-mars-stroke:before { - content: "\f229"; -} -.fa-mars-stroke-v:before { - content: "\f22a"; -} -.fa-mars-stroke-h:before { - content: "\f22b"; -} -.fa-neuter:before { - content: "\f22c"; -} -.fa-genderless:before { - content: "\f22d"; -} -.fa-facebook-official:before { - content: "\f230"; -} -.fa-pinterest-p:before { - content: "\f231"; -} -.fa-whatsapp:before { - content: "\f232"; -} -.fa-server:before { - content: "\f233"; -} -.fa-user-plus:before { - content: "\f234"; -} -.fa-user-times:before { - content: "\f235"; -} -.fa-hotel:before, -.fa-bed:before { - content: "\f236"; -} -.fa-viacoin:before { - content: "\f237"; -} -.fa-train:before { - content: "\f238"; -} -.fa-subway:before { - content: "\f239"; -} -.fa-medium:before { - content: "\f23a"; -} -.fa-yc:before, -.fa-y-combinator:before { - content: "\f23b"; -} -.fa-optin-monster:before { - content: "\f23c"; -} -.fa-opencart:before { - content: "\f23d"; -} -.fa-expeditedssl:before { - content: "\f23e"; -} -.fa-battery-4:before, -.fa-battery:before, -.fa-battery-full:before { - content: "\f240"; -} -.fa-battery-3:before, -.fa-battery-three-quarters:before { - content: "\f241"; -} -.fa-battery-2:before, -.fa-battery-half:before { - content: "\f242"; -} -.fa-battery-1:before, -.fa-battery-quarter:before { - content: "\f243"; -} -.fa-battery-0:before, -.fa-battery-empty:before { - content: "\f244"; -} -.fa-mouse-pointer:before { - content: "\f245"; -} -.fa-i-cursor:before { - content: "\f246"; -} -.fa-object-group:before { - content: "\f247"; -} -.fa-object-ungroup:before { - content: "\f248"; -} -.fa-sticky-note:before { - content: "\f249"; -} -.fa-sticky-note-o:before { - content: "\f24a"; -} -.fa-cc-jcb:before { - content: "\f24b"; -} -.fa-cc-diners-club:before { - content: "\f24c"; -} -.fa-clone:before { - content: "\f24d"; -} -.fa-balance-scale:before { - content: "\f24e"; -} -.fa-hourglass-o:before { - content: "\f250"; -} -.fa-hourglass-1:before, -.fa-hourglass-start:before { - content: "\f251"; -} -.fa-hourglass-2:before, -.fa-hourglass-half:before { - content: "\f252"; -} -.fa-hourglass-3:before, -.fa-hourglass-end:before { - content: "\f253"; -} -.fa-hourglass:before { - content: "\f254"; -} -.fa-hand-grab-o:before, -.fa-hand-rock-o:before { - content: "\f255"; -} -.fa-hand-stop-o:before, -.fa-hand-paper-o:before { - content: "\f256"; -} -.fa-hand-scissors-o:before { - content: "\f257"; -} -.fa-hand-lizard-o:before { - content: "\f258"; -} -.fa-hand-spock-o:before { - content: "\f259"; -} -.fa-hand-pointer-o:before { - content: "\f25a"; -} -.fa-hand-peace-o:before { - content: "\f25b"; -} -.fa-trademark:before { - content: "\f25c"; -} -.fa-registered:before { - content: "\f25d"; -} -.fa-creative-commons:before { - content: "\f25e"; -} -.fa-gg:before { - content: "\f260"; -} -.fa-gg-circle:before { - content: "\f261"; -} -.fa-tripadvisor:before { - content: "\f262"; -} -.fa-odnoklassniki:before { - content: "\f263"; -} -.fa-odnoklassniki-square:before { - content: "\f264"; -} -.fa-get-pocket:before { - content: "\f265"; -} -.fa-wikipedia-w:before { - content: "\f266"; -} -.fa-safari:before { - content: "\f267"; -} -.fa-chrome:before { - content: "\f268"; -} -.fa-firefox:before { - content: "\f269"; -} -.fa-opera:before { - content: "\f26a"; -} -.fa-internet-explorer:before { - content: "\f26b"; -} -.fa-tv:before, -.fa-television:before { - content: "\f26c"; -} -.fa-contao:before { - content: "\f26d"; -} -.fa-500px:before { - content: "\f26e"; -} -.fa-amazon:before { - content: "\f270"; -} -.fa-calendar-plus-o:before { - content: "\f271"; -} -.fa-calendar-minus-o:before { - content: "\f272"; -} -.fa-calendar-times-o:before { - content: "\f273"; -} -.fa-calendar-check-o:before { - content: "\f274"; -} -.fa-industry:before { - content: "\f275"; -} -.fa-map-pin:before { - content: "\f276"; -} -.fa-map-signs:before { - content: "\f277"; -} -.fa-map-o:before { - content: "\f278"; -} -.fa-map:before { - content: "\f279"; -} -.fa-commenting:before { - content: "\f27a"; -} -.fa-commenting-o:before { - content: "\f27b"; -} -.fa-houzz:before { - content: "\f27c"; -} -.fa-vimeo:before { - content: "\f27d"; -} -.fa-black-tie:before { - content: "\f27e"; -} -.fa-fonticons:before { - content: "\f280"; -} -.fa-reddit-alien:before { - content: "\f281"; -} -.fa-edge:before { - content: "\f282"; -} -.fa-credit-card-alt:before { - content: "\f283"; -} -.fa-codiepie:before { - content: "\f284"; -} -.fa-modx:before { - content: "\f285"; -} -.fa-fort-awesome:before { - content: "\f286"; -} -.fa-usb:before { - content: "\f287"; -} -.fa-product-hunt:before { - content: "\f288"; -} -.fa-mixcloud:before { - content: "\f289"; -} -.fa-scribd:before { - content: "\f28a"; -} -.fa-pause-circle:before { - content: "\f28b"; -} -.fa-pause-circle-o:before { - content: "\f28c"; -} -.fa-stop-circle:before { - content: "\f28d"; -} -.fa-stop-circle-o:before { - content: "\f28e"; -} -.fa-shopping-bag:before { - content: "\f290"; -} -.fa-shopping-basket:before { - content: "\f291"; -} -.fa-hashtag:before { - content: "\f292"; -} -.fa-bluetooth:before { - content: "\f293"; -} -.fa-bluetooth-b:before { - content: "\f294"; -} -.fa-percent:before { - content: "\f295"; -} -.fa-gitlab:before { - content: "\f296"; -} -.fa-wpbeginner:before { - content: "\f297"; -} -.fa-wpforms:before { - content: "\f298"; -} -.fa-envira:before { - content: "\f299"; -} -.fa-universal-access:before { - content: "\f29a"; -} -.fa-wheelchair-alt:before { - content: "\f29b"; -} -.fa-question-circle-o:before { - content: "\f29c"; -} -.fa-blind:before { - content: "\f29d"; -} -.fa-audio-description:before { - content: "\f29e"; -} -.fa-volume-control-phone:before { - content: "\f2a0"; -} -.fa-braille:before { - content: "\f2a1"; -} -.fa-assistive-listening-systems:before { - content: "\f2a2"; -} -.fa-asl-interpreting:before, -.fa-american-sign-language-interpreting:before { - content: "\f2a3"; -} -.fa-deafness:before, -.fa-hard-of-hearing:before, -.fa-deaf:before { - content: "\f2a4"; -} -.fa-glide:before { - content: "\f2a5"; -} -.fa-glide-g:before { - content: "\f2a6"; -} -.fa-signing:before, -.fa-sign-language:before { - content: "\f2a7"; -} -.fa-low-vision:before { - content: "\f2a8"; -} -.fa-viadeo:before { - content: "\f2a9"; -} -.fa-viadeo-square:before { - content: "\f2aa"; -} -.fa-snapchat:before { - content: "\f2ab"; -} -.fa-snapchat-ghost:before { - content: "\f2ac"; -} -.fa-snapchat-square:before { - content: "\f2ad"; -} -.fa-pied-piper:before { - content: "\f2ae"; -} -.fa-first-order:before { - content: "\f2b0"; -} -.fa-yoast:before { - content: "\f2b1"; -} -.fa-themeisle:before { - content: "\f2b2"; -} -.fa-google-plus-circle:before, -.fa-google-plus-official:before { - content: "\f2b3"; -} -.fa-fa:before, -.fa-font-awesome:before { - content: "\f2b4"; -} -.fa-handshake-o:before { - content: "\f2b5"; -} -.fa-envelope-open:before { - content: "\f2b6"; -} -.fa-envelope-open-o:before { - content: "\f2b7"; -} -.fa-linode:before { - content: "\f2b8"; -} -.fa-address-book:before { - content: "\f2b9"; -} -.fa-address-book-o:before { - content: "\f2ba"; -} -.fa-vcard:before, -.fa-address-card:before { - content: "\f2bb"; -} -.fa-vcard-o:before, -.fa-address-card-o:before { - content: "\f2bc"; -} -.fa-user-circle:before { - content: "\f2bd"; -} -.fa-user-circle-o:before { - content: "\f2be"; -} -.fa-user-o:before { - content: "\f2c0"; -} -.fa-id-badge:before { - content: "\f2c1"; -} -.fa-drivers-license:before, -.fa-id-card:before { - content: "\f2c2"; -} -.fa-drivers-license-o:before, -.fa-id-card-o:before { - content: "\f2c3"; -} -.fa-quora:before { - content: "\f2c4"; -} -.fa-free-code-camp:before { - content: "\f2c5"; -} -.fa-telegram:before { - content: "\f2c6"; -} -.fa-thermometer-4:before, -.fa-thermometer:before, -.fa-thermometer-full:before { - content: "\f2c7"; -} -.fa-thermometer-3:before, -.fa-thermometer-three-quarters:before { - content: "\f2c8"; -} -.fa-thermometer-2:before, -.fa-thermometer-half:before { - content: "\f2c9"; -} -.fa-thermometer-1:before, -.fa-thermometer-quarter:before { - content: "\f2ca"; -} -.fa-thermometer-0:before, -.fa-thermometer-empty:before { - content: "\f2cb"; -} -.fa-shower:before { - content: "\f2cc"; -} -.fa-bathtub:before, -.fa-s15:before, -.fa-bath:before { - content: "\f2cd"; -} -.fa-podcast:before { - content: "\f2ce"; -} -.fa-window-maximize:before { - content: "\f2d0"; -} -.fa-window-minimize:before { - content: "\f2d1"; -} -.fa-window-restore:before { - content: "\f2d2"; -} -.fa-times-rectangle:before, -.fa-window-close:before { - content: "\f2d3"; -} -.fa-times-rectangle-o:before, -.fa-window-close-o:before { - content: "\f2d4"; -} -.fa-bandcamp:before { - content: "\f2d5"; -} -.fa-grav:before { - content: "\f2d6"; -} -.fa-etsy:before { - content: "\f2d7"; -} -.fa-imdb:before { - content: "\f2d8"; -} -.fa-ravelry:before { - content: "\f2d9"; -} -.fa-eercast:before { - content: "\f2da"; -} -.fa-microchip:before { - content: "\f2db"; -} -.fa-snowflake-o:before { - content: "\f2dc"; -} -.fa-superpowers:before { - content: "\f2dd"; -} -.fa-wpexplorer:before { - content: "\f2de"; -} -.fa-meetup:before { - content: "\f2e0"; -} -.sr-only { - position: absolute; - width: 1px; - height: 1px; - padding: 0; - margin: -1px; - overflow: hidden; - clip: rect(0, 0, 0, 0); - border: 0; -} -.sr-only-focusable:active, -.sr-only-focusable:focus { - position: static; - width: auto; - height: auto; - margin: 0; - overflow: visible; - clip: auto; -} diff --git a/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/css/font-awesome.css.map b/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/css/font-awesome.css.map deleted file mode 100644 index 60763a864..000000000 --- a/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/css/font-awesome.css.map +++ /dev/null @@ -1,7 +0,0 @@ -{ -"version": 3, -"mappings": ";;;;;;;AAGA,UAUC;EATC,WAAW,EAAE,aAAa;EAC1B,GAAG,EAAE,+CAAgE;EACrE,GAAG,EAAE,ySAAmG;EAKxG,WAAW,EAAE,MAAM;EACnB,UAAU,EAAE,MAAM;ACTpB,GAAmB;EACjB,OAAO,EAAE,YAAY;EACrB,IAAI,EAAE,uCAAwD;EAC9D,SAAS,EAAE,OAAO;EAClB,cAAc,EAAE,IAAI;EACpB,sBAAsB,EAAE,WAAW;EACnC,uBAAuB,EAAE,SAAS;EAClC,SAAS,EAAE,eAAe;;;ACN5B,MAAsB;EACpB,SAAS,EAAE,SAAS;EACpB,WAAW,EAAE,MAAS;EACtB,cAAc,EAAE,IAAI;;AAEtB,MAAsB;EAAE,SAAS,EAAE,GAAG;;AACtC,MAAsB;EAAE,SAAS,EAAE,GAAG;;AACtC,MAAsB;EAAE,SAAS,EAAE,GAAG;;AACtC,MAAsB;EAAE,SAAS,EAAE,GAAG;;ACVtC,MAAsB;EACpB,KAAK,EAAE,SAAW;EAClB,UAAU,EAAE,MAAM;;ACDpB,MAAsB;EACpB,YAAY,EAAE,CAAC;EACf,WAAW,ECKU,SAAS;EDJ9B,eAAe,EAAE,IAAI;EACrB,WAAK;IAAE,QAAQ,EAAE,QAAQ;;AAE3B,MAAsB;EACpB,QAAQ,EAAE,QAAQ;EAClB,IAAI,EAAE,UAAa;EACnB,KAAK,ECFgB,SAAS;EDG9B,GAAG,EAAE,SAAU;EACf,UAAU,EAAE,MAAM;EAClB,YAAuB;IACrB,IAAI,EAAE,UAA0B;;AEbpC,UAA0B;EACxB,OAAO,EAAE,gBAAgB;EACzB,MAAM,EAAE,iBAA4B;EACpC,aAAa,EAAE,IAAI;;AAGrB,WAAY;EAAE,KAAK,EAAE,KAAK;;AAC1B,UAAW;EAAE,KAAK,EAAE,IAAI;;AAGtB,aAAY;EAAE,YAAY,EAAE,IAAI;AAChC,cAAa;EAAE,WAAW,EAAE,IAAI;;ACXlC,QAAwB;EACtB,iBAAiB,EAAE,0BAA0B;EACrC,SAAS,EAAE,0BAA0B;;AAG/C,SAAyB;EACvB,iBAAiB,EAAE,4BAA4B;EACvC,SAAS,EAAE,4BAA4B;;AAGjD,0BASC;EARC,EAAG;IACD,iBAAiB,EAAE,YAAY;IACvB,SAAS,EAAE,YAAY;EAEjC,IAAK;IACH,iBAAiB,EAAE,cAAc;IACzB,SAAS,EAAE,cAAc;AAIrC,kBASC;EARC,EAAG;IACD,iBAAiB,EAAE,YAAY;IACvB,SAAS,EAAE,YAAY;EAEjC,IAAK;IACH,iBAAiB,EAAE,cAAc;IACzB,SAAS,EAAE,cAAc;AC5BrC,aAA8B;ECY5B,MAAM,EAAE,wDAAmE;EAC3E,iBAAiB,EAAE,aAAgB;EAC/B,aAAa,EAAE,aAAgB;EAC3B,SAAS,EAAE,aAAgB;;ADdrC,cAA8B;ECW5B,MAAM,EAAE,wDAAmE;EAC3E,iBAAiB,EAAE,cAAgB;EAC/B,aAAa,EAAE,cAAgB;EAC3B,SAAS,EAAE,cAAgB;;ADbrC,cAA8B;ECU5B,MAAM,EAAE,wDAAmE;EAC3E,iBAAiB,EAAE,cAAgB;EAC/B,aAAa,EAAE,cAAgB;EAC3B,SAAS,EAAE,cAAgB;;ADXrC,mBAAmC;ECejC,MAAM,EAAE,wDAAmE;EAC3E,iBAAiB,EAAE,YAAoB;EACnC,aAAa,EAAE,YAAoB;EAC/B,SAAS,EAAE,YAAoB;;ADjBzC,iBAAmC;ECcjC,MAAM,EAAE,wDAAmE;EAC3E,iBAAiB,EAAE,YAAoB;EACnC,aAAa,EAAE,YAAoB;EAC/B,SAAS,EAAE,YAAoB;;ADZzC;;;;uBAIuC;EACrC,MAAM,EAAE,IAAI;;AEfd,SAAyB;EACvB,QAAQ,EAAE,QAAQ;EAClB,OAAO,EAAE,YAAY;EACrB,KAAK,EAAE,GAAG;EACV,MAAM,EAAE,GAAG;EACX,WAAW,EAAE,GAAG;EAChB,cAAc,EAAE,MAAM;;AAExB,0BAAyD;EACvD,QAAQ,EAAE,QAAQ;EAClB,IAAI,EAAE,CAAC;EACP,KAAK,EAAE,IAAI;EACX,UAAU,EAAE,MAAM;;AAEpB,YAA4B;EAAE,WAAW,EAAE,OAAO;;AAClD,YAA4B;EAAE,SAAS,EAAE,GAAG;;AAC5C,WAA2B;EAAE,KAAK,ELVZ,IAAI;;;;AMN1B,gBAAgC;EAAE,OAAO,ENoQ1B,GAAO;;AMnQtB,gBAAgC;EAAE,OAAO,EN0W1B,GAAO;;AMzWtB,iBAAiC;EAAE,OAAO,ENmb1B,GAAO;;AMlbvB,qBAAqC;EAAE,OAAO,ENmL1B,GAAO;;AMlL3B,gBAAgC;EAAE,OAAO,ENkR1B,GAAO;;AMjRtB,eAA+B;EAAE,OAAO,ENke1B,GAAO;;AMjerB,iBAAiC;EAAE,OAAO,ENse1B,GAAO;;AMrevB,eAA+B;EAAE,OAAO,EN+iB1B,GAAO;;AM9iBrB,eAA+B;EAAE,OAAO,ENyN1B,GAAO;;AMxNrB,mBAAmC;EAAE,OAAO,ENggB1B,GAAO;;AM/fzB,aAA6B;EAAE,OAAO,EN8f1B,GAAO;;AM7fnB,kBAAkC;EAAE,OAAO,EN+f1B,GAAO;;AM9fxB,gBAAgC;EAAE,OAAO,ENoG1B,GAAO;;AMnGtB;;gBAEgC;EAAE,OAAO,ENkgB1B,GAAO;;AMjgBtB,sBAAsC;EAAE,OAAO,ENua1B,GAAO;;AMta5B,uBAAuC;EAAE,OAAO,ENqa1B,GAAO;;AMpa7B,oBAAoC;EAAE,OAAO,EN+X1B,GAAO;;AM9X1B,iBAAiC;EAAE,OAAO,ENsb1B,GAAO;;AMrbvB;cAC8B;EAAE,OAAO,ENwH1B,GAAO;;AMvHpB,kBAAkC;EAAE,OAAO,ENygB1B,GAAO;;AMxgBxB,eAA+B;EAAE,OAAO,ENmQ1B,GAAO;;AMlQrB,iBAAiC;EAAE,OAAO,EN6L1B,GAAO;;AM5LvB,kBAAkC;EAAE,OAAO,EN0G1B,GAAO;;AMzGxB,eAA+B;EAAE,OAAO,EN+Y1B,GAAO;;AM9YrB,mBAAmC;EAAE,OAAO,ENiJ1B,GAAO;;AMhJzB,8BAA8C;EAAE,OAAO,ENI1B,GAAO;;AMHpC,4BAA4C;EAAE,OAAO,ENM1B,GAAO;;AMLlC,gBAAgC;EAAE,OAAO,ENkQ1B,GAAO;;AMjQtB,wBAAwC;EAAE,OAAO,EN4W1B,GAAO;;AM3W9B;iBACiC;EAAE,OAAO,ENmY1B,GAAO;;AMlYvB,kBAAkC;EAAE,OAAO,EN8X1B,GAAO;;AM7XxB,mBAAmC;EAAE,OAAO,ENiS1B,GAAO;;AMhSzB,eAA+B;EAAE,OAAO,ENoS1B,GAAO;;AMnSrB,eAA+B;EAAE,OAAO,ENgM1B,GAAO;;AM/LrB,qBAAqC;EAAE,OAAO,EN+O1B,GAAO;;AM9O3B,qBAAqC;EAAE,OAAO,EN8hB1B,GAAO;;AM7hB3B,sBAAsC;EAAE,OAAO,EN4hB1B,GAAO;;AM3hB5B,oBAAoC;EAAE,OAAO,EN6hB1B,GAAO;;AM5hB1B,iBAAiC;EAAE,OAAO,EN2W1B,GAAO;;AM1WvB,kBAAkC;EAAE,OAAO,ENW1B,GAAO;;AMVxB,cAA8B;EAAE,OAAO,ENod1B,GAAO;;AMndpB,eAA+B;EAAE,OAAO,ENod1B,GAAO;;AMndrB,eAA+B;EAAE,OAAO,EN2B1B,GAAO;;AM1BrB,mBAAmC;EAAE,OAAO,EN2B1B,GAAO;;AM1BzB,gBAAgC;EAAE,OAAO,ENkW1B,GAAO;;AMjWtB,iBAAiC;EAAE,OAAO,ENwC1B,GAAO;;AMvCvB,eAA+B;EAAE,OAAO,EN8L1B,GAAO;;AM7LrB,eAA+B;EAAE,OAAO,ENmB1B,GAAO;;AMlBrB,iBAAiC;EAAE,OAAO,ENoP1B,GAAO;;AMnPvB,sBAAsC;EAAE,OAAO,ENid1B,GAAO;;AMhd5B,qBAAqC;EAAE,OAAO,ENid1B,GAAO;;AMhd3B,qBAAqC;EAAE,OAAO,EN1C1B,GAAO;;AM2C3B,uBAAuC;EAAE,OAAO,EN7C1B,GAAO;;AM8C7B,sBAAsC;EAAE,OAAO,EN3C1B,GAAO;;AM4C5B,wBAAwC;EAAE,OAAO,EN9C1B,GAAO;;AM+C9B,eAA+B;EAAE,OAAO,ENwQ1B,GAAO;;AMvQrB;kBACkC;EAAE,OAAO,ENmT1B,GAAO;;AMlTxB,iBAAiC;EAAE,OAAO,ENmO1B,GAAO;;AMlOvB,uBAAuC;EAAE,OAAO,ENigB1B,GAAO;;AMhgB7B;;oBAEoC;EAAE,OAAO,EN+T1B,GAAO;;AM9T1B,iBAAiC;EAAE,OAAO,ENwT1B,GAAO;;AMvTvB,qBAAqC;EAAE,OAAO,EN+Q1B,GAAO;;AM9Q3B,iBAAiC;EAAE,OAAO,EN5D1B,GAAO;;AM6DvB,eAA+B;EAAE,OAAO,EN8c1B,GAAO;;AM7crB;0BAC0C;EAAE,OAAO,ENqT1B,GAAO;;AMpThC,yBAAyC;EAAE,OAAO,ENuX1B,GAAO;;AMtX/B,yBAAyC;EAAE,OAAO,EN0C1B,GAAO;;AMzC/B,iBAAiC;EAAE,OAAO,ENjC1B,GAAO;;AMkCvB,wBAAwC;EAAE,OAAO,ENma1B,GAAO;;AMla9B,wBAAwC;EAAE,OAAO,EN4H1B,GAAO;;AM3H9B,mBAAmC;EAAE,OAAO,EN7B1B,GAAO;;AM8BzB,eAA+B;EAAE,OAAO,EN0T1B,GAAO;;AMzTrB,gBAAgC;EAAE,OAAO,ENwS1B,GAAO;;AMvStB,eAA+B;EAAE,OAAO,ENia1B,GAAO;;AMharB,kBAAkC;EAAE,OAAO,ENgK1B,GAAO;;AM/JxB,uBAAuC;EAAE,OAAO,ENuH1B,GAAO;;AMtH7B,uBAAuC;EAAE,OAAO,EN4Z1B,GAAO;;AM3Z7B,gBAAgC;EAAE,OAAO,EN4F1B,GAAO;;AM3FtB,uBAAuC;EAAE,OAAO,ENoC1B,GAAO;;AMnC7B,wBAAwC;EAAE,OAAO,ENoC1B,GAAO;;AMnC9B,sBAAsC;EAAE,OAAO,ENsT1B,GAAO;;AMrT5B,uBAAuC;EAAE,OAAO,ENyQ1B,GAAO;;AMxQ7B,uBAAuC;EAAE,OAAO,ENwb1B,GAAO;;AMvb7B,uBAAuC;EAAE,OAAO,ENsB1B,GAAO;;AMrB7B,0BAA0C;EAAE,OAAO,EN2T1B,GAAO;;AM1ThC,sBAAsC;EAAE,OAAO,ENsM1B,GAAO;;AMrM5B,qBAAqC;EAAE,OAAO,EN6D1B,GAAO;;AM5D3B,yBAAyC;EAAE,OAAO,ENob1B,GAAO;;AMnb/B,yBAAyC;EAAE,OAAO,ENkB1B,GAAO;;AMjB/B,cAA8B;EAAE,OAAO,EN/C1B,GAAO;;AMgDpB,qBAAqC;EAAE,OAAO,EN3D1B,GAAO;;AM4D3B,sBAAsC;EAAE,OAAO,EN3D1B,GAAO;;AM4D5B,mBAAmC;EAAE,OAAO,EN3D1B,GAAO;;AM4DzB,qBAAqC;EAAE,OAAO,EN/D1B,GAAO;;AMgE3B;gBACgC;EAAE,OAAO,ENqV1B,GAAO;;AMpVtB,iBAAiC;EAAE,OAAO,ENuF1B,GAAO;;AMtFvB,mBAAmC;EAAE,OAAO,EN4C1B,GAAO;;AM3CzB,eAA+B;EAAE,OAAO,ENmS1B,GAAO;;AMlSrB,gBAAgC;EAAE,OAAO,ENsP1B,GAAO;;AMrPtB,mBAAmC;EAAE,OAAO,EN9D1B,GAAO;;AM+DzB,6BAA6C;EAAE,OAAO,ENgF1B,GAAO;;AM/EnC,eAA+B;EAAE,OAAO,EN+I1B,GAAO;;AM9IrB,eAA+B;EAAE,OAAO,ENoM1B,GAAO;;AMnMrB,eAA+B;EAAE,OAAO,ENmH1B,GAAO;;AMlHrB,cAA8B;EAAE,OAAO,ENiF1B,GAAO;;AMhFpB,oBAAoC;EAAE,OAAO,ENiF1B,GAAO;;AMhF1B;+BAC+C;EAAE,OAAO,EN0E1B,GAAO;;AMzErC,gBAAgC;EAAE,OAAO,ENmR1B,GAAO;;AMlRtB,mBAAmC;EAAE,OAAO,EN/B1B,GAAO;;AMgCzB,iBAAiC;EAAE,OAAO,ENoS1B,GAAO;;AMnSvB,kBAAkC;EAAE,OAAO,ENwB1B,GAAO;;AMvBxB,iBAAiC;EAAE,OAAO,ENqN1B,GAAO;;AMpNvB,qBAAqC;EAAE,OAAO,ENE1B,GAAO;;AMD3B,uBAAuC;EAAE,OAAO,ENF1B,GAAO;;AMG7B,kBAAkC;EAAE,OAAO,EN2S1B,GAAO;;AM1SxB,wBAAwC;EAAE,OAAO,ENyU1B,GAAO;;AMxU9B,iBAAiC;EAAE,OAAO,EN8G1B,GAAO;;AM7GvB,sBAAsC;EAAE,OAAO,EN+G1B,GAAO;;AM9G5B,mBAAmC;EAAE,OAAO,ENnF1B,GAAO;;AMoFzB,mBAAmC;EAAE,OAAO,ENrF1B,GAAO;;AMsFzB;oBACoC;EAAE,OAAO,EN/E1B,GAAO;;AMgF1B,yBAAyC;EAAE,OAAO,ENua1B,GAAO;;AMta/B,0BAA0C;EAAE,OAAO,ENmE1B,GAAO;;AMlEhC,uBAAuC;EAAE,OAAO,EN5C1B,GAAO;;AM6C7B,cAA8B;EAAE,OAAO,ENqK1B,GAAO;;AMpKpB;eAC+B;EAAE,OAAO,ENK1B,GAAO;;AMJrB,mBAAmC;EAAE,OAAO,ENQ1B,GAAO;;AMPzB,sBAAsC;EAAE,OAAO,ENmY1B,GAAO;;AMlY5B,wBAAwC;EAAE,OAAO,ENiY1B,GAAO;;AMhY9B,oBAAoC;EAAE,OAAO,EN2V1B,GAAO;;AM1V1B,kBAAkC;EAAE,OAAO,ENyI1B,GAAO;;AMxIxB,mBAAmC;EAAE,OAAO,ENyT1B,GAAO;;AMxTzB,0BAA0C;EAAE,OAAO,ENiL1B,GAAO;;AMhLhC,qBAAqC;EAAE,OAAO,EN0X1B,GAAO;;AMzX3B,wBAAwC;EAAE,OAAO,EN8C1B,GAAO;;AM7C9B,kBAAkC;EAAE,OAAO,ENoT1B,GAAO;;AMnTxB,iBAAiC;EAAE,OAAO,EN8Y1B,GAAO;;AM7YvB,wBAAwC;EAAE,OAAO,EN6G1B,GAAO;;AM5G9B,iBAAiC;EAAE,OAAO,EN8Z1B,GAAO;;AM7ZvB,kBAAkC;EAAE,OAAO,EN+J1B,GAAO;;AM9JxB,gBAAgC;EAAE,OAAO,ENsO1B,GAAO;;AMrOtB,mBAAmC;EAAE,OAAO,EN2U1B,GAAO;;AM1UzB,qBAAqC;EAAE,OAAO,EN/E1B,GAAO;;AMgF3B,uBAAuC;EAAE,OAAO,ENoO1B,GAAO;;AMnO7B,kBAAkC;EAAE,OAAO,EN8Y1B,GAAO;;AM7YxB;mBACmC;EAAE,OAAO,ENuC1B,GAAO;;AMtCzB,iBAAiC;EAAE,OAAO,ENiG1B,GAAO;;AMhGvB,iBAAiC;EAAE,OAAO,ENiZ1B,GAAO;;AMhZvB,sBAAsC;EAAE,OAAO,ENR1B,GAAO;;AMS5B,cAA8B;EAAE,OAAO,EN4Q1B,GAAO;;AM3QpB,gBAAgC;EAAE,OAAO,ENgH1B,GAAO;;AM/GtB,mBAAmC;EAAE,OAAO,ENnF1B,GAAO;;AMoFzB,eAA+B;EAAE,OAAO,ENzG1B,GAAO;;AM0GrB,sBAAsC;EAAE,OAAO,ENzD1B,GAAO;;AM0D5B,uBAAuC;EAAE,OAAO,EN0G1B,GAAO;;AMzG7B,sBAAsC;EAAE,OAAO,ENwG1B,GAAO;;AMvG5B,oBAAoC;EAAE,OAAO,ENyG1B,GAAO;;AMxG1B,sBAAsC;EAAE,OAAO,ENqG1B,GAAO;;AMpG5B,4BAA4C;EAAE,OAAO,EN5I1B,GAAO;;AM6IlC,6BAA6C;EAAE,OAAO,ENxI1B,GAAO;;AMyInC,0BAA0C;EAAE,OAAO,ENxI1B,GAAO;;AMyIhC,4BAA4C;EAAE,OAAO,ENhJ1B,GAAO;;AMiJlC,gBAAgC;EAAE,OAAO,ENsF1B,GAAO;;AMrFtB,iBAAiC;EAAE,OAAO,ENia1B,GAAO;;AMhavB,gBAAgC;EAAE,OAAO,ENiV1B,GAAO;;AMhVtB,iBAAiC;EAAE,OAAO,ENgD1B,GAAO;;AM/CvB,oBAAoC;EAAE,OAAO,ENvG1B,GAAO;;AMwG1B,qBAAqC;EAAE,OAAO,ENzI1B,GAAO;;AM0I3B;gBACgC;EAAE,OAAO,ENqY1B,GAAO;;AMpYtB;eAC+B;EAAE,OAAO,ENuI1B,GAAO;;AMtIrB,gBAAgC;EAAE,OAAO,ENpD1B,GAAO;;AMqDtB,gBAAgC;EAAE,OAAO,EN+C1B,GAAO;;AM9CtB;mBACmC;EAAE,OAAO,ENwP1B,GAAO;;AMvPzB;kBACkC;EAAE,OAAO,ENkC1B,GAAO;;AMjCxB,oBAAoC;EAAE,OAAO,ENsL1B,GAAO;;AMrL1B;mBACmC;EAAE,OAAO,EN0C1B,GAAO;;AMzCzB,iBAAiC;EAAE,OAAO,ENiS1B,GAAO;;AMhSvB;;eAE+B;EAAE,OAAO,EN9I1B,GAAO;;AM+IrB,kBAAkC;EAAE,OAAO,ENgI1B,GAAO;;AM/HxB,kBAAkC;EAAE,OAAO,EN8H1B,GAAO;;AM7HxB,wBAAwC;EAAE,OAAO,EN4S1B,GAAO;;AM3S9B,oBAAoC;EAAE,OAAO,ENoW1B,GAAO;;AMnW1B,gBAAgC;EAAE,OAAO,ENmT1B,GAAO;;AMlTtB,gBAAgC;EAAE,OAAO,ENkI1B,GAAO;;AMjItB,gBAAgC;EAAE,OAAO,ENuV1B,GAAO;;AMtVtB,oBAAoC;EAAE,OAAO,ENwL1B,GAAO;;AMvL1B,2BAA2C;EAAE,OAAO,ENyL1B,GAAO;;AMxLjC,6BAA6C;EAAE,OAAO,ENyD1B,GAAO;;AMxDnC,sBAAsC;EAAE,OAAO,ENuD1B,GAAO;;AMtD5B,gBAAgC;EAAE,OAAO,ENsJ1B,GAAO;;AMrJtB,qBAAqC;EAAE,OAAO,ENtH1B,GAAO;;AMuH3B,mBAAmC;EAAE,OAAO,ENhH1B,GAAO;;AMiHzB,qBAAqC;EAAE,OAAO,ENvH1B,GAAO;;AMwH3B,sBAAsC;EAAE,OAAO,ENvH1B,GAAO;;AMwH5B,kBAAkC;EAAE,OAAO,ENvE1B,GAAO;;AMwExB;eAC+B;EAAE,OAAO,EN2P1B,GAAO;;AM1PrB;oBACoC;EAAE,OAAO,EN+P1B,GAAO;;AM9P1B;mBACmC;EAAE,OAAO,EN4P1B,GAAO;;AM3PzB,mBAAmC;EAAE,OAAO,ENxC1B,GAAO;;AMyCzB,mBAAmC;EAAE,OAAO,ENkG1B,GAAO;;AMjGzB;eAC+B;EAAE,OAAO,EN8U1B,GAAO;;AM7UrB;gBACgC;EAAE,OAAO,ENqB1B,GAAO;;AMpBtB;qBACqC;EAAE,OAAO,EN2R1B,GAAO;;AM1R3B,oBAAoC;EAAE,OAAO,ENpF1B,GAAO;;AMqF1B,qBAAqC;EAAE,OAAO,ENnF1B,GAAO;;AMoF3B;eAC+B;EAAE,OAAO,ENjK1B,GAAO;;AMkKrB,kBAAkC;EAAE,OAAO,ENkO1B,GAAO;;AMjOxB,mBAAmC;EAAE,OAAO,ENkU1B,GAAO;;AMjUzB;oBACoC;EAAE,OAAO,EN1G1B,GAAO;;AM2G1B,sBAAsC;EAAE,OAAO,ENgF1B,GAAO;;AM/E5B,mBAAmC;EAAE,OAAO,ENnD1B,GAAO;;AMoDzB,yBAAyC;EAAE,OAAO,ENzG1B,GAAO;;AM0G/B,uBAAuC;EAAE,OAAO,ENzG1B,GAAO;;AM0G7B,kBAAkC;EAAE,OAAO,ENsU1B,GAAO;;AMrUxB,sBAAsC;EAAE,OAAO,EN+P1B,GAAO;;AM9P5B,mBAAmC;EAAE,OAAO,ENsQ1B,GAAO;;AMrQzB,iBAAiC;EAAE,OAAO,ENvL1B,GAAO;;AMwLvB,iBAAiC;EAAE,OAAO,ENzG1B,GAAO;;AM0GvB,kBAAkC;EAAE,OAAO,ENtF1B,GAAO;;AMuFxB,sBAAsC;EAAE,OAAO,EN3B1B,GAAO;;AM4B5B,qBAAqC;EAAE,OAAO,ENxK1B,GAAO;;AMyK3B,qBAAqC;EAAE,OAAO,ENkC1B,GAAO;;AMjC3B,oBAAoC;EAAE,OAAO,EN3O1B,GAAO;;AM4O1B,iBAAiC;EAAE,OAAO,ENiG1B,GAAO;;AMhGvB,sBAAsC;EAAE,OAAO,EN/C1B,GAAO;;AMgD5B,eAA+B;EAAE,OAAO,ENpM1B,GAAO;;AMqMrB,mBAAmC;EAAE,OAAO,ENe1B,GAAO;;AMdzB,sBAAsC;EAAE,OAAO,ENgJ1B,GAAO;;AM/I5B,4BAA4C;EAAE,OAAO,EN5O1B,GAAO;;AM6OlC,6BAA6C;EAAE,OAAO,EN5O1B,GAAO;;AM6OnC,0BAA0C;EAAE,OAAO,EN5O1B,GAAO;;AM6OhC,4BAA4C;EAAE,OAAO,ENhP1B,GAAO;;AMiPlC,qBAAqC;EAAE,OAAO,EN5O1B,GAAO;;AM6O3B,sBAAsC;EAAE,OAAO,EN5O1B,GAAO;;AM6O5B,mBAAmC;EAAE,OAAO,EN5O1B,GAAO;;AM6OzB,qBAAqC;EAAE,OAAO,ENhP1B,GAAO;;AMiP3B,kBAAkC;EAAE,OAAO,ENlG1B,GAAO;;AMmGxB,iBAAiC;EAAE,OAAO,ENuC1B,GAAO;;AMtCvB,iBAAiC;EAAE,OAAO,ENoP1B,GAAO;;AMnPvB;iBACiC;EAAE,OAAO,ENyF1B,GAAO;;AMxFvB,mBAAmC;EAAE,OAAO,EN9I1B,GAAO;;AM+IzB,qBAAqC;EAAE,OAAO,EN0I1B,GAAO;;AMzI3B,sBAAsC;EAAE,OAAO,EN0I1B,GAAO;;AMzI5B,kBAAkC;EAAE,OAAO,ENgN1B,GAAO;;AM/MxB,iBAAiC;EAAE,OAAO,ENnJ1B,GAAO;;AMoJvB;gBACgC;EAAE,OAAO,ENkJ1B,GAAO;;AMjJtB,qBAAqC;EAAE,OAAO,ENnB1B,GAAO;;AMoB3B,mBAAmC;EAAE,OAAO,ENxC1B,GAAO;;AMyCzB,wBAAwC;EAAE,OAAO,ENvC1B,GAAO;;AMwC9B,kBAAkC;EAAE,OAAO,EN0L1B,GAAO;;AMzLxB,kBAAkC;EAAE,OAAO,ENpC1B,GAAO;;AMqCxB,gBAAgC;EAAE,OAAO,ENoE1B,GAAO;;AMnEtB,kBAAkC;EAAE,OAAO,ENpC1B,GAAO;;AMqCxB,qBAAqC;EAAE,OAAO,ENkB1B,GAAO;;AMjB3B,iBAAiC;EAAE,OAAO,ENrD1B,GAAO;;AMsDvB,yBAAyC;EAAE,OAAO,ENvD1B,GAAO;;AMwD/B,mBAAmC;EAAE,OAAO,ENuO1B,GAAO;;AMtOzB,eAA+B;EAAE,OAAO,ENtJ1B,GAAO;;AMuJrB;oBACoC;EAAE,OAAO,ENqI1B,GAAO;;AMpI1B;;sBAEsC;EAAE,OAAO,ENuM1B,GAAO;;AMtM5B,yBAAyC;EAAE,OAAO,ENkC1B,GAAO;;AMjC/B,eAA+B;EAAE,OAAO,EN5I1B,GAAO;;AM6IrB,oBAAoC;EAAE,OAAO,EN7J1B,GAAO;;AM8J1B;uBACuC;EAAE,OAAO,EN1L1B,GAAO;;AM2L7B,mBAAmC;EAAE,OAAO,EN4G1B,GAAO;;AM3GzB,eAA+B;EAAE,OAAO,ENT1B,GAAO;;AMUrB,sBAAsC;EAAE,OAAO,ENhH1B,GAAO;;AMiH5B,sBAAsC;EAAE,OAAO,EN8M1B,GAAO;;AM7M5B,oBAAoC;EAAE,OAAO,ENyM1B,GAAO;;AMxM1B,iBAAiC;EAAE,OAAO,ENvH1B,GAAO;;AMwHvB,uBAAuC;EAAE,OAAO,ENmG1B,GAAO;;AMlG7B,qBAAqC;EAAE,OAAO,EN8C1B,GAAO;;AM7C3B,2BAA2C;EAAE,OAAO,EN8C1B,GAAO;;AM7CjC,iBAAiC;EAAE,OAAO,ENgJ1B,GAAO;;AM/IvB,qBAAqC;EAAE,OAAO,EN5N1B,GAAO;;AM6N3B,4BAA4C;EAAE,OAAO,ENjF1B,GAAO;;AMkFlC,iBAAiC;EAAE,OAAO,ENoH1B,GAAO;;AMnHvB,iBAAiC;EAAE,OAAO,ENkC1B,GAAO;;AMjCvB,8BAA8C;EAAE,OAAO,ENlM1B,GAAO;;AMmMpC,+BAA+C;EAAE,OAAO,ENlM1B,GAAO;;AMmMrC,4BAA4C;EAAE,OAAO,ENlM1B,GAAO;;AMmMlC,8BAA8C;EAAE,OAAO,ENtM1B,GAAO;;AMuMpC,gBAAgC;EAAE,OAAO,EN/B1B,GAAO;;AMgCtB,eAA+B;EAAE,OAAO,ENjK1B,GAAO;;AMkKrB,iBAAiC;EAAE,OAAO,EN9S1B,GAAO;;AM+SvB,qBAAqC;EAAE,OAAO,ENmP1B,GAAO;;AMlP3B,mBAAmC;EAAE,OAAO,EN9O1B,GAAO;;AM+OzB,qBAAqC;EAAE,OAAO,EN/I1B,GAAO;;AMgJ3B,qBAAqC;EAAE,OAAO,EN/I1B,GAAO;;AMgJ3B,qBAAqC;EAAE,OAAO,EN4G1B,GAAO;;AM3G3B,sBAAsC;EAAE,OAAO,ENsE1B,GAAO;;AMrE5B,iBAAiC;EAAE,OAAO,EN2M1B,GAAO;;AM1MvB,uBAAuC;EAAE,OAAO,EN6B1B,GAAO;;AM5B7B,yBAAyC;EAAE,OAAO,EN6B1B,GAAO;;AM5B/B,mBAAmC;EAAE,OAAO,ENhB1B,GAAO;;AMiBzB,qBAAqC;EAAE,OAAO,ENlB1B,GAAO;;AMmB3B,uBAAuC;EAAE,OAAO,ENvN1B,GAAO;;AMwN7B,wBAAwC;EAAE,OAAO,ENiD1B,GAAO;;AMhD9B,+BAA+C;EAAE,OAAO,EN3I1B,GAAO;;AM4IrC,uBAAuC;EAAE,OAAO,ENkH1B,GAAO;;AMjH7B,kBAAkC;EAAE,OAAO,EN1L1B,GAAO;;AM2LxB;8BAC8C;EAAE,OAAO,ENjP1B,GAAO;;AMkPpC;4BAC4C;EAAE,OAAO,ENhP1B,GAAO;;AMiPlC;+BAC+C;EAAE,OAAO,ENnP1B,GAAO;;AMoPrC;cAC8B;EAAE,OAAO,EN7J1B,GAAO;;AM8JpB,cAA8B;EAAE,OAAO,EN/F1B,GAAO;;AMgGpB;cAC8B;EAAE,OAAO,EN4N1B,GAAO;;AM3NpB;cAC8B;EAAE,OAAO,ENvD1B,GAAO;;AMwDpB;;;cAG8B;EAAE,OAAO,ENrD1B,GAAO;;AMsDpB;;cAE8B;EAAE,OAAO,EN8E1B,GAAO;;AM7EpB;cAC8B;EAAE,OAAO,ENtD1B,GAAO;;AMuDpB;cAC8B;EAAE,OAAO,ENzR1B,GAAO;;AM0RpB,eAA+B;EAAE,OAAO,ENzJ1B,GAAO;;AM0JrB,oBAAoC;EAAE,OAAO,EN7I1B,GAAO;;AM8I1B,yBAAyC;EAAE,OAAO,EN2G1B,GAAO;;AM1G/B,0BAA0C;EAAE,OAAO,EN2G1B,GAAO;;AM1GhC,0BAA0C;EAAE,OAAO,EN2G1B,GAAO;;AM1GhC,2BAA2C;EAAE,OAAO,EN2G1B,GAAO;;AM1GjC,2BAA2C;EAAE,OAAO,EN8G1B,GAAO;;AM7GjC,4BAA4C;EAAE,OAAO,EN8G1B,GAAO;;AM7GlC,oBAAoC;EAAE,OAAO,ENgK1B,GAAO;;AM/J1B,sBAAsC;EAAE,OAAO,EN4J1B,GAAO;;AM3J5B,yBAAyC;EAAE,OAAO,ENwO1B,GAAO;;AMvO/B,kBAAkC;EAAE,OAAO,ENqO1B,GAAO;;AMpOxB,eAA+B;EAAE,OAAO,EN+N1B,GAAO;;AM9NrB,sBAAsC;EAAE,OAAO,EN+N1B,GAAO;;AM9N5B,uBAAuC;EAAE,OAAO,ENmO1B,GAAO;;AMlO7B,kBAAkC;EAAE,OAAO,ENxM1B,GAAO;;AMyMxB,yBAAyC;EAAE,OAAO,EN+G1B,GAAO;;AM9G/B,oBAAoC;EAAE,OAAO,ENnF1B,GAAO;;AMoF1B,iBAAiC;EAAE,OAAO,EN/I1B,GAAO;;AMgJvB,cAA8B;EAAE,OAAO,ENhX1B,GAAO;;AMiXpB,oBAAoC;EAAE,OAAO,ENxT1B,GAAO;;AMyT1B,2BAA2C;EAAE,OAAO,ENxT1B,GAAO;;AMyTjC,iBAAiC;EAAE,OAAO,ENyK1B,GAAO;;AMxKvB,wBAAwC;EAAE,OAAO,ENyK1B,GAAO;;AMxK9B,0BAA0C;EAAE,OAAO,ENtD1B,GAAO;;AMuDhC,wBAAwC;EAAE,OAAO,ENpD1B,GAAO;;AMqD9B,0BAA0C;EAAE,OAAO,ENvD1B,GAAO;;AMwDhC,2BAA2C;EAAE,OAAO,ENvD1B,GAAO;;AMwDjC,gBAAgC;EAAE,OAAO,ENxW1B,GAAO;;AMyWtB,kBAAkC;EAAE,OAAO,EN0M1B,GAAO;;AMzMxB,kBAAkC;EAAE,OAAO,ENpX1B,GAAO;;AMqXxB,gBAAgC;EAAE,OAAO,ENpE1B,GAAO;;AMqEtB,mBAAmC;EAAE,OAAO,EN1N1B,GAAO;;AM2NzB,gBAAgC;EAAE,OAAO,ENqE1B,GAAO;;AMpEtB,qBAAqC;EAAE,OAAO,ENtJ1B,GAAO;;AMuJ3B,iBAAiC;EAAE,OAAO,ENuJ1B,GAAO;;AMtJvB,iBAAiC;EAAE,OAAO,EN/L1B,GAAO;;AMgMvB,eAA+B;EAAE,OAAO,EN1D1B,GAAO;;AM2DrB;mBACmC;EAAE,OAAO,ENnI1B,GAAO;;AMoIzB,gBAAgC;EAAE,OAAO,EN2G1B,GAAO;;AM1GtB,iBAAiC;EAAE,OAAO,ENxC1B,GAAO;;AMyCvB,kBAAkC;EAAE,OAAO,ENrX1B,GAAO;;AMsXxB,cAA8B;EAAE,OAAO,ENpU1B,GAAO;;AMqUpB,aAA6B;EAAE,OAAO,ENgL1B,GAAO;;AM/KnB,gBAAgC;EAAE,OAAO,ENqL1B,GAAO;;AMpLtB,iBAAiC;EAAE,OAAO,ENa1B,GAAO;;AMZvB,oBAAoC;EAAE,OAAO,ENrC1B,GAAO;;AMsC1B,yBAAyC;EAAE,OAAO,EN8E1B,GAAO;;AM7E/B,+BAA+C;EAAE,OAAO,ENtX1B,GAAO;;AMuXrC,8BAA8C;EAAE,OAAO,ENxX1B,GAAO;;AMyXpC;8BAC8C;EAAE,OAAO,EN3T1B,GAAO;;AM4TpC,uBAAuC;EAAE,OAAO,ENjP1B,GAAO;;AMkP7B,qBAAqC;EAAE,OAAO,EN+K1B,GAAO;;AM9K3B,uBAAuC;EAAE,OAAO,ENmK1B,GAAO;;AMlK7B;cAC8B;EAAE,OAAO,ENoI1B,GAAO;;AMnIpB,wBAAwC;EAAE,OAAO,ENjB1B,GAAO;;AMkB9B,wBAAwC;EAAE,OAAO,EN6D1B,GAAO;;AM5D9B,gBAAgC;EAAE,OAAO,EN2C1B,GAAO;;AM1CtB,0BAA0C;EAAE,OAAO,EN7O1B,GAAO;;AM8OhC,oBAAoC;EAAE,OAAO,EN2K1B,GAAO;;AM1K1B,iBAAiC;EAAE,OAAO,ENvD1B,GAAO;;AMwDvB;;qBAEqC;EAAE,OAAO,ENsI1B,GAAO;;AMrI3B;yBACyC;EAAE,OAAO,ENjK1B,GAAO;;AMkK/B,gBAAgC;EAAE,OAAO,ENwK1B,GAAO;;AMvKtB,iBAAiC;EAAE,OAAO,ENvK1B,GAAO;;AMwKvB,iBAAiC;EAAE,OAAO,ENhB1B,GAAO;;AMiBvB,wBAAwC;EAAE,OAAO,ENhB1B,GAAO;;AMiB9B,6BAA6C;EAAE,OAAO,ENsE1B,GAAO;;AMrEnC,sBAAsC;EAAE,OAAO,ENoE1B,GAAO;;AMnE5B,oBAAoC;EAAE,OAAO,EN7Q1B,GAAO;;AM8Q1B,eAA+B;EAAE,OAAO,EN1Q1B,GAAO;;AM2QrB,qBAAqC;EAAE,OAAO,ENjD1B,GAAO;;AMkD3B,yBAAyC;EAAE,OAAO,ENjD1B,GAAO;;AMkD/B,iBAAiC;EAAE,OAAO,ENvQ1B,GAAO;;AMwQvB,iBAAiC;EAAE,OAAO,EN9I1B,GAAO;;AM+IvB,mBAAmC;EAAE,OAAO,ENzI1B,GAAO;;AM0IzB,cAA8B;EAAE,OAAO,EN9O1B,GAAO;;AM+OpB,mBAAmC;EAAE,OAAO,EN3W1B,GAAO;;AM4WzB,gBAAgC;EAAE,OAAO,EN9T1B,GAAO;;AM+TtB,cAA8B;EAAE,OAAO,ENnE1B,GAAO;;AMoEpB,gBAAgC;EAAE,OAAO,ENoC1B,GAAO;;AMnCtB,eAA+B;EAAE,OAAO,ENjS1B,GAAO;;AMkSrB,gBAAgC;EAAE,OAAO,ENjS1B,GAAO;;AMkStB,kBAAkC;EAAE,OAAO,ENtY1B,GAAO;;AMuYxB,yBAAyC;EAAE,OAAO,ENtY1B,GAAO;;AMuY/B,gBAAgC;EAAE,OAAO,EN2C1B,GAAO;;AM1CtB,uBAAuC;EAAE,OAAO,EN2C1B,GAAO;;AM1C7B,kBAAkC;EAAE,OAAO,ENvC1B,GAAO;;AMwCxB;cAC8B;EAAE,OAAO,EN3W1B,GAAO;;AM4WpB;eAC+B;EAAE,OAAO,EN2D1B,GAAO;;AM1DrB,eAA+B;EAAE,OAAO,ENuF1B,GAAO;;AMtFrB,kBAAkC;EAAE,OAAO,ENwB1B,GAAO;;AMvBxB,qBAAqC;EAAE,OAAO,ENpS1B,GAAO;;AMqS3B,qBAAqC;EAAE,OAAO,ENkB1B,GAAO;;AMjB3B,mBAAmC;EAAE,OAAO,EN1S1B,GAAO;;AM2SzB,qBAAqC;EAAE,OAAO,ENxP1B,GAAO;;AMyP3B,sBAAsC;EAAE,OAAO,ENjP1B,GAAO;;AMkP5B,uBAAuC;EAAE,OAAO,EN9P1B,GAAO;;AM+P7B,4BAA4C;EAAE,OAAO,ENxP1B,GAAO;;AMyPlC;;uBAEuC;EAAE,OAAO,ENjQ1B,GAAO;;AMkQ7B;yBACyC;EAAE,OAAO,ENvQ1B,GAAO;;AMwQ/B;uBACuC;EAAE,OAAO,ENxQ1B,GAAO;;AMyQ7B;uBACuC;EAAE,OAAO,EN7P1B,GAAO;;AM8P7B,sBAAsC;EAAE,OAAO,EN1Q1B,GAAO;;AM2Q5B,eAA+B;EAAE,OAAO,ENsG1B,GAAO;;AMrGrB,kBAAkC;EAAE,OAAO,ENlV1B,GAAO;;AMmVxB,mBAAmC;EAAE,OAAO,ENnL1B,GAAO;;AMoLzB;;;;oBAIoC;EAAE,OAAO,ENxK1B,GAAO;;AMyK1B,yBAAyC;EAAE,OAAO,ENpW1B,GAAO;;AMqW/B;gBACgC;EAAE,OAAO,EN1E1B,GAAO;;AM2EtB;iBACiC;EAAE,OAAO,ENpT1B,GAAO;;AMqTvB,qBAAqC;EAAE,OAAO,EN1O1B,GAAO;;AM2O3B,cAA8B;EAAE,OAAO,EN5O1B,GAAO;;AM6OpB,sBAAsC;EAAE,OAAO,EN7N1B,GAAO;;AM8N5B,wBAAwC;EAAE,OAAO,ENwB1B,GAAO;;AMvB9B,aAA6B;EAAE,OAAO,ENzF1B,GAAO;;AM0FnB;iBACiC;EAAE,OAAO,EN2F1B,GAAO;;AM1FvB;sBACsC;EAAE,OAAO,EN9H1B,GAAO;;AM+H5B;wBACwC;EAAE,OAAO,EN/H1B,GAAO;;AMgI9B,kBAAkC;EAAE,OAAO,EN3N1B,GAAO;;AM4NxB;sBACsC;EAAE,OAAO,ENrX1B,GAAO;;AMsX5B,iBAAiC;EAAE,OAAO,ENnO1B,GAAO;;AMoOvB,oBAAoC;EAAE,OAAO,ENlI1B,GAAO;;AMmI1B,kBAAkC;EAAE,OAAO,EN1C1B,GAAO;;AM2CxB,oBAAoC;EAAE,OAAO,EN7D1B,GAAO;;AM8D1B,2BAA2C;EAAE,OAAO,EN7D1B,GAAO;;AM8DjC,eAA+B;EAAE,OAAO,ENpb1B,GAAO;;AMqbrB;mBACmC;EAAE,OAAO,ENzQ1B,GAAO;;AM0QzB,cAA8B;EAAE,OAAO,ENsC1B,GAAO;;AMrCpB,qBAAqC;EAAE,OAAO,EN/b1B,GAAO;;AMgc3B,eAA+B;EAAE,OAAO,ENrH1B,GAAO;;AMsHrB,qBAAqC;EAAE,OAAO,ENlD1B,GAAO;;AMmD3B,iBAAiC;EAAE,OAAO,ENsC1B,GAAO;;AMrCvB,eAA+B;EAAE,OAAO,ENiF1B,GAAO;;AMhFrB,sBAAsC;EAAE,OAAO,ENvJ1B,GAAO;;AMwJ5B,eAA+B;EAAE,OAAO,ENuE1B,GAAO;;AMtErB,qBAAqC;EAAE,OAAO,ENjb1B,GAAO;;AMkb3B,iBAAiC;EAAE,OAAO,EN9I1B,GAAO;;AM+IvB,wBAAwC;EAAE,OAAO,ENhQ1B,GAAO;;AMiQ9B,kBAAkC;EAAE,OAAO,EN9Z1B,GAAO;;AM+ZxB,wBAAwC;EAAE,OAAO,ENla1B,GAAO;;AMma9B,sBAAsC;EAAE,OAAO,ENpa1B,GAAO;;AMqa5B,kBAAkC;EAAE,OAAO,ENta1B,GAAO;;AMuaxB,oBAAoC;EAAE,OAAO,ENpa1B,GAAO;;AMqa1B,oBAAoC;EAAE,OAAO,ENpa1B,GAAO;;AMqa1B,qBAAqC;EAAE,OAAO,ENld1B,GAAO;;AMmd3B,uBAAuC;EAAE,OAAO,ENld1B,GAAO;;AMmd7B,gBAAgC;EAAE,OAAO,ENY1B,GAAO;;AMXtB,oBAAoC;EAAE,OAAO,EN3X1B,GAAO;;AM4X1B,aAA6B;EAAE,OAAO,ENre1B,GAAO;;AMsenB,qBAAqC;EAAE,OAAO,ENjV1B,GAAO;;AMkV3B,sBAAsC;EAAE,OAAO,ENpK1B,GAAO;;AMqK5B,wBAAwC;EAAE,OAAO,ENrd1B,GAAO;;AMsd9B,qBAAqC;EAAE,OAAO,EN3f1B,GAAO;;AM4f3B,oBAAoC;EAAE,OAAO,ENvJ1B,GAAO;;AMwJ1B,qBAAqC;EAAE,OAAO,EN5N1B,GAAO;;AM6N3B,iBAAiC;EAAE,OAAO,EN1O1B,GAAO;;AM2OvB,wBAAwC;EAAE,OAAO,EN1O1B,GAAO;;AM2O9B,qBAAqC;EAAE,OAAO,ENN1B,GAAO;;AMO3B,oBAAoC;EAAE,OAAO,ENN1B,GAAO;;AMO1B,kBAAkC;EAAE,OAAO,EN/d1B,GAAO;;AMgexB,cAA8B;EAAE,OAAO,EN7c1B,GAAO;;AM8cpB,kBAAkC;EAAE,OAAO,EN1P1B,GAAO;;AM2PxB,oBAAoC;EAAE,OAAO,ENhhB1B,GAAO;;AMihB1B,aAA6B;EAAE,OAAO,EN7b1B,GAAO;;AM8bnB;;cAE8B;EAAE,OAAO,ENxQ1B,GAAO;;AMyQpB,mBAAmC;EAAE,OAAO,EN7M1B,GAAO;;AM8MzB,qBAAqC;EAAE,OAAO,ENpd1B,GAAO;;AMqd3B,yBAAyC;EAAE,OAAO,ENnZ1B,GAAO;;AMoZ/B,mBAAmC;EAAE,OAAO,ENxY1B,GAAO;;AMyYzB,mBAAmC;EAAE,OAAO,EN1T1B,GAAO;;AM2TzB,kBAAkC;EAAE,OAAO,ENxP1B,GAAO;;AMyPxB,iBAAiC;EAAE,OAAO,ENrH1B,GAAO;;AMsHvB,uBAAuC;EAAE,OAAO,ENzG1B,GAAO;;AM0G7B,sBAAsC;EAAE,OAAO,ENrG1B,GAAO;;AMsG5B,mBAAmC;EAAE,OAAO,ENpG1B,GAAO;;AMqGzB,oBAAoC;EAAE,OAAO,EN5c1B,GAAO;;AM6c1B,0BAA0C;EAAE,OAAO,EN9c1B,GAAO;;AM+chC,kBAAkC;EAAE,OAAO,EN3Y1B,GAAO;;AM4YxB,eAA+B;EAAE,OAAO,ENhH1B,GAAO;;AMiHrB,sBAAsC;EAAE,OAAO,ENI1B,GAAO;;AMH5B,qBAAqC;EAAE,OAAO,EN5M1B,GAAO;;AM6M3B,sBAAsC;EAAE,OAAO,ENpE1B,GAAO;;AMqE5B,oBAAoC;EAAE,OAAO,ENhS1B,GAAO;;AMiS1B,gBAAgC;EAAE,OAAO,ENG1B,GAAO;;AMFtB,eAA+B;EAAE,OAAO,ENtO1B,GAAO;;AMuOrB,kBAAkC;EAAE,OAAO,EN7N1B,GAAO;;AM8NxB,sBAAsC;EAAE,OAAO,ENhC1B,GAAO;;AMiC5B,0BAA0C;EAAE,OAAO,ENhC1B,GAAO;;AMiChC,uBAAuC;EAAE,OAAO,END1B,GAAO;;AME7B,sBAAsC;EAAE,OAAO,EN1O1B,GAAO;;AM2O5B,qBAAqC;EAAE,OAAO,ENF1B,GAAO;;AMG3B,sBAAsC;EAAE,OAAO,EN3O1B,GAAO;;AM4O5B,wBAAwC;EAAE,OAAO,EN1O1B,GAAO;;AM2O9B,wBAAwC;EAAE,OAAO,EN5O1B,GAAO;;AM6O9B,iBAAiC;EAAE,OAAO,ENvN1B,GAAO;;AMwNvB,4BAA4C;EAAE,OAAO,EN9X1B,GAAO;;AM+XlC,sBAAsC;EAAE,OAAO,ENhM1B,GAAO;;AMiM5B,mBAAmC;EAAE,OAAO,ENI1B,GAAO;;AMHzB,iBAAiC;EAAE,OAAO,EN7I1B,GAAO;;AM8IvB,oBAAoC;EAAE,OAAO,ENjB1B,GAAO;;AMkB1B,qBAAqC;EAAE,OAAO,ENhB1B,GAAO;;AMiB3B;cAC8B;EAAE,OAAO,ENphB1B,GAAO;;AMqhBpB,kBAAkC;EAAE,OAAO,ENd1B,GAAO;;AMexB,gBAAgC;EAAE,OAAO,ENnD1B,GAAO;;AMoDtB,iBAAiC;EAAE,OAAO,ENvF1B,GAAO;;AMwFvB,iBAAiC;EAAE,OAAO,ENrP1B,GAAO", -"sources": ["../scss/_path.scss","../scss/_core.scss","../scss/_larger.scss","../scss/_fixed-width.scss","../scss/_list.scss","../scss/_variables.scss","../scss/_bordered-pulled.scss","../scss/_animated.scss","../scss/_rotated-flipped.scss","../scss/_mixins.scss","../scss/_stacked.scss","../scss/_icons.scss"], -"names": [], -"file": "font-awesome.css" -} diff --git a/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/css/font-awesome.min.css b/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/css/font-awesome.min.css deleted file mode 100644 index 540440ce8..000000000 --- a/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/css/font-awesome.min.css +++ /dev/null @@ -1,4 +0,0 @@ -/*! - * Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome - * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) - */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.7.0');src:url('../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'),url('../fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'),url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal normal normal 14px/1 FontAwesome;font-size:inherit;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.33333333em;line-height:.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.28571429em;text-align:center}.fa-ul{padding-left:0;margin-left:2.14285714em;list-style-type:none}.fa-ul>li{position:relative}.fa-li{position:absolute;left:-2.14285714em;width:2.14285714em;top:.14285714em;text-align:center}.fa-li.fa-lg{left:-1.85714286em}.fa-border{padding:.2em .25em .15em;border:solid .08em #eee;border-radius:.1em}.fa-pull-left{float:left}.fa-pull-right{float:right}.fa.fa-pull-left{margin-right:.3em}.fa.fa-pull-right{margin-left:.3em}.pull-right{float:right}.pull-left{float:left}.fa.pull-left{margin-right:.3em}.fa.pull-right{margin-left:.3em}.fa-spin{-webkit-animation:fa-spin 2s infinite linear;animation:fa-spin 2s infinite linear}.fa-pulse{-webkit-animation:fa-spin 1s infinite steps(8);animation:fa-spin 1s infinite steps(8)}@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}.fa-rotate-90{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=1)";-webkit-transform:rotate(90deg);-ms-transform:rotate(90deg);transform:rotate(90deg)}.fa-rotate-180{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=2)";-webkit-transform:rotate(180deg);-ms-transform:rotate(180deg);transform:rotate(180deg)}.fa-rotate-270{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=3)";-webkit-transform:rotate(270deg);-ms-transform:rotate(270deg);transform:rotate(270deg)}.fa-flip-horizontal{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=0, mirror=1)";-webkit-transform:scale(-1, 1);-ms-transform:scale(-1, 1);transform:scale(-1, 1)}.fa-flip-vertical{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=2, mirror=1)";-webkit-transform:scale(1, -1);-ms-transform:scale(1, -1);transform:scale(1, -1)}:root .fa-rotate-90,:root .fa-rotate-180,:root .fa-rotate-270,:root .fa-flip-horizontal,:root .fa-flip-vertical{filter:none}.fa-stack{position:relative;display:inline-block;width:2em;height:2em;line-height:2em;vertical-align:middle}.fa-stack-1x,.fa-stack-2x{position:absolute;left:0;width:100%;text-align:center}.fa-stack-1x{line-height:inherit}.fa-stack-2x{font-size:2em}.fa-inverse{color:#fff}.fa-glass:before{content:"\f000"}.fa-music:before{content:"\f001"}.fa-search:before{content:"\f002"}.fa-envelope-o:before{content:"\f003"}.fa-heart:before{content:"\f004"}.fa-star:before{content:"\f005"}.fa-star-o:before{content:"\f006"}.fa-user:before{content:"\f007"}.fa-film:before{content:"\f008"}.fa-th-large:before{content:"\f009"}.fa-th:before{content:"\f00a"}.fa-th-list:before{content:"\f00b"}.fa-check:before{content:"\f00c"}.fa-remove:before,.fa-close:before,.fa-times:before{content:"\f00d"}.fa-search-plus:before{content:"\f00e"}.fa-search-minus:before{content:"\f010"}.fa-power-off:before{content:"\f011"}.fa-signal:before{content:"\f012"}.fa-gear:before,.fa-cog:before{content:"\f013"}.fa-trash-o:before{content:"\f014"}.fa-home:before{content:"\f015"}.fa-file-o:before{content:"\f016"}.fa-clock-o:before{content:"\f017"}.fa-road:before{content:"\f018"}.fa-download:before{content:"\f019"}.fa-arrow-circle-o-down:before{content:"\f01a"}.fa-arrow-circle-o-up:before{content:"\f01b"}.fa-inbox:before{content:"\f01c"}.fa-play-circle-o:before{content:"\f01d"}.fa-rotate-right:before,.fa-repeat:before{content:"\f01e"}.fa-refresh:before{content:"\f021"}.fa-list-alt:before{content:"\f022"}.fa-lock:before{content:"\f023"}.fa-flag:before{content:"\f024"}.fa-headphones:before{content:"\f025"}.fa-volume-off:before{content:"\f026"}.fa-volume-down:before{content:"\f027"}.fa-volume-up:before{content:"\f028"}.fa-qrcode:before{content:"\f029"}.fa-barcode:before{content:"\f02a"}.fa-tag:before{content:"\f02b"}.fa-tags:before{content:"\f02c"}.fa-book:before{content:"\f02d"}.fa-bookmark:before{content:"\f02e"}.fa-print:before{content:"\f02f"}.fa-camera:before{content:"\f030"}.fa-font:before{content:"\f031"}.fa-bold:before{content:"\f032"}.fa-italic:before{content:"\f033"}.fa-text-height:before{content:"\f034"}.fa-text-width:before{content:"\f035"}.fa-align-left:before{content:"\f036"}.fa-align-center:before{content:"\f037"}.fa-align-right:before{content:"\f038"}.fa-align-justify:before{content:"\f039"}.fa-list:before{content:"\f03a"}.fa-dedent:before,.fa-outdent:before{content:"\f03b"}.fa-indent:before{content:"\f03c"}.fa-video-camera:before{content:"\f03d"}.fa-photo:before,.fa-image:before,.fa-picture-o:before{content:"\f03e"}.fa-pencil:before{content:"\f040"}.fa-map-marker:before{content:"\f041"}.fa-adjust:before{content:"\f042"}.fa-tint:before{content:"\f043"}.fa-edit:before,.fa-pencil-square-o:before{content:"\f044"}.fa-share-square-o:before{content:"\f045"}.fa-check-square-o:before{content:"\f046"}.fa-arrows:before{content:"\f047"}.fa-step-backward:before{content:"\f048"}.fa-fast-backward:before{content:"\f049"}.fa-backward:before{content:"\f04a"}.fa-play:before{content:"\f04b"}.fa-pause:before{content:"\f04c"}.fa-stop:before{content:"\f04d"}.fa-forward:before{content:"\f04e"}.fa-fast-forward:before{content:"\f050"}.fa-step-forward:before{content:"\f051"}.fa-eject:before{content:"\f052"}.fa-chevron-left:before{content:"\f053"}.fa-chevron-right:before{content:"\f054"}.fa-plus-circle:before{content:"\f055"}.fa-minus-circle:before{content:"\f056"}.fa-times-circle:before{content:"\f057"}.fa-check-circle:before{content:"\f058"}.fa-question-circle:before{content:"\f059"}.fa-info-circle:before{content:"\f05a"}.fa-crosshairs:before{content:"\f05b"}.fa-times-circle-o:before{content:"\f05c"}.fa-check-circle-o:before{content:"\f05d"}.fa-ban:before{content:"\f05e"}.fa-arrow-left:before{content:"\f060"}.fa-arrow-right:before{content:"\f061"}.fa-arrow-up:before{content:"\f062"}.fa-arrow-down:before{content:"\f063"}.fa-mail-forward:before,.fa-share:before{content:"\f064"}.fa-expand:before{content:"\f065"}.fa-compress:before{content:"\f066"}.fa-plus:before{content:"\f067"}.fa-minus:before{content:"\f068"}.fa-asterisk:before{content:"\f069"}.fa-exclamation-circle:before{content:"\f06a"}.fa-gift:before{content:"\f06b"}.fa-leaf:before{content:"\f06c"}.fa-fire:before{content:"\f06d"}.fa-eye:before{content:"\f06e"}.fa-eye-slash:before{content:"\f070"}.fa-warning:before,.fa-exclamation-triangle:before{content:"\f071"}.fa-plane:before{content:"\f072"}.fa-calendar:before{content:"\f073"}.fa-random:before{content:"\f074"}.fa-comment:before{content:"\f075"}.fa-magnet:before{content:"\f076"}.fa-chevron-up:before{content:"\f077"}.fa-chevron-down:before{content:"\f078"}.fa-retweet:before{content:"\f079"}.fa-shopping-cart:before{content:"\f07a"}.fa-folder:before{content:"\f07b"}.fa-folder-open:before{content:"\f07c"}.fa-arrows-v:before{content:"\f07d"}.fa-arrows-h:before{content:"\f07e"}.fa-bar-chart-o:before,.fa-bar-chart:before{content:"\f080"}.fa-twitter-square:before{content:"\f081"}.fa-facebook-square:before{content:"\f082"}.fa-camera-retro:before{content:"\f083"}.fa-key:before{content:"\f084"}.fa-gears:before,.fa-cogs:before{content:"\f085"}.fa-comments:before{content:"\f086"}.fa-thumbs-o-up:before{content:"\f087"}.fa-thumbs-o-down:before{content:"\f088"}.fa-star-half:before{content:"\f089"}.fa-heart-o:before{content:"\f08a"}.fa-sign-out:before{content:"\f08b"}.fa-linkedin-square:before{content:"\f08c"}.fa-thumb-tack:before{content:"\f08d"}.fa-external-link:before{content:"\f08e"}.fa-sign-in:before{content:"\f090"}.fa-trophy:before{content:"\f091"}.fa-github-square:before{content:"\f092"}.fa-upload:before{content:"\f093"}.fa-lemon-o:before{content:"\f094"}.fa-phone:before{content:"\f095"}.fa-square-o:before{content:"\f096"}.fa-bookmark-o:before{content:"\f097"}.fa-phone-square:before{content:"\f098"}.fa-twitter:before{content:"\f099"}.fa-facebook-f:before,.fa-facebook:before{content:"\f09a"}.fa-github:before{content:"\f09b"}.fa-unlock:before{content:"\f09c"}.fa-credit-card:before{content:"\f09d"}.fa-feed:before,.fa-rss:before{content:"\f09e"}.fa-hdd-o:before{content:"\f0a0"}.fa-bullhorn:before{content:"\f0a1"}.fa-bell:before{content:"\f0f3"}.fa-certificate:before{content:"\f0a3"}.fa-hand-o-right:before{content:"\f0a4"}.fa-hand-o-left:before{content:"\f0a5"}.fa-hand-o-up:before{content:"\f0a6"}.fa-hand-o-down:before{content:"\f0a7"}.fa-arrow-circle-left:before{content:"\f0a8"}.fa-arrow-circle-right:before{content:"\f0a9"}.fa-arrow-circle-up:before{content:"\f0aa"}.fa-arrow-circle-down:before{content:"\f0ab"}.fa-globe:before{content:"\f0ac"}.fa-wrench:before{content:"\f0ad"}.fa-tasks:before{content:"\f0ae"}.fa-filter:before{content:"\f0b0"}.fa-briefcase:before{content:"\f0b1"}.fa-arrows-alt:before{content:"\f0b2"}.fa-group:before,.fa-users:before{content:"\f0c0"}.fa-chain:before,.fa-link:before{content:"\f0c1"}.fa-cloud:before{content:"\f0c2"}.fa-flask:before{content:"\f0c3"}.fa-cut:before,.fa-scissors:before{content:"\f0c4"}.fa-copy:before,.fa-files-o:before{content:"\f0c5"}.fa-paperclip:before{content:"\f0c6"}.fa-save:before,.fa-floppy-o:before{content:"\f0c7"}.fa-square:before{content:"\f0c8"}.fa-navicon:before,.fa-reorder:before,.fa-bars:before{content:"\f0c9"}.fa-list-ul:before{content:"\f0ca"}.fa-list-ol:before{content:"\f0cb"}.fa-strikethrough:before{content:"\f0cc"}.fa-underline:before{content:"\f0cd"}.fa-table:before{content:"\f0ce"}.fa-magic:before{content:"\f0d0"}.fa-truck:before{content:"\f0d1"}.fa-pinterest:before{content:"\f0d2"}.fa-pinterest-square:before{content:"\f0d3"}.fa-google-plus-square:before{content:"\f0d4"}.fa-google-plus:before{content:"\f0d5"}.fa-money:before{content:"\f0d6"}.fa-caret-down:before{content:"\f0d7"}.fa-caret-up:before{content:"\f0d8"}.fa-caret-left:before{content:"\f0d9"}.fa-caret-right:before{content:"\f0da"}.fa-columns:before{content:"\f0db"}.fa-unsorted:before,.fa-sort:before{content:"\f0dc"}.fa-sort-down:before,.fa-sort-desc:before{content:"\f0dd"}.fa-sort-up:before,.fa-sort-asc:before{content:"\f0de"}.fa-envelope:before{content:"\f0e0"}.fa-linkedin:before{content:"\f0e1"}.fa-rotate-left:before,.fa-undo:before{content:"\f0e2"}.fa-legal:before,.fa-gavel:before{content:"\f0e3"}.fa-dashboard:before,.fa-tachometer:before{content:"\f0e4"}.fa-comment-o:before{content:"\f0e5"}.fa-comments-o:before{content:"\f0e6"}.fa-flash:before,.fa-bolt:before{content:"\f0e7"}.fa-sitemap:before{content:"\f0e8"}.fa-umbrella:before{content:"\f0e9"}.fa-paste:before,.fa-clipboard:before{content:"\f0ea"}.fa-lightbulb-o:before{content:"\f0eb"}.fa-exchange:before{content:"\f0ec"}.fa-cloud-download:before{content:"\f0ed"}.fa-cloud-upload:before{content:"\f0ee"}.fa-user-md:before{content:"\f0f0"}.fa-stethoscope:before{content:"\f0f1"}.fa-suitcase:before{content:"\f0f2"}.fa-bell-o:before{content:"\f0a2"}.fa-coffee:before{content:"\f0f4"}.fa-cutlery:before{content:"\f0f5"}.fa-file-text-o:before{content:"\f0f6"}.fa-building-o:before{content:"\f0f7"}.fa-hospital-o:before{content:"\f0f8"}.fa-ambulance:before{content:"\f0f9"}.fa-medkit:before{content:"\f0fa"}.fa-fighter-jet:before{content:"\f0fb"}.fa-beer:before{content:"\f0fc"}.fa-h-square:before{content:"\f0fd"}.fa-plus-square:before{content:"\f0fe"}.fa-angle-double-left:before{content:"\f100"}.fa-angle-double-right:before{content:"\f101"}.fa-angle-double-up:before{content:"\f102"}.fa-angle-double-down:before{content:"\f103"}.fa-angle-left:before{content:"\f104"}.fa-angle-right:before{content:"\f105"}.fa-angle-up:before{content:"\f106"}.fa-angle-down:before{content:"\f107"}.fa-desktop:before{content:"\f108"}.fa-laptop:before{content:"\f109"}.fa-tablet:before{content:"\f10a"}.fa-mobile-phone:before,.fa-mobile:before{content:"\f10b"}.fa-circle-o:before{content:"\f10c"}.fa-quote-left:before{content:"\f10d"}.fa-quote-right:before{content:"\f10e"}.fa-spinner:before{content:"\f110"}.fa-circle:before{content:"\f111"}.fa-mail-reply:before,.fa-reply:before{content:"\f112"}.fa-github-alt:before{content:"\f113"}.fa-folder-o:before{content:"\f114"}.fa-folder-open-o:before{content:"\f115"}.fa-smile-o:before{content:"\f118"}.fa-frown-o:before{content:"\f119"}.fa-meh-o:before{content:"\f11a"}.fa-gamepad:before{content:"\f11b"}.fa-keyboard-o:before{content:"\f11c"}.fa-flag-o:before{content:"\f11d"}.fa-flag-checkered:before{content:"\f11e"}.fa-terminal:before{content:"\f120"}.fa-code:before{content:"\f121"}.fa-mail-reply-all:before,.fa-reply-all:before{content:"\f122"}.fa-star-half-empty:before,.fa-star-half-full:before,.fa-star-half-o:before{content:"\f123"}.fa-location-arrow:before{content:"\f124"}.fa-crop:before{content:"\f125"}.fa-code-fork:before{content:"\f126"}.fa-unlink:before,.fa-chain-broken:before{content:"\f127"}.fa-question:before{content:"\f128"}.fa-info:before{content:"\f129"}.fa-exclamation:before{content:"\f12a"}.fa-superscript:before{content:"\f12b"}.fa-subscript:before{content:"\f12c"}.fa-eraser:before{content:"\f12d"}.fa-puzzle-piece:before{content:"\f12e"}.fa-microphone:before{content:"\f130"}.fa-microphone-slash:before{content:"\f131"}.fa-shield:before{content:"\f132"}.fa-calendar-o:before{content:"\f133"}.fa-fire-extinguisher:before{content:"\f134"}.fa-rocket:before{content:"\f135"}.fa-maxcdn:before{content:"\f136"}.fa-chevron-circle-left:before{content:"\f137"}.fa-chevron-circle-right:before{content:"\f138"}.fa-chevron-circle-up:before{content:"\f139"}.fa-chevron-circle-down:before{content:"\f13a"}.fa-html5:before{content:"\f13b"}.fa-css3:before{content:"\f13c"}.fa-anchor:before{content:"\f13d"}.fa-unlock-alt:before{content:"\f13e"}.fa-bullseye:before{content:"\f140"}.fa-ellipsis-h:before{content:"\f141"}.fa-ellipsis-v:before{content:"\f142"}.fa-rss-square:before{content:"\f143"}.fa-play-circle:before{content:"\f144"}.fa-ticket:before{content:"\f145"}.fa-minus-square:before{content:"\f146"}.fa-minus-square-o:before{content:"\f147"}.fa-level-up:before{content:"\f148"}.fa-level-down:before{content:"\f149"}.fa-check-square:before{content:"\f14a"}.fa-pencil-square:before{content:"\f14b"}.fa-external-link-square:before{content:"\f14c"}.fa-share-square:before{content:"\f14d"}.fa-compass:before{content:"\f14e"}.fa-toggle-down:before,.fa-caret-square-o-down:before{content:"\f150"}.fa-toggle-up:before,.fa-caret-square-o-up:before{content:"\f151"}.fa-toggle-right:before,.fa-caret-square-o-right:before{content:"\f152"}.fa-euro:before,.fa-eur:before{content:"\f153"}.fa-gbp:before{content:"\f154"}.fa-dollar:before,.fa-usd:before{content:"\f155"}.fa-rupee:before,.fa-inr:before{content:"\f156"}.fa-cny:before,.fa-rmb:before,.fa-yen:before,.fa-jpy:before{content:"\f157"}.fa-ruble:before,.fa-rouble:before,.fa-rub:before{content:"\f158"}.fa-won:before,.fa-krw:before{content:"\f159"}.fa-bitcoin:before,.fa-btc:before{content:"\f15a"}.fa-file:before{content:"\f15b"}.fa-file-text:before{content:"\f15c"}.fa-sort-alpha-asc:before{content:"\f15d"}.fa-sort-alpha-desc:before{content:"\f15e"}.fa-sort-amount-asc:before{content:"\f160"}.fa-sort-amount-desc:before{content:"\f161"}.fa-sort-numeric-asc:before{content:"\f162"}.fa-sort-numeric-desc:before{content:"\f163"}.fa-thumbs-up:before{content:"\f164"}.fa-thumbs-down:before{content:"\f165"}.fa-youtube-square:before{content:"\f166"}.fa-youtube:before{content:"\f167"}.fa-xing:before{content:"\f168"}.fa-xing-square:before{content:"\f169"}.fa-youtube-play:before{content:"\f16a"}.fa-dropbox:before{content:"\f16b"}.fa-stack-overflow:before{content:"\f16c"}.fa-instagram:before{content:"\f16d"}.fa-flickr:before{content:"\f16e"}.fa-adn:before{content:"\f170"}.fa-bitbucket:before{content:"\f171"}.fa-bitbucket-square:before{content:"\f172"}.fa-tumblr:before{content:"\f173"}.fa-tumblr-square:before{content:"\f174"}.fa-long-arrow-down:before{content:"\f175"}.fa-long-arrow-up:before{content:"\f176"}.fa-long-arrow-left:before{content:"\f177"}.fa-long-arrow-right:before{content:"\f178"}.fa-apple:before{content:"\f179"}.fa-windows:before{content:"\f17a"}.fa-android:before{content:"\f17b"}.fa-linux:before{content:"\f17c"}.fa-dribbble:before{content:"\f17d"}.fa-skype:before{content:"\f17e"}.fa-foursquare:before{content:"\f180"}.fa-trello:before{content:"\f181"}.fa-female:before{content:"\f182"}.fa-male:before{content:"\f183"}.fa-gittip:before,.fa-gratipay:before{content:"\f184"}.fa-sun-o:before{content:"\f185"}.fa-moon-o:before{content:"\f186"}.fa-archive:before{content:"\f187"}.fa-bug:before{content:"\f188"}.fa-vk:before{content:"\f189"}.fa-weibo:before{content:"\f18a"}.fa-renren:before{content:"\f18b"}.fa-pagelines:before{content:"\f18c"}.fa-stack-exchange:before{content:"\f18d"}.fa-arrow-circle-o-right:before{content:"\f18e"}.fa-arrow-circle-o-left:before{content:"\f190"}.fa-toggle-left:before,.fa-caret-square-o-left:before{content:"\f191"}.fa-dot-circle-o:before{content:"\f192"}.fa-wheelchair:before{content:"\f193"}.fa-vimeo-square:before{content:"\f194"}.fa-turkish-lira:before,.fa-try:before{content:"\f195"}.fa-plus-square-o:before{content:"\f196"}.fa-space-shuttle:before{content:"\f197"}.fa-slack:before{content:"\f198"}.fa-envelope-square:before{content:"\f199"}.fa-wordpress:before{content:"\f19a"}.fa-openid:before{content:"\f19b"}.fa-institution:before,.fa-bank:before,.fa-university:before{content:"\f19c"}.fa-mortar-board:before,.fa-graduation-cap:before{content:"\f19d"}.fa-yahoo:before{content:"\f19e"}.fa-google:before{content:"\f1a0"}.fa-reddit:before{content:"\f1a1"}.fa-reddit-square:before{content:"\f1a2"}.fa-stumbleupon-circle:before{content:"\f1a3"}.fa-stumbleupon:before{content:"\f1a4"}.fa-delicious:before{content:"\f1a5"}.fa-digg:before{content:"\f1a6"}.fa-pied-piper-pp:before{content:"\f1a7"}.fa-pied-piper-alt:before{content:"\f1a8"}.fa-drupal:before{content:"\f1a9"}.fa-joomla:before{content:"\f1aa"}.fa-language:before{content:"\f1ab"}.fa-fax:before{content:"\f1ac"}.fa-building:before{content:"\f1ad"}.fa-child:before{content:"\f1ae"}.fa-paw:before{content:"\f1b0"}.fa-spoon:before{content:"\f1b1"}.fa-cube:before{content:"\f1b2"}.fa-cubes:before{content:"\f1b3"}.fa-behance:before{content:"\f1b4"}.fa-behance-square:before{content:"\f1b5"}.fa-steam:before{content:"\f1b6"}.fa-steam-square:before{content:"\f1b7"}.fa-recycle:before{content:"\f1b8"}.fa-automobile:before,.fa-car:before{content:"\f1b9"}.fa-cab:before,.fa-taxi:before{content:"\f1ba"}.fa-tree:before{content:"\f1bb"}.fa-spotify:before{content:"\f1bc"}.fa-deviantart:before{content:"\f1bd"}.fa-soundcloud:before{content:"\f1be"}.fa-database:before{content:"\f1c0"}.fa-file-pdf-o:before{content:"\f1c1"}.fa-file-word-o:before{content:"\f1c2"}.fa-file-excel-o:before{content:"\f1c3"}.fa-file-powerpoint-o:before{content:"\f1c4"}.fa-file-photo-o:before,.fa-file-picture-o:before,.fa-file-image-o:before{content:"\f1c5"}.fa-file-zip-o:before,.fa-file-archive-o:before{content:"\f1c6"}.fa-file-sound-o:before,.fa-file-audio-o:before{content:"\f1c7"}.fa-file-movie-o:before,.fa-file-video-o:before{content:"\f1c8"}.fa-file-code-o:before{content:"\f1c9"}.fa-vine:before{content:"\f1ca"}.fa-codepen:before{content:"\f1cb"}.fa-jsfiddle:before{content:"\f1cc"}.fa-life-bouy:before,.fa-life-buoy:before,.fa-life-saver:before,.fa-support:before,.fa-life-ring:before{content:"\f1cd"}.fa-circle-o-notch:before{content:"\f1ce"}.fa-ra:before,.fa-resistance:before,.fa-rebel:before{content:"\f1d0"}.fa-ge:before,.fa-empire:before{content:"\f1d1"}.fa-git-square:before{content:"\f1d2"}.fa-git:before{content:"\f1d3"}.fa-y-combinator-square:before,.fa-yc-square:before,.fa-hacker-news:before{content:"\f1d4"}.fa-tencent-weibo:before{content:"\f1d5"}.fa-qq:before{content:"\f1d6"}.fa-wechat:before,.fa-weixin:before{content:"\f1d7"}.fa-send:before,.fa-paper-plane:before{content:"\f1d8"}.fa-send-o:before,.fa-paper-plane-o:before{content:"\f1d9"}.fa-history:before{content:"\f1da"}.fa-circle-thin:before{content:"\f1db"}.fa-header:before{content:"\f1dc"}.fa-paragraph:before{content:"\f1dd"}.fa-sliders:before{content:"\f1de"}.fa-share-alt:before{content:"\f1e0"}.fa-share-alt-square:before{content:"\f1e1"}.fa-bomb:before{content:"\f1e2"}.fa-soccer-ball-o:before,.fa-futbol-o:before{content:"\f1e3"}.fa-tty:before{content:"\f1e4"}.fa-binoculars:before{content:"\f1e5"}.fa-plug:before{content:"\f1e6"}.fa-slideshare:before{content:"\f1e7"}.fa-twitch:before{content:"\f1e8"}.fa-yelp:before{content:"\f1e9"}.fa-newspaper-o:before{content:"\f1ea"}.fa-wifi:before{content:"\f1eb"}.fa-calculator:before{content:"\f1ec"}.fa-paypal:before{content:"\f1ed"}.fa-google-wallet:before{content:"\f1ee"}.fa-cc-visa:before{content:"\f1f0"}.fa-cc-mastercard:before{content:"\f1f1"}.fa-cc-discover:before{content:"\f1f2"}.fa-cc-amex:before{content:"\f1f3"}.fa-cc-paypal:before{content:"\f1f4"}.fa-cc-stripe:before{content:"\f1f5"}.fa-bell-slash:before{content:"\f1f6"}.fa-bell-slash-o:before{content:"\f1f7"}.fa-trash:before{content:"\f1f8"}.fa-copyright:before{content:"\f1f9"}.fa-at:before{content:"\f1fa"}.fa-eyedropper:before{content:"\f1fb"}.fa-paint-brush:before{content:"\f1fc"}.fa-birthday-cake:before{content:"\f1fd"}.fa-area-chart:before{content:"\f1fe"}.fa-pie-chart:before{content:"\f200"}.fa-line-chart:before{content:"\f201"}.fa-lastfm:before{content:"\f202"}.fa-lastfm-square:before{content:"\f203"}.fa-toggle-off:before{content:"\f204"}.fa-toggle-on:before{content:"\f205"}.fa-bicycle:before{content:"\f206"}.fa-bus:before{content:"\f207"}.fa-ioxhost:before{content:"\f208"}.fa-angellist:before{content:"\f209"}.fa-cc:before{content:"\f20a"}.fa-shekel:before,.fa-sheqel:before,.fa-ils:before{content:"\f20b"}.fa-meanpath:before{content:"\f20c"}.fa-buysellads:before{content:"\f20d"}.fa-connectdevelop:before{content:"\f20e"}.fa-dashcube:before{content:"\f210"}.fa-forumbee:before{content:"\f211"}.fa-leanpub:before{content:"\f212"}.fa-sellsy:before{content:"\f213"}.fa-shirtsinbulk:before{content:"\f214"}.fa-simplybuilt:before{content:"\f215"}.fa-skyatlas:before{content:"\f216"}.fa-cart-plus:before{content:"\f217"}.fa-cart-arrow-down:before{content:"\f218"}.fa-diamond:before{content:"\f219"}.fa-ship:before{content:"\f21a"}.fa-user-secret:before{content:"\f21b"}.fa-motorcycle:before{content:"\f21c"}.fa-street-view:before{content:"\f21d"}.fa-heartbeat:before{content:"\f21e"}.fa-venus:before{content:"\f221"}.fa-mars:before{content:"\f222"}.fa-mercury:before{content:"\f223"}.fa-intersex:before,.fa-transgender:before{content:"\f224"}.fa-transgender-alt:before{content:"\f225"}.fa-venus-double:before{content:"\f226"}.fa-mars-double:before{content:"\f227"}.fa-venus-mars:before{content:"\f228"}.fa-mars-stroke:before{content:"\f229"}.fa-mars-stroke-v:before{content:"\f22a"}.fa-mars-stroke-h:before{content:"\f22b"}.fa-neuter:before{content:"\f22c"}.fa-genderless:before{content:"\f22d"}.fa-facebook-official:before{content:"\f230"}.fa-pinterest-p:before{content:"\f231"}.fa-whatsapp:before{content:"\f232"}.fa-server:before{content:"\f233"}.fa-user-plus:before{content:"\f234"}.fa-user-times:before{content:"\f235"}.fa-hotel:before,.fa-bed:before{content:"\f236"}.fa-viacoin:before{content:"\f237"}.fa-train:before{content:"\f238"}.fa-subway:before{content:"\f239"}.fa-medium:before{content:"\f23a"}.fa-yc:before,.fa-y-combinator:before{content:"\f23b"}.fa-optin-monster:before{content:"\f23c"}.fa-opencart:before{content:"\f23d"}.fa-expeditedssl:before{content:"\f23e"}.fa-battery-4:before,.fa-battery:before,.fa-battery-full:before{content:"\f240"}.fa-battery-3:before,.fa-battery-three-quarters:before{content:"\f241"}.fa-battery-2:before,.fa-battery-half:before{content:"\f242"}.fa-battery-1:before,.fa-battery-quarter:before{content:"\f243"}.fa-battery-0:before,.fa-battery-empty:before{content:"\f244"}.fa-mouse-pointer:before{content:"\f245"}.fa-i-cursor:before{content:"\f246"}.fa-object-group:before{content:"\f247"}.fa-object-ungroup:before{content:"\f248"}.fa-sticky-note:before{content:"\f249"}.fa-sticky-note-o:before{content:"\f24a"}.fa-cc-jcb:before{content:"\f24b"}.fa-cc-diners-club:before{content:"\f24c"}.fa-clone:before{content:"\f24d"}.fa-balance-scale:before{content:"\f24e"}.fa-hourglass-o:before{content:"\f250"}.fa-hourglass-1:before,.fa-hourglass-start:before{content:"\f251"}.fa-hourglass-2:before,.fa-hourglass-half:before{content:"\f252"}.fa-hourglass-3:before,.fa-hourglass-end:before{content:"\f253"}.fa-hourglass:before{content:"\f254"}.fa-hand-grab-o:before,.fa-hand-rock-o:before{content:"\f255"}.fa-hand-stop-o:before,.fa-hand-paper-o:before{content:"\f256"}.fa-hand-scissors-o:before{content:"\f257"}.fa-hand-lizard-o:before{content:"\f258"}.fa-hand-spock-o:before{content:"\f259"}.fa-hand-pointer-o:before{content:"\f25a"}.fa-hand-peace-o:before{content:"\f25b"}.fa-trademark:before{content:"\f25c"}.fa-registered:before{content:"\f25d"}.fa-creative-commons:before{content:"\f25e"}.fa-gg:before{content:"\f260"}.fa-gg-circle:before{content:"\f261"}.fa-tripadvisor:before{content:"\f262"}.fa-odnoklassniki:before{content:"\f263"}.fa-odnoklassniki-square:before{content:"\f264"}.fa-get-pocket:before{content:"\f265"}.fa-wikipedia-w:before{content:"\f266"}.fa-safari:before{content:"\f267"}.fa-chrome:before{content:"\f268"}.fa-firefox:before{content:"\f269"}.fa-opera:before{content:"\f26a"}.fa-internet-explorer:before{content:"\f26b"}.fa-tv:before,.fa-television:before{content:"\f26c"}.fa-contao:before{content:"\f26d"}.fa-500px:before{content:"\f26e"}.fa-amazon:before{content:"\f270"}.fa-calendar-plus-o:before{content:"\f271"}.fa-calendar-minus-o:before{content:"\f272"}.fa-calendar-times-o:before{content:"\f273"}.fa-calendar-check-o:before{content:"\f274"}.fa-industry:before{content:"\f275"}.fa-map-pin:before{content:"\f276"}.fa-map-signs:before{content:"\f277"}.fa-map-o:before{content:"\f278"}.fa-map:before{content:"\f279"}.fa-commenting:before{content:"\f27a"}.fa-commenting-o:before{content:"\f27b"}.fa-houzz:before{content:"\f27c"}.fa-vimeo:before{content:"\f27d"}.fa-black-tie:before{content:"\f27e"}.fa-fonticons:before{content:"\f280"}.fa-reddit-alien:before{content:"\f281"}.fa-edge:before{content:"\f282"}.fa-credit-card-alt:before{content:"\f283"}.fa-codiepie:before{content:"\f284"}.fa-modx:before{content:"\f285"}.fa-fort-awesome:before{content:"\f286"}.fa-usb:before{content:"\f287"}.fa-product-hunt:before{content:"\f288"}.fa-mixcloud:before{content:"\f289"}.fa-scribd:before{content:"\f28a"}.fa-pause-circle:before{content:"\f28b"}.fa-pause-circle-o:before{content:"\f28c"}.fa-stop-circle:before{content:"\f28d"}.fa-stop-circle-o:before{content:"\f28e"}.fa-shopping-bag:before{content:"\f290"}.fa-shopping-basket:before{content:"\f291"}.fa-hashtag:before{content:"\f292"}.fa-bluetooth:before{content:"\f293"}.fa-bluetooth-b:before{content:"\f294"}.fa-percent:before{content:"\f295"}.fa-gitlab:before{content:"\f296"}.fa-wpbeginner:before{content:"\f297"}.fa-wpforms:before{content:"\f298"}.fa-envira:before{content:"\f299"}.fa-universal-access:before{content:"\f29a"}.fa-wheelchair-alt:before{content:"\f29b"}.fa-question-circle-o:before{content:"\f29c"}.fa-blind:before{content:"\f29d"}.fa-audio-description:before{content:"\f29e"}.fa-volume-control-phone:before{content:"\f2a0"}.fa-braille:before{content:"\f2a1"}.fa-assistive-listening-systems:before{content:"\f2a2"}.fa-asl-interpreting:before,.fa-american-sign-language-interpreting:before{content:"\f2a3"}.fa-deafness:before,.fa-hard-of-hearing:before,.fa-deaf:before{content:"\f2a4"}.fa-glide:before{content:"\f2a5"}.fa-glide-g:before{content:"\f2a6"}.fa-signing:before,.fa-sign-language:before{content:"\f2a7"}.fa-low-vision:before{content:"\f2a8"}.fa-viadeo:before{content:"\f2a9"}.fa-viadeo-square:before{content:"\f2aa"}.fa-snapchat:before{content:"\f2ab"}.fa-snapchat-ghost:before{content:"\f2ac"}.fa-snapchat-square:before{content:"\f2ad"}.fa-pied-piper:before{content:"\f2ae"}.fa-first-order:before{content:"\f2b0"}.fa-yoast:before{content:"\f2b1"}.fa-themeisle:before{content:"\f2b2"}.fa-google-plus-circle:before,.fa-google-plus-official:before{content:"\f2b3"}.fa-fa:before,.fa-font-awesome:before{content:"\f2b4"}.fa-handshake-o:before{content:"\f2b5"}.fa-envelope-open:before{content:"\f2b6"}.fa-envelope-open-o:before{content:"\f2b7"}.fa-linode:before{content:"\f2b8"}.fa-address-book:before{content:"\f2b9"}.fa-address-book-o:before{content:"\f2ba"}.fa-vcard:before,.fa-address-card:before{content:"\f2bb"}.fa-vcard-o:before,.fa-address-card-o:before{content:"\f2bc"}.fa-user-circle:before{content:"\f2bd"}.fa-user-circle-o:before{content:"\f2be"}.fa-user-o:before{content:"\f2c0"}.fa-id-badge:before{content:"\f2c1"}.fa-drivers-license:before,.fa-id-card:before{content:"\f2c2"}.fa-drivers-license-o:before,.fa-id-card-o:before{content:"\f2c3"}.fa-quora:before{content:"\f2c4"}.fa-free-code-camp:before{content:"\f2c5"}.fa-telegram:before{content:"\f2c6"}.fa-thermometer-4:before,.fa-thermometer:before,.fa-thermometer-full:before{content:"\f2c7"}.fa-thermometer-3:before,.fa-thermometer-three-quarters:before{content:"\f2c8"}.fa-thermometer-2:before,.fa-thermometer-half:before{content:"\f2c9"}.fa-thermometer-1:before,.fa-thermometer-quarter:before{content:"\f2ca"}.fa-thermometer-0:before,.fa-thermometer-empty:before{content:"\f2cb"}.fa-shower:before{content:"\f2cc"}.fa-bathtub:before,.fa-s15:before,.fa-bath:before{content:"\f2cd"}.fa-podcast:before{content:"\f2ce"}.fa-window-maximize:before{content:"\f2d0"}.fa-window-minimize:before{content:"\f2d1"}.fa-window-restore:before{content:"\f2d2"}.fa-times-rectangle:before,.fa-window-close:before{content:"\f2d3"}.fa-times-rectangle-o:before,.fa-window-close-o:before{content:"\f2d4"}.fa-bandcamp:before{content:"\f2d5"}.fa-grav:before{content:"\f2d6"}.fa-etsy:before{content:"\f2d7"}.fa-imdb:before{content:"\f2d8"}.fa-ravelry:before{content:"\f2d9"}.fa-eercast:before{content:"\f2da"}.fa-microchip:before{content:"\f2db"}.fa-snowflake-o:before{content:"\f2dc"}.fa-superpowers:before{content:"\f2dd"}.fa-wpexplorer:before{content:"\f2de"}.fa-meetup:before{content:"\f2e0"}.sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0, 0, 0, 0);border:0}.sr-only-focusable:active,.sr-only-focusable:focus{position:static;width:auto;height:auto;margin:0;overflow:visible;clip:auto} diff --git a/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/fonts/FontAwesome.otf b/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/fonts/FontAwesome.otf deleted file mode 100644 index 401ec0f36..000000000 Binary files a/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/fonts/FontAwesome.otf and /dev/null differ diff --git a/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/fonts/fontawesome-webfont.eot b/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/fonts/fontawesome-webfont.eot deleted file mode 100644 index e9f60ca95..000000000 Binary files a/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/fonts/fontawesome-webfont.eot and /dev/null differ diff --git a/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/fonts/fontawesome-webfont.svg b/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/fonts/fontawesome-webfont.svg deleted file mode 100644 index 855c845e5..000000000 --- a/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/fonts/fontawesome-webfont.svg +++ /dev/null @@ -1,2671 +0,0 @@ - - - - -Created by FontForge 20120731 at Mon Oct 24 17:37:40 2016 - By ,,, -Copyright Dave Gandy 2016. All rights reserved. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/fonts/fontawesome-webfont.ttf b/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/fonts/fontawesome-webfont.ttf deleted file mode 100644 index 35acda2fa..000000000 Binary files a/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/fonts/fontawesome-webfont.ttf and /dev/null differ diff --git a/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/fonts/fontawesome-webfont.woff b/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/fonts/fontawesome-webfont.woff deleted file mode 100644 index 400014a4b..000000000 Binary files a/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/fonts/fontawesome-webfont.woff and /dev/null differ diff --git a/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/fonts/fontawesome-webfont.woff2 b/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/fonts/fontawesome-webfont.woff2 deleted file mode 100644 index 4d13fc604..000000000 Binary files a/docs/generated/reference/output/reference/api-docs/node_modules/font-awesome/fonts/fontawesome-webfont.woff2 and /dev/null differ diff --git a/docs/generated/reference/output/reference/api-docs/node_modules/highlight.js/styles/default.css b/docs/generated/reference/output/reference/api-docs/node_modules/highlight.js/styles/default.css deleted file mode 100644 index f1bfade31..000000000 --- a/docs/generated/reference/output/reference/api-docs/node_modules/highlight.js/styles/default.css +++ /dev/null @@ -1,99 +0,0 @@ -/* - -Original highlight.js style (c) Ivan Sagalaev - -*/ - -.hljs { - display: block; - overflow-x: auto; - padding: 0.5em; - background: #F0F0F0; -} - - -/* Base color: saturation 0; */ - -.hljs, -.hljs-subst { - color: #444; -} - -.hljs-comment { - color: #888888; -} - -.hljs-keyword, -.hljs-attribute, -.hljs-selector-tag, -.hljs-meta-keyword, -.hljs-doctag, -.hljs-name { - font-weight: bold; -} - - -/* User color: hue: 0 */ - -.hljs-type, -.hljs-string, -.hljs-number, -.hljs-selector-id, -.hljs-selector-class, -.hljs-quote, -.hljs-template-tag, -.hljs-deletion { - color: #880000; -} - -.hljs-title, -.hljs-section { - color: #880000; - font-weight: bold; -} - -.hljs-regexp, -.hljs-symbol, -.hljs-variable, -.hljs-template-variable, -.hljs-link, -.hljs-selector-attr, -.hljs-selector-pseudo { - color: #BC6060; -} - - -/* Language color: hue: 90; */ - -.hljs-literal { - color: #78A960; -} - -.hljs-built_in, -.hljs-bullet, -.hljs-code, -.hljs-addition { - color: #397300; -} - - -/* Meta color: hue: 200 */ - -.hljs-meta { - color: #1f7199; -} - -.hljs-meta-string { - color: #4d99bf; -} - - -/* Misc effects */ - -.hljs-emphasis { - font-style: italic; -} - -.hljs-strong { - font-weight: bold; -} diff --git a/docs/generated/reference/output/reference/api-docs/node_modules/jquery.scrollto/jquery.scrollTo.min.js b/docs/generated/reference/output/reference/api-docs/node_modules/jquery.scrollto/jquery.scrollTo.min.js deleted file mode 100644 index 65a020d92..000000000 --- a/docs/generated/reference/output/reference/api-docs/node_modules/jquery.scrollto/jquery.scrollTo.min.js +++ /dev/null @@ -1,7 +0,0 @@ -/** - * Copyright (c) 2007-2015 Ariel Flesler - afleslergmailcom | http://flesler.blogspot.com - * Licensed under MIT - * @author Ariel Flesler - * @version 2.1.2 - */ -;(function(f){"use strict";"function"===typeof define&&define.amd?define(["jquery"],f):"undefined"!==typeof module&&module.exports?module.exports=f(require("jquery")):f(jQuery)})(function($){"use strict";function n(a){return!a.nodeName||-1!==$.inArray(a.nodeName.toLowerCase(),["iframe","#document","html","body"])}function h(a){return $.isFunction(a)||$.isPlainObject(a)?a:{top:a,left:a}}var p=$.scrollTo=function(a,d,b){return $(window).scrollTo(a,d,b)};p.defaults={axis:"xy",duration:0,limit:!0};$.fn.scrollTo=function(a,d,b){"object"=== typeof d&&(b=d,d=0);"function"===typeof b&&(b={onAfter:b});"max"===a&&(a=9E9);b=$.extend({},p.defaults,b);d=d||b.duration;var u=b.queue&&1=f[g]?0:Math.min(f[g],n));!a&&1+~]|"+M+")"+M+"*"),U=new RegExp(M+"|>"),X=new RegExp($),V=new RegExp("^"+I+"$"),G={ID:new RegExp("^#("+I+")"),CLASS:new RegExp("^\\.("+I+")"),TAG:new RegExp("^("+I+"|[*])"),ATTR:new RegExp("^"+W),PSEUDO:new RegExp("^"+$),CHILD:new RegExp("^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\("+M+"*(even|odd|(([+-]|)(\\d*)n|)"+M+"*(?:([+-]|)"+M+"*(\\d+)|))"+M+"*\\)|)","i"),bool:new RegExp("^(?:"+R+")$","i"),needsContext:new RegExp("^"+M+"*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\("+M+"*((?:-\\d)?\\d*)"+M+"*\\)|)(?=[^-]|$)","i")},Y=/HTML$/i,Q=/^(?:input|select|textarea|button)$/i,J=/^h\d$/i,K=/^[^{]+\{\s*\[native \w/,Z=/^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/,ee=/[+~]/,te=new RegExp("\\\\([\\da-f]{1,6}"+M+"?|("+M+")|.)","ig"),ne=function(e,t,n){var r="0x"+t-65536;return r!=r||n?t:r<0?String.fromCharCode(r+65536):String.fromCharCode(r>>10|55296,1023&r|56320)},re=/([\0-\x1f\x7f]|^-?\d)|^-$|[^\0-\x1f\x7f-\uFFFF\w-]/g,ie=function(e,t){return t?"\0"===e?"\ufffd":e.slice(0,-1)+"\\"+e.charCodeAt(e.length-1).toString(16)+" ":"\\"+e},oe=function(){T()},ae=be(function(e){return!0===e.disabled&&"fieldset"===e.nodeName.toLowerCase()},{dir:"parentNode",next:"legend"});try{H.apply(t=O.call(m.childNodes),m.childNodes),t[m.childNodes.length].nodeType}catch(e){H={apply:t.length?function(e,t){L.apply(e,O.call(t))}:function(e,t){var n=e.length,r=0;while(e[n++]=t[r++]);e.length=n-1}}}function se(t,e,n,r){var i,o,a,s,u,l,c,f=e&&e.ownerDocument,p=e?e.nodeType:9;if(n=n||[],"string"!=typeof t||!t||1!==p&&9!==p&&11!==p)return n;if(!r&&((e?e.ownerDocument||e:m)!==C&&T(e),e=e||C,E)){if(11!==p&&(u=Z.exec(t)))if(i=u[1]){if(9===p){if(!(a=e.getElementById(i)))return n;if(a.id===i)return n.push(a),n}else if(f&&(a=f.getElementById(i))&&y(e,a)&&a.id===i)return n.push(a),n}else{if(u[2])return H.apply(n,e.getElementsByTagName(t)),n;if((i=u[3])&&d.getElementsByClassName&&e.getElementsByClassName)return H.apply(n,e.getElementsByClassName(i)),n}if(d.qsa&&!A[t+" "]&&(!v||!v.test(t))&&(1!==p||"object"!==e.nodeName.toLowerCase())){if(c=t,f=e,1===p&&U.test(t)){(s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=k),o=(l=h(t)).length;while(o--)l[o]="#"+s+" "+xe(l[o]);c=l.join(","),f=ee.test(t)&&ye(e.parentNode)||e}try{return H.apply(n,f.querySelectorAll(c)),n}catch(e){A(t,!0)}finally{s===k&&e.removeAttribute("id")}}}return g(t.replace(B,"$1"),e,n,r)}function ue(){var r=[];return function e(t,n){return r.push(t+" ")>b.cacheLength&&delete e[r.shift()],e[t+" "]=n}}function le(e){return e[k]=!0,e}function ce(e){var t=C.createElement("fieldset");try{return!!e(t)}catch(e){return!1}finally{t.parentNode&&t.parentNode.removeChild(t),t=null}}function fe(e,t){var n=e.split("|"),r=n.length;while(r--)b.attrHandle[n[r]]=t}function pe(e,t){var n=t&&e,r=n&&1===e.nodeType&&1===t.nodeType&&e.sourceIndex-t.sourceIndex;if(r)return r;if(n)while(n=n.nextSibling)if(n===t)return-1;return e?1:-1}function de(t){return function(e){return"input"===e.nodeName.toLowerCase()&&e.type===t}}function he(n){return function(e){var t=e.nodeName.toLowerCase();return("input"===t||"button"===t)&&e.type===n}}function ge(t){return function(e){return"form"in e?e.parentNode&&!1===e.disabled?"label"in e?"label"in e.parentNode?e.parentNode.disabled===t:e.disabled===t:e.isDisabled===t||e.isDisabled!==!t&&ae(e)===t:e.disabled===t:"label"in e&&e.disabled===t}}function ve(a){return le(function(o){return o=+o,le(function(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e.namespaceURI,n=(e.ownerDocument||e).documentElement;return!Y.test(t||n&&n.nodeName||"HTML")},T=se.setDocument=function(e){var t,n,r=e?e.ownerDocument||e:m;return r!==C&&9===r.nodeType&&r.documentElement&&(a=(C=r).documentElement,E=!i(C),m!==C&&(n=C.defaultView)&&n.top!==n&&(n.addEventListener?n.addEventListener("unload",oe,!1):n.attachEvent&&n.attachEvent("onunload",oe)),d.attributes=ce(function(e){return e.className="i",!e.getAttribute("className")}),d.getElementsByTagName=ce(function(e){return e.appendChild(C.createComment("")),!e.getElementsByTagName("*").length}),d.getElementsByClassName=K.test(C.getElementsByClassName),d.getById=ce(function(e){return a.appendChild(e).id=k,!C.getElementsByName||!C.getElementsByName(k).length}),d.getById?(b.filter.ID=function(e){var t=e.replace(te,ne);return function(e){return e.getAttribute("id")===t}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n=t.getElementById(e);return n?[n]:[]}}):(b.filter.ID=function(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((n=o.getAttributeNode("id"))&&n.value===e)return[o];i=t.getElementsByName(e),r=0;while(o=i[r++])if((n=o.getAttributeNode("id"))&&n.value===e)return[o]}return[]}}),b.find.TAG=d.getElementsByTagName?function(e,t){return"undefined"!=typeof t.getElementsByTagName?t.getElementsByTagName(e):d.qsa?t.querySelectorAll(e):void 0}:function(e,t){var n,r=[],i=0,o=t.getElementsByTagName(e);if("*"===e){while(n=o[i++])1===n.nodeType&&r.push(n);return r}return o},b.find.CLASS=d.getElementsByClassName&&function(e,t){if("undefined"!=typeof t.getElementsByClassName&&E)return t.getElementsByClassName(e)},s=[],v=[],(d.qsa=K.test(C.querySelectorAll))&&(ce(function(e){a.appendChild(e).innerHTML="",e.querySelectorAll("[msallowcapture^='']").length&&v.push("[*^$]="+M+"*(?:''|\"\")"),e.querySelectorAll("[selected]").length||v.push("\\["+M+"*(?:value|"+R+")"),e.querySelectorAll("[id~="+k+"-]").length||v.push("~="),e.querySelectorAll(":checked").length||v.push(":checked"),e.querySelectorAll("a#"+k+"+*").length||v.push(".#.+[+~]")}),ce(function(e){e.innerHTML="";var t=C.createElement("input");t.setAttribute("type","hidden"),e.appendChild(t).setAttribute("name","D"),e.querySelectorAll("[name=d]").length&&v.push("name"+M+"*[*^$|!~]?="),2!==e.querySelectorAll(":enabled").length&&v.push(":enabled",":disabled"),a.appendChild(e).disabled=!0,2!==e.querySelectorAll(":disabled").length&&v.push(":enabled",":disabled"),e.querySelectorAll("*,:x"),v.push(",.*:")})),(d.matchesSelector=K.test(c=a.matches||a.webkitMatchesSelector||a.mozMatchesSelector||a.oMatchesSelector||a.msMatchesSelector))&&ce(function(e){d.disconnectedMatch=c.call(e,"*"),c.call(e,"[s!='']:x"),s.push("!=",$)}),v=v.length&&new RegExp(v.join("|")),s=s.length&&new RegExp(s.join("|")),t=K.test(a.compareDocumentPosition),y=t||K.test(a.contains)?function(e,t){var n=9===e.nodeType?e.documentElement:e,r=t&&t.parentNode;return e===r||!(!r||1!==r.nodeType||!(n.contains?n.contains(r):e.compareDocumentPosition&&16&e.compareDocumentPosition(r)))}:function(e,t){if(t)while(t=t.parentNode)if(t===e)return!0;return!1},D=t?function(e,t){if(e===t)return l=!0,0;var n=!e.compareDocumentPosition-!t.compareDocumentPosition;return n||(1&(n=(e.ownerDocument||e)===(t.ownerDocument||t)?e.compareDocumentPosition(t):1)||!d.sortDetached&&t.compareDocumentPosition(e)===n?e===C||e.ownerDocument===m&&y(m,e)?-1:t===C||t.ownerDocument===m&&y(m,t)?1:u?P(u,e)-P(u,t):0:4&n?-1:1)}:function(e,t){if(e===t)return l=!0,0;var n,r=0,i=e.parentNode,o=t.parentNode,a=[e],s=[t];if(!i||!o)return e===C?-1:t===C?1:i?-1:o?1:u?P(u,e)-P(u,t):0;if(i===o)return pe(e,t);n=e;while(n=n.parentNode)a.unshift(n);n=t;while(n=n.parentNode)s.unshift(n);while(a[r]===s[r])r++;return r?pe(a[r],s[r]):a[r]===m?-1:s[r]===m?1:0}),C},se.matches=function(e,t){return se(e,null,null,t)},se.matchesSelector=function(e,t){if((e.ownerDocument||e)!==C&&T(e),d.matchesSelector&&E&&!A[t+" "]&&(!s||!s.test(t))&&(!v||!v.test(t)))try{var n=c.call(e,t);if(n||d.disconnectedMatch||e.document&&11!==e.document.nodeType)return n}catch(e){A(t,!0)}return 0":{dir:"parentNode",first:!0}," ":{dir:"parentNode"},"+":{dir:"previousSibling",first:!0},"~":{dir:"previousSibling"}},preFilter:{ATTR:function(e){return e[1]=e[1].replace(te,ne),e[3]=(e[3]||e[4]||e[5]||"").replace(te,ne),"~="===e[2]&&(e[3]=" "+e[3]+" "),e.slice(0,4)},CHILD:function(e){return e[1]=e[1].toLowerCase(),"nth"===e[1].slice(0,3)?(e[3]||se.error(e[0]),e[4]=+(e[4]?e[5]+(e[6]||1):2*("even"===e[3]||"odd"===e[3])),e[5]=+(e[7]+e[8]||"odd"===e[3])):e[3]&&se.error(e[0]),e},PSEUDO:function(e){var t,n=!e[6]&&e[2];return G.CHILD.test(e[0])?null:(e[3]?e[2]=e[4]||e[5]||"":n&&X.test(n)&&(t=h(n,!0))&&(t=n.indexOf(")",n.length-t)-n.length)&&(e[0]=e[0].slice(0,t),e[2]=n.slice(0,t)),e.slice(0,3))}},filter:{TAG:function(e){var t=e.replace(te,ne).toLowerCase();return"*"===e?function(){return!0}:function(e){return e.nodeName&&e.nodeName.toLowerCase()===t}},CLASS:function(e){var t=p[e+" "];return t||(t=new RegExp("(^|"+M+")"+e+"("+M+"|$)"))&&p(e,function(e){return t.test("string"==typeof e.className&&e.className||"undefined"!=typeof e.getAttribute&&e.getAttribute("class")||"")})},ATTR:function(n,r,i){return function(e){var t=se.attr(e,n);return null==t?"!="===r:!r||(t+="","="===r?t===i:"!="===r?t!==i:"^="===r?i&&0===t.indexOf(i):"*="===r?i&&-1:\x20\t\r\n\f]*)[\x20\t\r\n\f]*\/?>(?:<\/\1>|)$/i;function j(e,n,r){return m(n)?k.grep(e,function(e,t){return!!n.call(e,t,e)!==r}):n.nodeType?k.grep(e,function(e){return e===n!==r}):"string"!=typeof n?k.grep(e,function(e){return-1)[^>]*|#([\w-]+))$/;(k.fn.init=function(e,t,n){var r,i;if(!e)return this;if(n=n||q,"string"==typeof e){if(!(r="<"===e[0]&&">"===e[e.length-1]&&3<=e.length?[null,e,null]:L.exec(e))||!r[1]&&t)return!t||t.jquery?(t||n).find(e):this.constructor(t).find(e);if(r[1]){if(t=t instanceof k?t[0]:t,k.merge(this,k.parseHTML(r[1],t&&t.nodeType?t.ownerDocument||t:E,!0)),D.test(r[1])&&k.isPlainObject(t))for(r in t)m(this[r])?this[r](t[r]):this.attr(r,t[r]);return this}return(i=E.getElementById(r[2]))&&(this[0]=i,this.length=1),this}return e.nodeType?(this[0]=e,this.length=1,this):m(e)?void 0!==n.ready?n.ready(e):e(k):k.makeArray(e,this)}).prototype=k.fn,q=k(E);var H=/^(?:parents|prev(?:Until|All))/,O={children:!0,contents:!0,next:!0,prev:!0};function P(e,t){while((e=e[t])&&1!==e.nodeType);return e}k.fn.extend({has:function(e){var t=k(e,this),n=t.length;return this.filter(function(){for(var e=0;e\x20\t\r\n\f]*)/i,he=/^$|^module$|\/(?:java|ecma)script/i,ge={option:[1,""],thead:[1,"","
    "],col:[2,"","
    "],tr:[2,"","
    "],td:[3,"","
    "],_default:[0,"",""]};function ve(e,t){var n;return n="undefined"!=typeof e.getElementsByTagName?e.getElementsByTagName(t||"*"):"undefined"!=typeof e.querySelectorAll?e.querySelectorAll(t||"*"):[],void 0===t||t&&A(e,t)?k.merge([e],n):n}function ye(e,t){for(var n=0,r=e.length;nx",y.noCloneChecked=!!me.cloneNode(!0).lastChild.defaultValue;var Te=/^key/,Ce=/^(?:mouse|pointer|contextmenu|drag|drop)|click/,Ee=/^([^.]*)(?:\.(.+)|)/;function ke(){return!0}function Se(){return!1}function Ne(e,t){return e===function(){try{return E.activeElement}catch(e){}}()==("focus"===t)}function Ae(e,t,n,r,i,o){var a,s;if("object"==typeof t){for(s in"string"!=typeof n&&(r=r||n,n=void 0),t)Ae(e,s,n,r,t[s],o);return e}if(null==r&&null==i?(i=n,r=n=void 0):null==i&&("string"==typeof n?(i=r,r=void 0):(i=r,r=n,n=void 0)),!1===i)i=Se;else if(!i)return e;return 1===o&&(a=i,(i=function(e){return k().off(e),a.apply(this,arguments)}).guid=a.guid||(a.guid=k.guid++)),e.each(function(){k.event.add(this,t,i,r,n)})}function De(e,i,o){o?(Q.set(e,i,!1),k.event.add(e,i,{namespace:!1,handler:function(e){var t,n,r=Q.get(this,i);if(1&e.isTrigger&&this[i]){if(r.length)(k.event.special[i]||{}).delegateType&&e.stopPropagation();else if(r=s.call(arguments),Q.set(this,i,r),t=o(this,i),this[i](),r!==(n=Q.get(this,i))||t?Q.set(this,i,!1):n={},r!==n)return e.stopImmediatePropagation(),e.preventDefault(),n.value}else r.length&&(Q.set(this,i,{value:k.event.trigger(k.extend(r[0],k.Event.prototype),r.slice(1),this)}),e.stopImmediatePropagation())}})):void 0===Q.get(e,i)&&k.event.add(e,i,ke)}k.event={global:{},add:function(t,e,n,r,i){var o,a,s,u,l,c,f,p,d,h,g,v=Q.get(t);if(v){n.handler&&(n=(o=n).handler,i=o.selector),i&&k.find.matchesSelector(ie,i),n.guid||(n.guid=k.guid++),(u=v.events)||(u=v.events={}),(a=v.handle)||(a=v.handle=function(e){return"undefined"!=typeof k&&k.event.triggered!==e.type?k.event.dispatch.apply(t,arguments):void 0}),l=(e=(e||"").match(R)||[""]).length;while(l--)d=g=(s=Ee.exec(e[l])||[])[1],h=(s[2]||"").split(".").sort(),d&&(f=k.event.special[d]||{},d=(i?f.delegateType:f.bindType)||d,f=k.event.special[d]||{},c=k.extend({type:d,origType:g,data:r,handler:n,guid:n.guid,selector:i,needsContext:i&&k.expr.match.needsContext.test(i),namespace:h.join(".")},o),(p=u[d])||((p=u[d]=[]).delegateCount=0,f.setup&&!1!==f.setup.call(t,r,h,a)||t.addEventListener&&t.addEventListener(d,a)),f.add&&(f.add.call(t,c),c.handler.guid||(c.handler.guid=n.guid)),i?p.splice(p.delegateCount++,0,c):p.push(c),k.event.global[d]=!0)}},remove:function(e,t,n,r,i){var o,a,s,u,l,c,f,p,d,h,g,v=Q.hasData(e)&&Q.get(e);if(v&&(u=v.events)){l=(t=(t||"").match(R)||[""]).length;while(l--)if(d=g=(s=Ee.exec(t[l])||[])[1],h=(s[2]||"").split(".").sort(),d){f=k.event.special[d]||{},p=u[d=(r?f.delegateType:f.bindType)||d]||[],s=s[2]&&new RegExp("(^|\\.)"+h.join("\\.(?:.*\\.|)")+"(\\.|$)"),a=o=p.length;while(o--)c=p[o],!i&&g!==c.origType||n&&n.guid!==c.guid||s&&!s.test(c.namespace)||r&&r!==c.selector&&("**"!==r||!c.selector)||(p.splice(o,1),c.selector&&p.delegateCount--,f.remove&&f.remove.call(e,c));a&&!p.length&&(f.teardown&&!1!==f.teardown.call(e,h,v.handle)||k.removeEvent(e,d,v.handle),delete u[d])}else for(d in u)k.event.remove(e,d+t[l],n,r,!0);k.isEmptyObject(u)&&Q.remove(e,"handle events")}},dispatch:function(e){var t,n,r,i,o,a,s=k.event.fix(e),u=new Array(arguments.length),l=(Q.get(this,"events")||{})[s.type]||[],c=k.event.special[s.type]||{};for(u[0]=s,t=1;t\x20\t\r\n\f]*)[^>]*)\/>/gi,qe=/\s*$/g;function Oe(e,t){return A(e,"table")&&A(11!==t.nodeType?t:t.firstChild,"tr")&&k(e).children("tbody")[0]||e}function Pe(e){return e.type=(null!==e.getAttribute("type"))+"/"+e.type,e}function Re(e){return"true/"===(e.type||"").slice(0,5)?e.type=e.type.slice(5):e.removeAttribute("type"),e}function Me(e,t){var n,r,i,o,a,s,u,l;if(1===t.nodeType){if(Q.hasData(e)&&(o=Q.access(e),a=Q.set(t,o),l=o.events))for(i in delete a.handle,a.events={},l)for(n=0,r=l[i].length;n")},clone:function(e,t,n){var r,i,o,a,s,u,l,c=e.cloneNode(!0),f=oe(e);if(!(y.noCloneChecked||1!==e.nodeType&&11!==e.nodeType||k.isXMLDoc(e)))for(a=ve(c),r=0,i=(o=ve(e)).length;r").attr(n.scriptAttrs||{}).prop({charset:n.scriptCharset,src:n.url}).on("load error",i=function(e){r.remove(),i=null,e&&t("error"===e.type?404:200,e.type)}),E.head.appendChild(r[0])},abort:function(){i&&i()}}});var Vt,Gt=[],Yt=/(=)\?(?=&|$)|\?\?/;k.ajaxSetup({jsonp:"callback",jsonpCallback:function(){var e=Gt.pop()||k.expando+"_"+kt++;return this[e]=!0,e}}),k.ajaxPrefilter("json jsonp",function(e,t,n){var r,i,o,a=!1!==e.jsonp&&(Yt.test(e.url)?"url":"string"==typeof e.data&&0===(e.contentType||"").indexOf("application/x-www-form-urlencoded")&&Yt.test(e.data)&&"data");if(a||"jsonp"===e.dataTypes[0])return r=e.jsonpCallback=m(e.jsonpCallback)?e.jsonpCallback():e.jsonpCallback,a?e[a]=e[a].replace(Yt,"$1"+r):!1!==e.jsonp&&(e.url+=(St.test(e.url)?"&":"?")+e.jsonp+"="+r),e.converters["script json"]=function(){return o||k.error(r+" was not called"),o[0]},e.dataTypes[0]="json",i=C[r],C[r]=function(){o=arguments},n.always(function(){void 0===i?k(C).removeProp(r):C[r]=i,e[r]&&(e.jsonpCallback=t.jsonpCallback,Gt.push(r)),o&&m(i)&&i(o[0]),o=i=void 0}),"script"}),y.createHTMLDocument=((Vt=E.implementation.createHTMLDocument("").body).innerHTML="
    ",2===Vt.childNodes.length),k.parseHTML=function(e,t,n){return"string"!=typeof e?[]:("boolean"==typeof t&&(n=t,t=!1),t||(y.createHTMLDocument?((r=(t=E.implementation.createHTMLDocument("")).createElement("base")).href=E.location.href,t.head.appendChild(r)):t=E),o=!n&&[],(i=D.exec(e))?[t.createElement(i[1])]:(i=we([e],t,o),o&&o.length&&k(o).remove(),k.merge([],i.childNodes)));var r,i,o},k.fn.load=function(e,t,n){var r,i,o,a=this,s=e.indexOf(" ");return-1").append(k.parseHTML(e)).find(r):e)}).always(n&&function(e,t){a.each(function(){n.apply(this,o||[e.responseText,t,e])})}),this},k.each(["ajaxStart","ajaxStop","ajaxComplete","ajaxError","ajaxSuccess","ajaxSend"],function(e,t){k.fn[t]=function(e){return this.on(t,e)}}),k.expr.pseudos.animated=function(t){return k.grep(k.timers,function(e){return t===e.elem}).length},k.offset={setOffset:function(e,t,n){var r,i,o,a,s,u,l=k.css(e,"position"),c=k(e),f={};"static"===l&&(e.style.position="relative"),s=c.offset(),o=k.css(e,"top"),u=k.css(e,"left"),("absolute"===l||"fixed"===l)&&-1<(o+u).indexOf("auto")?(a=(r=c.position()).top,i=r.left):(a=parseFloat(o)||0,i=parseFloat(u)||0),m(t)&&(t=t.call(e,n,k.extend({},s))),null!=t.top&&(f.top=t.top-s.top+a),null!=t.left&&(f.left=t.left-s.left+i),"using"in t?t.using.call(e,f):c.css(f)}},k.fn.extend({offset:function(t){if(arguments.length)return void 0===t?this:this.each(function(e){k.offset.setOffset(this,t,e)});var e,n,r=this[0];return r?r.getClientRects().length?(e=r.getBoundingClientRect(),n=r.ownerDocument.defaultView,{top:e.top+n.pageYOffset,left:e.left+n.pageXOffset}):{top:0,left:0}:void 0},position:function(){if(this[0]){var e,t,n,r=this[0],i={top:0,left:0};if("fixed"===k.css(r,"position"))t=r.getBoundingClientRect();else{t=this.offset(),n=r.ownerDocument,e=r.offsetParent||n.documentElement;while(e&&(e===n.body||e===n.documentElement)&&"static"===k.css(e,"position"))e=e.parentNode;e&&e!==r&&1===e.nodeType&&((i=k(e).offset()).top+=k.css(e,"borderTopWidth",!0),i.left+=k.css(e,"borderLeftWidth",!0))}return{top:t.top-i.top-k.css(r,"marginTop",!0),left:t.left-i.left-k.css(r,"marginLeft",!0)}}},offsetParent:function(){return this.map(function(){var e=this.offsetParent;while(e&&"static"===k.css(e,"position"))e=e.offsetParent;return e||ie})}}),k.each({scrollLeft:"pageXOffset",scrollTop:"pageYOffset"},function(t,i){var o="pageYOffset"===i;k.fn[t]=function(e){return _(this,function(e,t,n){var r;if(x(e)?r=e:9===e.nodeType&&(r=e.defaultView),void 0===n)return r?r[i]:e[t];r?r.scrollTo(o?r.pageXOffset:n,o?n:r.pageYOffset):e[t]=n},t,e,arguments.length)}}),k.each(["top","left"],function(e,n){k.cssHooks[n]=ze(y.pixelPosition,function(e,t){if(t)return t=_e(e,n),$e.test(t)?k(e).position()[n]+"px":t})}),k.each({Height:"height",Width:"width"},function(a,s){k.each({padding:"inner"+a,content:s,"":"outer"+a},function(r,o){k.fn[o]=function(e,t){var n=arguments.length&&(r||"boolean"!=typeof e),i=r||(!0===e||!0===t?"margin":"border");return _(this,function(e,t,n){var r;return x(e)?0===o.indexOf("outer")?e["inner"+a]:e.document.documentElement["client"+a]:9===e.nodeType?(r=e.documentElement,Math.max(e.body["scroll"+a],r["scroll"+a],e.body["offset"+a],r["offset"+a],r["client"+a])):void 0===n?k.css(e,t,i):k.style(e,t,n,i)},s,n?e:void 0,n)}})}),k.each("blur focus focusin focusout resize scroll click dblclick mousedown mouseup mousemove mouseover mouseout mouseenter mouseleave change select submit keydown keypress keyup contextmenu".split(" "),function(e,n){k.fn[n]=function(e,t){return 0= node.offset().top) { - activeElemToken = token; - } - } - if (!prevElemToken) { - getNavElemNode(activeElemToken).addClass('selected'); - prevElemToken = activeElemToken; - return; - } - if (activeElemToken !== prevElemToken) { - getNavElemNode(prevElemToken).removeClass('selected'); - getNavElemNode(activeElemToken).addClass('selected'); - prevElemToken = activeElemToken; - } - return activeElemToken; - } - - function getHeadingNode(token) { - return $('#' + token); - } - - function getNavNode(token) { - return $('#' + token + '-nav'); - } - - function getNavElemNode(token) { - return $('#sidebar-wrapper > ul a[href="#' + token + '"]'); - } - - function checkNodePositions(nodes, flatNodeMap, scrollPosition) { - var activeNode; - for (var i = 0; i < nodes.length; i++) { - var item = nodes[i]; - var node = flatNodeMap[item.section]; - var nodeTop = node.offset().top - 50; - if (scrollPosition >= nodeTop) { - activeNode = {token: item.section, node: node}; - - if (item.subsections) { - activeNode.subsections = item.subsections; - } - break; - } - } - return activeNode; - } - - function scrollToNav(token) { - setTimeout(function() { - var scrollPosition = $(window).scrollTop(); - var activeSectionTokens = scrollActions(scrollPosition); - var activeElemToken = checkActiveElement(flatToc, scrollPosition); - var navNode = $('#sidebar-wrapper > ul a[href="#' + token + '"]'); - $('#sidebar-wrapper').scrollTo(navNode, {duration: 'fast', axis: 'y'}); - }, 200); - } - - $(window).on('hashchange', function(event) { - var scrollPosition = $(window).scrollTop(); - var activeSectionTokens = scrollActions(scrollPosition); - var activeElemToken = checkActiveElement(flatToc, scrollPosition); - var scrollToken = activeSectionTokens.L2 ? activeSectionTokens.L2 : activeSectionTokens.L1; - scrollToNav(scrollToken); - var token = location.hash.slice(1); - }); - - var scrollPosition = $(window).scrollTop(); - scrollActions(scrollPosition); - checkActiveElement(flatToc, scrollPosition); - // TODO: prevent scroll on sidebar from propogating to window - $(window).on('scroll', function(event) { - var scrollPosition = $(window).scrollTop(); - var activeSectionTokens = scrollActions(scrollPosition); - var activeElemToken = checkActiveElement(flatToc, scrollPosition); - }); -}); \ No newline at end of file diff --git a/docs/generated/reference/output/reference/api-docs/stylesheet.css b/docs/generated/reference/output/reference/api-docs/stylesheet.css deleted file mode 100644 index 6da5596e7..000000000 --- a/docs/generated/reference/output/reference/api-docs/stylesheet.css +++ /dev/null @@ -1,269 +0,0 @@ -/* -Kubernetes colors - -kubernetes blue - rgb(50, 109, 230) -dark blue - rgb(51, 113, 227) -dark grey - rgb(48, 48, 48) -light grey - rgb(161, 160, 158) -*/ - -/* User agent CSS overrides */ -#sidebar-wrapper ul, #sidebar-wrapper li { - margin-left: 10px; - padding-left: 0; -} - -/* Inspired by Slate CSS */ -.body-content aside { - padding: 1.6em; - margin: 1.8em 0; - background: lightsteelblue; - line-height: 1.6; - border-radius: 15px; -} - -.body-content aside.warning { - background-color: peachpuff; -} - -.body-content aside.success { - background-color: olivedrab; -} - -.body-content aside:before { - vertical-align: middle; - padding-right: 1em; - font-size: 16px; -} - -.body-content aside.warning:before, .body-content aside.notice:before, .body-content aside.success:before { - font-family: 'FontAwesome'; - font-style: normal; - font-weight: normal; - font-variant: normal; - text-transform: none; - line-height: 1; -} - -.body-content aside.warning:before { - content: "\f071"; -} - -.body-content aside.notice:before { - content: "\f05a"; -} - -.body-content hr { - margin: 2em 0; - border-top: 2px solid dimgrey; - border-bottom: 2px solid antiquewhite; -} - -.body-content table { - margin-bottom: 1em; - overflow: auto; -} - -.body-content table th, .body-content table td { - text-align: left; - vertical-align: top; - line-height: 1.6; -} - -.body-content table th { - padding: 15px 20px; - border-bottom: 1px solid lightsteelblue; - vertical-align: bottom; -} - -.body-content table td { - padding: 10px; -} - -.body-content table tr:last-child { - border-bottom: 1px solid lightsteelblue; -} - -.body-content table tr:nth-child(odd) > td { - background-color: whitesmoke; -} - -.body-content table tr:nth-child(even) > td { - background-color: lightsteelblue; -} - -.body-content dt { - font-weight: bold; -} - -.body-content dd { - margin-left: 15px; -} - -.body-content p, .body-content li, .body-content dt, .body-content dd { - line-height: 1.6; - margin-top: 0; -} - -/* Brodoc CSS */ - -body > #wrapper { - display: block; - padding-bottom: 500px; - background-image: linear-gradient(90deg, #FFFFFF 63%, rgb(48, 48, 48) 63%); -} - -#sidebar-wrapper { - display: block; - height: 100%; - width: 20%; - position: fixed; - z-index: 1; - top: 0; - left: 0; - background-color: whitesmoke; - border-right: 2px solid slategrey; - overflow-x: hidden; - padding-top: 60px; -} - -#sidebar-wrapper a { - text-decoration: none; - white-space: nowrap; - overflow: hidden; - text-overflow: ellipsis; - padding: 0 5px; -} - -#sidebar-wrapper ul { - list-style: none; -} - -#sidebar-wrapper a.selected { - font-style: bold; - color: whitesmoke; - border: 1px solid rgb(161, 160, 158); - background-color: rgb(51, 113, 227); - border-radius: 5px; -} - -#sidebar-wrapper .strong-nav { - font-family: monospace; - font-weight: bold; -} - -#sidebar-wrapper .nav-level-1.strong-nav { - margin-top: 25px; -} - -#sidebar-wrapper .copyright { - padding-left: 10px; - padding-top: 50px; - padding-bottom: 50px; - text-decoration: underline; -} - -#page-content-wrapper { - margin-left: 20%; - padding-top: 60px; -} - -.body-content h1, .body-content h2 { - width: 52%; - clear: both; - border-bottom: 3px solid lightslategrey; -} - -.body-content > h3, .body-content > h4, .body-content > h5, .body-content > h6, .body-content > p, .body-content > aside, .body-content > ul > li, .body-content > ul > li { - width: 52%; - padding-top: 20px; -} - -.body-content table { - width: 52%; -} - -.body-content table tr td:not(:first-child) { - overflow-wrap: break-word; - word-wrap: break-word; -} - -.body-content table tr td a { - word-break: break-word; -} - -.body-content p code { - text-overflow: ellipsis; - display: inline-block; - font-size: smaller; - word-break: break-word; -} - -.body-content blockquote { - border-left: 0; - border-radius: 5px; -} - -.body-content pre.code-block { - margin-bottom: 80px; -} - -.body-content blockquote p, .body-content pre { - color: black; - font-size: 13px; -} - -.body-content blockquote.code-block { - background: lightsteelblue; -} - -.body-content pre.code-block code { - overflow: auto; - overflow-wrap: normal; - word-wrap: normal; - white-space: pre; -} - -.code-block { - display: none; - width: 45%; - float: right; - clear: right; -} - -.code-block.active { - display: initial; -} - -#code-tabs-wrapper { - width: 35%; - height: 60px; - position: fixed; - top: 0; - right: 0; -} - -#code-tabs-wrapper .code-tab-list { - float: right; - margin-top: 0; - padding: 0 10px; -} - -#code-tabs-wrapper .code-tab { - color: white; - display: inline-block; - padding: 0 30px; - background: rgb(48, 48, 48); - border: 1px solid rgb(161, 160, 158); - border-radius: 5px; -} - -#code-tabs-wrapper .tab-selected { - background: rgb(51, 113, 227); - font-style: bold; - border-radius: 5px; -} - -.side-nav a { - color: black; -} \ No newline at end of file diff --git a/docs/generated/reference/output/reference/api-docs/tabvisibility.js b/docs/generated/reference/output/reference/api-docs/tabvisibility.js deleted file mode 100644 index 48c0df7fe..000000000 --- a/docs/generated/reference/output/reference/api-docs/tabvisibility.js +++ /dev/null @@ -1,27 +0,0 @@ -$(document).ready(function() { - var codeTabs = $('#code-tabs-wrapper').find('li'); - - for (var i = 0; i < codeTabs.length; i++) { - createCodeTabListeners(codeTabs, i); - } - - function createCodeTabListeners(codeTabs, index) { - var tab = $(codeTabs[index]), - id = tab.attr('id'), - codeClass = '.' + id; - tab.on('click', function() { - codeTabs.removeClass('tab-selected'); - tab.addClass('tab-selected'); - $('.code-block').removeClass('active'); - $(codeClass).addClass('active'); - - }); - } - - function setDefautTab() { - $(codeTabs[0]).addClass('tab-selected'); - $('.' + codeTabs[0].id).addClass('active'); - } - - setDefautTab(); -}); \ No newline at end of file diff --git a/docs/getting-started/index.rst b/docs/getting-started/index.rst index aebfaf0e2..6ce70e6e9 100644 --- a/docs/getting-started/index.rst +++ b/docs/getting-started/index.rst @@ -1,13 +1,6 @@ -=========== -Get started -=========== +========== +File moved +========== -The guides in this section will explain how to install, set up, and -uninstall cert-manager. - -.. toctree:: - :maxdepth: 2 - :caption: Contents: - - install/index - webhook +This document has moved to https://cert-manager.netlify.com/docs/installation/. +This placeholder file will be removed in a later release. diff --git a/docs/getting-started/install/index.rst b/docs/getting-started/install/index.rst index 741118c05..6ce70e6e9 100644 --- a/docs/getting-started/install/index.rst +++ b/docs/getting-started/install/index.rst @@ -1,16 +1,6 @@ -======================= -Installing cert-manager -======================= +========== +File moved +========== -cert-manager supports running on Kubernetes_ and OpenShift_. The installation -mechanism between the two platforms is similar, although there are a number -of extra notes to be aware of per-platform. - -.. toctree:: - :maxdepth: 1 - - kubernetes - openshift - -.. _Kubernetes: https://kubernetes.io -.. _OpenShift: https://www.openshift.com +This document has moved to https://cert-manager.netlify.com/docs/installation/. +This placeholder file will be removed in a later release. diff --git a/docs/getting-started/install/kubernetes.rst b/docs/getting-started/install/kubernetes.rst index 6eec74a65..594860180 100644 --- a/docs/getting-started/install/kubernetes.rst +++ b/docs/getting-started/install/kubernetes.rst @@ -1,298 +1,6 @@ -======================== -Installing on Kubernetes -======================== +========== +File moved +========== -cert-manager runs within your Kubernetes cluster as a series of deployment -resources. It utilises `CustomResourceDefinitions`_ to configure Certificate -Authorities and request certificates. - -It is deployed using regular YAML manifests, like any other applications on -Kubernetes. - -Once cert-manager has been deployed, you must configure Issuer or ClusterIssuer -resources which represent certificate authorities. -More information on configuring different Issuer types can be found in the -:doc:`respective setup guides `. - -.. note:: - From cert-manager v0.11.0 onwards, the minimum supported version of - Kubernetes is v1.11.0. Users still running Kubernetes v1.10 or below should - upgrade to a supported version before installing cert-manager. - -.. warning:: - - You should not install multiple instances of cert-manager on a single - cluster. This will lead to undefined behaviour and you may be banned from - providers such as Let's Encrypt. - -Installing with regular manifests -================================= - -In order to install cert-manager, we must first create a namespace to run it -within. This guide will install cert-manager into the ``cert-manager`` -namespace. It is possible to run cert-manager in a different namespace, -although you will need to make modifications to the deployment manifests. - -.. code-block:: shell - - # Create a namespace to run cert-manager in - kubectl create namespace cert-manager - -As part of the installation, cert-manager also deploys a webhook deployment as -an `APIService`_. This can cause issues when uninstalling cert-manager if the -API service still exists but the webhook is no longer running as the API server -is unable to reach the validating webhook. Ensure to follow the documentation -when :doc:`uninstalling cert-manager <../../../tasks/uninstall/index>`. - -The webhook enables cert-manager to implement validation and mutating webhooks -on cert-manager resources. A `ValidatingWebhookConfiguration`_ resource is -deployed to validate cert-manager resources we will create after installation. -No mutating webhooks are currently implemented. - -You can read more about the webhook on the :doc:`webhook document <../webhook>`. - -We can now go ahead and install cert-manager. All resources -(the CustomResourceDefinitions, cert-manager, and the webhook component) -are included in a single YAML manifest file: - -.. code-block:: shell - - # Install the CustomResourceDefinitions and cert-manager itself - kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v0.11.0/cert-manager.yaml - -.. note:: - If you are running Kubernetes v1.15 or below, you will need to add the - ``--validate=false`` flag to your ``kubectl apply`` command above else you - will receive a validation error relating to the - ``x-kubernetes-preserve-unknown-fields`` field in our - ``CustomResourceDefinition`` resources. - This is a benign error and occurs due to the way ``kubectl`` performs - resource validation. - -.. note:: - When running on GKE (Google Kubernetes Engine), you may encounter a - 'permission denied' error when creating some of these resources. This is a - nuance of the way GKE handles RBAC and IAM permissions, and as such you - should 'elevate' your own privileges to that of a 'cluster-admin' **before** - running the above command. If you have already run the above command, you - should run them again after elevating your permissions:: - - kubectl create clusterrolebinding cluster-admin-binding \ - --clusterrole=cluster-admin \ - --user=$(gcloud config get-value core/account) - -Installing with Helm -==================== - -As an alternative to the YAML manifests referenced above, we also provide an -official Helm chart for installing cert-manager. - -Pre-requisites --------------- - -* Helm_ and Tiller installed (or alternatively, use `Tillerless Helm v2`_) -* `cluster-admin privileges bound to the Tiller pod`_ - -Foreword --------- - -Before deploying cert-manager with Helm, you must ensure Tiller_ is up and -running in your cluster. Tiller is the server side component to Helm. - -Your cluster administrator may have already setup and configured Helm for you, -in which case you can skip this step. - -Full documentation on installing Helm can be found in the `Installing helm docs`_. - -If your cluster has RBAC (Role Based Access Control) enabled (default in GKE -v1.7+), you will need to take special care when deploying Tiller, to ensure -Tiller has permission to create resources as a cluster administrator. More -information on deploying Helm with RBAC can be found in the `Helm RBAC docs`_. - -Steps ------ - -In order to install the Helm chart, you must run: - -.. code-block:: shell - - # Install the CustomResourceDefinition resources separately - kubectl apply --validate=false -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/deploy/manifests/00-crds.yaml - - # Create the namespace for cert-manager - kubectl create namespace cert-manager - - # Add the Jetstack Helm repository - helm repo add jetstack https://charts.jetstack.io - - # Update your local Helm chart repository cache - helm repo update - - # Install the cert-manager Helm chart - helm install \ - --name cert-manager \ - --namespace cert-manager \ - --version v0.11.0 \ - jetstack/cert-manager - -The default cert-manager configuration is good for the majority of users, but a -full list of the available options can be found in the `Helm chart README`_. - -Verifying the installation -========================== - -Once you've installed cert-manager, you can verify it is deployed correctly by -checking the ``cert-manager`` namespace for running pods: - -.. code-block:: shell - - kubectl get pods --namespace cert-manager - - NAME READY STATUS RESTARTS AGE - cert-manager-5c6866597-zw7kh 1/1 Running 0 2m - cert-manager-cainjector-577f6d9fd7-tr77l 1/1 Running 0 2m - cert-manager-webhook-787858fcdb-nlzsq 1/1 Running 0 2m - -You should see the ``cert-manager``, ``cert-manager-cainjector`` and -``cert-manager-webhook`` pod in a Running state. -It may take a minute or so for the TLS assets required for the webhook to -function to be provisioned. This may cause the webhook to take a while longer -to start for the first time than other pods. If you experience problems, please -check the :doc:`troubleshooting guide <../troubleshooting>`. - -The following steps will confirm that cert-manager is set up correctly and able -to issue basic certificate types: - -.. code-block:: shell - - # Create a ClusterIssuer to test the webhook works okay - cat < test-resources.yaml - apiVersion: v1 - kind: Namespace - metadata: - name: cert-manager-test - --- - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: test-selfsigned - namespace: cert-manager-test - spec: - selfSigned: {} - --- - apiVersion: cert-manager.io/v1alpha2 - kind: Certificate - metadata: - name: selfsigned-cert - namespace: cert-manager-test - spec: - commonName: example.com - secretName: selfsigned-cert-tls - issuerRef: - name: test-selfsigned - EOF - - # Create the test resources - kubectl apply -f test-resources.yaml - - # Check the status of the newly created certificate - # You may need to wait a few seconds before cert-manager processes the - # certificate request - kubectl describe certificate -n cert-manager-test - ... - Spec: - Common Name: example.com - Issuer Ref: - Name: test-selfsigned - Secret Name: selfsigned-cert-tls - Status: - Conditions: - Last Transition Time: 2019-01-29T17:34:30Z - Message: Certificate is up to date and has not expired - Reason: Ready - Status: True - Type: Ready - Not After: 2019-04-29T17:34:29Z - Events: - Type Reason Age From Message - ---- ------ ---- ---- ------- - Normal CertIssued 4s cert-manager Certificate issued successfully - - # Clean up the test resources - kubectl delete -f test-resources.yaml - -If all the above steps have completed without error, you are good to go! - -If you experience problems, please check the -:doc:`troubleshooting guide <../troubleshooting>`. - -Configuring your first Issuer -============================= - -Before you can begin issuing certificates, you must configure at least one -Issuer or ClusterIssuer resource in your cluster. - -You should read the :doc:`Setting up Issuers ` guide to -learn how to configure cert-manager to issue certificates from one of the -supported backends. - -Alternative installation methods -================================ - -Helmfile --------- - -Helmfile is a declarative spec for deploying helm charts. - -'cert-manager-installer': https://github.com/zakkg3/cert-manager-installer -It's an easy and automated way to install cert-manager. - -Note: This is an external link and it's not officially maintained by cert-manager -but by the community. - -.. code-block:: shell - - git clone git@github.com:zakkg3/cert-manager-installer.git - cd cert-manager-installer - helmfile sync - - -kubeprod --------- - -`Bitnami Kubernetes Production Runtime`_ (BKPR, ``kubeprod``) is a curated -collection of the services you would need to deploy on top of your Kubernetes -cluster to enable logging, monitoring, certificate management, automatic -discovery of Kubernetes resources via public DNS servers and other common -infrastructure needs. - -It depends on ``cert-manager`` for certificate management, and it is `regularly -tested`_ so the components are known to work together for GKE and AKS clusters -(EKS to be added soon). For its ingress stack it creates a DNS entry in the -configured DNS zone and requests a TLS certificate from the Let's Encrypt -staging server. - -BKPR can be deployed using the ``kubeprod install`` command, which will deploy -``cert-manager`` as part of it. Details available in the `BKPR installation guide`_. - - -Debugging installation issues -============================= - -If you have any issues with your installation, please refer to the -:doc:`troubleshooting guide <../troubleshooting>`. - -.. _`CustomResourceDefinitions`: https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/ -.. _`Helm chart README`: https://github.com/jetstack/cert-manager/blob/release-0.11/deploy/charts/cert-manager/README.md -.. _`kubernetes/kubernetes#69590`: https://github.com/kubernetes/kubernetes/issues/69590 -.. _`ValidatingWebhookConfiguration`: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/ -.. _`APIService`: https://kubernetes.io/docs/tasks/access-kubernetes-api/setup-extension-api-server -.. _`Helm`: https://helm.sh/ -.. _`cluster-admin privileges bound to the Tiller pod`: https://github.com/helm/helm/blob/240e539cec44e2b746b3541529d41f4ba01e77df/docs/rbac.md#Example-Service-account-with-cluster-admin-role -.. _`helm RBAC docs`: https://github.com/helm/helm/blob/master/docs/rbac.md -.. _`installing helm docs`: https://github.com/kubernetes/helm/blob/master/docs/install.md -.. _Tiller: https://github.com/helm/helm -.. _`Tillerless Helm v2`: https://rimusz.net/tillerless-helm/ -.. _`Bitnami Kubernetes Production Runtime`: https://github.com/bitnami/kube-prod-runtime/ -.. _`regularly tested`: https://github.com/bitnami/kube-prod-runtime/blob/master/Jenkinsfile -.. _`BKPR installation guide`: https://github.com/bitnami/kube-prod-runtime/blob/master/docs/install.md +This document has moved to https://cert-manager.netlify.com/docs/installation/kubernetes/. +This placeholder file will be removed in a later release. diff --git a/docs/getting-started/install/openshift.rst b/docs/getting-started/install/openshift.rst index c6d48db8b..ad576ed6d 100644 --- a/docs/getting-started/install/openshift.rst +++ b/docs/getting-started/install/openshift.rst @@ -1,96 +1,6 @@ -======================= -Installing on OpenShift -======================= +========== +File moved +========== -cert-manager supports running on OpenShift in a similar manner to :doc:`Running on Kubernetes <./kubernetes>`. -It runs within your OpenShift cluster as a series of deployment -resources. -It utilises `CustomResourceDefinitions`_ to configure Certificate -Authorities and request certificates. - -It is deployed using regular YAML manifests, like any other application on -OpenShift. - -Once cert-manager has been deployed, you must configure Issuer or ClusterIssuer -resources which represent certificate authorities. -More information on configuring different Issuer types can be found in the -:doc:`respective setup guides `. - -.. warning:: - - You should not install multiple instances of cert-manager on a single - cluster. This will lead to undefined behaviour and you may be banned from - providers such as Let's Encrypt. - -Login to your OpenShift cluster -=============================== - -Before you can install cert-manager, you must first ensure your local machine -is configured to talk to your OpenShift cluster using the ``oc`` tool. - -.. code-block:: shell - - # Login to the OpenShift cluster as the system:admin user - oc login -u system:admin - -Installing with regular manifests -================================= - -In order to install cert-manager, we must first create a namespace to run it -within. This guide will install cert-manager into the ``cert-manager`` -namespace. It is possible to run cert-manager in a different namespace, -although you will need to make modifications to the deployment manifests. - -.. code-block:: shell - - # Create a namespace to run cert-manager in - oc create namespace cert-manager - -As part of the installation, cert-manager also deploys a webhook deployment as -an `APIService`_. This can cause issues when uninstalling cert-manager if the -API service still exists but the webhook is no longer running as the API server -is unable to reach the validating webhook. Ensure to follow the documentation -when :doc:`uninstalling cert-manager <../../../tasks/uninstall/index>`. - -The webhook enables cert-manager to implement validation and mutating webhooks -on cert-manager resources. A `ValidatingWebhookConfiguration`_ resource is -deployed to validate cert-manager resources we will create after installation. -No mutating webhooks are currently implemented. - -You can read more about the webhook on the :doc:`webhook document <../webhook>`. - -We can now go ahead and install cert-manager. All resources -(the CustomResourceDefinitions, cert-manager, and the webhook component) -are included in a single YAML manifest file: - -.. code-block:: shell - - # Install the CustomResourceDefinitions and cert-manager itself - oc apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.11.0/cert-manager-openshift.yaml - -.. note:: - The ``--validate=false`` flag is added to the ``oc apply`` command above - else you will receive a validation error relating to the ``caBundle`` field - of the ``ValidatingWebhookConfiguration`` resource. - - -Configuring your first Issuer -============================= - -Before you can begin issuing certificates, you must configure at least one -Issuer or ClusterIssuer resource in your cluster. - -You should read the :doc:`Setting up Issuers ` guide to -learn how to configure cert-manager to issue certificates from one of the -supported backends. - -Debugging installation issues -============================= - -If you have any issues with your installation, please refer to the -:doc:`troubleshooting guide <../troubleshooting>`. - -.. _`CustomResourceDefinitions`: https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/ -.. _`APIService`: https://kubernetes.io/docs/tasks/access-kubernetes-api/setup-extension-api-server -.. _`kubernetes/kubernetes#69590`: https://github.com/kubernetes/kubernetes/issues/69590 -.. _`ValidatingWebhookConfiguration`: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/ +This document has moved to https://cert-manager.netlify.com/docs/installation/openshift/. +This placeholder file will be removed in a later release. diff --git a/docs/getting-started/webhook.rst b/docs/getting-started/webhook.rst index 2de1fc2e9..e9b5c4d59 100644 --- a/docs/getting-started/webhook.rst +++ b/docs/getting-started/webhook.rst @@ -1,166 +1,6 @@ -================= -Webhook component -================= +========== +File moved +========== -In order to provide advanced resource validation, cert-manager includes a -ValidatingWebhookConfiguration_ resource which is deployed into the cluster. - -This allows cert-manager to validate that cert-manager API resources that are -submitted to the apiserver are syntactically valid, and catch issues with your -resources early on. - -If you disable the webhook component, cert-manager will still perform the -same resource validation however it will not reject 'create' events when the -resources are submitted to the apiserver if they are invalid. -This means it may be possible for a user to submit a resource that renders -the controller inoperable. -For this reason, it is strongly advised to keep the webhook **enabled**. - -.. note:: - This feature requires Kubernetes v1.9 or greater. - -How it works -============ - -This sections walks through how the resource validation webhook is configured -and explains the process required for it to provision. - -The webhook is a ValidatingWebhookConfiguration_ resource combined with an -extra pod that is deployed alongside the cert-manager-controller. - -The ValidatingWebhookConfiguration instructs the Kubernetes apiserver to -POST the contents of any Create or Update operations performed on cert-manager -resource types in order to validate that they are setting valid configurations. - -This allows us to ensure mis-configurations are caught early on and -communicated to you. - -In order for this to work, the webhook requires a TLS certificate that the -apiserver is configured to trust. This is created by the webhook itself and is -implemented by the following two Secrets: - -* secret/cert-manager-webhook-ca - A self-signed root CA certificate - which is used to sign certificates for the webhook pod. -* secret/cert-manager-webhook-tls - A TLS certificate issued by the - root CA above, served by the webhook. - -The webhook's 'webhookbootstrap' controller is responsible for creating these -secrets with no manual intervention needed. - -If errors occur around the webhook but the webhook is running then the webhook -is most likely not reachable from the API server. In this case, ensure that the -API server can communicate with the webhook by following the GKE private cluster -explanation below. - -cainjector ----------- - -The :doc:`cert-manager CA injector ` is responsible for -injecting the two CA bundles above into the webhook's -ValidatingWebhookConfiguration and APIService resource in order to allow the -Kubernetes apiserver to 'trust' the webhook apiserver. - -This component is configured using the ``cert-manager.io/inject-apiserver-ca: "true"`` -and ``cert-manager.io/inject-apiserver-ca: "true"`` annotations on the -APIService and ValidatingWebhookConfiguration resources. - -It copies across the CA defined in the 'cert-manager-webhook-ca' Secret -generated above to the ``caBundle`` field on the APIService resource. -It also sets the webhook's ``clientConfig.caBundle`` field on the -``cert-manager-webhook`` ValidatingWebhookConfiguration resource to that of -your Kubernetes API server in order to support Kubernetes versions earlier than -v1.11. - -Known issues ------------- - -This section contains known issues with the webhook component. - -If you're having problems, or receiving errors when creating cert-manager -resources, please read through this section for help. - -Running on private GKE clusters -------------------------------- - -When Google configure the control plane for private clusters, they -automatically configure VPC peering between your Kubernetes cluster's network -and a separate Google managed project. - -In order to restrict what Google are able to access within your cluster, the -firewall rules configured restrict access to your Kubernetes pods. This will -mean that you will experience the webhook to not work and expierence errors such -as `Internal error occurred: failed calling admission webhook ... the server is -currently unable to handle the request`. - -In order to use the webhook component with a GKE private -cluster, you must configure an additional firewall rule to allow the GKE -control plane access to your webhook pod. - -You can read more information on how to add firewall rules for the GKE control -plane nodes in the `GKE docs`_. - -Alternatively, you can read how to `disable the webhook component`_ below. - -.. todo:: add an example command for how to do this here & explain any security - implications - -Disable the webhook component -============================== - -If you are having issues with the webhook and cannot use it at this time, -you can optionally disable the webhook altogether. - -Doing this may expose your cluster to mis-configuration problems that in some -cases could cause cert-manager to stop working altogether (i.e. if invalid types -are set for fields on cert-manager resources). - -How you disable the webhook depends on your deployment method. - -With Helm ---------- - -The Helm chart exposes an option that can be used to disable the webhook. - -To do so with an existing installation, you can run: - -.. code-block:: shell - - helm upgrade cert-manager \ - --reuse-values \ - --set webhook.enabled=false - -If you have not installed cert-manager yet, you can add the -``--set webhook.enabled=false`` to the ``helm install`` command used to install -cert-manager. - -With static manifests ---------------------- - -Because we cannot specify options when installing the static manifests to -conditionally disable different components, we also ship a copy of the -deployment files that do not include the webhook. - -Instead of installing with `cert-manager.yaml`_ file, you should instead use -the `cert-manager-no-webhook.yaml`_ file located in the deploy directory. - -This is a destructive operation, as it will remove the CustomResourceDefinition -resources, causing your configured Issuers, Certificates etc to be deleted. - -You should first :doc:`backup your configuration ` -before running the following commands. - -To re-install cert-manager without the webhook, run: - -.. code-block:: shell - - kubectl delete -f https://github.com/jetstack/cert-manager/releases/download/v0.11.0/cert-manager.yaml - - kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v0.11.0/cert-manager-no-webhook.yaml - -Once you have re-installed cert-manager, you should then -:doc:`restore your configuration `. - -.. _`cert-manager.yaml`: https://github.com/jetstack/cert-manager/releases/download/v0.11.0/cert-manager.yaml -.. _`cert-manager-no-webhook.yaml`: https://github.com/jetstack/cert-manager/releases/download/v0.11.0/cert-manager-no-webhook.yaml -.. _`GKE docs`: https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters#add_firewall_rules -.. _`ValidatingWebhookConfiguration`: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/ +This document has moved to https://cert-manager.netlify.com/docs/faq/webhook/. +This placeholder file will be removed in a later release. diff --git a/docs/index.rst b/docs/index.rst index 20817e0f5..5f4ecd1fa 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -1,43 +1,6 @@ -.. cert-manager documentation master file, created by - sphinx-quickstart on Sat Mar 24 10:03:16 2018. - You can adapt this file completely to your liking, but it should at least - contain the root `toctree` directive. +========== +File moved +========== -======================================== -Welcome to cert-manager's documentation! -======================================== - -cert-manager is a native Kubernetes_ certificate management controller. -It can help with issuing certificates from a variety of sources, such as -`Let's Encrypt`_, `HashiCorp Vault`_, `Venafi`_, a simple signing keypair, or self signed. - -It will ensure certificates are valid and up to date, and attempt to renew -certificates at a configured time before expiry. - -It is loosely based upon the work of kube-lego_ and has borrowed some wisdom -from other similar projects e.g. kube-cert-manager_. - -.. image:: images/high-level-overview.svg - :align: center - -This is the full technical documentation for the project, and should be used as -a source of references when seeking help with the project. - -.. toctree:: - :maxdepth: 2 - :titlesonly: - :caption: Contents: - - getting-started/index - tutorials/index - tasks/index - reference/index - design/index - devel/index - -.. _Kubernetes: https://kubernetes.io -.. _kube-lego: https://github.com/jetstack/kube-lego -.. _kube-cert-manager: https://github.com/PalmStoneGames/kube-cert-manager -.. _`Let's Encrypt`: https://letsencrypt.org -.. _`HashiCorp Vault`: https://www.vaultproject.io -.. _`Venafi`: https://www.venafi.com/ +This document has moved to https://cert-manager.netlify.com/docs/. +This placeholder file will be removed in a later release. diff --git a/docs/reference/api-docs/index.rst b/docs/reference/api-docs/index.rst index c8b844067..de16bcb58 100644 --- a/docs/reference/api-docs/index.rst +++ b/docs/reference/api-docs/index.rst @@ -1,3 +1,6 @@ -================= -API documentation -================= +========== +File moved +========== + +This document has moved to https://cert-manager.netlify.com/docs/reference/api-docs/. +This placeholder file will be removed in a later release. diff --git a/docs/reference/cainjector.rst b/docs/reference/cainjector.rst index 1a7626e4d..aa4b376c6 100644 --- a/docs/reference/cainjector.rst +++ b/docs/reference/cainjector.rst @@ -1,12 +1,6 @@ -===================== -cainjector controller -===================== +========== +File moved +========== -The cainjector controller injects a Certificate into the ``caBundle`` field -of ValidatingWebhookConfiguration, MutatingWebhookConfiguration or -APIService resources annotated with: - -* ``cert-manager.io/inject-apiserver-ca: "true"`` - Injects the cluster CA. -* ``cert-manager.io/inject-ca-from: /`` - Injects the CA from the specified :doc:`certificate `. +This document has moved to https://cert-manager.netlify.com/docs/concepts/ca-injector/. +This placeholder file will be removed in a later release. diff --git a/docs/reference/certificaterequests.rst b/docs/reference/certificaterequests.rst index 2629bd108..a78321040 100644 --- a/docs/reference/certificaterequests.rst +++ b/docs/reference/certificaterequests.rst @@ -1,68 +1,6 @@ -=================== -CertificateRequests -=================== +========== +File moved +========== -A 'CertificateRequest' is a resource in cert-manager that is used to request -x509 certificates from an issuer. The resource contains a base64 encoded string -of a PEM encoded certificate request which is sent to the referenced issuer. A -successful issuance will return a signed certificate, based on the certificate -signing request. 'CertificateRequests' are typically consumed and managed by -controllers or other systems and should not be used by humans - unless -specifically needed. - -A simple CertificateRequest looks like the following: - -.. code-block:: yaml - :linenos: - - apiVersion: cert-manager.io/v1alpha2 - kind: CertificateRequest - metadata: - name: my-ca-cr - spec: - csr: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQzNqQ0NBY1lDQVFBd2daZ3hDekFKQmdOVkJBWVRBbHBhTVE4d0RRWURWUVFJREFaQmNHOXNiRzh4RFRBTApCZ05WQkFjTUJFMXZiMjR4RVRBUEJnTlZCQW9NQ0VwbGRITjBZV05yTVJVd0V3WURWUVFMREF4alpYSjBMVzFoCmJtRm5aWEl4RVRBUEJnTlZCQU1NQ0dwdmMyaDJZVzVzTVN3d0tnWUpLb1pJaHZjTkFRa0JGaDFxYjNOb2RXRXUKZG1GdWJHVmxkWGRsYmtCcVpYUnpkR0ZqYXk1cGJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQwpBUW9DZ2dFQkFLd01tTFhuQkNiRStZdTIvMlFtRGsxalRWQ3BvbHU3TlZmQlVFUWl1bDhFMHI2NFBLcDRZQ0c5Cmx2N2kwOHdFMEdJQUgydnJRQmxVd3p6ZW1SUWZ4YmQvYVNybzRHNUFBYTJsY2NMaFpqUlh2NEVMaER0aVg4N3IKaTQ0MWJ2Y01OM0ZPTlRuczJhRkJYcllLWGxpNG4rc0RzTEVuZmpWdXRiV01Zeis3M3ptaGZzclRJUjRzTXo3cQpmSzM2WFM4UkRjNW5oVVcyYU9BZ3lnbFZSOVVXRkxXNjNXYXVhcHg2QUpBR1RoZnJYdVVHZXlZUUVBSENxZmZmCjhyOEt3YTFYK1NwYm9YK1ppSVE0Nk5jQ043OFZnL2dQVHNLZmphZURoNWcyNlk1dEVidHd3MWdRbWlhK0MyRHIKWHpYNU13RzJGNHN0cG5kUnRQckZrU1VnMW1zd0xuc0NBd0VBQWFBQU1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQgpBUUFXR0JuRnhaZ0gzd0N3TG5IQ0xjb0l5RHJrMUVvYkRjN3BJK1VVWEJIS2JBWk9IWEFhaGJ5RFFLL2RuTHN3CjJkZ0J3bmlJR3kxNElwQlNxaDBJUE03eHk5WjI4VW9oR3piN0FVakRJWHlNdmkvYTJyTVhjWjI1d1NVQmxGc28Kd005dE1QU2JwcEVvRERsa3NsOUIwT1BPdkFyQ0NKNnZGaU1UbS9wMUJIUWJSOExNQW53U0lUYVVNSFByRzJVMgpjTjEvRGNMWjZ2enEyeENjYVoxemh2bzBpY1VIUm9UWmV1ZEp6MkxmR0VHM1VOb2ppbXpBNUZHd0RhS3BySWp3ClVkd1JmZWZ1T29MT1dNVnFNbGRBcTlyT24wNHJaT3Jnak1HSE9tTWxleVdPS1AySllhaDNrVDdKU01zTHhYcFYKV0ExQjRsLzFFQkhWeGlKQi9Zby9JQWVsCi0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo= - isCA: false - duraton: 90d - issuerRef: - name: ca-issuer - # We can reference ClusterIssuers by changing the kind here. - # The default value is Issuer (i.e. a locally namespaced Issuer) - kind: Issuer - group: cert-manager.io - -This CertificateRequest will make cert-manager attempt to make the Issuer -``letsencrypt-prod`` in the default issuer pool ``cert-manager.io``, return a -certificate based upon the certificate signing request. Other groups can be -specified inside the ``issuerRef`` which will change the targeted issuers to other -external, third party issuers you may have installed. - -The resource also exposes the option for stating the certificate as CA and -requested validity duration. - -A successful issuance of the certificate signing request will cause an update to -the resource, setting the status with the signed certificate, the CA of the -certificate (if available), and setting the `Ready` condition to `True`. - -Whether issuance of the controller was successful or not, a retry of the -issuance will _not_ happen. It is the responsibility of some other controller to -manage the logic and life cycle of CertificateRequets. - ----------- -Conditions ----------- - -CertificateRequests have a set of strongly defined conditions that should be -used and relied upon by controllers or services to make decisions on what -actions to take next on the resource. Each condition consists of the pair -`Ready` - a boolean value, and `Reason` - a string. The set of values and -meanings are as follows: - -+---------+-----------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ -| *Ready* | *Reason* | Condition Meaning | -+=========+=================+===============================================================================================================================================================================================================================================+ -| False | Pending | The CertificateRequest is currently pending, waiting for some other operation to take place. This could be that the Issuer does not exist yet or the Issuer is in the process of issuing a certificate. | -+---------+-----------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ -| False | Failed | The certificate has failed to be issued - either the returned certificate failed to be decoded or an instance of the referenced issuer used for signing failed. No further action will be taken on the CertificateRequest by it's controller. | -+---------+-----------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ -| True | Issued | A signed certificate has been successfully issued by the referenced Issuer. | -+---------+-----------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ +This document has moved to https://cert-manager.netlify.com/docs/concepts/certificaterequest/. +This placeholder file will be removed in a later release. diff --git a/docs/reference/certificates.rst b/docs/reference/certificates.rst index 66cc59058..afb5992bf 100644 --- a/docs/reference/certificates.rst +++ b/docs/reference/certificates.rst @@ -1,149 +1,6 @@ -============ -Certificates -============ +========== +File moved +========== -cert-manager has the concept of 'Certificates' that define a desired X.509 -certificate. A Certificate is a namespaced resource that references an -Issuer or ClusterIssuer for information on how to obtain the certificate. - -A simple Certificate could be defined as: - -.. code-block:: yaml - :linenos: - :emphasize-lines: 17-20 - - apiVersion: cert-manager.io/v1alpha2 - kind: Certificate - metadata: - name: acme-crt - spec: - secretName: acme-crt-secret - dnsNames: - - foo.example.com - - bar.example.com - acme: - config: - - http01: - ingressClass: nginx - domains: - - foo.example.com - - bar.example.com - issuerRef: - name: letsencrypt-prod - # We can reference ClusterIssuers by changing the kind here. - # The default value is Issuer (i.e. a locally namespaced Issuer) - kind: Issuer - -This Certificate will tell cert-manager to attempt to use the Issuer -named ``letsencrypt-prod`` to obtain a certificate key pair for the -``foo.example.com`` and ``bar.example.com`` domains. If successful, the -resulting key and certificate will be stored in a secret named -``acme-crt-secret`` with keys of ``tls.key`` and ``tls.crt`` respectively. -This secret will live in the same namespace as the ``Certificate`` resource. - -The ``dnsNames`` field specifies a list of `Subject Alternative Names`_ to be -associated with the certificate. If the ``commonName`` field is omitted, the -first element in the list will be the common name. - -The referenced Issuer must exist in the same namespace as the Certificate. -A Certificate can alternatively reference a ClusterIssuer which is -non-namespaced. - -.. _`Subject Alternative Names`: https://en.wikipedia.org/wiki/Subject_Alternative_Name - -*************************************** -Certificate Duration and Renewal Window -*************************************** - -cert-manager Certificate resources also support custom validity durations and -renewal windows. - -**Important**: The backend service implementation can choose to generate a -certificate with a different validity period than what is requested in the -issuer. - -Although the duration and renewal periods are specified on the Certificate -resources, the corresponding Issuer or ClusterIssuer must support this. - -The table below shows the support state of the different backend services used -by issuer types: - -=========== ============================================================ -Issuer Description -=========== ============================================================ -ACME Only 'renewBefore' supported -CA Fully supported -Vault Fully supported (although the requested duration must be lower - than the configured Vault role's TTL) -Self Signed Fully supported -Venafi Fully supported -=========== ============================================================ - -The default duration for all certificates is 90 days and the default renewal -windows is 30 days. This means that certificates are considered valid for 3 -months and renewal will be attempted within 1 month of expiration. - -The *duration* and *renewBefore* parameters must be given in the golang `parseDuration string format `__. - -Example Usage -============= -Here an example of an issuer specifying the duration and renewal window. - -The certificate from the previous section is extended with a validity period of -24 hours and to begin trying to renew 12 hours before the certificate -expiration. - - .. code-block:: yaml - :linenos: - :emphasize-lines: 7,8 - - apiVersion: cert-manager.io/v1alpha2 - kind: Certificate - metadata: - name: example - spec: - secretName: example-tls - duration: 24h - renewBefore: 12h - dnsNames: - - foo.example.com - - bar.example.com - issuerRef: - name: my-internal-ca - kind: Issuer - -************************ -Certificate Key Encoding -************************ - -cert-manager Certificate resources support two types of key encodings -for its private key known as the private key cryptography standards (PKCS). -The two key encodings are PKCS#1 and PKCS#8. - -The default encoding is PKCS#1, if the `keyEncoding` field of the Certificate spec is left empty. - -A limitation exists where once a Certificate resource is generated with a -specific key encoding, it cannot be generated with a different key encoding. - -Example Usage -============= -Here is an example of a Certificate specifying the use of PKCS#8 encoding on -its private key. - - .. code-block:: yaml - :linenos: - :emphasize-lines: 7 - - apiVersion: cert-manager.io/v1alpha2 - kind: Certificate - metadata: - name: example-pkcs8-cert - spec: - secretName: example-pkcs8-secret - keyEncoding: pkcs8 - dnsNames: - - foo.example.com - - bar.example.com - issuerRef: - name: my-internal-ca - kind: Issuer +This document has moved to https://cert-manager.netlify.com/docs/concepts/certificate/. +This placeholder file will be removed in a later release. diff --git a/docs/reference/challenges.rst b/docs/reference/challenges.rst index 1dded7b96..49175135e 100644 --- a/docs/reference/challenges.rst +++ b/docs/reference/challenges.rst @@ -1,119 +1,6 @@ ========== -Challenges +File moved ========== -Challenge resources are used by the ACME issuer to manage the lifecycle of an -ACME 'challenge' that must be completed in order to complete an 'authorization' -for a single DNS name/identifier. - -When an **Order** resource is created, the order controller will create -Challenge resources for each DNS name that is being authorized with the ACME -server. - -As an end-user, you will never need to manually create a Challenge resource. -Once created, a Challenge cannot be changed. Instead, a new Challenge resource -must be created. - -Challenge lifecycle -=================== - -After a Challenge resource has been created, it will be initially queued for -processing. -Processing will not begin until the challenge has been 'scheduled' to start. -This scheduling process prevents too many challenges being attempted at once, -or multiple challenges for the same DNS name being attempted at once. -For more information on how challenges are scheduled, read the -`challenge scheduling`_ section. - -Once a challenge has been scheduled, it will first be 'synced' with the ACME -server in order to determine its current state. If the challenge is already -valid, its 'state' will be updated to 'valid', and also set -``status.processing = false`` to 'unschedule' itself. - -If the challenge is still 'pending', the challenge controller will 'present' -the challenge using the configured solver, one of HTTP01 or DNS01. -Once the challenge has been 'presented', it will set ``status.presented=true``. - -Once 'presented', the challenge controller will perform a 'self check' to -ensure that the challenge has 'propagated' (i.e. the authoritve DNS servers -have been updated to respond correctly, or the changes to the ingress resources -have been observed and in-use by the ingress controller). - -If the self check fails, cert-manager will retry the self check with a fixed -10 second retry interval. Challenges that do not ever complete the self check -will continue retrying until the user intervenes. - -Once the self check is passing, the ACME 'authorization' associated with this -challenge will be 'accepted' (TODO: add link to accepting challenges section of -ACME spec). - -The final state of the authorization after accepting it will be copied across -to the Challenge's ``status.state`` field, as well as the 'error reason' if -an error occurred whilst the ACME server attempted to validate the challenge. - -Once a Challenge has entered the ``valid``, ``invalid``, ``expired`` or -``revoked`` state, it will set ``status.processing=false`` to prevent any -further processing of the ACME challenge, and to allow another challenge to be -scheduled if there is a backlog of challenges to complete. - -Challenge scheduling -==================== - -Instead of attempting to process all challenges at once, challenges are -'scheduled' by cert-manager. - -This scheduler applies a cap on the maximum number of simultaneous challenges -as well as disallows two challenges for the same DNS name and solver type -(http-01 or dns-01) to be completed at once. - -The maximum number of challenges that can be processed at a time is 60 as of -ddff78_. - -Debugging Challenge resources -============================= - -In order to determine why an ACME Certificate is not being issued, we can debug -using the 'Challenge' resources that cert-manager has created. - -In order to determine which Challenge is failing, you can run -``kubectl get challenges``: - -.. code-block:: shell - - $ kubectl get challenges - - NAME STATE DOMAIN REASON AGE - example-com-1217431265-0 pending example.com Waiting for dns-01 challenge propagation 22s - -This shows that the challenge has been presented using the DNS01 solver -successfully and now cert-manager is waiting for the 'self check' to pass. - -You can get more information about the challenge by using ``kubectl describe``: - -.. code-block:: shell - - $ kubectl describe challenge example-com-1217431265-0 - - ... - Status: - Presented: true - Processing: true - Reason: Waiting for dns-01 challenge propagation - State: pending - Events: - Type Reason Age From Message - ---- ------ ---- ---- ------- - Normal Started 19s cert-manager Challenge scheduled for processing - Normal Presented 16s cert-manager Presented challenge using dns-01 challenge mechanism - -Progress about the state of each challenge will be recorded either as Events -or on the Challenge's ``status`` block (as shown above). - -Troubleshooting failing challenges -================================== - -.. todo:: - add section describing common issues and resolutions when challenges are - failing - -.. _ddff78: https://github.com/jetstack/cert-manager/blob/ddff78f011558e64186d61f7c693edced1496afa/pkg/controller/acmechallenges/scheduler/scheduler.go#L31-L33 +This document has moved to https://cert-manager.netlify.com/docs/concepts/acme-orders-challenges/. +This placeholder file will be removed in a later release. diff --git a/docs/reference/clusterissuers.rst b/docs/reference/clusterissuers.rst index 76460a168..24d45ff1b 100644 --- a/docs/reference/clusterissuers.rst +++ b/docs/reference/clusterissuers.rst @@ -1,50 +1,6 @@ -============== -ClusterIssuers -============== +========== +File moved +========== -ClusterIssuers are a resource type similar to :doc:`Issuers `. -They are specified in exactly the same way, but they do not belong to a single -namespace and can be referenced by Certificate resources from multiple different -namespaces. - -They are particularly useful when you want to provide the ability to obtain -certificates from a central authority (e.g. Letsencrypt, or your internal CA) -and you run single-tenant clusters. - -The docs for Issuer resources apply equally to ClusterIssuers. - -You can specify a ClusterIssuer resource by changing the ``kind`` attribute of -an Issuer to ``ClusterIssuer``, and removing the ``metadata.namespace`` attribute: - -.. code-block:: yaml - :emphasize-lines: 2 - - apiVersion: cert-manager.io/v1alpha2 - kind: ClusterIssuer - metadata: - name: letsencrypt-prod - spec: - ... - -We can then reference a ClusterIssuer from a Certificate resource by setting -the ``spec.issuerRef.kind`` field to ClusterIssuer: - -.. code-block:: yaml - :emphasize-lines: 10 - - apiVersion: cert-manager.io/v1alpha2 - kind: Certificate - metadata: - name: my-certificate - namespace: my-namespace - spec: - secretName: my-certificate-secret - issuerRef: - name: letsencrypt-prod - kind: ClusterIssuer - ... - -When referencing a ``Secret`` resource in ``ClusterIssuer`` resources (eg ``apiKeySecretRef``) the ``Secret`` needs to be in the same namespace as the ``cert-manager`` controller pod. You can optionally override this by using the ``--cluster-resource-namespace`` argument to the controller. - -For more information on configuring Issuer resources, see the :doc:`Issuers ` -reference documentation. +This document has moved to https://cert-manager.netlify.com/docs/concepts/issuer/. +This placeholder file will be removed in a later release. diff --git a/docs/reference/index.rst b/docs/reference/index.rst index d6b6d1a78..2802be62f 100644 --- a/docs/reference/index.rst +++ b/docs/reference/index.rst @@ -1,22 +1,6 @@ -Reference documentation -======================= +========== +File moved +========== -This section contains detailed reference documentation about cert-manager's -types and how it operates. It also includes some simple example configurations -in order to help users activate advanced functionality of cert-manager. - -Step by step user guides and tutorials can be found in the -:doc:`tutorials ` section. - -.. toctree:: - :maxdepth: 2 - :caption: Contents: - - certificates - certificaterequests - orders - challenges - issuers - clusterissuers - cainjector - api-docs/index +This document has moved to https://cert-manager.netlify.com/docs/concepts/. +This placeholder file will be removed in a later release. diff --git a/docs/reference/issuers.rst b/docs/reference/issuers.rst index 88e7af994..24d45ff1b 100644 --- a/docs/reference/issuers.rst +++ b/docs/reference/issuers.rst @@ -1,148 +1,6 @@ -======= -Issuers -======= +========== +File moved +========== -Issuers (and :doc:`ClusterIssuers `) represent a -certificate authority from which signed x509 certificates can be obtained, such -as `Let's Encrypt`_. You will need at least one Issuer or ClusterIssuer in -order to begin issuing certificates within your cluster. - -An example of an Issuer type is ACME. A simple ACME issuer could be defined as: - -.. code-block:: yaml - :linenos: - :emphasize-lines: 11, 20 - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: letsencrypt-prod - namespace: edge-services - spec: - acme: - # The ACME server URL - server: https://acme-v02.api.letsencrypt.org/directory - # Email address used for ACME registration - email: user@example.com - # Name of a secret used to store the ACME account private key - privateKeySecretRef: - name: letsencrypt-prod - solvers: - # An empty 'selector' means that this solver matches all domains - - selector: {} - http01: - ingress: - class: nginx - - -This is the simplest of ACME issuers - it specifies no DNS-01 challenge -providers. HTTP-01 validation can be performed through using Ingress -resources by enabling the HTTP-01 challenge mechanism (with the ``http01: {}`` -field). -More information on configuring ACME Issuers can be found :doc:`here `. - -*********** -Namespacing -*********** - -An Issuer is a namespaced resource, and it is not possible to issue -certificates from an Issuer in a different namespace. This means you will need -to create an Issuer in each namespace you wish to obtain Certificates in. - -If you want to create a single issuer than can be consumed in multiple -namespaces, you should consider creating a :doc:`ClusterIssuer ` -resource. This is almost identical to the Issuer resource, however is -non-namespaced and so it can be used to issue Certificates across all namespaces. - -******************* -Ambient Credentials -******************* - -Some API clients are able to infer credentials to use from the environment they -run within. Notably, this includes cloud instance-metadata stores and -environment variables. -In cert-manager, the term 'ambient credentials' refers to such credentials. -They are always drawn from the environment of the 'cert-manager-controller' -deployment. - -Example Usage -============= - -If cert-manager is deployed in an environment with ambient AWS credentials, -such as with a kube2iam_ role, the following ClusterIssuer would make use of -those credentials to perform the ACME DNS01 challenge with route53. - -.. code-block:: yaml - :linenos: - :emphasize-lines: 17-18 - - apiVersion: cert-manager.io/v1alpha2 - kind: ClusterIssuer - metadata: - name: letsencrypt-prod - spec: - acme: - server: https://acme-v02.api.letsencrypt.org/directory - email: user@example.com - privateKeySecretRef: - name: letsencrypt-prod - solvers: - # An empty 'selector' means that this solver matches all domains - - selector: {} - dns01: - providers: - - name: route53 - route53: - region: us-east-1 - -It is important to note that the ``route53`` section does not specify any -``accessKeyID`` or ``secretAccessKeySecretRef``. If either of these are -specified, ambient credentials will not be used. - -When are Ambient Credentials used -================================= - -Ambient credentials are supported for the 'route53' ACME DNS01 challenge -provider. - -They will only be used if no credentials are supplied, even if the supplied -credentials are invalid. - -By default, ambient credentials may be used by ClusterIssuers, but not regular -issuers. The ``--issuer-ambient-credentials`` and -``--cluster-issuer-ambient-credentials=false`` flags on cert-manager may be -used to override this behavior. - -Note that ambient credentials are disabled for regular Issuers by default to -ensure unprivileged users who may create issuers cannot issue certificates -using any credentials cert-manager incidentally has access to. - -********************** -Supported Issuer types -********************** - -cert-manager has been designed to support pluggable Issuer backends. The -currently supported Issuer types are: - -+------------------------------------------------------+----------------------------------------------------------------------+ -| Name | Description | -+======================================================+======================================================================+ -| :doc:`ACME ` | Supports obtaining certificates from an ACME server, validating with | -| | HTTP01 or DNS01 | -+------------------------------------------------------+----------------------------------------------------------------------+ -| :doc:`CA ` | Supports issuing certificates using a simple signing keypair, stored | -| | in a Secret in the Kubernetes API server | -+------------------------------------------------------+----------------------------------------------------------------------+ -| :doc:`Vault ` | Supports issuing certificates using HashiCorp Vault. | -+------------------------------------------------------+----------------------------------------------------------------------+ -| :doc:`Self signed ` | Supports issuing self signed certificates | -+------------------------------------------------------+----------------------------------------------------------------------+ -| :doc:`Venafi ` | Supports issuing certificates from Venafi Cloud & TPP | -+------------------------------------------------------+----------------------------------------------------------------------+ - -Each Issuer resource is of one, and only one type. The type of an Issuer is -inferred by which field it specifies in its spec, such as ``spec.acme`` -for the ACME issuer, or ``spec.ca`` for the CA based issuer. - -.. _`Let's Encrypt`: https://letsencrypt.org -.. _kube2iam: https://github.com/jtblin/kube2iam +This document has moved to https://cert-manager.netlify.com/docs/concepts/issuer/. +This placeholder file will be removed in a later release. diff --git a/docs/reference/orders.rst b/docs/reference/orders.rst index a6f1ef611..49175135e 100644 --- a/docs/reference/orders.rst +++ b/docs/reference/orders.rst @@ -1,82 +1,6 @@ -====== -Orders -====== +========== +File moved +========== -Order resources are used by the ACME issuer to manage the lifecycle of an ACME -'order' for a signed TLS certificate. - -When a Certificate resource is created that references an ACME issuer, -cert-manager will create an Order resource in order to obtain a signed -certificate. - -As an end-user, you will never need to manually create an Order resource. -Once created, an Order cannot be changed. Instead, a new Order resource must be -created. - -Debugging Order resources -========================= - -In order to debug why a Certificate isn't being issued, we can first run -``kubectl describe`` on the Certificate resource we're having issues with: - -.. code-block:: shell - - $ kubectl describe certificate example-com - - ... - Events: - Type Reason Age From Message - ---- ------ ---- ---- ------- - Normal Generated 1m cert-manager Generated new private key - Normal OrderCreated 1m cert-manager Created Order resource "example-com-1217431265" - -We can see here that Certificate controller has created an Order resource to -request a new certificate from the ACME server. - -Orders are a useful source of information when debugging failures issuing ACME -certificates. By running ``kubectl describe order`` on a particular order, -information can be gleaned about failures in the process: - -.. code-block:: shell - - $ kubectl describe order example-com-1248919344 - - ... - Reason: - State: pending - URL: https://acme-v02.api.letsencrypt.org/acme/order/41123272/265506123 - Events: - Type Reason Age From Message - ---- ------ ---- ---- ------- - Normal Created 1m cert-manager Created Challenge resource "example-com-1217431265-0" for domain "test1.example.com" - Normal Created 1m cert-manager Created Challenge resource "example-com-1217431265-1" for domain "test2.example.com" - -Here we can see that cert-manager has created two Challenge resources in order -to fulfil the requirements of the ACME order to obtain a signed certificate. - -You can then go on to run -``kubectl describe challenge example-com-1217431265-0`` to further debug the -progress of the Order. - -Once an Order is successful, you should see an event like the following: - -.. code-block:: shell - - $ kubectl describe order example-com-1248919344 - - ... - Reason: - State: valid - URL: https://acme-v02.api.letsencrypt.org/acme/order/41123272/265506123 - Events: - Type Reason Age From Message - ---- ------ ---- ---- ------- - Normal Created 72s cert-manager Created Challenge resource "example-com-1217431265-0" for domain "test1.example.com" - Normal Created 72s cert-manager Created Challenge resource "example-com-1217431265-1" for domain "test2.example.com" - Normal OrderValid 4s cert-manager Order completed successfully - -If the Order is not completing successfully, you can debug the challenges -for the Order by running ``kubectl describe`` on the Challenge resource. - -For more information on debugging Challenge resources, read the -:doc:`challenge reference docs `. +This document has moved to https://cert-manager.netlify.com/docs/concepts/acme-orders-challenges/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/backup-restore-crds.rst b/docs/tasks/backup-restore-crds.rst index b837ec021..65bd8176a 100644 --- a/docs/tasks/backup-restore-crds.rst +++ b/docs/tasks/backup-restore-crds.rst @@ -1,55 +1,6 @@ -======================== -Backing up and restoring -======================== - -If you need to uninstall cert-manager, or transfer your installation to a new -cluster, you can backup all of cert-manager's configuration in order to -later re-install. - -Backing up +========== +File moved ========== -To backup all of your cert-manager configuration resources, run: - -.. code-block:: shell - - kubectl get -o yaml \ - --all-namespaces \ - issuer,clusterissuer,certificates,orders,challenges,certificaterequests > cert-manager-backup.yaml - -If you are transferring data to a new cluster, you may also need to copy across -additional Secret resources that are referenced by your configured Issuers, -such as: - -CA Issuers ----------- - -* The root CA Secret referenced by ``issuer.spec.ca.secretName`` - -Vault Issuers -------------- - -* The token authentication Secret referenced by - ``issuer.spec.vault.auth.tokenSecretRef`` -* The approle configuration Secret referenced by - ``issuer.spec.vault.auth.appRole.secretRef`` - -ACME Issuers ------------- - -* The ACME account private key Secret referenced by ``issuer.acme.privateKeySecretRef`` -* Any Secrets referenced by DNS providers configured under the - ``issuer.acme.dns01.providers`` and ``issuer.acme.solvers.dns01`` fields. - -Restoring -========= - -In order to restore your configuration, you can simply ``kubectl apply`` the -files created above after installing cert-manager. - -.. code-block:: shell - - kubectl apply -f cert-manager-backup.yaml - -If you have migrated from an old cluster, you will need to make sure to run a -similar ``kubectl apply`` command to restore your Secret resources too. +This document has moved to https://cert-manager.netlify.com/docs/tutorials/backup/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/index.rst b/docs/tasks/index.rst index e7851f47a..8e12991bb 100644 --- a/docs/tasks/index.rst +++ b/docs/tasks/index.rst @@ -1,16 +1,6 @@ -===== -Tasks -===== +========== +File moved +========== -This section contains guides on using specific features of cert-manager, such -as configuring different Issuer types and any special settings that you may -want to configure. - -.. toctree:: - :maxdepth: 2 - - issuers/index - issuing-certificates/index - backup-restore-crds - uninstall/index - upgrading/index +This document has moved to https://cert-manager.netlify.com/docs/configuration/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/issuers/index.rst b/docs/tasks/issuers/index.rst index 380c6c033..8e12991bb 100644 --- a/docs/tasks/issuers/index.rst +++ b/docs/tasks/issuers/index.rst @@ -1,83 +1,6 @@ -================== -Setting up Issuers -================== +========== +File moved +========== -Before you can begin issuing certificates, you must configure at least one -Issuer or ClusterIssuer resource in your cluster. - -These represent a certificate authority from which signed x509 certificates can -be obtained, such as Let's Encrypt, or your own signing key pair stored in a -Kubernetes Secret resource. They are referenced by Certificate resources in -order to request certificates from them. - -An :doc:`Issuer ` is scoped to a single namespace, and can -only fulfill :doc:`Certificate ` resources within its -own namespace. This is useful in a multi-tenant environment where multiple -teams or independent parties operate within a single cluster. - -On the other hand, a :doc:`ClusterIssuer ` is a -cluster wide version of an :doc:`Issuer `. It is able to be -referenced by :doc:`Certificate ` resources in any -namespace. - -Users often create ``letsencrypt-staging`` and ``letsencrypt-prod`` -:doc:`ClusterIssuers ` if they operate a -single-tenant environment and want to expose a cluster-wide mechanism for -obtaining TLS certificates from `Let's Encrypt`_. - -Supported issuer types -====================== - -cert-manager supports a number of different issuer backends, each with their -own different types of configuration. - -Please follow one of the below linked guides to learn how to set up the issuer -types you require: - -* :doc:`CA <./setup-ca>` - issue certificates signed by a X509 signing keypair, - stored in a Secret in the Kubernetes API server. -* :doc:`Self signed <./setup-selfsigned>` - issue self signed certificates. -* :doc:`ACME <./setup-acme/index>` - issue certificates obtained by performing - challenge validations against an ACME server such as `Let's Encrypt`_. -* :doc:`Vault <./setup-vault>`- issue certificates from a Vault instance - configured with the `Vault PKI backend`_. -* :doc:`Venafi <./setup-venafi>` - issue certificates from a Venafi_ Cloud - or Trust Protection Platform instance. - -Additional information -====================== - -There are a few key things to know about Issuers, but for full information -you can refer to the :doc:`Issuer reference docs `. - -.. _issuer_vs_clusterissuer: - -Difference between Issuers and ClusterIssuers ---------------------------------------------- - -ClusterIssuers are a resource type similar to :doc:`Issuers `. -They are specified in exactly the same way, but they do not belong to a single -namespace and can be referenced by Certificate resources from multiple different -namespaces. - -They are particularly useful when you want to provide the ability to obtain -certificates from a central authority (e.g. Letsencrypt, or your internal CA) -and you run single-tenant clusters. - -The resource spec is identical, and you should set the -``certificate.spec.issuerRef.kind`` field to ClusterIssuer when creating your -Certificate resources. - -.. toctree:: - :maxdepth: 2 - :caption: Contents: - - setup-acme/index - setup-ca - setup-selfsigned - setup-vault - setup-venafi - -.. _`Let's Encrypt`: https://letsencrypt.org -.. _`Vault PKI backend`: https://www.vaultproject.io/docs/secrets/pki/index.html -.. _Venafi: https://venafi.com +This document has moved to https://cert-manager.netlify.com/docs/configuration/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/issuers/setup-acme/dns01/acme-dns.rst b/docs/tasks/issuers/setup-acme/dns01/acme-dns.rst index f2601e5e3..bda3ea549 100644 --- a/docs/tasks/issuers/setup-acme/dns01/acme-dns.rst +++ b/docs/tasks/issuers/setup-acme/dns01/acme-dns.rst @@ -1,103 +1,6 @@ -========================= -ACME-DNS -========================= +========== +File moved +========== -.. code-block:: yaml - :emphasize-lines: 10-14 - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: example-issuer - spec: - acme: - ... - solvers: - - dns01: - acmedns: - host: https://acme.example.com - accountSecretRef: - name: acme-dns - key: acmedns.json - -In general, clients to acme-dns perform registration on the users behalf and inform -them of the CNAME entries they must create. This is not possible in cert-manager, it -is a non-interactive system. Registration must be carried out beforehand and the resulting -credentials JSON uploaded to the cluster as a secret. In this example, we use ``curl`` and the -API endpoints directly. Information about setting up and configuring acme-dns is available on -the `acme-dns project page `_. - -1. First, register with the acme-dns server, in this example, there is one running at "auth.example.com" - - ``curl -X POST http://auth.example.com/register`` will return a JSON with credentials for your registration: - - .. code-block :: json - - { - "username":"eabcdb41-d89f-4580-826f-3e62e9755ef2", - "password":"pbAXVjlIOE01xbut7YnAbkhMQIkcwoHO0ek2j4Q0", - "fulldomain":"d420c923-bbd7-4056-ab64-c3ca54c9b3cf.auth.example.com", - "subdomain":"d420c923-bbd7-4056-ab64-c3ca54c9b3cf", - "allowfrom":[] - } - - It is strongly recommended to restrict the update endpoint to the IP range of your pods. - This is done at registration time as follows: - - ``curl -X POST http://auth.example.com/register -H "Content-Type: application/json" --data '{"allowfrom": ["10.244.0.0/16"]}'`` - - Make sure to update the ``allowfrom`` field to match your cluster configuration. The JSON will now look like - - .. code-block :: json - - { - "username":"eabcdb41-d89f-4580-826f-3e62e9755ef2", - "password":"pbAXVjlIOE01xbut7YnAbkhMQIkcwoHO0ek2j4Q0", - "fulldomain":"d420c923-bbd7-4056-ab64-c3ca54c9b3cf.auth.example.com", - "subdomain":"d420c923-bbd7-4056-ab64-c3ca54c9b3cf", - "allowfrom":["10.244.0.0/16"] - } - -2. Save this JSON to a file with the key as your domain. You can specify multiple domains with the same credentials - if you like. In our example, the returned credentials can be used to verify ownership of "example.com" and - and "example.org". - - .. code-block :: json - - { - "example.com": { - "username":"eabcdb41-d89f-4580-826f-3e62e9755ef2", - "password":"pbAXVjlIOE01xbut7YnAbkhMQIkcwoHO0ek2j4Q0", - "fulldomain":"d420c923-bbd7-4056-ab64-c3ca54c9b3cf.auth.example.com", - "subdomain":"d420c923-bbd7-4056-ab64-c3ca54c9b3cf", - "allowfrom":["10.244.0.0/16"] - }, - "example.org": { - "username":"eabcdb41-d89f-4580-826f-3e62e9755ef2", - "password":"pbAXVjlIOE01xbut7YnAbkhMQIkcwoHO0ek2j4Q0", - "fulldomain":"d420c923-bbd7-4056-ab64-c3ca54c9b3cf.auth.example.com", - "subdomain":"d420c923-bbd7-4056-ab64-c3ca54c9b3cf", - "allowfrom":["10.244.0.0/16"] - } - } - -3. Next update your primary DNS server with CNAME record that will tell the verifier how to locate the challenge TXT - record. This is obtained from the "fulldomain" field in the registration: - - ``_acme-challenge.example.com CNAME d420c923-bbd7-4056-ab64-c3ca54c9b3cf.auth.example.com`` - ``_acme-challenge.example.org CNAME d420c923-bbd7-4056-ab64-c3ca54c9b3cf.auth.example.com`` - - Note that the "name" of the record is always the "_acme-challenge" subdomain, and the "value" of the record matches - exactly the "fulldomain" field from registration. - - At verification time, the domain name ``d420c923-bbd7-4056-ab64-c3ca54c9b3cf.auth.example.com`` will be a TXT - record that is set to your validation token. When the verifier queries ``_acme-challenge.example.com``, it will - be directed to the correct location by this CNAME record. This proves that you control "example.com" - -4. Create a secret from the credentials json that was saved in step 2, this secret is referenced - in the ``accountSecretRef`` field of your dns01 issuer settings. - - ``kubectl create secret generic acme-dns --from-file acmedns.json`` - - -.. _`Let's Encrypt`: https://letsencrypt.org +This document has moved to https://cert-manager.netlify.com/docs/configuration/acme/dns01/acme-dns/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/issuers/setup-acme/dns01/akamai.rst b/docs/tasks/issuers/setup-acme/dns01/akamai.rst index f84bf7fac..467bc2503 100644 --- a/docs/tasks/issuers/setup-acme/dns01/akamai.rst +++ b/docs/tasks/issuers/setup-acme/dns01/akamai.rst @@ -1,27 +1,6 @@ -========================= -Akamai FastDNS -========================= +========== +File moved +========== -.. code-block:: yaml - :emphasize-lines: 10-20 - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: example-issuer - spec: - acme: - ... - solvers: - - dns01: - akamai: - serviceConsumerDomain: akab-tho6xie2aiteip8p-poith5aej0ughaba.luna.akamaiapis.net - clientTokenSecretRef: - name: akamai-dns - key: clientToken - clientSecretSecretRef: - name: akamai-dns - key: clientSecret - accessTokenSecretRef: - name: akamai-dns - key: accessToken +This document has moved to https://cert-manager.netlify.com/docs/configuration/acme/dns01/akamai/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/issuers/setup-acme/dns01/azuredns.rst b/docs/tasks/issuers/setup-acme/dns01/azuredns.rst index d3a730e41..838462c45 100644 --- a/docs/tasks/issuers/setup-acme/dns01/azuredns.rst +++ b/docs/tasks/issuers/setup-acme/dns01/azuredns.rst @@ -1,70 +1,6 @@ -========================= -AzureDNS -========================= +========== +File moved +========== -Configuring the AzureDNS DNS-01 Challenge for a Kubernetes cluster requires creating a service principal in Azure. - -For security purposes, it is appropriate to utilize RBAC to ensure that you properly maintain access control to your resources in Azure. The service principal that is generated by this tutorial has fine grained access to ONLY the DNS Zone in the specific resource group specified. It requires this permission so that it can read/write the _acme_challenge TXT records to the zone. - -To create the service principal you can use the following script (requires ``azure-cli`` and ``jq``): - -.. code-block:: bash - :linenos: - - AZURE_CERT_MANAGER_SP_NAME=SOME_SERVICE_PRINCIPAL_NAME - AZURE_CERT_MANAGER_DNS_RESOURCE_GROUP=SOME_RESOURCE_GROUP - AZURE_CERT_MANAGER_DNS_NAME=SOME_DNS_ZONE - - DNS_SP=$(az ad sp create-for-rbac --name $AZURE_CERT_MANAGER_SP_NAME) - AZURE_CERT_MANAGER_SP_APP_ID=$(echo $DNS_SP | jq -r '.appId') - AZURE_CERT_MANAGER_SP_PASSWORD=$(echo $DNS_SP | jq -r '.password') - - # Lower the Permissions of the SP - az role assignment delete --assignee $AZURE_CERT_MANAGER_SP_APP_ID --role Contributor - - # Give Access to DNS Zone - DNS_ID=$(az network dns zone show --name $AZURE_CERT_MANAGER_DNS_NAME --resource-group $AZURE_CERT_MANAGER_DNS_RESOURCE_GROUP --query "id" --output tsv) - - az role assignment create --assignee $AZURE_CERT_MANAGER_SP_APP_ID --role "DNS Zone Contributor" --scope $DNS_ID - - # Check Permissions - az role assignment list --assignee $AZURE_CERT_MANAGER_SP_APP_ID - - # Create Secret - kubectl create secret generic azuredns-config \ - --from-literal=CLIENT_SECRET=$AZURE_CERT_MANAGER_SP_PASSWORD - - # Get the Service Principal App ID for configuration - echo "Principal: $AZURE_CERT_MANAGER_SP_APP_ID" - echo "Password: $AZURE_CERT_MANAGER_SP_PASSWORD" - -You can configure the issuer like so: - -.. code-block:: yaml - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: example-issuer - spec: - acme: - ... - solvers: - - dns01: - azuredns: - # Service principal clientId (also called appId) - clientID: AZURE_SERVICE_PRINCIPAL_ID - # A secretKeyRef to a service principal ClientSecret (password) - # ref: https://docs.microsoft.com/en-us/azure/container-service/kubernetes/container-service-kubernetes-service-principal - clientSecretSecretRef: - name: AZUREDNS_SECRET_KEY_NAME - key: CLIENT_SECRET - # Azure subscription Id - subscriptionID: AZURE_SUBSCRIPTION_ID - # Azure AD tenant Id - tenantID: AZURE_TENANT_ID - # ResourceGroup name where dns zone is provisioned - resourceGroupName: AZURE_RESOURCE_GROUP - hostedZoneName: AZURE_DNS_ZONE_NAME - # Azure Cloud Environment, default to AzurePublicCloud - environment: AZURE_ENVIRONMENT +This document has moved to https://cert-manager.netlify.com/docs/configuration/acme/dns01/azuredns/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/issuers/setup-acme/dns01/cloudflare.rst b/docs/tasks/issuers/setup-acme/dns01/cloudflare.rst index 259a1cc2a..0a6a6935c 100644 --- a/docs/tasks/issuers/setup-acme/dns01/cloudflare.rst +++ b/docs/tasks/issuers/setup-acme/dns01/cloudflare.rst @@ -1,21 +1,6 @@ -========================= -Cloudflare -========================= +========== +File moved +========== -.. code-block:: yaml - :emphasize-lines: 10-14 - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: example-issuer - spec: - acme: - ... - solvers: - - dns01: - cloudflare: - email: my-cloudflare-acc@example.com - apiKeySecretRef: - name: cloudflare-api-key-secret - key: api-key +This document has moved to https://cert-manager.netlify.com/docs/configuration/acme/dns01/cloudflare/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/issuers/setup-acme/dns01/digitalocean.rst b/docs/tasks/issuers/setup-acme/dns01/digitalocean.rst index 1f1621e7f..3b23ece07 100644 --- a/docs/tasks/issuers/setup-acme/dns01/digitalocean.rst +++ b/docs/tasks/issuers/setup-acme/dns01/digitalocean.rst @@ -1,28 +1,6 @@ -========================= -DigitalOcean -========================= +========== +File moved +========== -This provider uses a Kubernetes ``Secret`` Resource to work. In the -following example, the secret will have to be named ``digitalocean-dns`` -and have a subkey ``access-token`` with the token in it. - -To create a Personnal Access Token, see `DigitalOcean documentation `_. -Handy direct link: https://cloud.digitalocean.com/account/api/tokens/new - - -.. code-block:: yaml - :emphasize-lines: 10-13 - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: example-issuer - spec: - acme: - ... - solvers: - - dns01: - digitalocean: - tokenSecretRef: - name: digitalocean-dns - key: access-token +This document has moved to https://cert-manager.netlify.com/docs/configuration/acme/dns01/digitalocean/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/issuers/setup-acme/dns01/google.rst b/docs/tasks/issuers/setup-acme/dns01/google.rst index 6371a48d0..1dc5babb7 100644 --- a/docs/tasks/issuers/setup-acme/dns01/google.rst +++ b/docs/tasks/issuers/setup-acme/dns01/google.rst @@ -1,101 +1,6 @@ -========================= -Google CloudDNS -========================= +========== +File moved +========== -This guide explains how to set up an Issuer, or ClusterIssuer, to use Google CloudDNS to solve DNS01 ACME challenges. It's advised you read the :doc:`DNS01 Challenge Provider <./index>` page first for a more general understanding of how cert-manager handles DNS01 challenges. - -.. note:: - This guide assumes that your cluster is hosted on Google Cloud Platform (GCP) and that you already have a domain set up with CloudDNS. - -Set up a Service Account -======================== - -Cert-manager needs to be able to add records to CloudDNS in order to solve the DNS01 challenge. To enable this, a GCP service account must be created with the ``dns.admin`` role. - -.. note:: - For this guide the ``gcloud`` command will be used to set up the service account. Ensure that ``gcloud`` is in using the correct project and zone before entering the commands. These steps could also be completed using the Cloud Console. - -.. code-block:: shell - export PROJECT_ID=myproject-id - gcloud iam service-accounts create dns01-solver \ - --display-name "dns01-solver" - # Replace both uses of project-id with the id of your project - gcloud projects add-iam-policy-binding $PROJECT_ID \ - --member serviceAccount:dns01-solver@$PROJECT_ID.iam.gserviceaccount.com \ - --role roles/dns.admin - -Create a Service Account Secret -=============================== - -To access this service account cert-manager uses a key stored in a Kubernetes Secret. First, create a key for the service account and download it as JSON file, then create a Secret from this file. - -If you did not create the service "dns01-solver" account before, you need to create it first: - -.. code-block:: shell - - gcloud iam service-accounts create dns01-solver - -.. code-block:: shell - - # Replace use of project-id with the id of your project - gcloud iam service-accounts keys create key.json \ - --iam-account dns01-solver@$PROJECT_ID.iam.gserviceaccount.com - kubectl create secret generic clouddns-dns01-solver-svc-acct \ - --from-file=key.json - -.. note:: - Keep the key file safe and do not share it, as it could be used to gain access to your cloud resources. The key file can be deleted once it has been used to generate the Secret. - -.. note:: - If you have already added the secret but get an error: `...due to error processing: error getting clouddns service account: secret "XXX" not found`, the secret may be in the wrong namespace. If you're configuring a `ClusterIssuer`, try moving the secret to the same namespace as cert-manager. If you're configuring an `Issuer`, the secret should be stored in the same namespace as the `Issuer` resource. - -Create an Issuer That Uses CloudDNS -=================================== - -Next, create an Issuer (or ClusterIssuer) with a ``clouddns`` provider. An example Issuer manifest can be seen below with annotations. - -.. code-block:: yaml - :linenos: - :emphasize-lines: 10-16 - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: example-issuer - spec: - acme: - ... - solvers: - - dns01: - clouddns: - # The ID of the GCP project - project: $PROJECT_ID - # This is the secret used to access the service account - serviceAccountSecretRef: - name: clouddns-dns01-solver-svc-acct - key: key.json - -For more information about Issuers and ClusterIssuers, see :doc:`Setting Up Issuers `. - -Once an Issuer (or ClusterIssuer) has been created successfully a Certificate can then be added to verify that everything works. - -.. code-block:: yaml - :linenos: - :emphasize-lines: 9-10 - - apiVersion: cert-manager.io/v1alpha2 - kind: Certificate - metadata: - name: example-com - namespace: default - spec: - secretName: example-com-tls - issuerRef: - # The issuer created previously - name: example-issuer - commonName: example.com - dnsNames: - - example.com - - www.example.com - -For more details about Certificates, see :doc:`Issuing Certificates `. +This document has moved to https://cert-manager.netlify.com/docs/configuration/acme/dns01/google/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/issuers/setup-acme/dns01/index.rst b/docs/tasks/issuers/setup-acme/dns01/index.rst index d46b12396..5b51a3810 100644 --- a/docs/tasks/issuers/setup-acme/dns01/index.rst +++ b/docs/tasks/issuers/setup-acme/dns01/index.rst @@ -1,128 +1,6 @@ -===================================== -Configuring DNS01 Challenge Providers -===================================== +========== +File moved +========== -This page contains details on the different options available on the ``Issuer`` -resource's DNS01 challenge solver configuration. - -For more information on configuring ACME issuers and their API format, read the -:doc:`Setting up ACME Issuers <../index>` documentation. - -DNS01 provider configuration must be specified on the Issuer resource, similar -to the examples in the setting up documentation: - -You can read about how the DNS01 challenge type works on the -`Let's Encrypt challenge types page`_. - -.. _`Let's Encrypt challenge types page`: https://letsencrypt.org/docs/challenge-types/#dns-01-challenge - - -.. code-block:: yaml - :linenos: - :emphasize-lines: 12-17 - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: example-issuer - spec: - acme: - email: user@example.com - server: https://acme-staging-v02.api.letsencrypt.org/directory - privateKeySecretRef: - name: example-issuer-account-key - solvers: - - dns01: - clouddns: - project: my-project - serviceAccountSecretRef: - name: prod-clouddns-svc-acct-secret - key: service-account.json - -Each issuer can specify multiple different DNS01 challenge providers, and -it is also possible to have multiple instances of the same DNS provider on a -single Issuer (e.g. two clouddns accounts could be set, each with their own -name). - -For more information on utilising multiple solver types on a single Issuer, -read the multiple-solver-types_ section. - -Setting nameservers for DNS01 self check -======================================== - -cert-manager will check the correct DNS records exist before attempting a DNS01 -challenge. -By default, the DNS servers for this check will be taken from -``/etc/resolv.conf``. -If this is not desired (for example with multiple authoritative nameservers or -split-horizon DNS), the cert-manager controller exposes a flag that allows you -alter this behaviour: - -Example usage:: - - --dns01-recursive-nameservers "8.8.8.8:53,1.1.1.1:53" - -If you're using the `cert-manager` helm chart, you can set recursive nameservers -through `.Values.extraArgs` or at the command at helm install/upgrade time -with `--set`: - - --set 'extraArgs={--dns01-recursive-nameservers=8.8.8.8:53\,1.1.1.1:53}' - - -.. _supported-dns01-providers: - -Delegated Domains for DNS01 -=========================== - -By default, cert-manager will not follow CNAME records pointing to subdomains. - -If granting cert-manager access to the root DNS zone is not desired, then the -_acme-challenge.example.com subdomain can instead be delegated to some other, -less privileged domain. -Once a CNAME record has been configured to point at the desired domain, and the -DNS configuration/credentials for the zone that *should be updated* have been -provided, all that is left to be done is adding an additional field into the -relevant `dns01` solver: - -.. code-block:: yaml - :linenos: - :emphasize-lines: 11 - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - ... - spec: - acme: - ... - solvers: - - dns01: - # Valid values are None and Follow - cnameStrategy: Follow - clouddns: - ... - -cert-manager will then follow CNAME records recursively in order to determine -which DNS zone to update during DNS01 challenges. - - -************************* -Supported DNS01 providers -************************* - -A number of different DNS providers are supported for the ACME issuer. Below is -a listing of available providers, their `.yaml` configurations, along with additional Kubernetes -and provider specific notes regarding their usage. - -.. toctree:: - :maxdepth: 1 - - acme-dns - akamai - azuredns - cloudflare - google - route53 - digitalocean - rfc2136 - webhook +This document has moved to https://cert-manager.netlify.com/docs/configuration/acme/dns01/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/issuers/setup-acme/dns01/rfc2136.rst b/docs/tasks/issuers/setup-acme/dns01/rfc2136.rst index b85619475..749b45d9c 100644 --- a/docs/tasks/issuers/setup-acme/dns01/rfc2136.rst +++ b/docs/tasks/issuers/setup-acme/dns01/rfc2136.rst @@ -1,214 +1,6 @@ -RFC-2136 -======== +========== +File moved +========== -The goal of this document is to provide a configuration overview of the -various facilities required to deploy cert-manager against a RFC-2136 -compliant DNS server such as BIND ``named``. This capability is also -commonly known as “dynamic DNS”. - -Unlike the peer of other cert-manager DNS integrations, ``named`` is a bit of a -“Swiss Army Knife” of domain name servers. Over the years, it has been -highly optimized to provide maximal vertical scalability for a single -node, as well as horizontal scalability with service provider -interfaces. This flexibility makes it impossible to go into every possible -``named`` deployment that a user may run in to though. Instead, this -document will try to make sure your server is ready -to accept requests from cert-manager using command line tools, then get -on to the making the two work together. - -Transaction Signatures ⇒ TSIG ------------------------------ - -Dynamic DNS updates are essentially server queries which otherwise might -return resource records (RRs). Since DNS servers are commonly exposed to -the public internet, being able to push an unauthenticated update to any -server that responds to queries would be immediately untenable. - -In the eyes of the ``named`` architects, the generic solution to this -problem space was twofold. The first is to require manual enablement of -updates at a zone level, such as ``example.com``. In a naive network, -there is no requirement that zone updates have any security to them, and -clients can be configured such that they can provide updates without any -authentication. An example of where this is useful is for machines -booting using DHCP, in this case the machines know about themselves and -the DNS server can be configured to accept updates when they come from -the address being configured. - -This clearly has limitations in situations such as cert-manager and the -DNS-01 challenge. In this environment, a TXT RR must be created after -coordination with the ACME server. After negotiating with the ACME server, -a the TXT RR that is published on the domain validates that the -domain is legitimately engaged with the process of creating a -certificate for it. In the bigger picture of DNS, this -means that an arbitrary actor (cert-manager, in this case) must be able -to add one of these KV mappings to the domain and delete it after the -certificate has been issued. ``cert-manager`` does not have a convenient -physical characteristic such as a DHCP allocation to validate it's requests. - -For cases like this, we need to be able to sign a request that is being -sent to the DNS server. We do that through TSIGs, or Transaction -SIGnatures. - -Configuration Step 1 - Set up your DNS server for secure dynamic updates ------------------------------------------------------------------------- - -There are many excellent tutorials on the net that walk through -preparing a basic ``named`` server for dynamic updates: - -- https://www.cyberciti.biz/faq/unix-linux-bind-named-configuring-tsig/ -- https://tomthorp.me/blog/using-tsig-enable-secure-zone-transfers-between-bind-9x-servers - -More complex ``named`` deployments will not use text files, but rather -may use LDAP or SQL for a database for resource records. An additional -wrinkle is metadata configuration, such as for zone metadata like -enabling dynamic updates or access control lists (ACLs) for a zone. -There are too many configurations to go into here, but you should be -able to find the documentation to do so. - -Whatever your deployment is, the goal at this stage has nothing to do -with cert-manager and everything to do with a tool called ``nsupdate`` -generating updates signed with TSIG. Once this is out of the way, you -can attack the cert-manager configuration with far greater confidence. - -Using ``nsupdate`` -~~~~~~~~~~~~~~~~~~ - -Most paths to configuring BIND ``named`` will go through using -``dnssec-keygen``. This command-line tool generates a named private key -that is used for signing TSIG requests. When a request is signed, both -the signature and the name of the private key are attached to the -request in an unencrypted form. In this manner, when the request is -received, the name of the private key can be used to by the recipient to -find the private key itself, build a new signature with it, and compare -the two for acceptance. - -Since there are dozens of ways to have your ``named`` server -misconfigured, we’ll use ``nsupdate`` to test that the server behaves as -expected before we get there. -https://debian-administration.org/article/591/Using_the_dynamic_DNS_editor_nsupdate -is a solid breakdown of how to use the tool. - -To get started, we’ll simply run ``nsupdate -k `` where keyID is -the value returned from ``dnssec-keygen``. This will read the key from -disk and provide a command prompt to issue commands. In general, we want -to write a simple TXT RR and make sure we can delete it. - -:: - - $ nsupdate -k - > update add www1.example.com txt testing - > send - > … test here with ``nslookup`` - > update delete www1.example.com txt - > send - > … test here with ``nslookup`` - -Any failures to write, read or delete the record will mean that -cert-manager will not be able to do so either, no matter how well it is -configured. - -Configuration Step 2 - Set up cert-manager ------------------------------------------- - -Now we get to the fun stuff, seeing everything work. Remember that we -need to set up the ACME DNS-01 issuer and challenge mechanism as well as -the ``rfc2136`` provider. Since the documentation covers the other parts -sufficiently, let’s focus on the provider here. - -.. code:: yaml - :emphasize-lines: 10-16 - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: example-issuer - spec: - acme: - ... - solvers: - - dns01: - rfc2136: - nameserver:
    - tsigKeyName: - tsigAlgorithm: HMACSHA512 // should be matched to the algo you chose in `dnssec-keygen` - tsigSecretSecretRef: - name: - key: - -For example: - -.. code:: yaml - - rfc2136: - nameserver: 1.2.3.4:53 - tsigKeyName: example-com-secret - tsigAlgorithm: HMACSHA512 - tsigSecretSecretRef: - name: tsig-secret - key: tsig-secret-key - -For this example configuration, we’ll need the following two commands. -The first, on your ``named`` server generates the key. Note how -``example-com-secret`` is both in the ``tsigKeyName`` above and the -``dnssec-keygen`` command that follows. - -:: - - dnssec-keygen -r /dev/urandom -a HMAC-SHA512 -b 512 -n HOST example-com-secret - -Also note how the ``tsigAlgorithm`` is provided in both the -configuration and the keygen command. They are listed at -https://github.com/miekg/dns/blob/v1.0.12/tsig.go#L18-L23. - -The second bit of configuration you need on the kubernetes side is to -create a secret. Pulling the secret key string from the -``.private`` file generated above, use the secret in the -placeholder below: - -:: - - kubectl -n cert-manager create secret generic tsig-secret --from-literal=tsig-secret-key= - -Note how the ``tsig-secret`` and ``tsig-secret-key`` match the -configuration in the ``tsigSecretSecretRef`` above. - -Rate Limits ------------ - -The ``rfc2136`` provider waits until *all* nameservers to in your domain's SOA RR respond with the same result before -it contacts Let's Encrypt to complete the challenge process. This is because the challenge server contacts a -non-authoritative DNS server that does a recursive query (a query for records it does not maintain locally). If the -servers in the SOA do not contain the correct values, it's likely that the non-authoritative server will have -bad information as well, causing the request to go against rate limits and eventually locking the process out. - -This process is in place to protect users from server misconfigurations creating a more subtle lockout that persists -after the server configuration has been repaired. - -As documented elsewhere, it is prudent to fully debug configurations using the ACME staging servers before using -the production servers. The staging servers have less aggressive rate limits, but the certificates they issue are -not signed with a root certificate trusted by browsers. - -What’s next? ------------- - -This configuration so far will actually do nothing. You still have to -request a certificate as in :doc:`/tasks/issuing-certificates/index`. Once a certficate is requested, -the provider will begin processing the request. - -Troubleshooting ---------------- - -* Be sure that you have fully tested the DNS server updates using ``nsupdate`` first. Ideally, this is done from - a pod in the same namespace as the ``rfc2136`` provider to ensure there are no firewall issues. -* The logs for the ``cert-manager`` pod are your friend. Additional logs can be generated by adding the ``--v=5`` - argument to the container launch. -* The TSIG key is encoded with ``base64``, but the Kubernetes API server also expects that key literals will be - decoded before they are stored. In some cases, a key must be double-encoded. (If you've tested using ``nsupdate``, - it's pretty easy to spot when you are running into this.) -* Pay attention to the refresh time of the zone you are working with. For zones with low traffic, it will not make a - significant difference to reduce the refresh time down to about five minutes while getting initial certificates. - Once the process is working, the beauty of ``cert-manager`` is it doesn't matter if a renewal takes hours due to - refresh times, it's all automated! -* Compared to the other providers that often use REST APIs to modify DNS RRs, this provider can take a little longer. - You can ``watch kubectl certificate yourcert`` to get a display of what's going on. It's not uncommon for the process - to take five minutes in total. +This document has moved to https://cert-manager.netlify.com/docs/configuration/acme/dns01/rfc2136/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/issuers/setup-acme/dns01/route53.rst b/docs/tasks/issuers/setup-acme/dns01/route53.rst index d1e9947a3..6cf90176a 100644 --- a/docs/tasks/issuers/setup-acme/dns01/route53.rst +++ b/docs/tasks/issuers/setup-acme/dns01/route53.rst @@ -1,127 +1,6 @@ -========================= -Amazon Route53 -========================= +========== +File moved +========== -This guide explains how to set up an Issuer, or ClusterIssuer, to use Amazon Route53 to solve DNS01 ACME challenges. It's advised you read the :doc:`DNS01 Challenge Provider <./index>` page first for a more general understanding of how cert-manager handles DNS01 challenges. - -.. note:: - This guide assumes that your cluster is hosted on Amazon Web Services (AWS) and that you already have a hosted zone in Route53. - -Set up a IAM Role -======================== - -Cert-manager needs to be able to add records to Route53 in order to solve the DNS01 challenge. To enable this, create a IAM policy with the following permissions: - -.. code-block:: json - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": "route53:GetChange", - "Resource": "arn:aws:route53:::change/*" - }, - { - "Effect": "Allow", - "Action": [ - "route53:ChangeResourceRecordSets", - "route53:ListResourceRecordSets" - ], - "Resource": "arn:aws:route53:::hostedzone/*" - }, - { - "Effect": "Allow", - "Action": "route53:ListHostedZonesByName", - "Resource": "*" - } - ] - } - -.. note:: - The ``route53:ListHostedZonesByName`` statement can be removed if you specify - the (optional) ``hostedZoneID``. You can further tighten the policy by limiting the hosted - zone that cert-manager has access to (e.g. ``arn:aws:route53:::hostedzone/DIKER8JEXAMPLE``). - -Credentials -======================== - -You have two options for the set up: Either create a user or a role and attach that policy from above. -Using a role is considered best practice because you do not have to store permanent credentials in a secret. - -Cert-manager supports two ways of specifying credentials: - -* explicit by providing a ``accessKeyID`` and ``secretAccessKey`` -* or implicit (using `metadata service `_ or `env vars or credentials file `_) - -Cert-manager also supports specifying a ``role`` to enable cross-account access and/or to limit the access for the cert-manager. Integration with `kiam `_ and `kube2iam `_ should work out of the box. - - -Cross account access -_____________________ - -Example: Account A manages a Route53 DNS Zone. Now you want account X to be able to manage records in that zone. - -First, create a role with the policy above (let's call the role ``dns-manager``) and attach a trust relationship like the one below. Make sure role ``cert-manager`` in account X exists: - -.. code-block:: json - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::XXXXXXXXXXX:role/cert-manager" - }, - "Action": "sts:AssumeRole" - } - ] - } - -This allows the role ``cert-manager`` in account X to manage the Route53 DNS Zone in account A. -For more information visit the `official documentation `_. - - -Creating a Issuer (or ClusterIssuer) -==================================== - -Here is an example configuration for a ClusterIssuer: - -.. code:: yaml - - apiVersion: cert-manager.io/v1alpha2 - kind: ClusterIssuer - metadata: - name: letsencrypt-prod - spec: - acme: - ... - solvers: - - # example: cross-account zone management for example.com - # this solver uses ambient credentials (i.e. inferred from the environment or EC2 Metadata Service) - # to assume a role in a different account - - selector: - dnsZones: - - "example.com" - dns01: - route53: - region: us-east-1 - hostedZoneID: DIKER8JEXAMPLE # optional, see bpolicy above - role: arn:aws:iam::XXXXXXXXXXXX:role/dns-manager - - # this solver handles foobar.cloud challenges - # and uses explicit credentials - - selector: - dnsZones: - - "foobar.cloud" - dns01: - route53: - region: eu-central-1 - accessKeyID: AKIAIOSFODNN7EXAMPLE - secretAccessKeySecretRef: - name: prod-route53-credentials-secret - key: secret-access-key - # you can also assume a role with these credentials - role: arn:aws:iam::XXXXXXXXXXXX:role/dns-manager +This document has moved to https://cert-manager.netlify.com/docs/configuration/acme/dns01/route53/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/issuers/setup-acme/dns01/webhook.rst b/docs/tasks/issuers/setup-acme/dns01/webhook.rst index 6795bdeb3..5a956110b 100644 --- a/docs/tasks/issuers/setup-acme/dns01/webhook.rst +++ b/docs/tasks/issuers/setup-acme/dns01/webhook.rst @@ -1,33 +1,6 @@ -========================= -Webhook -========================= +========== +File moved +========== -The webhook issuer is a generic acme solver. The actual work is done by an external service. Look at the respective documentation of the `solver`. - -Existing webhook solvers: - -* `alidns-webhook `_ -* `cert-manager-webhook-dnspod `_ -* `cert-manager-webhook-selectel `_ -* `cert-manager-webhook-softlayer `_ - -See more webhook solver on: https://github.com/topics/cert-manager-webhook - -.. code-block:: yaml - :emphasize-lines: 10-14 - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: example-issuer - spec: - acme: - ... - solvers: - - dns01: - webhook: - groupName: - solverName: - config: - ... - +This document has moved to https://cert-manager.netlify.com/docs/configuration/acme/dns01/webhook/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/issuers/setup-acme/http01/index.rst b/docs/tasks/issuers/setup-acme/http01/index.rst index a2bea361b..a370030e6 100644 --- a/docs/tasks/issuers/setup-acme/http01/index.rst +++ b/docs/tasks/issuers/setup-acme/http01/index.rst @@ -1,111 +1,6 @@ -=================================== -Configuring HTTP01 Ingress Provider -=================================== +========== +File moved +========== -This page contains details on the different options available on the ``Issuer`` -resource's HTTP01 challenge solver configuration. - -For more information on configuring ACME issuers and their API format, read the -:doc:`Setting up ACME Issuers <../index>` documentation. - -How HTTP01 validations work -=========================== - -You can read about how the HTTP01 challenge type works on the -`Let's Encrypt challenge types page`_. - -.. _`Let's Encrypt challenge types page`: https://letsencrypt.org/docs/challenge-types/#http-01-challenge - -Options -======= - -The HTTP01 Issuer supports a number of additional options. -For full details on the range of options available, read the -`reference documentation`_. - -.. _`reference documentation`: https://docs.cert-manager.io/en/latest/reference/api-docs/index.html#acmeissuerhttp01config-v1alpha2 - -ingressClass ------------- - -If the ``ingressClass`` field is specified, cert-manager will create new -Ingress resources in order to route traffic to the 'acmesolver' pods, which -are responsible for responding to ACME challenge validation requests. - -If this field is not specified, and ``ingressName`` is also not specified, -cert-manager will default to create **new** ingress resources but will **not** -set the ingress class on these resources, meaning **all** ingress controllers -installed in your cluster will server traffic for the challenge solver, -potentially occurring additional cost. - -ingressName ------------ - -If the 'ingressName' field is specified, cert-manager will edit the named -ingress resource in order to solve HTTP01 challenges. - -This is useful for compatibility with ingress controllers such as ingress-gce_, -which utilise a unique IP address for each Ingress resource created. - -This mode should be avoided when using ingress controllers that expose a single -IP for all ingress resources, as it can create compatibility problems with -certain ingress-controller specific annotations. - -servicePort ------------ - -In rare cases it might be not possible/desired to use NodePort as type for the -http01 challenge response service, e.g. because of Kubernetes limit -restrictions. To define which Kubernetes service type to use during challenge -response specify the following http01 config: - -.. code-block:: yaml - - http01: - # Valid values are ClusterIP and NodePort - serviceType: ClusterIP - -By default type NodePort will be used when you don't set http01 or when you set -serviceType to an empty string. Normally there's no need to change this. - -podTemplate ------------ - -You may wish to change or add to the labels and annotations of solver pods. -These can be configured under the ``metadata`` field under ``podTemplate``. - -Similarly, you can set the nodeSelector, tolerations and affinity of solver -pods by configuring under the ``spec`` field of the ``podTemplate``. No other -spec fields can be edited. - -An example of how you could configure the template is as so: - -.. code-block:: yaml - :linenos: - :emphasize-lines: 13-20 - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: ... - spec: - acme: - server: ... - privateKeySecretRef: - name: ... - solvers: - - http01: - ingress: - podTemplate: - metadata: - labels: - foo: "bar" - env: "prod" - spec: - nodeSelector: - bar: baz - -The added labels and annotations will merge on top of the cert-manager defaults, -overriding entries with the same key. - -No other fields can be edited. \ No newline at end of file +This document has moved to https://cert-manager.netlify.com/docs/configuration/acme/http01/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/issuers/setup-acme/index.rst b/docs/tasks/issuers/setup-acme/index.rst index d9aa76304..514f33e8e 100644 --- a/docs/tasks/issuers/setup-acme/index.rst +++ b/docs/tasks/issuers/setup-acme/index.rst @@ -1,178 +1,6 @@ -======================= -Setting up ACME Issuers -======================= +========== +File moved +========== -The ACME Issuer type represents a single Account registered with the ACME -server. - -When you create a new ACME Issuer, cert-manager will generate a private key -which is used to identify you with the ACME server. - -To set up a basic ACME issuer, you should create a new Issuer or ClusterIssuer -resource. - -You should read the guides linked at the bottom of this page to learn more -about the ACME challenge validation mechanisms that cert-manager supports and -how to configure the various DNS01 provider implementations. - -Creating a basic ACME Issuer -============================ - -The below example configures a ClusterIssuer named ``letsencrypt-staging`` that -is configured to HTTP01 challenge solving with configuration suitable for -ingress controllers such as ingress-nginx_. - -You should copy and paste this example into a new file named -``letsencrypt-staging.yaml`` and update the ``spec.acme.email`` field to be your -own email address. - -.. code-block:: yaml - :linenos: - :emphasize-lines: 7-10, 13-14, 19 - - apiVersion: cert-manager.io/v1alpha2 - kind: ClusterIssuer - metadata: - name: letsencrypt-staging - spec: - acme: - # You must replace this email address with your own. - # Let's Encrypt will use this to contact you about expiring - # certificates, and issues related to your account. - email: user@example.com - server: https://acme-staging-v02.api.letsencrypt.org/directory - privateKeySecretRef: - # Secret resource used to store the account's private key. - name: example-issuer-account-key - # Add a single challenge solver, HTTP01 using nginx - solvers: - - http01: - ingress: - class: nginx - -You can then create this resource using ``kubectl apply``: - -.. code-block:: shell - - kubectl apply -f letsencrypt-staging.yaml - -To verify that the account has been registered successfully, you can run -``kubectl describe`` and check the 'Ready' condition: - -.. code-block:: shell - - kubectl describe clusterissuer letsencrypt-staging - ... - Status: - Acme: - Uri: https://acme-staging-v02.api.letsencrypt.org/acme/acct/7571319 - Conditions: - Last Transition Time: 2019-01-30T14:52:03Z - Message: The ACME account was registered with the ACME server - Reason: ACMEAccountRegistered - Status: True - Type: Ready - -Any Certificate you create that references this Issuer resource will use the -HTTP01 challenge solver you have configured above. - -.. note:: - Let's Encrypt does not support issuing wildcard certificates with HTTP-01 challenges. - To issue wildcard certificates, you must use the DNS-01 challenge. - -.. _multiple-solver-types: - -Adding multiple solver types -============================ - -You may want to use different types of challenge solver configuration for -different ingress controllers, for example if you want to issue wildcard -certificates using DNS01 alongside other certificates that are validated using -HTTP01. - -The ``solvers`` stanza has an optional ``selector`` field, that can be used to -specify which Certificates, and further, what DNS names **on those certificates** -should be used to solve challenges. - -For example, to configure HTTP01 using nginx ingress as the default solver, -along with a DNS01 solver that can be used for wildcard certificates: - -.. code-block:: yaml - :linenos: - :emphasize-lines: 14-15 - - apiVersion: cert-manager.io/v1alpha2 - kind: ClusterIssuer - metadata: - name: letsencrypt-staging - spec: - acme: - ... - solvers: - - http01: - ingress: - class: nginx - - selector: - matchLabels: - use-cloudflare-solver: "true" - dns01: - cloudflare: - email: user@example.com - apiKeySecretRef: - name: cloudflare-apikey-secret - key: apikey - -In order to utilise the configured cloudflare DNS01 solver, you must add the -``use-cloudflare-solver: "true"`` label to your Certificate resources. - -Using multiple solvers for a single certificate ------------------------------------------------ - -The solver's ``selector`` stanza has an additional field ``dnsNames`` that -further refines the set of domains that the solver configuration applies to. - -If any ``dnsNames`` are specified, then that challenge solver will be used if -the domain being validated is named in that list. - -For example: - -.. code-block:: yaml - :linenos: - :emphasize-lines: 14-15 - - apiVersion: cert-manager.io/v1alpha2 - kind: ClusterIssuer - metadata: - name: letsencrypt-staging - spec: - acme: - ... - solvers: - - http01: - ingress: - class: nginx - - selector: - dnsNames: - - '*.example.com' - dns01: - cloudflare: - email: user@example.com - apiKeySecretRef: - name: cloudflare-apikey-secret - key: apikey - -In this instance, a Certificate that specified both ``*.example.com`` and -``example.com`` would use the HTTP01 challenge solver for ``example.com`` and -the DNS01 challenge solver for ``*.example.com``. - -It is possible to specify both ``matchLabels`` AND ``dnsNames`` on an ACME -solver selector. - -.. toctree:: - :maxdepth: 2 - :caption: Contents: - - http01/index - dns01/index - -.. _`Let's Encrypt staging endpoint`: https://letsencrypt.org/docs/staging-environment/ +This document has moved to https://cert-manager.netlify.com/docs/configuration/acme/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/issuers/setup-ca.rst b/docs/tasks/issuers/setup-ca.rst index b77b4d20d..e97aa02b9 100644 --- a/docs/tasks/issuers/setup-ca.rst +++ b/docs/tasks/issuers/setup-ca.rst @@ -1,156 +1,6 @@ -===================== -Setting up CA Issuers -===================== +========== +File moved +========== - -cert-manager can be used to obtain certificates using an arbitrary signing -key pair stored in a Kubernetes Secret resource. - -This guide will show you how to configure and create a CA based issuer, backed -by a signing key pair stored in a Secret resource. - -1. (Optional) Generate a signing key pair -========================================= - -The CA Issuer does not automatically create and manage a signing key pair for -you. As a result, you will need to either supply your own or generate a self -signed CA using a tool such as openssl_ or cfssl_. - -This guide will explain how to generate a new signing key pair, however you can -substitute it for your own so long as it has the ``CA`` flag set. - -.. code-block:: shell - - # Generate a CA private key - $ openssl genrsa -out ca.key 2048 - - # Create a self signed Certificate, valid for 10yrs with the 'signing' option set - $ openssl req -x509 -new -nodes -key ca.key -subj "/CN=${COMMON_NAME}" -days 3650 -reqexts v3_req -extensions v3_ca -out ca.crt - -The output of these commands will be two files, ``ca.key`` and ``ca.crt``, the -key and certificate for your signing key pair. If you already have your own key -pair, you should name the private key and certificate ``ca.key`` and ``ca.crt`` -respectively. - -2. Save the signing key pair as a Secret -======================================== - -We are going to create an Issuer that will use this key pair to generate signed -certificates. You can read more about the Issuer resource in :doc:`the Issuer -reference docs `. To allow the Issuer to reference our key -pair we will store it in a Kubernetes Secret resource. - -Issuers are namespaced resources and so they can only reference Secrets in -their own namespace. We will therefore put the key pair into the same namespace -as the Issuer. We could alternatively create a :doc:`ClusterIssuer -`, a cluster-scoped version of an Issuer. For more -information on ClusterIssuers, read the :doc:`ClusterIssuer reference -documentation `. - -The following command will create a Secret containing a signing key pair in the -default namespace: - -.. code-block:: shell - - kubectl create secret tls ca-key-pair \ - --cert=ca.crt \ - --key=ca.key \ - --namespace=default - -3. Creating an Issuer referencing the Secret -============================================ - -We can now create an Issuer referencing the Secret resource we just created: - -.. code-block:: yaml - :linenos: - :emphasize-lines: 8 - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: ca-issuer - namespace: default - spec: - ca: - secretName: ca-key-pair - -We are now ready to obtain certificates! - -4. Obtain a signed Certificate -============================== - -We can now create the following Certificate resource which specifies the -desired certificate. You can read more about the Certificate resource in -:doc:`the reference docs `. - -.. code-block:: yaml - :linenos: - :emphasize-lines: 9, 10, 11, 12 - - apiVersion: cert-manager.io/v1alpha2 - kind: Certificate - metadata: - name: example-com - namespace: default - spec: - secretName: example-com-tls - issuerRef: - name: ca-issuer - # We can reference ClusterIssuers by changing the kind here. - # The default value is Issuer (i.e. a locally namespaced Issuer) - kind: Issuer - commonName: example.com - organization: - - Example CA - dnsNames: - - example.com - - www.example.com - -In order to use the Issuer to obtain a Certificate, we must create a -Certificate resource in the **same namespace as the Issuer**, as an Issuer is a -namespaced resource. We could alternatively create a :doc:`ClusterIssuer -` if we wanted to reuse the signing key pair across -multiple namespaces. - -Once we have created the Certificate resource, cert-manager will attempt to use -the Issuer ``ca-issuer`` to obtain a certificate. If successful, the -certificate will be stored in a Secret resource named ``example-com-tls`` in -the same namespace as the Certificate resource (``default``). - -The example above explicitly sets the ``commonName`` field to ``example.com``. -cert-manager automatically adds the ``commonName`` field as a `DNS SAN`_ if it -is not already contained in the ``dnsNames`` field. - -If we had **not** specified the ``commonName`` field, then the **first** DNS -SAN that is specified (under ``dnsNames``) would be used as the certificate's -common name. - -After creating the above Certificate, we can check whether it has been obtained -successfully like so: - -.. code-block:: shell - - $ kubectl describe certificate example-com - Events: - Type Reason Age From Message - ---- ------ ---- ---- ------- - Warning ErrorCheckCertificate 26s cert-manager-controller Error checking existing TLS certificate: secret "example-com-tls" not found - Normal PrepareCertificate 26s cert-manager-controller Preparing certificate with issuer - Normal IssueCertificate 26s cert-manager-controller Issuing certificate... - Normal CertificateIssued 25s cert-manager-controller Certificate issued successfully - -You can also check whether issuance was successful with -``kubectl get secret example-com-tls -o yaml``. You should see a base64 encoded -signed TLS key pair. - -Once the certificate has been obtained, cert-manager will keep checking its -validity and attempt to renew it if it gets close to expiry. -cert-manager considers certificates to be close to expiry when the 'Not After' -field on the certificate is less than the current time plus 30 days. For CA -based Issuers, cert-manager will issue certificates with the 'Not After' -field set to the current time plus 365 days. - -.. _openssl: https://github.com/openssl/openssl -.. _cfssl: https://github.com/cloudflare/cfssl -.. _`DNS SAN`: https://en.wikipedia.org/wiki/Subject_Alternative_Name +This document has moved to https://cert-manager.netlify.com/docs/configuration/ca/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/issuers/setup-selfsigned.rst b/docs/tasks/issuers/setup-selfsigned.rst index 65cd3ab1f..185eeb19d 100644 --- a/docs/tasks/issuers/setup-selfsigned.rst +++ b/docs/tasks/issuers/setup-selfsigned.rst @@ -1,44 +1,6 @@ -=============================== -Setting up self signing Issuers -=============================== +========== +File moved +========== -.. toctree:: - :maxdepth: 1 - -Self signed Issuers will issue self signed certificates. - -This is useful when building PKI within Kubernetes, or as a means to generate a -root CA for use with the :doc:`CA Issuer <./setup-ca>`. - -A self-signed Issuer contains no additional configuration fields, and can be -created with a resource like so: - -.. code-block:: yaml - - apiVersion: cert-manager.io/v1alpha2 - kind: ClusterIssuer - metadata: - name: selfsigning-issuer - spec: - selfSigned: {} - -.. note:: - The presence of the ``selfSigned: {}`` line is enough to indicate that this Issuer - is of type 'self signed'. - -Once created, you should be able to issue certificates like usual by -referencing the newly created Issuer in your ``issuerRef``: - -.. code-block:: yaml - - apiVersion: cert-manager.io/v1alpha2 - kind: Certificate - metadata: - name: example-crt - spec: - secretName: my-selfsigned-cert - commonName: "my-selfsigned-root-ca" - isCA: true - issuerRef: - name: selfsigning-issuer - kind: ClusterIssuer +This document has moved to https://cert-manager.netlify.com/docs/configuration/selfsigned/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/issuers/setup-vault.rst b/docs/tasks/issuers/setup-vault.rst index e2cb440db..bc5ad57bf 100644 --- a/docs/tasks/issuers/setup-vault.rst +++ b/docs/tasks/issuers/setup-vault.rst @@ -1,263 +1,6 @@ -======================== -Setting up Vault Issuers -======================== +========== +File moved +========== -Installing Vault ----------------- - -Vault installation is a complex subject. For a thorough tour of the subject -you can read the official HashiCorp Vault -`documentation `__. - - -Vault PKI Backend ------------------ - -The PKI Secrets Engine needs to be initialized for cert-manager to be -able to generate certificate. The official Vault documentation can be -found -`here `__. - -Vault Authentication with a AppRole -=================================== - -This Vault authentication method uses a -`Vault AppRole `__. - -The secret ID of the AppRole is stored in a secret. - -Here an example of a secret containing the secretId of the AppRole: - -.. code-block:: yaml - - apiVersion: v1 - kind: Secret - type: Opaque - metadata: - name: cert-manager-vault-approle - namespace: default - data: - secretId: "MDI..." - -Where the secretId is the base 64 encoded value of the appRole *secretId* -giving access to the pki backend in Vault. - -We can now create a cluster issuer referencing this secret: - -.. code-block:: yaml - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: vault-issuer - namespace: default - spec: - vault: - path: pki_int/sign/example-dot-com - server: https://vault - caBundle: - auth: - appRole: - path: approle - roleId: "291b9d21-8ff5-..." - secretRef: - name: cert-manager-vault-approle - key: secretId - -Where *path* is the Vault role path of the PKI backend and *server* is -the Vault server base URL. The *path* MUST USE the vault ``sign`` endpoint. -The Vault appRole credentials are supplied as the -Vault authentication method using the appRole created in Vault. The secretRef -references the Kubernetes secret created previously. More specifically, the field -*name* is the Kubernetes secret name and *key* is the name given as the -key value that store the *secretId*. The optional attribute *path* specifies -where the AppRole authentication is mounted in Vault. The attribute *path* default -value is *approle*. - -An optional base64 encoded *caBundle* in PEM format can be provided to validate -the TLS connection to the Vault Server. When *caBundle* is set it replaces the CA -bundle inside the container running cert-manager. -This parameter has no effect if the connection used is in plain HTTP. - -Once we have created the above Issuer we can use it to obtain a certificate. - -.. code-block:: yaml - - apiVersion: cert-manager.io/v1alpha2 - kind: Certificate - metadata: - name: example-com - namespace: default - spec: - secretName: example-com-tls - issuerRef: - name: vault-issuer - commonName: example.com - dnsNames: - - www.example.com - -The Certificate resource describes our desired certificate and the possible -methods that can be used to obtain it. You can learn more about the Certificate -resource in the :doc:`reference docs `. -If the certificate is obtained successfully, the resulting key pair will be -stored in a secret called ``example-com-tls`` in the same namespace as the Certificate. - -The certificate will have a common name of ``example.com`` and the -`Subject Alternative Names`_ (SANs) will be ``example.com`` and ``www.example.com``. - -In our Certificate we have referenced the ``vault-issuer`` Issuer above. -The Issuer must be in the same namespace as the Certificate. -If you want to reference a ClusterIssuer, which is a cluster-scoped version of -an Issuer, you must add ``kind: ClusterIssuer`` to the ``issuerRef`` stanza. - -For more information on ClusterIssuers, read the -:doc:`ClusterIssuer reference docs `. - -Vault Authentication with a Token -================================= - -This Vault authentication method uses a plain token. A Vault token is generated by -one of the many authentication backends supported by Vault. Tokens in Vault have -expiration and need to be refreshed. You need to be aware that cert-manager does not -refresh these tokens. Another process must be put in place to keep them from expiring. - -For testing purposes a root token is generated at Vault installation time. -**WARNING: Root tokens do not expire, so should only be used for testing purposes.** - -Please refer to the official token `documentation `__ -for all the details. - -Here an example of a secret Kubernetes resource containing the Vault token: - -.. code-block:: yaml - - apiVersion: v1 - kind: Secret - type: Opaque - metadata: - name: cert-manager-vault-token - namespace: kube-system - data: - token: "MjI..." - -Where the token value is the base 64 encoded value of the token giving -access to the PKI backend in Vault. - -We can now create an issuer referencing this secret: - -.. code-block:: yaml - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: vault-issuer - namespace: default - spec: - vault: - auth: - tokenSecretRef: - name: cert-manager-vault-token - key: token - path: pki_int/sign/example-dot-com - server: https://vault - caBundle: - -Where *path* is the Vault role path of the PKI backend and *server* is -the Vault server base URL. The secret created previously is referenced in the issuer -with its *name* and *key* corresponding to the name of the Kubernetes secret and the -property name containing the token value respectively. - -An optional base64 encoded *caBundle* in PEM format can be provided to validate -the TLS connection to the Vault Server. When *caBundle* is set it replaces the CA -bundle inside the container running cert-manager. This parameter as no effect if the -connection used is in plain HTTP. - -Once we have created the above Issuer we can use it to obtain a certificate. - -.. code-block:: yaml - - apiVersion: cert-manager.io/v1alpha2 - kind: Certificate - metadata: - name: example-com - namespace: default - spec: - secretName: example-com-tls - issuerRef: - name: vault-issuer - commonName: example.com - dnsNames: - - www.example.com - -The Certificate resource describes our desired certificate and the possible -methods that can be used to obtain it. You can learn more about the Certificate -resource in the :doc:`reference docs `. -If the certificate is obtained successfully, the resulting key pair will be -stored in a secret called ``example-com-tls`` in the same namespace as the Certificate. - -The certificate will have a common name of ``example.com`` and the -`Subject Alternative Names`_ (SANs) will be ``example.com`` and ``www.example.com``. - -In our Certificate we have referenced the ``vault-issuer`` Issuer above. -The Issuer must be in the same namespace as the Certificate. -If you want to reference a ClusterIssuer, which is a cluster-scoped version of -an Issuer, you must add ``kind: ClusterIssuer`` to the ``issuerRef`` stanza. - -For more information on ClusterIssuers, read the -:doc:`ClusterIssuer reference docs `. - -.. _`Subject Alternative Names`: https://en.wikipedia.org/wiki/Subject_Alternative_Name - -Vault Authentication with Kubernetes Service Accounts -===================================================== - -This Vault authentication method uses Service Account tokens created by -Kubernetes to authenticate requests to Vault for signing certificates. You can -find more information on how to configure vault for Kubernetes based Service -Account authentication in the `documentation -`__. This authentication -expects three stanzas; a secret reference of the Service Account to use, -an optional authentication mount path that is defaulted to `kubernetes`, and -finally a Vault role that the Service Account is to assume. - -Here is an example Vault issuer using the Kubernetes Service Account -authentication method. - -.. code-block:: yaml - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: vault-issuer - namespace: default - spec: - vault: - path: pki_int/sign/example-dot-com - server: https://vault - caBundle: - auth: - kubernetes: - path: /kubernetes/cluster-1 - role: my-app-1 - secretRef: - name: my-service-account-secret - key: token - - -Once created and is ready you can create Certificates referencing this issuer in -the normal way. - -.. code-block:: yaml - - apiVersion: cert-manager.io/v1alpha2 - kind: Certificate - metadata: - name: example-com - namespace: default - spec: - secretName: example-com-tls - issuerRef: - name: vault-issuer - commonName: example.com - dnsNames: - - www.example.com +This document has moved to https://cert-manager.netlify.com/docs/configuration/vault/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/issuers/setup-venafi.rst b/docs/tasks/issuers/setup-venafi.rst index 9e9e6d9b2..8705a33ae 100644 --- a/docs/tasks/issuers/setup-venafi.rst +++ b/docs/tasks/issuers/setup-venafi.rst @@ -1,180 +1,6 @@ -========================= -Setting up Venafi Issuers -========================= +========== +File moved +========== -The Venafi Issuer types allows you to obtain certificates from `Venafi Cloud`_ -and `Venafi Trust Protection Platform`_ instances. - -Register your account at https://ui.venafi.cloud/enroll and get an API key from -your dashboard. - -You can have multiple different Venafi Issuer types installed within the same -cluster, including mixtures of Cloud and TPP issuer types. This allows you to -be flexible with the types of Venafi account you use. - -Automated certificate renewal and management are provided for Certificates -using the Venafi issuer. - -.. note:: - The Venafi Issuer has been recently added, and the exact structure of the - Issuer resource is subject to change. Such changes will be clearly - documented, and migration steps will be provided. - -Creating an Issuer resource -=========================== - -A single Venafi Issuer represents a single 'zone' within the Venafi API, -therefore you must create an Issuer resource for each Venafi Zone you want to -obtain certificates from. - -You can configure your Issuer resource to either issue certificates only within -a single namespace, or cluster-wide (using a ClusterIssuer resource). -For more information on the distinction between Issuer and ClusterIssuer -resources, read the :ref:`issuer_vs_clusterissuer` section. - - -Creating a Venafi Cloud Issuer ------------------------------- - -In order to set up a Venafi Cloud Issuer, you must first create a Kubernetes -Secret resource containing your Venafi Cloud API credentials: - -.. code-block:: shell - - kubectl create secret generic \ - cloud-secret \ - --namespace='NAMESPACE OF YOUR ISSUER RESOURCE' \ - --from-literal=apikey='YOUR_CLOUD_API_KEY_HERE' - -.. note:: - If you are configuring your Issuer as a ClusterIssuer resource in order to - issue Certificates across your whole cluster, you must set the - ``--namespace`` parameter to ``cert-manager``, which is the default 'cluster - resource namespace'. - -This API key will be used by cert-manager to interact with the Venafi Cloud -service on your behalf. - -Once the API key Secret has been created, you can create your Issuer or -ClusterIssuer resource. If you are creating a ClusterIssuer resource, you must -change the ``kind`` field to ``ClusterIssuer`` and remove the -``metadata.namespace`` field. - -Save the below content after making your amendments to a file named -``venafi-cloud-issuer.yaml``: - -.. code-block:: yaml - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: cloud-venafi-issuer - namespace: - spec: - venafi: - zone: "DevOps" # Set this to the Venafi policy zone you want to use - cloud: - apiTokenSecretRef: - name: cloud-secret - key: apikey - -You can then create the Issuer using ``kubectl create -f``: - -.. code-block:: shell - - kubectl create -f venafi-cloud-issuer.yaml - -Verify the Issuer has been initialised correctly using ``kubectl describe``: - -.. code-block:: shell - - kubectl describe issuer cloud-venafi-issuer --namespace='NAMESPACE OF YOUR ISSUER RESOURCE' - - (TODO) include sample output - -You are now ready to issue certificates using the newly provisioned Venafi -Issuer. - -Read the :doc:`Issuing Certificates <../issuing-certificates/index>` document -for more information on how to create Certificate resources. - -Creating a Venafi Trust Protection Platform Issuer --------------------------------------------------- - -The Venafi Trust Protection integration allows you to obtain certificates from -a properly configured Venafi TPP instance. - -The setup is similar to the Venafi Cloud configuration above, however some of -the connection parameters are slightly different. - -.. note:: - You **must** allow "User Provided CSRs" as part of your TPP policy, as this - is the only type supported by cert-manager at this time. - -In order to set up a Venafi Trust Protection Platform Issuer, you must first -create a Kubernetes Secret resource containing your Venafi TPP API credentials: - -.. code-block:: shell - - kubectl create secret generic \ - tpp-secret \ - --namespace= \ - --from-literal=username='YOUR_TPP_USERNAME_HERE' \ - --from-literal=password='YOUR_TPP_PASSWORD_HERE' - -.. note:: - If you are configuring your Issuer as a ClusterIssuer resource in order to - issue Certificates across your whole cluster, you must set the - ``--namespace`` parameter to ``cert-manager``, which is the default 'cluster - resource namespace'. - -These credentials will be used by cert-manager to interact with your Venafi TPP -instance. Username attribute must be adhere to the : format. -For example: ``local:admin``. - -Once the Secret containing credentials has been created, you can create your -Issuer or ClusterIssuer resource. If you are creating a ClusterIssuer resource, -you must change the ``kind`` field to ``ClusterIssuer`` and remove the -``metadata.namespace`` field. - -Save the below content after making your amendments to a file named -``venafi-tpp-issuer.yaml``: - -.. code-block:: yaml - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: tpp-venafi-issuer - namespace: - spec: - venafi: - zone: devops\cert-manager # Set this to the Venafi policy zone you want to use - tpp: - url: https://tpp.venafi.example/vedsdk # Change this to the URL of your TPP instance - caBundle: - credentialsRef: - name: tpp-secret - -You can then create the Issuer using ``kubectl create -f``: - -.. code-block:: shell - - kubectl create -f venafi-tpp-issuer.yaml - -Verify the Issuer has been initialised correctly using ``kubectl describe``: - -.. code-block:: shell - - kubectl describe issuer tpp-venafi-issuer --namespace='NAMESPACE OF YOUR ISSUER RESOURCE' - - (TODO) include sample output - -You are now ready to issue certificates using the newly provisioned Venafi -Issuer. - -Read the :doc:`Issuing Certificates <../issuing-certificates/index>` document -for more information on how to create Certificate resources. - -.. _Venafi Cloud: https://pki.venafi.com/venafi-cloud/ -.. _Venafi Trust Protection Platform: https://venafi.com/ +This document has moved to https://cert-manager.netlify.com/docs/configuration/venafi/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/issuing-certificates/index.rst b/docs/tasks/issuing-certificates/index.rst index fd653c535..41093f9e9 100644 --- a/docs/tasks/issuing-certificates/index.rst +++ b/docs/tasks/issuing-certificates/index.rst @@ -1,115 +1,6 @@ -==================== -Issuing Certificates -==================== +========== +File moved +========== -The Certificate resource type is used to request certificates from different -Issuers. - -In order to issue any certificates, you'll need to configure an Issuer resource -first. - -If you have not configured any issuers yet, you should read the -:doc:`Setting up Issuers <../issuers/index>` guide. - -Creating Certificate resources -============================== - -A Certificate resource specifies fields that are used to generated certificate -signing requests which are then fulfilled by the issuer type you have -referenced. - -Certificates specify which issuer they want to obtain the certificate from by -specifying the ``certificate.spec.issuerRef`` field. - -A basic Certificate resource, for the ``example.com`` and ``www.example.com`` -DNS names, ``spiffe://cluster.local/ns/sandbox/sa/example`` URI Subject -Alternative Name, that is valid for 90d and renews 15d before expiry is below: - -.. code-block:: yaml - :linenos: - :emphasize-lines: 9, 10, 11, 12 - - apiVersion: cert-manager.io/v1alpha2 - kind: Certificate - metadata: - name: example-com - namespace: default - spec: - secretName: example-com-tls - duration: 2160h # 90d - renewBefore: 360h # 15d - commonName: example.com - dnsNames: - - example.com - - www.example.com - uriSANs: - - spiffe://cluster.local/ns/sandbox/sa/example - issuerRef: - name: ca-issuer - # We can reference ClusterIssuers by changing the kind here. - # The default value is Issuer (i.e. a locally namespaced Issuer) - kind: Issuer - -The signed certificate will be stored in a Secret resource named -``example-com-tls`` once the issuer has successfully issued the requested -certificate. - -The Certificate will be issued using the issuer named ``ca-issuer`` in the -``default`` namespace (the same namespace as the Certificate resource). - -.. note:: - If you want to create an Issuer that can be referenced by Certificate - resources in **all** namespaces, you should create a - :doc:`ClusterIssuer ` resource and set the - ``certificate.spec.issuerRef.kind`` field to ``ClusterIssuer``. - -.. note:: - The ``renewBefore`` and ``duration`` fields must be specified using Golang's - ``time.Time`` string format, which does not allow the ``d`` (days) suffix. - You must specify these values using ``s``, ``m`` and ``h`` suffixes instead. - Failing to do so without installing the - :doc:`webhook ` component can prevent cert-manager - from functioning correctly (`#1269`_). - -.. note:: - Take care when setting the ``renewBefore`` field to be very close to the - ``duration`` as this can lead to a renewal loop, where the Certificate is - always in the renewal period. Some Issuers set the ``notBefore`` field on - their issued X.509 certificate before the issue time to fix clock-skew - issues, leading to the working duration of a certificate to be less than - the full duration of the certificate. For example, Let's Encrypt sets it - to be one hour before issue time, so the actual *working duration* of the - certificate is 89 days, 23 hours (the *full duration* remains 90 days). - -A full list of the fields supported on the Certificate resource can be found in -the `API reference documentation`_. - -.. _`#1269`: https://github.com/jetstack/cert-manager/issues/1269 -.. _`API reference documentation`: https://docs.cert-manager.io/en/release-0.11/reference/api-docs/index.html#certificatespec-v1alpha2 - -Temporary certificates whilst issuing -===================================== - -With some Issuer types, certificates can take a few minutes to be issued. - -A temporary untrusted certificate will be issued whilst this process takes -places if another certificate does not already exist in the target Secret -resource. - -This helps to improve compatibility with certain ingress controllers (e.g. -ingress-gce_) which require a TLS certificate to be present at all times in -order to function. - -After the real, valid certificate has been obtained, cert-manager will replace -the temporary self signed certificate with the valid one, **but will retain the -same private key**. - -You can disable issuing temporary certificate by setting feature gate flag -``--feature-gates=IssueTemporaryCertificate=false`` - -.. toctree:: - :maxdepth: 2 - - ingress-shim - -.. _ingress-gce: https://github.com/kubernetes/ingress-gce +This document has moved to https://cert-manager.netlify.com/docs/usage/certificate/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/issuing-certificates/ingress-shim.rst b/docs/tasks/issuing-certificates/ingress-shim.rst index 160d93df5..a4f931e03 100644 --- a/docs/tasks/issuing-certificates/ingress-shim.rst +++ b/docs/tasks/issuing-certificates/ingress-shim.rst @@ -1,96 +1,6 @@ -========================================================= -Automatically creating Certificates for Ingress resources -========================================================= +========== +File moved +========== -cert-manager can be configured to automatically provision TLS certificates for -Ingress resources via annotations on your Ingresses. - -A small sub-component of cert-manager, ingress-shim, is responsible for this. - -How it works -============ - -ingress-shim watches Ingress resources across your cluster. If it observes an -Ingress with *any* of the annotations described in the 'Usage' section, it will -ensure a Certificate resource with the same name as the Ingress, and configured -as described on the Ingress exists. For example: - -.. code-block:: yaml - - apiVersion: extensions/v1beta1 - kind: Ingress - metadata: - annotations: - # add an annotation indicating the issuer to use. - cert-manager.io/cluster-issuer: nameOfClusterIssuer - name: myIngress - namespace: myIngress - spec: - rules: - - host: myingress.com - http: - paths: - - backend: - serviceName: myservice - servicePort: 80 - path: / - tls: # < placing a host in the TLS config will indicate a cert should be created - - hosts: - - myingress.com - secretName: myingress-cert # < cert-manager will store the created certificate in this secret. - - -Configuration -============= - -Since cert-manager v0.2.2, ingress-shim is deployed automatically as part of a -Helm chart installation. - -If you would also like to use the old kube-lego_ ``kubernetes.io/tls-acme: "true"`` -annotation for fully automated TLS, you will need to configure a default Issuer -when deploying cert-manager. This can be done by adding the following ``--set`` -when deploying using Helm: - -.. code-block:: shell - - --set ingressShim.defaultIssuerName=letsencrypt-prod \ - --set ingressShim.defaultIssuerKind=ClusterIssuer - - -In the above example, cert-manager will create Certificate resources that reference the ClusterIssuer `letsencrypt-prod` for all Ingresses that have a ``kubernetes.io/tls-acme: "true"`` annotation. - -For more information on deploying cert-manager, read the :doc:`deployment guide `. - -Supported annotations -===================== - -You can specify the following annotations on ingresses in order to trigger -Certificate resources to be automatically created: - -* ``cert-manager.io/issuer`` - the name of an Issuer to acquire the - certificate required for this ingress from. The Issuer **must** be in the same - namespace as the Ingress resource. - -* ``cert-manager.io/cluster-issuer`` - the name of a ClusterIssuer to acquire - the certificate required for this ingress from. It does not matter which - namespace your Ingress resides, as ClusterIssuers are non-namespaced resources. - -* ``kubernetes.io/tls-acme: "true"`` - this annotation requires additional - configuration of the ingress-shim (see above). Namely, a default issuer must be - specified as arguments to the ingress-shim container. - -* ``acme.cert-manager.io/http01-ingress-class`` - this annotation allows you - to configure ingress class that will be used to solve challenges for this - ingress. Customising this is useful when you are trying to secure internal - services, and need to solve challenges using different ingress class to that - of the ingress. If not specified and the 'acme-http01-edit-in-place' - annotation is not set, this defaults to the ingress class of the ingress - resource. - -* ``acme.cert-manager.io/http01-edit-in-place: "true"`` - this controls - whether the ingress is modified 'in-place', or a new one created specifically - for the http01 challenge. If present, and set to "true" the existing ingress - will be modified. Any other value, or the absence of the annotation assumes - "false". - -.. _kube-lego: https://github.com/jetstack/kube-lego +This document has moved to https://cert-manager.netlify.com/docs/usage/ingress/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/uninstall/index.rst b/docs/tasks/uninstall/index.rst index a71eefa55..12316dd71 100644 --- a/docs/tasks/uninstall/index.rst +++ b/docs/tasks/uninstall/index.rst @@ -1,16 +1,6 @@ -========================= -Uninstalling cert-manager -========================= +========== +File moved +========== -cert-manager supports running on Kubernetes_ and OpenShift_. The uninstallation -process between the two platforms is similar, although there are a number of -extra notes to be aware of per-platform. - -.. toctree:: - :maxdepth: 1 - - kubernetes - openshift - -.. _Kubernetes: https://kubernetes.io -.. _OpenShift: https://www.openshift.com +This document has moved to https://cert-manager.netlify.com/docs/tutorials/uninstall/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/uninstall/kubernetes.rst b/docs/tasks/uninstall/kubernetes.rst index ebe2e3433..ed17c004e 100644 --- a/docs/tasks/uninstall/kubernetes.rst +++ b/docs/tasks/uninstall/kubernetes.rst @@ -1,79 +1,6 @@ -========================== -Uninstalling on Kubernetes -========================== +========== +File moved +========== -Below is the processes for uninstalling cert-manager on Kubernetes. There are -two processes to chose depending on which method you used to install -cert-manager - static manifests or ``helm``. - -.. warning:: - - To uninstall cert-manger you should always use the same process for installing - but in reverse. Deviating from the following process whether cert-manager has - been installed from static manifests or helm can cause issues and - potentially broken states. Please ensure you follow the below steps when - uninstalling to prevent this happening. - -Before continuing, ensure that all cert-manager resources that have been created -by users have been deleted. You can check for any existing resources with the -following command: - -.. code-block:: shell - - kubectl get Issuers,ClusterIssuers,Certificates,CertificateRequests,Orders,Challenges --all-namespaces - -O nce all these resources have been deleted you are ready to uninstall -cert-manager using the procedure determined by how you installed. - -Uninstalling with regular manifests -=================================== - -Uninstalling from an installation with regular manifests is a case of running -the installation process, *in reverse*, using the delete command of ``kubectl``. - -Delete the installation manifests using a link to your currently running -version vX.Y.Z like so: - -.. code-block:: shell - - kubectl delete -f https://github.com/jetstack/cert-manager/releases/download/vX.Y.Z/cert-manager.yaml - -Uninstalling with Helm -====================== - -Uninstalling cert-manager from a ``helm`` installation is a case of running the -installation process, *in reverse*, using the delete command on both ``kubectl`` -and ``helm``. - -Firstly, delete the cert-manager installation using ``helm``. Ensure the -``--purge`` flag is applied. - -.. code-block:: shell - - helm delete cert-manager --purge - -Next, delete the cert-manager namespace: - -.. code-block:: shell - - kubectl delete namespace cert-manager - -Finally, delete the cert-manger `CustomResourceDefinitions`_ using the link to -the version vX.Y you installed: - -.. code-block:: shell - - kubectl delete -f https://raw.githubusercontent.com/jetstack/cert-manager/release-X.Y/deploy/manifests/00-crds.yaml - -Namespace Stuck in Terminating State -==================================== - -If the namespace has been marked for deletion without deleting the cert-manager -installation first, the namespace may become stuck in a terminating state. This -is typically due to the fact that the `APIService`_ resource still exists -however the webhook is no longer running so is no longer reachable. To resolve -this, ensure you have run the above commands correctly, and if you're still -experiencing issues then run ``kubectl delete apiservice v1beta1.webhook.cert-manager.io``. - -.. _`CustomResourceDefinitions`: https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/ -.. _`APIService`: https://kubernetes.io/docs/tasks/access-kubernetes-api/setup-extension-api-server +This document has moved to https://cert-manager.netlify.com/docs/tutorials/uninstall/kubernetes/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/uninstall/openshift.rst b/docs/tasks/uninstall/openshift.rst index f1e4cedea..297f35080 100644 --- a/docs/tasks/uninstall/openshift.rst +++ b/docs/tasks/uninstall/openshift.rst @@ -1,60 +1,6 @@ -========================= -Uninstalling on OpenShift -========================= +========== +File moved +========== -Below is the processes for uninstalling cert-manager on OpenShift. - -.. warning:: - - To uninstall cert-manger you should always use the same process for installing - but in reverse. Deviating from the following process can cause issues and - potentially broken states. Please ensure you follow the below steps when - uninstalling to prevent this happening. - -Login to your OpenShift cluster -=============================== - -Before you can uninstall cert-manager, you must first ensure your local machine -is configured to talk to your OpenShift cluster using the ``oc`` tool. - -.. code-block:: shell - - # Login to the OpenShift cluster as the system:admin user - oc login -u system:admin - -Uninstalling with regular manifests -=================================== - -Before continuing, ensure that all cert-manager resources that have been created -by users have been deleted. You can check for any existing resources with the -following command: - -.. code-block:: shell - - oc get Issuers,ClusterIssuers,Certificates,CertificateRequests,Orders,Challenges --all-namespaces - -Once all these resources have been deleted you are ready to uninstall -cert-manager. - -Uninstalling from an installation with regular manifests is a case of running -the installation process, *in reverse*, using the delete command of ``oc``. - -Delete the installation manifests using a link to your currently running -version vX.Y.Z like so: - -.. code-block:: shell - - oc delete -f https://github.com/jetstack/cert-manager/releases/download/vX.Y.Z/cert-manager-openshift.yaml - -Namespace Stuck in Terminating State -==================================== - -If the namespace has been marked for deletion without deleting the cert-manager -installation first, the namespace may become stuck in a terminating state. This -is typically due to the fact that the `APIService`_ resource still exists -however the webhook is no longer running so is no longer reachable. To resolve -this, ensure you have run the above commands correctly, and if you're still -experiencing issues then run ``oc delete apiservice v1beta1.webhook.cert-manager.io``. - -.. _`CustomResourceDefinitions`: https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/ -.. _`APIService`: https://kubernetes.io/docs/tasks/access-kubernetes-api/setup-extension-api-server +This document has moved to https://cert-manager.netlify.com/docs/tutorials/uninstall/openshift/. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/upgrading/index.rst b/docs/tasks/upgrading/index.rst index 230b65243..7bcd75ed6 100644 --- a/docs/tasks/upgrading/index.rst +++ b/docs/tasks/upgrading/index.rst @@ -1,98 +1,6 @@ -====================== -Upgrading cert-manager -====================== +========== +File moved +========== -This section contains information on upgrading cert-manager. -It also contains documents detailing breaking changes between cert-manager -versions, and information on things to look out for when upgrading. - -.. note:: - Before performing upgrades of cert-manager, it is advised to take a backup - of all your cert-manager resources just in case an issue occurs whilst - upgrading. You can read how to backup and restore cert-manager in the - :doc:`../backup-restore-crds` guide. - -Upgrading with Helm -=================== - -If you installed cert-manager using Helm, you can easily upgrade using the Helm -CLI. - -.. note:: - Before upgrading, please read the relevant instructions at the links below - for your from and to version. - -Once you have read the relevant upgrading notes and taken any appropriate -actions, you can begin the upgrade process like so - replacing -```` with the name of your Helm release for cert-manager (usually -this is ``cert-manager``) and replacing ```` with the -version number you want to install: - -.. code:: shell - - # Install the cert-manager CustomResourceDefinition resources before - # upgrading the Helm chart - kubectl apply \ - --validate=false \ - -f https://raw.githubusercontent.com/jetstack/cert-manager//deploy/manifests/00-crds.yaml - - # Add the Jetstack Helm repository if you haven't already - helm repo add jetstack https://charts.jetstack.io - - # Ensure the local Helm chart repository cache is up to date - helm repo update - - helm upgrade --version jetstack/cert-manager - -This will upgrade you to the latest version of cert-manager, as listed in the -`Jetstack Helm chart repository`_. - -.. note:: - You can find out your release name using ``helm list | grep cert-manager``. - -Upgrading using static manifests -================================ - -If you installed cert-manager using the static deployment manifests published -on each release, you can upgrade them in a similar way to how you first -installed them. - -.. note:: - Before upgrading, please read the relevant instructions at the links below - for your from and to version. - -Once you have read the relevant notes and taken any appropriate actions, you -can begin the upgrade process like so - replacing ```` with the -version number you want to install: - -.. code:: shell - - kubectl apply \ - --validate=false \ - -f https://github.com/jetstack/cert-manager/releases/download//cert-manager.yaml - -.. note:: - If you are running Kubernetes v1.15 or below, you will need to add the - ``--validate=false`` flag to your ``kubectl apply`` command above else you - will receive a validation error relating to the - ``x-kubernetes-preserve-unknown-fields`` field in our - ``CustomResourceDefinition`` resources. - This is a benign error and occurs due to the way ``kubectl`` performs - resource validation. - -.. toctree:: - :maxdepth: 1 - - upgrading-0.2-0.3 - upgrading-0.3-0.4 - upgrading-0.4-0.5 - upgrading-0.5-0.6 - upgrading-0.6-0.7 - upgrading-0.7-0.8 - upgrading-0.8-0.9 - upgrading-0.9-0.10 - upgrading-0.10-0.11 - -.. _`official Helm charts repository`: https://hub.helm.sh/charts/jetstack -.. _`static deployment manifests`: https://github.com/jetstack/cert-manager/blob/release-0.11/deploy/manifests -.. _`kubernetes/kubernetes#69590`: https://github.com/kubernetes/kubernetes/issues/69590 +This document has moved to https://cert-manager.netlify.com/docs/TODO. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/upgrading/upgrading-0.10-0.11.rst b/docs/tasks/upgrading/upgrading-0.10-0.11.rst index c1ec7550f..7bcd75ed6 100644 --- a/docs/tasks/upgrading/upgrading-0.10-0.11.rst +++ b/docs/tasks/upgrading/upgrading-0.10-0.11.rst @@ -1,115 +1,6 @@ -============================= -Upgrading from v0.10 to v0.11 -============================= +========== +File moved +========== -The v0.11 release marks the removal of the v1alpha1 API that was used in -previous versions of cert-manager, as well as our API group changing to be -``cert-manager.io`` instead of ``certmanager.k8s.io``. - -We have also removed support for the **old style config format** that was -deprecated in the v0.8 release. This means you **must** transition to using the -new ``solvers`` style configuration format for your ACME issuers **before** -upgrading to v0.11. For more information, see the -:doc:`upgrading to v0.8 ` guide. - -This makes for a fairly significant breaking change for users, as **all** -cert-manager resources, or even Ingresses that reference cert-manager -resources, will need to be updated to reflect these changes. - -This upgrade should be performed in a few steps: - -1) Back up existing cert-manager resources, as per the - :doc:`backup and restore guide <../backup-restore-crds>`. - -2) :doc:`Uninstall cert-manager <../uninstall/index>`. - -3) Ensure the old cert-manager CRD resources have also been deleted: ``kubectl get crd | grep certmanager.k8s.io`` - -4) Update the apiVersion on all your backed up resources from - ``certmanager.k8s.io/v1alpha1`` to ``cert-manager.io/v1alpha2``. - -5) Re-install cert-manager from scratch according to the :doc:`getting started guide `. - -You must be sure to properly **backup**, **uninstall**, **re-install** and -**restore** your installation in order to ensure the upgrade is successful. - -Additional annotation changes -============================= - -As well as changing the API group used by our CRDs, we have also changed the -annotation-based configuration key to **also** reflect the new API group. - -This means that if you use any cert-manager annotations on any of your other -resources (such as Ingresses, {Validating,Mutating}WebhookConfiguration, etc) -you will need to update them to reflect the new API group. - -A full table of annotations, including the old and new equivalents: - -+----------------------------------------------+-------------------------------------------+ -| Old Annotation | New Annotation | -+----------------------------------------------+-------------------------------------------+ -| certmanager.k8s.io/acme-http01-edit-in-place | acme.cert-manager.io/http01-edit-in-place | -+----------------------------------------------+-------------------------------------------+ -| certmanager.k8s.io/acme-http01-ingress-class | acme.cert-manager.io/http01-ingress-class | -+----------------------------------------------+-------------------------------------------+ -| certmanager.k8s.io/issuer | cert-manager.io/issuer | -+----------------------------------------------+-------------------------------------------+ -| certmanager.k8s.io/cluster-issuer | cert-manager.io/cluster-issuer | -+----------------------------------------------+-------------------------------------------+ -| certmanager.k8s.io/acme-challenge-type | DEPRECIATED | -+----------------------------------------------+-------------------------------------------+ -| certmanager.k8s.io/acme-dns01-provider | DEPRECIATED | -+----------------------------------------------+-------------------------------------------+ -| certmanager.k8s.io/alt-names | cert-manager.io/alt-names | -+----------------------------------------------+-------------------------------------------+ -| certmanager.k8s.io/ip-sans | cert-manager.io/ip-sans | -+----------------------------------------------+-------------------------------------------+ -| certmanager.k8s.io/common-name | cert-manager.io/common-name | -+----------------------------------------------+-------------------------------------------+ -| certmanager.k8s.io/issuer-name | cert-manager.io/issuer-name | -+----------------------------------------------+-------------------------------------------+ -| certmanager.k8s.io/issuer-kind | cert-manager.io/issuer-kind | -+----------------------------------------------+-------------------------------------------+ - -You can use the following bash magic to print a list of Ingress resources that -still contain an old annotation: - -.. code-block:: shell - - kubectl get ingress \ - --all-namespaces \ - -o json | \ - jq '.items[] | select(.metadata.annotations| to_entries | map(.key)[] | test("certmanager")) | "Ingress resource \(.metadata.namespace)/\(.metadata.name) contains old annotations: (\( .metadata.annotations | to_entries | map(.key)[] | select( . | test("certmanager") ) ))"' - - Ingress resource "demo/testcrt contains old annotations: (certmanager.k8s.io/cluster-issuer)" - Ingress resource "example/ingress-resource contains old annotations: (certmanager.k8s.io/cluster-issuer)" - -In order to help with this migration, the following CLI tool will automatically -migrate these annotations for you. Note that it *will not* make any changes to -your cluster for you. - -.. code-block:: shell - - # Firstly, download the binary for your given platform - $ wget -O api-migration https://github.com/jetstack/cert-manager/releases/download/v0.11.0/api-migration-linux - # or for Darwin - $ wget -O api-migration https://github.com/jetstack/cert-manager/releases/download/v0.11.0/api-migration-darwin - - # Mark the binary as executable and run the binary against your cluster - $ chmod +x api-migration && ./api-migration --kubeconfig /path/to/my/kubeconfig.yaml - - # Follow the CLI ouput and check for the difference that has been made in files - $ diff ingress.yaml ingress-migrated.yaml - - # Finally, once the new ingress resources have been reviewed, apply the manifests - $ kubectl apply -f ingress-migrated.yaml --kubeconfig /path/to/my/kubeconfig.yaml - -You should make sure to update _all_ Ingress resources to ensure that your -certificates continue to be kept up to date. - -Issuer/ClusterIssuer solvers -============================ - -Support for the deprecated ``spec.http01`` or ``spec.dns01`` fields in ``Issuer`` and ``ClusterIssuer`` have been removed. Any ``Issuer`` or ``ClusterIssuer`` objects must be converted to use the equivalent ``spec.solvers[].http01`` or ``spec.solvers[].dns01`` syntax. You can read more about the Issuer resource in the :doc:`Issuer reference docs `. - -Any issuers that haven't been converted will result the ``cert-manager`` pod being unable to find any solvers at the expected location. This will result in errors like the following: ``no configured challenge solvers can be used for this challenge`` +This document has moved to https://cert-manager.netlify.com/docs/TODO. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/upgrading/upgrading-0.2-0.3.rst b/docs/tasks/upgrading/upgrading-0.2-0.3.rst index 0cc32c174..7bcd75ed6 100644 --- a/docs/tasks/upgrading/upgrading-0.2-0.3.rst +++ b/docs/tasks/upgrading/upgrading-0.2-0.3.rst @@ -1,138 +1,6 @@ -=========================== -Upgrading from v0.2 to v0.3 -=========================== +========== +File moved +========== -During the v0.3 release, a number of breaking changes were made that require you -to update either deployment configuration and runtime configuration (e.g. Certificate, -Issuer and ClusterIssuer resources). - -After reading these instructions, you should then proceed to upgrade cert-manager -according to your deployment configuration (e.g. using ``helm upgrade`` if installing -via Helm chart, or ``kubectl apply`` if installing with raw manifests). - -A brief summary: - -* Supporting resources for ClusterIssuers (e.g. signing CA certificates, or - ACME account private keys) will now be stored in the same namespace as - cert-manager, instead of kube-system in previous versions (#329, @munnerz) - -* Switch to ConfigMaps instead of Endpoints for leader election (#327, @mikebryant) - -* Removing support for ACMEv1 in favour of ACMEv2 (#309, @munnerz) - -* Removing ingress-shim and compiling it into cert-manager itself (#502, @munnerz) - -* Change to the default behaviour of ingress-shim. It now generates Certificates - with the ``ingressClass`` field set instead of the ``ingress`` field. This will - mean users of ingress controllers that assign a single IP to a single Ingress (e.g. - the GCE ingress controller) will no longer work without adding a new annotation - to your ingress resource. - -Supporting resources for ClusterIssuers moving into the cert-manager namespace -============================================================================== - -In the past, the cert-manager controller was hard coded to look for supplemental -resources, such as Secrets containing DNS provider credentials, in the kube-system -namespace. - -We now store these resources in the same namespace as the cert-manager pod itself -runs within. - -When upgrading, you should make sure to move any of these supplemental resources into -the cert-manager deployment namespace, or otherwise deploy cert-manager into kube-system -itself. - -You can also change the 'cluster resource namespace' when deploying cert-manager: - -With the helm chart: ``--set clusterResourceNamespace=kube-system``. - -Or if using the static deployment manifests, by adding the ``--cluster-resource-namespace`` -flag to the ``args`` field of the cert-manager container. - -Switch to ConfigMaps instead of Endpoints for leader election -============================================================= - -cert-manager-controller performs leader election to allow you to run 'hot standby' -replicas of cert-manager. - -In the past, we used Endpoint resources to perform this election. -The new best practice is to use ConfigMap resources in order to reduce API overhead -in large clusters. - -As such, v0.3 switches us to use ConfigMap resources for leader election. - -During the upgrade, you should first scale your cert-manager-controller deployment -to 0 to ensure no other replicas of cert-manager are running when the new v0.3 -deployment starts: - -.. code-block:: shell - - kubectl scale --namespace --replicas=0 deployment - -Removing support for ACMEv1 in favour of ACMEv2 -=============================================== - -The ACME v2 specification is now in production with Let's Encrypt. -In order to support this new spec, which includes support for wildcard certificates, -we have removed support for the v1 protocol altogether. - -If you have any ACME Issuer or ClusterIssuer resources, you should update the -server fields of these to the new ACMEv2 endpoints. - -For example, if you have a Let's Encrypt production issuer, you should update the -server URL: - -.. code-block:: yaml - - apiVersion: certmanager.k8s.io/v1alpha2 - kind: Issuer - ... - spec: - acme: - # server: https://acme-v01.api.letsencrypt.org/directory - server: https://acme-v02.api.letsencrypt.org/directory # we switch 'v01' to 'v02' - -Removing ingress-shim and compiling it into cert-manager itself -=============================================================== - -In v0.3 we removed the ingress-shim component and instead now compile in its -functionality into the main cert-manager binary. - -This change also introduces a change to the way you configure default Issuers -and ClusterIssuers at deployment time. - -The deployment documentation has been updated accordingly, but instead of setting -``ingressShim.extraArgs={--default-issuer-name=letsencrypt-pod}`` there are -now dedicated Helm chart fields: - -.. code-block:: shell - - --set ingressShim.defaultIssuerName=letsencrypt-prod \ - --set ingressShim.defaultIssuerKind=ClusterIssuer - -Change to the default behaviour of ingress-shim -=============================================== - -In the past, when using ingress-shim, we set the ``ingress`` field on the Certificate -resource to trigger cert-manager to edit the specified Ingress resource to solve -the challenge. - -The alternate option is to set the ``ingressClass`` field, which causes cert-manager -to create temporary Ingress resources to solve the challenge. This behaviour provides -better compatibility with ingress controllers like nginx-ingress_. - -In v0.3 we have changed the default behaviour of ingress-shim to set the ``ingressClass`` -field instead of ``ingress``. - -This will cause validations for ingress controllers like ingress-gce_ to fail without -additional configuration in your Ingress resources annotations. - -Add the follow annotation to your Ingress resources if you are using the GCE ingress -controller, in addition to the usual ingress-shim annotation(s): - -.. code-block:: yaml - - certmanager.k8s.io/acme-http01-edit-in-place: "true" - -.. _nginx-ingress: https://github.com/kubernetes/ingress-nginx -.. _ingress-gce: https://github.com/kubernetes/ingress-gce \ No newline at end of file +This document has moved to https://cert-manager.netlify.com/docs/TODO. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/upgrading/upgrading-0.3-0.4.rst b/docs/tasks/upgrading/upgrading-0.3-0.4.rst index c7411bdfa..7bcd75ed6 100644 --- a/docs/tasks/upgrading/upgrading-0.3-0.4.rst +++ b/docs/tasks/upgrading/upgrading-0.3-0.4.rst @@ -1,5 +1,6 @@ -=========================== -Upgrading from v0.3 to v0.4 -=========================== +========== +File moved +========== -There are no special notes or considerations when upgrading from v0.3 to v0.4. +This document has moved to https://cert-manager.netlify.com/docs/TODO. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/upgrading/upgrading-0.4-0.5.rst b/docs/tasks/upgrading/upgrading-0.4-0.5.rst index 8b83bbd66..7bcd75ed6 100644 --- a/docs/tasks/upgrading/upgrading-0.4-0.5.rst +++ b/docs/tasks/upgrading/upgrading-0.4-0.5.rst @@ -1,21 +1,6 @@ -=========================== -Upgrading from v0.4 to v0.5 -=========================== +========== +File moved +========== -Version 0.5 of cert-manager introduces a new 'webhook' component, which is used -by the Kubernetes apiserver to validate our CRD resource types. - -This should help in future to reduce errors caused by misconfigured Certificate -and Issuer resources. - -When upgrading from a previous release using Helm, it is **essential** that -you perform one extra step before upgrading. - -Disabling resource validation on the cert-manager namespace -=========================================================== - -Before upgrading, you should add the ``certmanager.k8s.io/disable-validation: "true"`` -label to the ``cert-manager`` namespace. - -This will allow the system resources that cert-manager requires to bootstrap -TLS to be created in its own namespace. +This document has moved to https://cert-manager.netlify.com/docs/TODO. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/upgrading/upgrading-0.5-0.6.rst b/docs/tasks/upgrading/upgrading-0.5-0.6.rst index 1dc710eca..7bcd75ed6 100644 --- a/docs/tasks/upgrading/upgrading-0.5-0.6.rst +++ b/docs/tasks/upgrading/upgrading-0.5-0.6.rst @@ -1,102 +1,6 @@ -=========================== -Upgrading from v0.5 to v0.6 -=========================== +========== +File moved +========== -.. warning:: - If you are upgrading from a release older than v0.5, please read the - `Upgrading from older versions using Helm`_ note at the bottom of this - document! - -The upgrade process from v0.5 to v0.6 should be fairly seamless for most users. -As part of the new release, we have changed how we ship the -CustomResourceDefinition resources that cert-manager needs in order to operate -(as well as introducing two **new** CRD types). - -Depending on the way you have installed cert-manager in the past, your upgrade -process will slightly vary: - -Upgrading with the Helm chart -============================= - -If you have previously deployed cert-manager v0.5 using the Helm installation -method, you will now need to perform one extra step before upgrading. - -Due to issues with the way Helm handles CRD resources in Helm charts, we have -now moved the installation of these resources into a separate YAML manifest -that must be installed with ``kubectl apply`` before upgrading the chart. - -You can follow the :doc:`regular upgrade guide <./index>` as -usual in order to upgrade from v0.5 to v0.6. - -Upgrading with static manifests -=============================== - -The static manifests have moved into the ``deploy/manifests`` directory for -this release. - -We now also no longer ship different manifests for different configurations, in -favour of a single ``cert-manager.yaml`` file which should work for all -Kubernetes clusters from Kubernetes v1.9 onwards. - -You can follow the :doc:`regular upgrade guide <./index>` as -usual in order to upgrade from v0.5 to v0.6. - -Upgrading from older versions using Helm -======================================== - -If you are upgrading from a version **older than v0.5** and -**have installed with Helm**, you will need to perform a fresh installation of -cert-manager due to issues with the Helm upgrade process. -This will involve the **removal of all cert-manager custom resources**. -This **will not** delete the Secret resources being used by your apps. - -Before upgrading you will need to: - -1. Read and follow the :doc:`backup guide <../backup-restore-crds>` to create a - backup of your configuration. - -2. Delete the existing cert-manager Helm release (replacing 'cert-manager' with - the name of your Helm release): - -.. code-block:: shell - - # Uninstall the Helm chart - $ helm delete --purge cert-manager - - # Ensure the cert-manager CustomResourceDefinition resources do not exist: - $ kubectl delete crd \ - certificates.certmanager.k8s.io \ - issuers.certmanager.k8s.io \ - clusterissuers.certmanager.k8s.io - -3. Perform a fresh install (as per the - :doc:`installation guide `): - -.. code-block:: shell - - # Install the cert-manager CRDs - $ kubectl apply \ - -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.6/deploy/manifests/00-crds.yaml - - # Update helm repository cache - $ helm repo update - - # Install cert-manager - $ helm install \ - --name cert-manager \ - --namespace cert-manager \ - --version v0.6.6 \ - stable/cert-manager - -4. Follow the steps in the :doc:`restore guide <../backup-restore-crds>` to - restore your configuration. - -5. Verify that your Issuers and Certificate resources are 'Ready': - -.. code-block:: shell - - $ kubectl get clusterissuer,issuer,certificates --all-namespaces - NAMESPACE NAME READY SECRET AGE - cert-manager cert-manager-webhook-ca True cert-manager-webhook-ca 1m - cert-manager cert-manager-webhook-webhook-tls True cert-manager-webhook-webhook-tls 1m - example-com example-com-tls True example-com-tls 11s +This document has moved to https://cert-manager.netlify.com/docs/TODO. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/upgrading/upgrading-0.6-0.7.rst b/docs/tasks/upgrading/upgrading-0.6-0.7.rst index 15cdf7cff..7bcd75ed6 100644 --- a/docs/tasks/upgrading/upgrading-0.6-0.7.rst +++ b/docs/tasks/upgrading/upgrading-0.6-0.7.rst @@ -1,5 +1,6 @@ -=========================== -Upgrading from v0.6 to v0.7 -=========================== +========== +File moved +========== -There are no special notes or considerations when upgrading from v0.6 to v0.7. +This document has moved to https://cert-manager.netlify.com/docs/TODO. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/upgrading/upgrading-0.7-0.8.rst b/docs/tasks/upgrading/upgrading-0.7-0.8.rst index 11f610db9..7bcd75ed6 100644 --- a/docs/tasks/upgrading/upgrading-0.7-0.8.rst +++ b/docs/tasks/upgrading/upgrading-0.7-0.8.rst @@ -1,283 +1,6 @@ -=========================== -Upgrading from v0.7 to v0.8 -=========================== +========== +File moved +========== -Upgrading from v0.7 to v0.8 is possible using the regular :doc:`upgrade guide <./index>`. - -All resources should continue to operate as before. - -As part of v0.8, a new format **for configure ACME Certificate resources** has -been introduced. Notably, challenge solver configuration has moved **from** -the Certificate resource (under ``certificate.spec.acme``) and now resides on -your configure **Issuer** resource, under ``issuer.spec.acme.solvers``. - -This allows Certificate resources to be portable between different Issuer types. - -Both the old and the new format of configuration are supported in the v0.8 -release, so it is possible to **incrementally upgrade your resources** if you -have a large, multi-team deployment of cert-manager that makes it complex to -upgrade all manifests at once in place. - -After upgrading, it is **strongly recommended** that you update your ACME -Issuer and Certificate resources to the :doc:`new format `. - -We will be removing support for the old format ahead of the 1.0 release. - -The documentation has been updated to reflect configuring using the new format, -and as such, exhaustive information can be found in the :doc:`/tasks/issuers/setup-acme/index` -document. - -Performing an incremental switch to the new format -================================================== - -The following guide assumes you have 2 'solver types' currently in use across -your cert-manager deployment - one for DNS01 and another for HTTP01 using an -ingress class of ``nginx``. The nginx based HTTP01 solver will be configured as -the default solver type for Certificate resources that reference our issuer. - -You can adjust the instructions below to fit your own configuration, either -with more or less solvers as appropriate. - -First, we will modify our ACME Issuer to add the new HTTP01 and DNS01 solvers. -This operation **will not** effect any existing Certificates that already -explicitly set a ``certificate.spec.acme`` field: - -.. code-block:: yaml - :linenos: - :emphasize-lines: 12-17, 28-52 - - apiVersion: certmanager.k8s.io/v1alpha2 - kind: ClusterIssuer - metadata: - name: letsencrypt-staging - spec: - acme: - email: user@example.com - server: https://acme-staging-v02.api.letsencrypt.org/directory - privateKeySecretRef: - name: example-issuer-account-key - - # The HTTP01 and DNS01 fields are now **deprecated**. - # We leave them in place here so that any Certificates that still - # specify a ``certificate.spec.acme`` stanza will continue to operate - # correctly. - # cert-manager will decide which configuration to use based on whether - # the Certificate contains a ``certificate.spec.acme`` stanza. - http01: {} - dns01: - providers: - - name: cloudflare - cloudflare: - email: my-cloudflare-acc@example.com - apiKeySecretRef: - name: cloudflare-api-key-secret - key: api-key - - # Configure the challenge solvers. - solvers: - # An empty selector will 'match' all Certificate resources that - # reference this Issuer. - - selector: {} - http01: - ingress: - class: nginx - - selector: - # Any Certificate resources, or Ingress resources that use - # ingress-shim and match the below label selector will use this - # configured solver type instead of the default nginx based HTTP01 - # solver above. - # You can continue to add new solver types if needed. - # The most specific 'match' will be used. - matchLabels: - use-cloudflare-solver: "true" - dns01: - # Adjust the configuration below according to your environment. - # You can view more example configurations for different DNS01 - # providers in the documentation: https://docs.cert-manager.io/en/latest/tasks/issuers/setup-acme/dns01/index.html - cloudflare: - email: my-cloudflare-acc@example.com - apiKeySecretRef: - name: cloudflare-api-key-secret - key: api-key - - -By retaining both the old and the new configuration format on the Issuer -resource, we can begin the process of incrementally upgrading our Certificate -resources. - -Any Certificate resources that you have manually created (i.e. not managed by -ingress-shim) must then be updated to remove the ``certificate.spec.acme`` -stanza. - -Given the above configuration, certificates will use the HTTP01 solver with the -``nginx`` ingress class in order to solve ACME challenges. - -If a particular certificate requires a wildcard, or you simply want to use -DNS01 for that certificate instead of HTTP01, you can add the ``use-cloudflare-solver: "true"`` -label to your Certificate resources and the appropriate ACME challenge solver -will be used. - -Upgrading ingress-shim managed certificates to the new format -============================================================= - -When using ingress-shim, cert-manager itself will create and manage your -Certificate resource for you. - -In order to support both the old and the new format simultaneously, -ingress-shim will continue to set the ``certificate.spec.acme`` field on -Certificate resources it manages. - -In order to force ingress-shim to also use the new format, you must **remove** -the old format configuration from your Issuer resources (i.e. ``issuer.spec.acme.http01`` -and ``issuer.spec.acme.dns01``). - -When ingress-shim detects that these fields are not specified, it will -clear/not set the ``certificate.spec.acme`` field. - -If you are managing a certificate using ingress-shim that requires an -alternative solver type (other than the default solver configured on the issuer -which in this instance is the HTTP01 nginx solver), you can add labels to the -Ingress resource which will be automatically copied across to the Certificate -resource: - -.. code-block:: yaml - :linenos: - :emphasize-lines: 6 - - apiVersion: extensions/v1beta1 - kind: Ingress - metadata: - name: my-test-ingress - labels: - use-cloudflare-solver: "true" - -Confirming all Certificate resources are upgraded -================================================= - -In order to check if any of your Certificate resources still have the old -configuration format, you can run the following command: - -.. code-block:: shell - - kubectl get certificate --all-namespaces \ - -o custom-columns="NAMESPACE:.metadata.namespace,NAME:.metadata.name,OWNER:.metadata.ownerReferences[0].kind,OLD FORMAT:.spec.acme" - - NAMESPACE NAME OWNER OLD FORMAT - default test - default test2 Ingress map[config:[map[domains:[abc.com] http01:map[ingressClass:nginx]]]] - -In the above example, we can see there are two Certificate resources. - -The ``test`` resource has been updated to no longer include the -``certificate.spec.acme`` field. - -The ``test2`` resource still specifies the old configuration format, however it -**also** has an OwnerReference linking it to an **Ingress** resource. -This is because the ``test2`` Certificate resource is managed by ingress-shim. - -As mentioned in the previous section, ingress-shim managed certificates will -only switch to the new format once the **old format** configuration on the -**Issuer** resource has been removed. This means we need to continue to the -next section in order to remove the old format configuration altogether from -**Issuer** resource in order for ingress-shim to automatically migrate the -``test2`` Certificate resource. - -Removing old configuration altogether -===================================== - -Once we've verified that all non-ingress-shim managed Certificate resources -have been updated to not specify the ``certificate.spec.acme`` stanza using the -command above, we can proceed to remove the ``issuer.spec.acme.http01`` and -``issuer.spec.acme.dns01`` stanzas from our Issuer resources. -Once completed, the Issuer resource from the previous section should look like -the following: - -.. code-block:: yaml - :linenos: - - apiVersion: certmanager.k8s.io/v1alpha2 - kind: ClusterIssuer - metadata: - name: letsencrypt-staging - spec: - acme: - email: user@example.com - server: https://acme-staging-v02.api.letsencrypt.org/directory - privateKeySecretRef: - name: example-issuer-account-key - - # Configure the challenge solvers. - solvers: - # An empty selector will 'match' all Certificate resources that - # reference this Issuer. - - selector: {} - http01: - ingress: - class: nginx - - selector: - # Any Certificate resources, or Ingress resources that use - # ingress-shim and match the below label selector will use this - # configured solver type instead of the default nginx based HTTP01 - # solver above. - # You can continue to add new solver types if needed. - # The most specific 'match' will be used. - matchLabels: - use-cloudflare-solver: "true" - dns01: - # Adjust the configuration below according to your environment. - # You can view more example configurations for different DNS01 - # providers in the documentation: https://docs.cert-manager.io/en/latest/tasks/issuers/setup-acme/dns01/index.html - cloudflare: - email: my-cloudflare-acc@example.com - apiKeySecretRef: - name: cloudflare-api-key-secret - key: api-key - -After applying the above Issuer resource, you should re-run the command from -the last section to verify that the remaining ingress-shim managed Certificate -resources have also been updated to the new format: - -.. code-block:: shell - - kubectl get certificate --all-namespaces \ - -o custom-columns="NAMESPACE:.metadata.namespace,NAME:.metadata.name,OWNER:.metadata.ownerReferences[0].kind,OLD FORMAT:.spec.acme" - - NAMESPACE NAME OWNER OLD FORMAT - default test - default test2 Ingress - -Manually triggering a Certificate to be issued to validate the full config -========================================================================== - -To be certain that you've correctly configured your new Issuer/Certificate -resources, it is advised you attempt to issue a new Certificate after removing -the old configuration format. - -To do so, you can either: - -* update the ``secretName`` field of an existing Certificate resource -* add an additional ``dnsName`` to one of your existing Certificate resources -* create a new Certificate resource - -You should ensure that your Certificates are still be issued correctly to avoid -any potential issues at renewal time. - -Special notes for ingress-gce users -=================================== - -Users of the ``ingress-gce`` ingress controller may find that their experience -configuring cert-manager to solve challenges using HTTP01 validation is -slightly more painful using the new format, as it requires the ``ingressName`` -field to be specified as a distinct ``solver`` on the Issuer resource (as -opposed to in the past where the ingressName could be specified as a field on -the ``Certificate`` resource). - -This is a `known issue`_, and a workaround is scheduled to be completed for -v0.9. - -In the meantime, ingress-gce users can either choose to manually create a -new solver entry per Ingress resource they want to use to solve challenges, or -otherwise continue to use the **old format** until a suitable alternative -appears in v0.9. - -.. _known issue: https://github.com/jetstack/cert-manager/issues/1666 +This document has moved to https://cert-manager.netlify.com/docs/TODO. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/upgrading/upgrading-0.8-0.9.rst b/docs/tasks/upgrading/upgrading-0.8-0.9.rst index 57ef1e8fe..7bcd75ed6 100644 --- a/docs/tasks/upgrading/upgrading-0.8-0.9.rst +++ b/docs/tasks/upgrading/upgrading-0.8-0.9.rst @@ -1,20 +1,6 @@ -=========================== -Upgrading from v0.8 to v0.9 -=========================== +========== +File moved +========== -Due to a change in the API group that cert-manager deployments use -(`apps/v1beta1` to `apps/v1`), cert-manager deployments must first be deleted -before applying the new version. This will cause downtime until the new version -has been applied. No data loss will occur during this operation however it is -always advised to backup your data during an upgrade, which you can follow -:doc:`here <../backup-restore-crds>`. To perform this action run: - -.. code-block:: shell - - kubectl delete deployments --namespace cert-manager \ - cert-manager \ - cert-manager-cainjector \ - cert-manager-webhook - -After this operation, follow the standard upgrade process as defined in the -:doc:`upgrade guide <./index>`. +This document has moved to https://cert-manager.netlify.com/docs/TODO. +This placeholder file will be removed in a later release. diff --git a/docs/tasks/upgrading/upgrading-0.9-0.10.rst b/docs/tasks/upgrading/upgrading-0.9-0.10.rst index 446ada946..7bcd75ed6 100644 --- a/docs/tasks/upgrading/upgrading-0.9-0.10.rst +++ b/docs/tasks/upgrading/upgrading-0.9-0.10.rst @@ -1,22 +1,6 @@ -============================ -Upgrading from v0.9 to v0.10 -============================ +========== +File moved +========== -Due to changes in the way the webhook component's TLS is bootstrapped in v0.10, -you will need to delete your webhook's Certificate and Issuer resources. - -If you are using a deployment tool that automatically handles this (i.e. Helm), -there should be no additional action to take. - -If you are using the 'static manifests' to install, you should run the following -after upgrading: - -.. code-block:: shell - - kubectl delete -n cert-manager issuer cert-manager-webhook-ca cert-manager-webhook-selfsign - kubectl delete -n cert-manager certificate cert-manager-webhook-ca cert-manager-webhook-webhook-tls - kubectl delete apiservice v1beta1.admission.certmanager.k8s.io - -The Secret resources used to contain TLS assets for the webhook are now -automatically handled internally by cert-manager, so these resources are no -longer required. +This document has moved to https://cert-manager.netlify.com/docs/TODO. +This placeholder file will be removed in a later release. diff --git a/docs/tutorials/acme/dns-validation.rst b/docs/tutorials/acme/dns-validation.rst index 27d8bc56e..e096b747c 100644 --- a/docs/tutorials/acme/dns-validation.rst +++ b/docs/tutorials/acme/dns-validation.rst @@ -1,176 +1,6 @@ -================================================ -Issuing an ACME certificate using DNS validation -================================================ +========== +File moved +========== -.. todo:: - This guide needs rewriting to be clearer, splitting into sections and - potentially rewriting altogether. - -cert-manager can be used to obtain certificates from a CA using the ACME_ protocol. -The ACME protocol supports various challenge mechanisms which are used to prove -ownership of a domain so that a valid certificate can be issued for that domain. - -One such challenge mechanism is DNS-01. With a DNS-01 challenge, you prove -ownership of a domain by proving you control its DNS records. -This is done by creating a TXT record with specific content that proves you -have control of the domains DNS records. - -The following Issuer defines the necessary information to enable DNS validation. -You can read more about the Issuer resource in the :doc:`Issuer reference docs `. - -.. code-block:: yaml - :linenos: - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: letsencrypt-staging - namespace: default - spec: - acme: - server: https://acme-staging-v02.api.letsencrypt.org/directory - email: user@example.com - - # Name of a secret used to store the ACME account private key - privateKeySecretRef: - name: letsencrypt-staging - - # ACME DNS-01 provider configurations - solvers: - # An empty 'selector' means that this solver matches all domains - - selector: {} - dns01: - clouddns: - # The ID of the GCP project - # reference: https://docs.cert-manager.io/en/latest/tasks/issuers/setup-acme/dns01/google.html - project: $PROJECT_ID - # This is the secret used to access the service account - serviceAccountSecretRef: - name: clouddns-dns01-solver-svc-acct - key: key.json - - # We only use cloudflare to solve challenges for foo.com. - # Alternative options such as 'matchLabels' and 'dnsZones' can be specified - # as part of a solver's selector too. - - selector: - dnsNames: - - foo.com - dns01: - cloudflare: - email: my-cloudflare-acc@example.com - # !! Remember to create a k8s secret before - # kubectl create secret generic cloudflare-api-key - apiKeySecretRef: - name: cloudflare-api-key-secret - key: api-key - - -We have specified the ACME server URL for Let's Encrypt's `staging environment`_. -The staging environment will not issue trusted certificates but is used to -ensure that the verification process is working properly before moving to -production. Let's Encrypt's production environment imposes much stricter -`rate limits`_, so to reduce the chance of you hitting those limits it is -highly recommended to start by using the staging environment. To move to -production, simply create a new Issuer with the URL set to -``https://acme-v02.api.letsencrypt.org/directory``. - -The first stage of the ACME protocol is for the client to register with the -ACME server. This phase includes generating an asymmetric key pair which is -then associated with the email address specified in the Issuer. Make sure to -change this email address to a valid one that you own. It is commonly used to -send expiry notices when your certificates are coming up for renewal. The -generated private key is stored in a Secret named ``letsencrypt-staging``. - -The ``dns01`` stanza contains a list of DNS-01 providers that can be used to -solve DNS challenges. Our Issuer defines two providers. This gives us a choice -of which one to use when obtaining certificates. - -More information about the DNS provider configuration, including a list of -supported providers, can be found :ref:`in the dns01 reference docs `. - -Once we have created the above Issuer we can use it to obtain a certificate. - -.. code-block:: yaml - :linenos: - - apiVersion: cert-manager.io/v1alpha2 - kind: Certificate - metadata: - name: example-com - namespace: default - spec: - secretName: example-com-tls - issuerRef: - name: letsencrypt-staging - commonName: '*.example.com' - dnsNames: - - example.com - - foo.com - -The Certificate resource describes our desired certificate and the possible -methods that can be used to obtain it. -You can obtain certificates for wildcard domains just like any other. Make sure to -wrap wildcard domains with asterisks in your YAML resources, to avoid formatting issues. -If you specify both ``example.com`` and ``*.example.com`` on the same Certificate, -it will take slightly longer to perform validation as each domain will have to be -validated one after the other. -You can learn more about the Certificate resource in the :doc:`reference docs `. -If the certificate is obtained successfully, the resulting key pair will be -stored in a secret called ``example-com-tls`` in the same namespace as the Certificate. - -The certificate will have a common name of ``*.example.com`` and the -`Subject Alternative Names`_ (SANs) will be ``*.example.com``, ``example.com`` and ``foo.com``. - -In our Certificate we have referenced the ``letsencrypt-staging`` Issuer above. -The Issuer must be in the same namespace as the Certificate. -If you want to reference a ClusterIssuer, which is a cluster-scoped version of -an Issuer, you must add ``kind: ClusterIssuer`` to the ``issuerRef`` stanza. - -For more information on ClusterIssuers, read the -:doc:`ClusterIssuer reference docs `. - -The ``acme`` stanza defines the configuration for our ACME challenges. -Here we have defined the configuration for our DNS challenges which will be used -to verify domain ownership. -For each domain mentioned in a ``dns01`` stanza, cert-manager will use the -provider's credentials from the referenced Issuer to create a TXT record called -``_acme-challenge``. -This record will then be verified by the ACME server in order to issue the -certificate. -Once domain ownership has been verified, any cert-manager affected records will -be cleaned up. - -.. note:: - It is your responsibility to ensure the selected provider is authoritative for - your domain. - -After creating the above Certificate, we can check whether it has been obtained -successfully using ``kubectl describe``: - -.. code-block:: shell - - $ kubectl describe certificate example-com - Events: - Type Reason Age From Message - ---- ------ ---- ---- ------- - Normal CreateOrder 57m cert-manager Created new ACME order, attempting validation... - Normal DomainVerified 55m cert-manager Domain "*.example.com" verified with "dns-01" validation - Normal DomainVerified 55m cert-manager Domain "example.com" verified with "dns-01" validation - Normal DomainVerified 55m cert-manager Domain "foo.com" verified with "dns-01" validation - Normal IssueCert 55m cert-manager Issuing certificate... - Normal CertObtained 55m cert-manager Obtained certificate from ACME server - Normal CertIssued 55m cert-manager Certificate issued successfully - -You can also check whether issuance was successful with -``kubectl get secret example-com-tls -o yaml``. -You should see a base64 encoded signed TLS key pair. - -Once our certificate has been obtained, cert-manager will periodically check its -validity and attempt to renew it if it gets close to expiry. -cert-manager considers certificates to be close to expiry when the 'Not After' -field on the certificate is less than the current time plus 30 days. - -.. _ACME: https://en.wikipedia.org/wiki/Automated_Certificate_Management_Environment -.. _`staging environment`: https://letsencrypt.org/docs/staging-environment/ -.. _`rate limits`: https://letsencrypt.org/docs/rate-limits/ -.. _`Subject Alternative Names`: https://en.wikipedia.org/wiki/Subject_Alternative_Name +This document has moved to https://cert-manager.netlify.com/docs/tutorials/acme/dns-validation/. +This placeholder file will be removed in a later release. diff --git a/docs/tutorials/acme/http-validation.rst b/docs/tutorials/acme/http-validation.rst index 314c271ab..718df51f2 100644 --- a/docs/tutorials/acme/http-validation.rst +++ b/docs/tutorials/acme/http-validation.rst @@ -1,162 +1,6 @@ -================================================= -Issuing an ACME certificate using HTTP validation -================================================= +========== +File moved +========== -cert-manager can be used to obtain certificates from a CA using the ACME_ protocol. -The ACME protocol supports various challenge mechanisms which are used to prove -ownership of a domain so that a valid certificate can be issued for that domain. - -One such challenge mechanism is the HTTP-01 challenge. With a HTTP-01 challenge, -you prove ownership of a domain by ensuring that a particular file is present at -the domain. -It is assumed that you control the domain if you are able to publish the given -file under a given path. - -The following Issuer defines the necessary information to enable HTTP validation. -You can read more about the Issuer resource in the :doc:`Issuer reference docs `. - -.. code-block:: yaml - :linenos: - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: letsencrypt-staging - namespace: default - spec: - acme: - # The ACME server URL - server: https://acme-staging-v02.api.letsencrypt.org/directory - # Email address used for ACME registration - email: user@example.com - # Name of a secret used to store the ACME account private key - privateKeySecretRef: - name: letsencrypt-staging - # Enable the HTTP-01 challenge provider - solvers: - # An empty 'selector' means that this solver matches all domains - - selector: {} - http01: - ingress: - class: nginx - -We have specified the ACME server URL for Let's Encrypt's `staging environment`_. -The staging environment will not issue trusted certificates but is used to -ensure that the verification process is working properly before moving to -production. Let's Encrypt's production environment imposes much stricter -`rate limits`_, so to reduce the chance of you hitting those limits it is -highly recommended to start by using the staging environment. To move to -production, simply create a new Issuer with the URL set to -``https://acme-v02.api.letsencrypt.org/directory``. - -The first stage of the ACME protocol is for the client to register with the -ACME server. This phase includes generating an asymmetric key pair which is -then associated with the email address specified in the Issuer. Make sure to -change this email address to a valid one that you own. It is commonly used to -send expiry notices when your certificates are coming up for renewal. The -generated private key is stored in a Secret named ``letsencrypt-staging``. - -We must provide one or more Solvers for handling the ACME challenge. In this case -we want to use HTTP validation so we specify an ``http01`` Solver. We could -optionally map different domains to use different Solver configurations. - -Once we have created the above Issuer we can use it to obtain a certificate. - -.. code-block:: yaml - :linenos: - - apiVersion: cert-manager.io/v1alpha2 - kind: Certificate - metadata: - name: example-com - namespace: default - spec: - secretName: example-com-tls - issuerRef: - name: letsencrypt-staging - commonName: example.com - dnsNames: - - www.example.com - -The Certificate resource describes our desired certificate and the possible -methods that can be used to obtain it. You can learn more about the Certificate -resource in the :doc:`reference docs `. -If the certificate is obtained successfully, the resulting key pair will be -stored in a secret called ``example-com-tls`` in the same namespace as the Certificate. - -The certificate will have a common name of ``example.com`` and the -`Subject Alternative Names`_ (SANs) will be ``example.com`` and ``www.example.com``. - -In our Certificate we have referenced the ``letsencrypt-staging`` Issuer above. -The Issuer must be in the same namespace as the Certificate. -If you want to reference a ClusterIssuer, which is a cluster-scoped version of -an Issuer, you must add ``kind: ClusterIssuer`` to the ``issuerRef`` stanza. - -For more information on ClusterIssuers, read the -:doc:`ClusterIssuer reference docs `. - -The ``acme`` stanza defines the configuration for our ACME challenges. -Here we have defined the configuration for our HTTP-01 challenges which will be -used to verify domain ownership. -To verify ownership of each domain mentioned in an ``http01`` stanza, cert-manager -will create a Pod, Service and Ingress that exposes an HTTP endpoint that satisfies -the HTTP-01 challenge. - -The fields ``ingress`` and ``ingressClass`` in the ``http01`` stanza can be used -to control how cert-manager interacts with Ingress resources: - -* If the ``ingress`` field is specified, then an Ingress resource with the same - name in the same namespace as the Certificate must already exist and it will - be modified only to add the appropriate rules to solve the challenge. - This field is useful for the GCLB ingress controller, as well as a number of - others, that assign a single public IP address for each ingress resource. - Without manual intervention, creating a new ingress resource would cause any - challenges to fail. - -* If the ``ingressClass`` field is specified, a new ingress resource with a - randomly generated name will be created in order to solve the challenge. - This new resource will have an annotation with key ``kubernetes.io/ingress.class`` - and value set to the value of the ``ingressClass`` field. - This works for the likes of the NGINX ingress controller. - -* If neither are specified, new ingress resources will be created with a randomly - generated name, but they will not have the ingress class annotation set. - -* If both are specified, then the ``ingress`` field will take precedence. - -Once domain ownership has been verified, any cert-manager affected resources will -be cleaned up or deleted. - -.. note:: - It is your responsibilty to point each domain name at the correct IP address - for your ingress controller. - -After creating the above Certificate, we can check whether it has been obtained -successfully using ``kubectl describe``: - -.. code-block:: shell - - $ kubectl describe certificate example-com - Events: - Type Reason Age From Message - ---- ------ ---- ---- ------- - Normal CreateOrder 57m cert-manager Created new ACME order, attempting validation... - Normal DomainVerified 55m cert-manager Domain "example.com" verified with "http-01" validation - Normal DomainVerified 55m cert-manager Domain "www.example.com" verified with "http-01" validation - Normal IssueCert 55m cert-manager Issuing certificate... - Normal CertObtained 55m cert-manager Obtained certificate from ACME server - Normal CertIssued 55m cert-manager Certificate issued successfully - -You can also check whether issuance was successful with -``kubectl get secret example-com-tls -o yaml``. -You should see a base64 encoded signed TLS key pair. - -Once our certificate has been obtained, cert-manager will periodically check its -validity and attempt to renew it if it gets close to expiry. -cert-manager considers certificates to be close to expiry when the 'Not After' -field on the certificate is less than the current time plus 30 days. - -.. _ACME: https://en.wikipedia.org/wiki/Automated_Certificate_Management_Environment -.. _`staging environment`: https://letsencrypt.org/docs/staging-environment/ -.. _`rate limits`: https://letsencrypt.org/docs/rate-limits/ -.. _`Subject Alternative Names`: https://en.wikipedia.org/wiki/Subject_Alternative_Name +This document has moved to https://cert-manager.netlify.com/docs/tutorials/acme/http-validation/. +This placeholder file will be removed in a later release. diff --git a/docs/tutorials/acme/index.rst b/docs/tutorials/acme/index.rst index caaaa84d1..4a17dbe84 100644 --- a/docs/tutorials/acme/index.rst +++ b/docs/tutorials/acme/index.rst @@ -1,14 +1,6 @@ -===================== -ACME Issuer Tutorials -===================== +========== +File moved +========== -This sections contains tutorials relating to the ACME issuer. - - -.. toctree:: - :maxdepth: 1 - - quick-start/index - dns-validation - http-validation - migrating-from-kube-lego +This document has moved to https://cert-manager.netlify.com/docs/tutorials/acme/ingress/. +This placeholder file will be removed in a later release. diff --git a/docs/tutorials/acme/migrating-from-kube-lego.rst b/docs/tutorials/acme/migrating-from-kube-lego.rst index 87daa1e9d..ddc6765ed 100644 --- a/docs/tutorials/acme/migrating-from-kube-lego.rst +++ b/docs/tutorials/acme/migrating-from-kube-lego.rst @@ -1,244 +1,6 @@ -======================== -Migrating from kube-lego -======================== +========== +File moved +========== -kube-lego_ is an older Jetstack project for obtaining TLS certificates from -Let's Encrypt (or another ACME server). - -Since cert-managers release, kube-lego has been gradually deprecated in favour -of this project. There are a number of key differences between the two: - -========================================= ================================ ===================== -Feature kube-lego cert-manager -========================================= ================================ ===================== -Configuration Annotations on Ingress resources CRDs -CAs ACME ACME, signing keypair -Kubernetes v1.2 - v1.8 v1.7+ -Debugging Look at logs Kubernetes Events API -Multi-tenancy Not supported Supported -Distinct issuance sources per Certificate Not supported Supported -Ingress controller support (ACME) GCE, nginx All -========================================= ================================ ===================== - -This guide will walk through how you can safely migrate your kube-lego -installation to cert-manager, without service interruption. - -By the end of the guide, we should have: - -1. Scaled down and removed kube-lego - -2. Installed cert-manager - -3. Migrated ACME private key to cert-manager - -4. Created an ACME ClusterIssuer using this private key, to issue certificates - throughout your cluster - -5. Configured cert-manager's - :doc:`ingress-shim ` to - automatically provision Certificate resources for all Ingress resources with - the ``kubernetes.io/tls-acme: "true"`` annotation, using the ClusterIssuer - we have created - -6. Verified that the cert-manager installation is working - - -1. Scale down kube-lego -======================= - -Before we begin deploying cert-manager, it is best we scale our kube-lego -deployment down to 0 replicas. This will prevent the two controllers -potentially 'fighting' each other. If you deployed kube-lego using the official -deployment YAMLs, a command like so should do: - -.. code-block:: shell - - $ kubectl scale deployment kube-lego \ - --namespace kube-lego \ - --replicas=0 - -You can then verify your kube-lego pod is no longer running with: - -.. code-block:: shell - - $ kubectl get pods --namespace kube-lego - -2. Deploy cert-manager -====================== - -cert-manager should be deployed using Helm, according to our official -:doc:`/getting-started/index` guide. No special steps are required here. We will -return to this deployment at the end of this guide and perform an upgrade of -some of the CLI flags we deploy cert-manager with however. - -Please take extra care to ensure you have configured RBAC correctly when -deploying Helm and cert-manager - there are some nuances described in our -deploying document! - -3. Obtaining your ACME account private key -========================================== - -In order to continue issuing and renewing certificates on your behalf, we need -to migrate the user account private key that kube-lego has created for you over -to cert-manager. - -Your ACME user account identity is a private key, stored in a secret resource. -By default, kube-lego will store this key in a secret named ``kube-lego-account`` -in the same namespace as your kube-lego Deployment. You may have overridden -this value when you deploy kube-lego, in which case the secret name to use will -be the value of the ``LEGO_SECRET_NAME`` environment variable. - -You should download a copy of this secret resource and save it in your local -directory: - -.. code-block:: shell - - $ kubectl get secret kube-lego-account -o yaml \ - --namespace kube-lego \ - --export > kube-lego-account.yaml - -Once saved, open up this file and change the ``metadata.name`` field to something -more relevant to cert-manager. For the rest of this guide, we'll assume you -chose ``letsencrypt-private-key``. - -Once done, we need to create this new resource in the ``kube-system`` namespace. -By default, cert-manager stores supporting resources for ClusterIssuers in the -namespace that it is running in, and we used ``kube-system`` when deploying -cert-manager above. You should change this if you have deployed cert-manager into -a different namespace. - -.. code-block:: shell - - $ kubectl create -f kube-lego-account.yaml \ - --namespace kube-system - -4. Creating an ACME ClusterIssuer using your old ACME account -============================================================= - -We need to create a ClusterIssuer which will hold information about the ACME -account previously registered via kube-lego. In order to do so, we need two -more pieces of information from our old kube-lego deployment: the server URL of -the ACME server, and the email address used to register the account. - -Both of these bits of information are stored within the kube-lego ConfigMap. - -To retrieve them, you should be able to ``get`` the ConfigMap using ``kubectl``: - -.. code-block:: shell - - $ kubectl get configmap kube-lego -o yaml \ - --namespace kube-lego \ - --export - -Your email address should be shown under the ``.data.lego.email`` field, and the -ACME server URL under ``.data.lego.url``. - -For the purposes of this guide, we will assume the lego email is -``user@example.com`` and the URL ``https://acme-staging-v02.api.letsencrypt.org/directory``. - -Now that we have migrated our private key to the new Secret resource, as well -as obtaining our ACME email address and URL, we can create a ClusterIssuer -resource! - -Create a file named ``cluster-issuer.yaml``: - -.. code-block:: yaml - :linenos: - :emphasize-lines: 11 - - apiVersion: cert-manager.io/v1alpha2 - kind: ClusterIssuer - metadata: - # Adjust the name here accordingly - name: letsencrypt-staging - spec: - acme: - # The ACME server URL - server: https://acme-staging-v02.api.letsencrypt.org/directory - # Email address used for ACME registration - email: user@example.com - # Name of a secret used to store the ACME account private key from step 3 - privateKeySecretRef: - name: letsencrypt-private-key - # Enable the HTTP-01 challenge provider - solvers: - - http01: - ingress: - class: nginx - -We then submit this file to our Kubernetes cluster: - -.. code-block:: shell - - $ kubectl create -f cluster-issuer.yaml - -You should be able to verify the ACME account has been verified successfully: - -.. code-block:: shell - - $ kubectl describe clusterissuer letsencrypt-staging - ... - Status: - Acme: - Uri: https://acme-staging-v02.api.letsencrypt.org/acme/acct/7571319 - Conditions: - Last Transition Time: 2019-01-30T14:52:03Z - Message: The ACME account was registered with the ACME server - Reason: ACMEAccountRegistered - Status: True - Type: Ready - -5. Configuring ingress-shim to use our new ClusterIssuer by default -=================================================================== - -Now that our ClusterIssuer is ready to issue certificates, we have one last -thing to do: we must reconfigure ingress-shim (deployed as part of -cert-manager) to automatically create Certificate resources for all Ingress -resources it finds with appropriate annotations. - -More information on the role of ingress-shim can be found -:doc:`in the docs `, but for now we -can just run a ``helm upgrade`` in order to add a few additional flags. -Assuming you've named your ClusterIssuer ``letsencrypt-staging`` (as above), -run: - -.. code-block:: shell - - helm upgrade cert-manager \ - jetstack/cert-manager \ - --namespace kube-system \ - --set ingressShim.defaultIssuerName=letsencrypt-staging \ - --set ingressShim.defaultIssuerKind=ClusterIssuer - -You should see the cert-manager pod be re-created, and once started it should -automatically create Certificate resources for all of your ingresses that -previously had kube-lego enabled. - -6. Verify each ingress now has a corresponding Certificate -========================================================== - -Before we finish, we should make sure there is now a Certificate resource for -each ingress resource you previously enabled kube-lego on. - -You should be able to check this by running: - -.. code-block:: shell - - $ kubectl get certificates --all-namespaces - -There should be an entry for each ingress in your cluster with the kube-lego -annotation. - -We can also verify that cert-manager has 'adopted' the old TLS certificates by -viewing the logs for cert-manager: - -.. code-block:: shell - - $ kubectl logs -n kube-system -l app=cert-manager -c cert-manager - ... - I1025 21:54:02.869269 1 sync.go:206] Certificate my-example-certificate scheduled for renewal in 292 hours - -Here we can see cert-manager has verified the existing TLS certificate and -scheduled it to be renewed in 292h time. - -.. _kube-lego: https://github.com/jetstack/kube-lego +This document has moved to https://cert-manager.netlify.com/docs/tutorials/acme/migrating-from-kube-lego/. +This placeholder file will be removed in a later release. diff --git a/docs/tutorials/acme/quick-start/index.rst b/docs/tutorials/acme/quick-start/index.rst index 5e22483b1..4a17dbe84 100644 --- a/docs/tutorials/acme/quick-start/index.rst +++ b/docs/tutorials/acme/quick-start/index.rst @@ -1,782 +1,6 @@ -================================================= -Quick-Start using Cert-Manager with NGINX Ingress -================================================= +========== +File moved +========== -Step 0 - Install Helm Client -============================= - -**Skip this section if you have helm installed.** - -The easiest way to install `cert-manager` is to use `Helm`_, a templating and -deployment tool for Kubernetes resources. - -First, ensure the Helm client is installed following the -`Helm installation instructions`_. - -For example, on macOS: - -.. code-block:: shell - - $ brew install kubernetes-helm - -.. _`Helm`: https://helm.sh -.. _`Helm installation instructions`: https://github.com/helm/helm/blob/master/docs/install.md - -Step 1 - Installer Tiller -========================= - -**Skip this section if you have Tiller set-up.** - -Tiller is Helm's server-side component, which the ``helm`` client uses to -deploy resources. - -Deploying resources is a privileged operation; in the general case requiring -arbitrary privileges. With this example, we give Tiller complete control -of the cluster. View the documentation on `securing helm`_ for details on -setting up appropriate permissions for your environment. - -.. _`securing helm`: https://docs.helm.sh/using_helm/#securing-your-helm-installation - -Create the a ServiceAccount for tiller: - -.. code-block:: shell - - $ kubectl create serviceaccount tiller --namespace=kube-system - serviceaccount "tiller" created - -Grant the ``tiller`` service account cluster admin privileges: - -.. code-block:: shell - - $ kubectl create clusterrolebinding tiller-admin --serviceaccount=kube-system:tiller --clusterrole=cluster-admin - clusterrolebinding.rbac.authorization.k8s.io "tiller-admin" created - -Install tiller with the ``tiller`` service account: - -.. code-block:: shell - - $ helm init --service-account=tiller - $HELM_HOME has been configured at /Users/myaccount/.helm. - - Tiller (the Helm server-side component) has been installed into your Kubernetes Cluster. - - Please note: by default, Tiller is deployed with an insecure 'allow unauthenticated users' policy. - To prevent this, run `helm init` with the --tiller-tls-verify flag. - For more information on securing your installation see: https://docs.helm.sh/using_helm/#securing-your-helm-installation - Happy Helming! - -Update the helm repository with the latest charts: - -.. code-block:: shell - - $ helm repo update - Hang tight while we grab the latest from your chart repositories... - ...Skip local chart repository - ...Successfully got an update from the "stable" chart repository - ...Successfully got an update from the "coreos" chart repository - Update Complete. ⎈ Happy Helming!⎈ - - -Step 2 - Deploy the NGINX Ingress Controller -============================================ - -A `kubernetes ingress controller`_ is designed to be the access point for -HTTP and HTTPS traffic to the software running within your cluster. The -nginx-ingress controller does this by providing an HTTP proxy service -supported by your cloud provider's load balancer. - -You can get more details about nginx-ingress and how it works from the -`documentation for nginx-ingress`_. - -.. _`kubernetes ingress controller`: https://kubernetes.io/docs/concepts/services-networking/ingress/ -.. _`documentation for nginx-ingress`: https://kubernetes.github.io/ingress-nginx/ - -Use ``helm`` to install an Nginx Ingress controller: - -.. code-block:: shell - - $ helm install stable/nginx-ingress --name quickstart - - NAME: quickstart - LAST DEPLOYED: Sat Nov 10 10:25:06 2018 - NAMESPACE: default - STATUS: DEPLOYED - - RESOURCES: - ==> v1/ConfigMap - NAME AGE - quickstart-nginx-ingress-controller 0s - - ==> v1beta1/ClusterRole - quickstart-nginx-ingress 0s - - ==> v1beta1/Deployment - quickstart-nginx-ingress-controller 0s - quickstart-nginx-ingress-default-backend 0s - - ==> v1/Pod(related) - - NAME READY STATUS RESTARTS AGE - quickstart-nginx-ingress-controller-6cfc45747-wcxrg 0/1 ContainerCreating 0 0s - quickstart-nginx-ingress-default-backend-bf9db5c67-dkg4l 0/1 ContainerCreating 0 0s - - ==> v1/ServiceAccount - - NAME AGE - quickstart-nginx-ingress 0s - - ==> v1beta1/ClusterRoleBinding - quickstart-nginx-ingress 0s - - ==> v1beta1/Role - quickstart-nginx-ingress 0s - - ==> v1beta1/RoleBinding - quickstart-nginx-ingress 0s - - ==> v1/Service - quickstart-nginx-ingress-controller 0s - quickstart-nginx-ingress-default-backend 0s - - - NOTES: - The nginx-ingress controller has been installed. - It may take a few minutes for the LoadBalancer IP to be available. - You can watch the status by running 'kubectl --namespace default get services -o wide -w quickstart-nginx-ingress-controller' - - An example Ingress that makes use of the controller: - - apiVersion: extensions/v1beta1 - kind: Ingress - metadata: - annotations: - kubernetes.io/ingress.class: nginx - name: example - namespace: foo - spec: - rules: - - host: www.example.com - http: - paths: - - backend: - serviceName: exampleService - servicePort: 80 - path: / - # This section is only required if TLS is to be enabled for the Ingress - tls: - - hosts: - - www.example.com - secretName: example-tls - - If TLS is enabled for the Ingress, a Secret containing the certificate and key must also be provided: - - apiVersion: v1 - kind: Secret - metadata: - name: example-tls - namespace: foo - data: - tls.crt: - tls.key: - type: kubernetes.io/tls - -It can take a minute or two for the cloud provider to provide and link a public -IP address. When it is complete, you can see the external IP address using the -``kubectl`` command: - -.. code-block:: shell - :emphasize-lines: 5 - - $ kubectl get svc - - NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE - kubernetes ClusterIP 10.63.240.1 443/TCP 23m - quickstart-nginx-ingress-controller LoadBalancer 10.63.248.177 35.233.154.161 80:31345/TCP,443:31376/TCP 16m - quickstart-nginx-ingress-default-backend ClusterIP 10.63.250.234 80/TCP 16m - -This command shows you all the services in your cluster (in the ``default`` -namespace), and any external IP addresses they have. When you first create the -controller, your cloud provider won't have assigned and allocated an IP address -through the LoadBalancer yet. Until it does, the external IP address for the -service will be listed as ````. - -Your cloud provider may have options for reserving an IP address prior to -creating the ingress controller and using that IP address rather than assigning -an IP address from a pool. Read through the documentation from your cloud -provider on how to arrange that. - -Step 3 - Assign a DNS name -========================== - -The external IP that is allocated to the ingress-controller is the IP to which -all incoming traffic should be routed. To enable this, add it to a DNS zone you -control, for example as `example.your-domain.com`. - -This quickstart assumes you know how to assign a DNS entry to an IP address and -will do so. - -Step 4 - Deploy an Example Service -================================== - -Your service may have its own chart, or you may be deploying it directly with -manifests. This quickstart uses manifests to create and expose a sample -service. The example service uses `kuard`_, a demo application which makes an -excellent back-end for examples. - -The quickstart example uses three manifests for the sample. The first two are a -sample deployment and an associated service: - -- deployment manifest: `deployment.yaml`_ - -.. literalinclude:: example/deployment.yaml - :language: yaml - -- service manifest: `service.yaml`_ - -.. literalinclude:: example/service.yaml - :language: yaml - -.. _`deployment.yaml`: https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/docs/tutorials/acme/quick-start/example/deployment.yaml -.. _`service.yaml`: https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/docs/tutorials/acme/quick-start/example/service.yaml -.. _`kuard`: https://github.com/kubernetes-up-and-running/kuard - -You can create download and reference these files locally, or you can -reference them from the GitHub source repository for this documentation. -To install the example service from the tutorial files straight from GitHub, -you may use the commands: - -.. code-block:: shell - - $ kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/docs/tutorials/acme/quick-start/example/deployment.yaml - deployment.extensions "kuard" created - - $ kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/docs/tutorials/acme/quick-start/example/service.yaml - service "kuard" created - -An `ingress resource`_ is what Kubernetes uses to expose this example service -outside the cluster. You will need to download and modify the example manifest -to reflect the domain that you own or control to complete this example. - - -A sample ingress you can start with is: - -- ingress manifest: `ingress.yaml`_ - -.. literalinclude:: example/ingress.yaml - :language: yaml - -.. _`ingress.yaml`: https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/docs/tutorials/acme/quick-start/example/ingress.yaml -.. _`ingress resource`: https://kubernetes.io/docs/concepts/services-networking/ingress/ - -You can download the sample manifest from github, edit it, and submit the manifest to Kubernetes with the command: - -.. code-block:: shell - - $ kubectl create --edit -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/docs/tutorials/acme/quick-start/example/ingress.yaml - - # edit the file in your editor, and once it is saved: - ingress.extensions "kuard" created - -.. note:: - - The ingress example we show above has a `host` definition within it. The - nginx-ingress-controller will route traffic when the hostname requested matches the - definition in the ingress. You *can* deploy an ingress without a `host` definition - in the rule, but that pattern isn't usable with a TLS certificate, which expects a - fully qualified domain name. - -Once it is deployed, you can use the command `kubectl get ingress` to see the status - of the ingress: - -.. code-block:: shell - - NAME HOSTS ADDRESS PORTS AGE - kuard * 80, 443 17s - -It may take a few minutes, depending on your service provider, for the ingress -to be fully created. When it has been created and linked into place, the -ingress will show an address as well: - -.. code-block:: shell - - NAME HOSTS ADDRESS PORTS AGE - kuard * 35.199.170.62 80 9m - -.. note:: - - The IP address on the ingress *may not* match the IP address that the - nginx-ingress-controller. This is fine, and is a quirk/implementation detail - of the service provider hosting your Kubernetes cluster. Since we are using - the nginx-ingress-controller instead of any cloud-provider specific ingress - backend, use the IP address that was defined and allocated for the - nginx-ingress-service LoadBalancer resource as the primary access point for - your service. - -Make sure the service is reachable at the domain name you added above, for -example `http://example.your-domain.com`. The simplest way is to open a browser -and enter the name that you set up in DNS, and for which we just added the -ingress. - -You may also use a command line tool like `curl` to check the ingress. - -.. code-block:: shell - - $ curl -kivL -H 'Host: example.your-domain.com' 'http://35.199.164.14' - -The options on this curl command will provide verbose output, following any -redirects, show the TLS headers in the output, and not error on insecure -certificates. With nginx-ingress-controller, the service will be available -with a TLS certificate, but it will be using a self-signed certificate -provided as a default from the nginx-ingress-controller. Browsers will show -a warning that this is an invalid certificate. This is expected and normal, -as we have not yet used cert-manager to get a fully trusted certificate -for our site. - -.. warning:: - - It is critical to make sure that your ingress is available and responding correctly - on the internet. This quickstart example uses Let's Encypt to provide the certificates, - which expects and validates both that the service is available and that during the - process of issuing a certificate uses that valdiation as proof that the request for - the domain belongs to someone with sufficient control over the domain. - -Step 5 - Deploy Cert Manager -============================ - -We need to install cert-manager to do the work with kubernetes to request a -certificate and respond to the challenge to validate it. We can use helm or -plain Kubernetes manifest to install cert-manager. - -Read the :doc:`getting started guide ` to install -cert-manager using your prefered method. - -Cert-manager uses two different custom resources, also known as `CRD`_'s, -to configure and control how it operates, as well as share status of its -operation. These two resources are: - -:doc:`Issuers ` (or :doc:`ClusterIssuers `) - - An Issuer is the definition for where cert-manager will get request TLS - certificates. An Issuer is specific to a single namespace in Kubernetes, - and a ClusterIssuer is meant to be a cluster-wide definition for the same - purpose. - - Note that if you're using this document as a guide to configure cert-manager - for your own Issuer, you must create the Issuers in the same namespace - as your Ingress resouces by adding '-n my-namespace' to your 'kubectl create' - commands. Your other option is to replace your Issuers with ClusterIssuers. - ClusterIssuer resources apply across all Ingress resources in your cluster - and don't have this namespace-matching requirement. - - More information on the differences between Issuers and ClusterIssuers and - when you might choose to use each can be found at: - - https://docs.cert-manager.io/en/latest/tasks/issuers/index.html#difference-between-issuers-and-clusterissuers - -:doc:`Certificate ` - - A certificate is the resource that cert-manager uses to expose the state - of a request as well as track upcoming expirations. - -.. _`CRD`: https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/ - - -Step 6 - Configure Let's Encrypt Issuer -======================================= - -We will set up two issuers for Let's Encrypt in this example. The Let's Encrypt -production issuer has `very strict rate limits`_. When you are experimenting -and learning, it is very easy to hit those limits, and confuse rate limiting -with errors in configuration or operation. - -.. _`very strict rate limits`: https://letsencrypt.org/docs/rate-limits/ - -Because of this, we will start with the Let's Encrypt staging issuer, and once -that is working switch to a production issuer. - -Create this definition locally and update the email address to your own. This -email required by Let's Encrypt and used to notify you of certificate -expirations and updates. - -- staging issuer: `staging-issuer.yaml`_ - -.. literalinclude:: example/staging-issuer.yaml - :language: yaml - -.. _`staging-issuer.yaml`: https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/docs/tutorials/acme/quick-start/example/staging-issuer.yaml - -Once edited, apply the custom resource: - -.. code-block:: shell - - $ kubectl create --edit -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/docs/tutorials/acme/quick-start/example/staging-issuer.yaml - issuer.cert-manager.io "letsencrypt-staging" created - -Also create a production issuer and deploy it. As with the staging issuer, you -will need to update this example and add in your own email address. - -- production issuer: `production-issuer.yaml`_ - -.. literalinclude:: example/production-issuer.yaml - :language: yaml - :emphasize-lines: 10 - -.. _`production-issuer.yaml`: https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/docs/tutorials/acme/quick-start/example/production-issuer.yaml - -.. code-block:: shell - - $ kubectl create --edit -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/docs/tutorials/acme/quick-start/example/production-issuer.yaml - issuer.cert-manager.io "letsencrypt-prod" created - -Both of these issuers are configured to use the -:doc:`HTTP01 ` challenge provider. - -Check on the status of the issuer after you create it: - -.. code-block:: shell - :emphasize-lines: 28-32 - - $ kubectl describe issuer letsencrypt-staging - - Name: letsencrypt-staging - Namespace: default - Labels: - Annotations: kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"cert-manager.io/v1alpha2","kind":"Issuer","metadata":{"annotations":{},"name":"letsencrypt-staging","namespace":"default"},"spec":{"a... - API Version: cert-manager.io/v1alpha2 - Kind: Issuer - Metadata: - Cluster Name: - Creation Timestamp: 2018-11-17T18:03:54Z - Generation: 0 - Resource Version: 9092 - Self Link: /apis/cert-manager.io/v1alpha2/namespaces/default/issuers/letsencrypt-staging - UID: 25b7ae77-ea93-11e8-82f8-42010a8a00b5 - Spec: - Acme: - Email: your.email@your-domain.com - Private Key Secret Ref: - Key: - Name: letsencrypt-staging - Server: https://acme-staging-v02.api.letsencrypt.org/directory - Solvers: - Http 01: - Ingress: - Class: nginx - Status: - Acme: - Uri: https://acme-staging-v02.api.letsencrypt.org/acme/acct/7374163 - Conditions: - Last Transition Time: 2018-11-17T18:04:00Z - Message: The ACME account was registered with the ACME server - Reason: ACMEAccountRegistered - Status: True - Type: Ready - Events: - -You should see the issuer listed with a registered account. - -Step 7 - Deploy a TLS Ingress Resource -====================================== - -With all the pre-requisite configuration in place, we can now do the pieces -to request the TLS certificate. There are two primary ways to do this: using -annotations on the ingress with -:doc:`ingress-shim ` or directly -creating a certificate resource. - -In this example, we will add annotations to the ingress, and take advantage -of ingress-shim to have it create the certificate resource on our behalf. -After creating a certificate, the cert-manager will update or create a ingress -resource and use that to validate the domain. Once verified and issued, -cert-manager will create or update the secret defined in the certificate. - -.. note:: - - The secret that is used in the ingress should match the secret defined in the certificate. - There isn't any explicit checking, so a typo will resut in the nginx-ingress-controller - falling back to its self-signed certificate. In our example, we are using annotations on - the ingress (and ingress-shim) which will create the correct secrets on your behalf. - -Edit the ingress add the annotations that were commented out in our earlier -example: - -- ingress tls: `ingress-tls.yaml`_ - -.. literalinclude:: example/ingress-tls.yaml - :language: yaml - :emphasize-lines: 6-8 - -.. _`ingress-tls.yaml`: https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/docs/tutorials/acme/quick-start/example/ingress-tls.yaml - -and apply it: - -.. code-block:: shell - - $ kubectl create --edit -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/docs/tutorials/acme/quick-start/example/ingress-tls.yaml - ingress.extensions "kuard" configured - -Cert-manager will read these annotations and use them to create a certificate, -which you can request and see: - -.. code-block:: shell - - $ kubectl get certificate - NAME READY SECRET AGE - quickstart-example-tls True quickstart-example-tls 16m - -Cert-manager reflects the state of the process for every request in the -certificate object. You can view this information using the -`kubectl describe` command: - -.. code-block:: shell - :emphasize-lines: 50-54 - - $ kubectl describe certificate quickstart-example-tls - - Name: quickstart-example-tls - Namespace: default - Labels: - Annotations: - API Version: cert-manager.io/v1alpha2 - Kind: Certificate - Metadata: - Cluster Name: - Creation Timestamp: 2018-11-17T17:58:37Z - Generation: 0 - Owner References: - API Version: extensions/v1beta1 - Block Owner Deletion: true - Controller: true - Kind: Ingress - Name: kuard - UID: a3e9f935-ea87-11e8-82f8-42010a8a00b5 - Resource Version: 9295 - Self Link: /apis/cert-manager.io/v1alpha2/namespaces/default/certificates/quickstart-example-tls - UID: 68d43400-ea92-11e8-82f8-42010a8a00b5 - Spec: - Dns Names: - example.your-domain.com - Issuer Ref: - Kind: Issuer - Name: letsencrypt-staging - Secret Name: quickstart-example-tls - Status: - Acme: - Order: - URL: https://acme-staging-v02.api.letsencrypt.org/acme/order/7374163/13665676 - Conditions: - Last Transition Time: 2018-11-17T18:05:57Z - Message: Certificate issued successfully - Reason: CertIssued - Status: True - Type: Ready - Events: - Type Reason Age From Message - ---- ------ ---- ---- ------- - Normal CreateOrder 9m cert-manager Created new ACME order, attempting validation... - Normal DomainVerified 8m cert-manager Domain "example.your-domain.com" verified with "http-01" validation - Normal IssueCert 8m cert-manager Issuing certificate... - Normal CertObtained 7m cert-manager Obtained certificate from ACME server - Normal CertIssued 7m cert-manager Certificate issued Successfully - -The events associated with this resource and listed at the bottom -of the `describe` results show the state of the request. In the above -example the certificate was validated and issued within a couple of minutes. - -Once complete, cert-manager will have created a secret with the details of -the certificate based on the secret used in the ingress resource. You can -use the describe command as well to see some details: - -.. code-block:: shell - - $ kubectl describe secret quickstart-example-tls - - Name: quickstart-example-tls - Namespace: default - Labels: cert-manager.io/certificate-name=quickstart-example-tls - Annotations: cert-manager.io/alt-names=example.your-domain.com - cert-manager.io/common-name=example.your-domain.com - cert-manager.io/issuer-kind=Issuer - cert-manager.io/issuer-name=letsencrypt-staging - - Type: kubernetes.io/tls - - Data - ==== - tls.crt: 3566 bytes - tls.key: 1675 bytes - - -Now that we have confidence that everything is configured correctly, you -can update the annotations in the ingress to specify the production issuer: - -- ingress tls final: `ingress-tls-final.yaml`_ - -.. literalinclude:: example/ingress-tls-final.yaml - :language: yaml - -.. _`ingress-tls-final.yaml`: https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/docs/tutorials/acme/quick-start/example/ingress-tls-final.yaml - -.. code-block:: shell - - $ kubectl create --edit -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/docs/tutorials/acme/quick-start/example/ingress-tls-final.yaml - - ingress.extensions "kuard" configured - -You will also need to delete the existing secret, which cert-manager is watching -and will cause it to reprocess the request with the updated issuer. - -.. code-block:: shell - - $ kubectl delete secret quickstart-example-tls - - secret "quickstart-example-tls" deleted - -This will start the process to get a new certificate, and using describe -you can see the status. Once the production certificate has been updated, -you should see the example KUARD running at your domain with a signed TLS -certificate. - -.. code-block:: shell - :emphasize-lines: 47-48 - - $ kubectl describe certificate - - Name: quickstart-example-tls - Namespace: default - Labels: - Annotations: - API Version: cert-manager.io/v1alpha2 - Kind: Certificate - Metadata: - Cluster Name: - Creation Timestamp: 2018-11-17T18:36:48Z - Generation: 0 - Owner References: - API Version: extensions/v1beta1 - Block Owner Deletion: true - Controller: true - Kind: Ingress - Name: kuard - UID: a3e9f935-ea87-11e8-82f8-42010a8a00b5 - Resource Version: 283686 - Self Link: /apis/cert-manager.io/v1alpha2/namespaces/default/certificates/quickstart-example-tls - UID: bdd93b32-ea97-11e8-82f8-42010a8a00b5 - Spec: - Dns Names: - example.your-domain.com - Issuer Ref: - Kind: Issuer - Name: letsencrypt-prod - Secret Name: quickstart-example-tls - Status: - Conditions: - Last Transition Time: 2019-01-09T13:52:05Z - Message: Certificate does not exist - Reason: NotFound - Status: False - Type: Ready - Events: - Type Reason Age From Message - kubectl describe certificate quickstart-example-tls ---- ------ ---- ---- ------- - Normal Generated 18s cert-manager Generated new private key - Normal OrderCreated 18s cert-manager Created Order resource "quickstart-example-tls-889745041" - -You can see the current state of the ACME Order by running ``kubectl describe`` -on the Order resource that cert-manager has created for your Certificate: - -.. code-block:: shell - - $ kubectl describe order quickstart-example-tls-889745041 - ... - Events: - Type Reason Age From Message - ---- ------ ---- ---- ------- - Normal Created 90s cert-manager Created Challenge resource "quickstart-example-tls-889745041-0" for domain "example.your-domain.com" - -Here, we can see that cert-manager has created 1 'Challenge' resource to fulfil -the Order. You can dig into the state of the current ACME challenge by running -``kubectl describe`` on the automatically created Challenge resource: - -.. code-block:: shell - - $ kubectl describe challenge quickstart-example-tls-889745041-0 - ... - - Status: - Presented: true - Processing: true - Reason: Waiting for http-01 challenge propagation - State: pending - Events: - Type Reason Age From Message - ---- ------ ---- ---- ------- - Normal Started 15s cert-manager Challenge scheduled for processing - Normal Presented 14s cert-manager Presented challenge using http-01 challenge mechanism - -From above, we can see that the challenge has been 'presented' and cert-manager -is waiting for the challenge record to propagate to the ingress controller. -You should keep an eye out for new events on the challenge resource, as a -'success' event should be printed after a minute or so (depending on how fast -your ingress controller is at updating rules): - -.. code-block:: shell - - $ kubectl describe challenge quickstart-example-tls-889745041-0 - ... - - Status: - Presented: false - Processing: false - Reason: Successfully authorized domain - State: valid - Events: - Type Reason Age From Message - ---- ------ ---- ---- ------- - Normal Started 71s cert-manager Challenge scheduled for processing - Normal Presented 70s cert-manager Presented challenge using http-01 challenge mechanism - Normal DomainVerified 2s cert-manager Domain "example.your-domain.com" verified with "http-01" validation - -.. note:: - If your challenges are not becoming 'valid' and remain in the 'pending' - state (or enter into a 'failed' state), it is likely there is some kind of - configuration error. - Read the :doc:`Challenge resource reference docs ` - for more information on debugging failing challenges. - -Once the challenge(s) have been completed, their corresponding challenge -resources will be *deleted*, and the 'Order' will be updated to reflect the -new state of the Order: - -.. code-block:: shell - - $ kubectl describe order quickstart-example-tls-889745041 - ... - Events: - Type Reason Age From Message - ---- ------ ---- ---- ------- - Normal Created 90s cert-manager Created Challenge resource "quickstart-example-tls-889745041-0" for domain "example.your-domain.com" - Normal OrderValid 16s cert-manager Order completed successfully - -Finally, the 'Certificate' resource will be updated to reflect the state of the -issuance process. If all is well, you should be able to 'describe' the Certificate -and see something like the below: - -.. code-block:: shell - - $ kubectl describe certificate quickstart-example-tls - - Status: - Conditions: - Last Transition Time: 2019-01-09T13:57:52Z - Message: Certificate is up to date and has not expired - Reason: Ready - Status: True - Type: Ready - Not After: 2019-04-09T12:57:50Z - Events: - Type Reason Age From Message - ---- ------ ---- ---- ------- - Normal Generated 11m cert-manager Generated new private key - Normal OrderCreated 11m cert-manager Created Order resource "quickstart-example-tls-889745041" - Normal OrderComplete 10m cert-manager Order "quickstart-example-tls-889745041" completed successfully +This document has moved to https://cert-manager.netlify.com/docs/tutorials/acme/ingress/. +This placeholder file will be removed in a later release. diff --git a/docs/tutorials/index.rst b/docs/tutorials/index.rst index 519871f65..1d48db0b9 100644 --- a/docs/tutorials/index.rst +++ b/docs/tutorials/index.rst @@ -1,15 +1,6 @@ -========= -Tutorials -========= +========== +File moved +========== -This section contains guides that help you get started using cert-manager for -more specific use cases. - -For more information on performing individual tasks, read the -:doc:`tasks section `. - -.. toctree:: - :maxdepth: 2 - - acme/index - venafi/securing-ingress +This document has moved to https://cert-manager.netlify.com/docs/tutorials/. +This placeholder file will be removed in a later release. diff --git a/docs/tutorials/venafi/securing-ingress.rst b/docs/tutorials/venafi/securing-ingress.rst index 06a41bbbd..00c5e44be 100644 --- a/docs/tutorials/venafi/securing-ingress.rst +++ b/docs/tutorials/venafi/securing-ingress.rst @@ -1,605 +1,6 @@ -============================== -Securing Ingresses with Venafi -============================== +========== +File moved +========== -This guide walks you through how to secure a Kubernetes `Ingress`_ resource -using the Venafi Issuer type. - -Whilst stepping through, you will learn how to: - -* Create an EKS cluster using `eksctl`_ -* Install cert-manager into the EKS cluster -* Deploy `nginx-ingress`_ to expose applications running in the cluster -* Configure a Venafi Cloud issuer -* Configure cert-manager to secure your application traffic - -While this guide focuses on EKS as a Kubernetes provisioner and Venafi -as a Certificate issuer, the steps here should be generally re-usable for other -Issuer types. - -Prerequisites -============= - -* An AWS account -* kubectl installed -* Access to a publicly registered DNS zone -* A Venafi Cloud account and API credentials - -Create an EKS cluster -===================== - -If you already have a running EKS cluster you can skip this step and move onto -deploying cert-manager. - -eksctl_ is a tool that makes it easier to deploy and manage an EKS cluster. - -Installation instructions for various platforms can be found in the -`eksctl installation instructions`_. - -Once installed, you can create a basic cluster by running: - -.. code-block:: shell - - eksctl create cluster - -This process may take up to 20 minutes to complete. -Complete instructions on using eksctl can be found in the `eksctl usage section`_ - -Once your cluster has been created, you should verify that your cluster is -running correctly by running the following command: - -.. code-block:: shell - - kubectl get pods --all-namespaces - NAME READY STATUS RESTARTS AGE - aws-node-8xpkp 1/1 Running 0 115s - aws-node-tflxs 1/1 Running 0 118s - coredns-694d9447b-66vlp 1/1 Running 0 23s - coredns-694d9447b-w5bg8 1/1 Running 0 23s - kube-proxy-4dvpj 1/1 Running 0 115s - kube-proxy-tpvht 1/1 Running 0 118s - -You should see output similar to the above, with all pods in a Running state. - -.. _eksctl: https://github.com/weaveworks/eksctl -.. _eksctl installation instructions: https://eksctl.io/introduction/installation/ -.. _eksctl usage section: https://eksctl.io/usage/creating-and-managing-clusters/ - -Installing cert-manager -======================= - -There are no special requirements to note when installing cert-manager on EKS, -so the regular -:doc:`Running on Kubernetes ` guide can -be used to install cert-manager. - -Please walk through the installation guide and return to this step once you -have validated cert-manager is deployed correctly. - -Installing ingress-nginx -======================== - -A `Kubernetes ingress controller`_ is designed to be the access point for -HTTP and HTTPS traffic to the software running within your cluster. The -ingress-nginx_ controller does this by providing an HTTP proxy service -supported by your cloud provider's load balancer (in this case, a -`Network Load Balancer (NLB)`_. - -You can get more details about nginx-ingress and how it works from the -`documentation for nginx-ingress`_. - -To deploy ingress-nginx using an ELB to expose the service, run the following: - -.. code-block:: shell - - # Deploy the AWS specific pre-requisite manifest - kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/aws/service-nlb.yaml - - # Deploy the 'generic' ingress-nginx manifest - kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/mandatory.yaml - -You may have to wait up to 5 minutes for all the required components in your -cluster and AWS account to become ready. - -You can run the following command to determine the address that Amazon has -assigned to your NLB: - -.. code-block:: shell - - kubectl get service -n ingress-nginx - NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE - ingress-nginx LoadBalancer 10.100.52.175 a8c2870a5a8a311e9a9a10a2e7af57d7-6c2ec8ede48726ab.elb.eu-west-1.amazonaws.com 80:31649/TCP,443:30567/TCP 4m10s - -The *EXTERNAL-IP* field may say ```` for a while. This indicates the -NLB is still being created. Retry the command until an *EXTERNAL-IP* has been -provisioned. - -Once the *EXTERNAL-IP* is available, you should run the following command to -verify that traffic is being correctly routed to ingress-nginx: - -.. code-block:: shell - - curl http://a8c2870a5a8a311e9a9a10a2e7af57d7-6c2ec8ede48726ab.elb.eu-west-1.amazonaws.com/ - - - 404 Not Found - -

    404 Not Found

    -
    openresty/1.15.8.1
    - - - -Whilst the above message would normally indicate an error (the page not being -found), in this instance it indicates that traffic is being correctly routed to -the ingress-nginx service. - -.. note:: - Although the AWS Application Load Balancer (ALB) is a modern load balancer - offered by AWS that can can be provisioned from within EKS, at the time of - writing, the `alb-ingress-controller `_; - is only capable of serving sites using certificates stored in AWS Certificate - Manager (ACM). Version 1.15 of Kubernetes should address multiple bug fixes - for this controller and allow for TLS termination support. - -.. _`kubernetes ingress controller`: https://kubernetes.io/docs/concepts/services-networking/ingress/ -.. _`documentation for nginx-ingress`: https://kubernetes.github.io/ingress-nginx/ -.. _Network Load Balancer (NLB): https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html - -Configure your DNS records -========================== - -Now that our NLB has been provisioned, we should point our application's DNS -records at the NLBs address. - -Go into your DNS provider's console and set a CNAME record pointing to your -NLB. - -For the purposes of demonstration, we will assume in this guide you have -created the following DNS entry: - -.. code-block:: text - - example.com CNAME a8c2870a5a8a311e9a9a10a2e7af57d7-6c2ec8ede48726ab.elb.eu-west-1.amazonaws.com - -As you progress through the rest of this tutorial, please replace -``example.com`` with your own registered domain. - -Deploying a demo application -============================ - -For the purposes of this demo, we provide an example deployment which is a -simple "hello world" website. - -First, create a new namespace that will contain your application: - -.. code-block:: shell - - kubectl create namespace demo - namespace/demo created - -Save the following YAML into a file named ``demo-deployment.yaml``: - -.. code-block:: yaml - :linenos: - - --- - apiVersion: v1 - kind: Service - metadata: - name: hello-kubernetes - namespace: demo - spec: - type: ClusterIP - ports: - - port: 80 - targetPort: 8080 - selector: - app: hello-kubernetes - --- - apiVersion: apps/v1 - kind: Deployment - metadata: - name: hello-kubernetes - namespace: demo - spec: - replicas: 2 - selector: - matchLabels: - app: hello-kubernetes - template: - metadata: - labels: - app: hello-kubernetes - spec: - containers: - - name: hello-kubernetes - image: paulbouwer/hello-kubernetes:1.5 - resources: - requests: - cpu: 100m - memory: 100Mi - ports: - - containerPort: 8080 - -Then run: - -.. code-block:: shell - - kubectl apply -n demo -f demo-deployment.yaml - -Note that the Service resource we deploy is of type ClusterIP and not -LoadBalancer, as we will expose and secure traffic for this service using -ingress-nginx that we deployed earlier. - -You should be able to see two Pods and one Service in the ``demo`` namespace: - -.. code-block:: shell - - kubectl get po,svc -n demo - NAME READY STATUS RESTARTS AGE - hello-kubernetes-66d45d6dff-m2lnr 1/1 Running 0 7s - hello-kubernetes-66d45d6dff-qt2kb 1/1 Running 0 7s - - NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE - service/hello-kubernetes ClusterIP 10.100.164.58 80/TCP 7s - -Note that we have not yet exposed this application to be accessible over the -internet. We will expose the demo application to the internet in later steps. - -Creating a Venafi Issuer resource -================================= - -cert-manager supports both Venafi TPP and Venafi Cloud. - -Please only follow one of the below sections according to where you want to -retrieve your Certificates from. - -Venafi TPP ----------- - -Assuming you already have a Venafi TPP server set up properly, you can create -a Venafi Issuer resource that can be used to issue certificates. - -To do this, you need to make sure you have your TPP *username* and *password*. - -In order for cert-manager to be able to authenticate with your Venafi TPP -server and set up an Issuer resource, you'll need to create a Kubernetes -Secret containing your username and password: - -.. code-block:: shell - - kubectl create secret generic \ - venafi-tpp-secret \ - --namespace=demo \ - --from-literal=username='YOUR_TPP_USERNAME_HERE' \ - --from-literal=password='YOUR_TPP_PASSWORD_HERE' - -We must then create a Venafi Issuer resource, which represents a certificate -authority within Kubernetes. - -Save the following YAML into a file named ``venafi-issuer.yaml``: - -.. code-block:: yaml - :linenos: - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: venafi-issuer - namespace: demo - spec: - venafi: - zone: "Default" # Set this to the Venafi policy zone you want to use - tpp: - url: https://venafi-tpp.example.com/vedsdk # Change this to the URL of your TPP instance - caBundle: - credentialsRef: - name: venafi-tpp-secret - -Then run: - -.. code-block:: shell - - kubectl apply -n demo -f venafi-issuer.yaml - -When you run the following command, you should see that the Status stanza of -the output shows that the Issuer is Ready (i.e. has successfully validated -itself with the Venafi TPP server). - -.. code-block:: shell - - kubectl describe issuer -n demo venafi-issuer - - Status: - Conditions: - Last Transition Time: 2019-07-17T15:46:00Z - Message: Venafi issuer started - Reason: Venafi issuer started - Status: True - Type: Ready - Events: - Type Reason Age From Message - ---- ------ ---- ---- ------- - Normal Ready 14s cert-manager Verified issuer with Venafi server - -Venafi Cloud ------------- - -You can sign up for a Venafi Cloud account by visiting the `enroll page`_. - -Once registered, you should fetch your API key by clicking your name in the top -right of the control panel interface. - -In order for cert-manager to be able to authenticate with your Venafi Cloud -account and set up an Issuer resource, you'll need to create a Kubernetes -Secret containing your API key: - -.. code-block:: shell - - kubectl create secret generic \ - venafi-cloud-secret \ - --namespace=demo \ - --from-literal=apikey= - -We must then create a Venafi Issuer resource, which represents a certificate -authority within Kubernetes. - -Save the following YAML into a file named ``venafi-issuer.yaml``: - -.. code-block:: yaml - :linenos: - - apiVersion: cert-manager.io/v1alpha2 - kind: Issuer - metadata: - name: venafi-issuer - namespace: demo - spec: - venafi: - zone: "Default" # Set this to the Venafi policy zone you want to use - cloud: - url: "https://api.venafi.cloud/v1" - apiTokenSecretRef: - name: venafi-cloud-secret - key: apikey - -Then run: - -.. code-block:: shell - - kubectl apply -n demo -f venafi-issuer.yaml - -When you run the following command, you should see that the Status stanza of -the output shows that the Issuer is Ready (i.e. has successfully validated -itself with the Venafi Cloud service). - -.. code-block:: shell - - kubectl describe issuer -n demo venafi-issuer - - Status: - Conditions: - Last Transition Time: 2019-07-17T15:46:00Z - Message: Venafi issuer started - Reason: Venafi issuer started - Status: True - Type: Ready - Events: - Type Reason Age From Message - ---- ------ ---- ---- ------- - Normal Ready 14s cert-manager Verified issuer with Venafi server - - -.. _enroll page: https://www.venafi.com/platform/cloud/devops - -Request a Certificate -===================== - -Now that the Issuer is configured and we have confirmed it has been set up -correctly, we can begin requesting certificates which can be used by Kubernetes -applications. - -Full information on how to specify and request Certificate resources can be -found in the :doc:`Issuing certificates ` -guide. - -For now, we will create a basic x509 Certificate that is valid for our domain, -``example.com``: - -.. code-block:: yaml - :linenos: - - apiVersion: cert-manager.io/v1alpha2 - kind: Certificate - metadata: - name: example-com-tls - namespace: demo - spec: - secretName: example-com-tls - dnsNames: - - example.com - issuerRef: - name: venafi-issuer - -Save this YAML into a file named ``example-com-tls.yaml`` and run: - -.. code-block:: shell - - kubectl apply -n demo -f example-com-tls.yaml - -As long as you've ensured that the zone of your Venafi Cloud account (in our -example, we use the "Default" zone) has been configured with a CA or contains a -custom certificate, cert-manager can now take steps to populate the -``example-com-tls`` Secret with a certificate. It does this by identifying -itself with Venafi Cloud using the API key, then requesting a certificate to -match the specifications of the Certificate resource that we've created. - -You can run ``kubectl describe`` to check the progress of your Certificate: - -.. code-block:: shell - - kubectl describe certificate -n demo example-com-tls - - ... - Status: - Conditions: - Last Transition Time: 2019-07-17T17:43:01Z - Message: Certificate is up to date and has not expired - Reason: Ready - Status: True - Type: Ready - Not After: 2019-10-15T12:00:00Z - Events: - Type Reason Age From Message - ---- ------ ---- ---- ------- - Normal Issuing 33s cert-manager Requesting new certificate... - Normal GenerateKey 33s cert-manager Generated new private key - Normal Validate 33s cert-manager Validated certificate request against Venafi zone policy - Normal Requesting 33s cert-manager Requesting certificate from Venafi server... - Normal Retrieve 15s cert-manager Retrieved certificate from Venafi server - Normal CertIssued 15s cert-manager Certificate issued successfully - -Once the Certificate has been issued, you should see events similar to above. - -You should then be able to see the certificate has been successfully stored in -the Secret resource: - -.. code-block:: shell - - kubectl get secret -n demo example-com-tls - - NAME TYPE DATA AGE - example-com-tls kubernetes.io/tls 3 2m47s - - kubectl get secret example-com-tls -o 'go-template={{index .data "tls.crt"}}' | \ - base64 --decode | \ - openssl x509 -noout -text - - Certificate: - Data: - Version: 3 (0x2) - Serial Number: - 0d:ce:bf:89:04:d4:41:83:f4:4c:32:66:64:fb:60:14 - Signature Algorithm: sha256WithRSAEncryption - Issuer: C=US, O=DigiCert Inc, CN=DigiCert Test SHA2 Intermediate CA-1 - Validity - Not Before: Jul 17 00:00:00 2019 GMT - Not After : Oct 15 12:00:00 2019 GMT - Subject: C=US, ST=California, L=Palo Alto, O=Venafi Cloud, OU=SerialNumber, CN=example.com - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - Public-Key: (2048 bit) - Modulus: - 00:ad:2e:66:02:20:c9:b1:6a:00:63:70:4e:22:3c: - 45:63:6e:e7:fd:4c:94:7d:75:50:22:a2:01:72:99: - 9c:23:04:90:51:85:4d:47:32:e4:8b:ee:b1:ea:09: - 1a:de:97:5d:31:05:a2:73:73:4f:06:a3:b2:59:ee: - bc:30:f7:26:85:3d:b3:56:e4:c2:97:34:b6:ac:6d: - 65:7e:a2:4e:b4:ce:f2:0a:0a:4c:d7:32:d7:5a:18: - e8:69:c6:34:28:26:36:ef:c5:bc:ae:ba:ca:d2:46: - 3f:d4:61:39:66:8f:19:cc:d6:d6:10:77:af:51:93: - 1b:4d:f8:d1:10:19:ab:ac:b3:7b:0b:98:58:29:e6: - a9:ac:9f:7a:dc:63:0d:51:f5:bd:9f:f3:03:2e:b3: - 2d:2f:00:87:f4:e1:cd:5a:32:c6:d8:fb:49:c4:e7: - da:3f:0f:8f:bb:66:94:28:5d:99:fe:7c:f0:17:1b: - fd:3e:ed:dd:36:bf:8e:62:60:0c:85:7f:76:74:4b: - 37:d9:c2:e8:74:49:04:bf:f1:83:81:cc:4f:9b:f3: - 40:97:d4:dc:b6:d3:2d:dc:73:18:93:48:a5:8f:6c: - 57:7f:ec:62:c0:bc:c2:b0:e9:0a:51:2d:c4:b6:87: - 68:96:87:f8:9a:86:3c:6a:f1:01:ca:57:c4:07:e7: - b0:51 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Authority Key Identifier: - keyid:D6:4D:F9:39:60:6C:73:C3:22:F5:AD:30:0C:2F:A0:D5:CA:75:4A:2A - - X509v3 Subject Key Identifier: - A3:B3:47:2C:41:5E:9C:B2:27:97:57:14:A4:2E:BA:8C:93:E7:01:65 - X509v3 Subject Alternative Name: - DNS:example.com - X509v3 Key Usage: critical - Digital Signature, Key Encipherment - X509v3 Extended Key Usage: - TLS Web Server Authentication, TLS Web Client Authentication - X509v3 CRL Distribution Points: - - Full Name: - URI:http://crl3.digicert.com/DigiCertTestSHA2IntermediateCA1.crl - - Full Name: - URI:http://crl4.digicert.com/DigiCertTestSHA2IntermediateCA1.crl - - X509v3 Certificate Policies: - Policy: 2.16.840.1.114412.1.1 - CPS: https://www.digicert.com/CPS - - Authority Information Access: - OCSP - URI:http://ocsp.digicert.com - CA Issuers - URI:http://cacerts.test.digicert.com/DigiCertTestSHA2IntermediateCA1.crt - - X509v3 Basic Constraints: critical - CA:FALSE - Signature Algorithm: sha256WithRSAEncryption - ae:d4:9c:8a:66:19:9e:7d:12:b7:05:c2:b6:33:b3:9c:a5:40: - 47:ab:34:8d:1b:0f:51:96:de:e9:46:5a:e4:16:10:43:56:bf: - fa:f8:64:f4:cb:53:39:5b:45:ca:7f:15:d9:59:25:21:23:c4: - 4d:dc:a7:f7:83:21:d2:3f:a8:0a:26:f4:ef:fa:1b:2b:7d:97: - 7e:28:f3:ca:cd:b2:c4:92:f3:92:27:7f:e0:f1:ac:d6:db:4c: - 10:8a:f8:6f:09:bb:b3:4f:19:06:aa:bb:74:1c:e0:51:42:f6: - 8c:7d:77:f7:80:a4:03:ab:a9:ae:ae:2b:89:17:af:2f:eb:f7: - 3d:61:7c:dd:e1:5d:d2:5a:c5:6a:f6:c8:92:4c:0a:b5:75:d1: - dd:39:f2:a7:a2:10:8c:6d:bf:ca:08:ad:b9:a9:df:e3:59:8f: - 64:16:3c:7e:8a:6e:27:fc:49:d7:06:f0:bd:94:15:f2:fd:0f: - 94:8a:b8:73:67:73:53:22:df:9d:36:e9:34:f9:2a:68:00:59: - 78:6d:2d:8f:a0:0f:13:af:bd:b3:aa:8c:37:c4:22:cf:23:fb: - 56:bc:4e:55:ae:3a:0a:e6:3e:b1:1a:22:71:7b:08:b8:00:41: - 14:26:f6:9b:9b:72:3f:eb:dc:dd:1b:db:a8:20:fd:54:75:ae: - 25:7f:80:e6 - -In the next step, we'll configure your application to actually use this new -Certificate resource. - -Exposing and securing your application -====================================== - -Now that we have issued a Certificate, we can expose our application using a -Kubernetes Ingress resource. - -Create a file named ``application-ingress.yaml`` and save the following in it, -replacing ``example.com`` with your own domain name: - -.. code-block:: yaml - :linenos: - - apiVersion: extensions/v1beta1 - kind: Ingress - metadata: - name: frontend-ingress - namespace: demo - annotations: - kubernetes.io/ingress.class: "nginx" - spec: - tls: - - hosts: - - example.com - secretName: example-com-tls - rules: - - host: example.com - http: - paths: - - path: / - backend: - serviceName: hello-kubernetes - servicePort: 80 - -You can then apply this resource with: - -.. code-block:: shell - - kubectl apply -n demo -f application-ingress.yaml - -Once this has been created, you should be able to visit your application at -the configured hostname, here ``example.com``! - -Navigate to the address in your web browser and you should see the certificate -obtained via Venafi being used to secure application traffic. +This document has moved to https://cert-manager.netlify.com/docs/tutorials/venafi/venafi/. +This placeholder file will be removed in a later release. diff --git a/go.mod b/go.mod index 11c199207..11dff6cce 100644 --- a/go.mod +++ b/go.mod @@ -48,7 +48,6 @@ require ( github.com/fatih/structs v1.1.0 // indirect github.com/go-logr/logr v0.1.0 github.com/go-logr/zapr v0.1.1 // indirect - github.com/go-openapi/spec v0.19.2 github.com/go-sql-driver/mysql v1.4.1 // indirect github.com/gocql/gocql v0.0.0-20190402132108-0e1d5de854df // indirect github.com/google/btree v1.0.0 // indirect diff --git a/hack/BUILD.bazel b/hack/BUILD.bazel index b9cfce486..f454a299f 100644 --- a/hack/BUILD.bazel +++ b/hack/BUILD.bazel @@ -216,32 +216,6 @@ sh_test( ], ) -# Reference docs generation rules -sh_binary( - name = "update-reference-docs", - srcs = ["update-reference-docs.sh"], - args = [ - "$(location @//docs/generated/reference/generate)", - ], - data = [ - "@//docs/generated/reference/generate", - ], -) - -sh_test( - name = "verify-reference-docs", - srcs = ["verify-reference-docs.sh"], - args = [ - "$(location :update-reference-docs)", - "$(location @//docs/generated/reference/generate)", - ], - data = [ - ":update-reference-docs", - "@//docs/generated/reference:output", - "@//docs/generated/reference/generate", - ], -) - # Gofmt rules sh_binary( diff --git a/hack/update-reference-docs.sh b/hack/update-reference-docs.sh deleted file mode 100755 index acf0c690a..000000000 --- a/hack/update-reference-docs.sh +++ /dev/null @@ -1,50 +0,0 @@ -#!/usr/bin/env bash -# Copyright 2019 The Jetstack cert-manager contributors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -set -o errexit -set -o nounset -set -o pipefail - -if [[ -n "${BUILD_WORKSPACE_DIRECTORY:-}" ]]; then # Running inside bazel - echo "Regenerate API reference documentation..." >&2 -elif ! command -v bazel &>/dev/null; then - echo "Install bazel at https://bazel.build" >&2 - exit 1 -else - ( - set -o xtrace - bazel run //hack:update-reference-docs - ) - exit 0 -fi - -generated_tarball=$(realpath "$1") - -cd "$BUILD_WORKSPACE_DIRECTORY" -output_path="docs/generated/reference/output/reference/api-docs" -# The final directory path to store the generated output data -output_dir="$BUILD_WORKSPACE_DIRECTORY/$output_path" - -# create a temporary directory to extract the generated reference docs tarball to -tmp_output="$(mktemp -d)" -# extract the generated docs tarball -tar -C "${tmp_output}" -xf "$generated_tarball" - -# clean up the output directory -rm -Rf "${output_dir}" - -# recreate the output directory and move extracted content to it -mkdir -p "${output_dir}" -mv "${tmp_output}"/* "${output_dir}" diff --git a/hack/verify-reference-docs.sh b/hack/verify-reference-docs.sh deleted file mode 100755 index 10e9a336a..000000000 --- a/hack/verify-reference-docs.sh +++ /dev/null @@ -1,58 +0,0 @@ -#!/usr/bin/env bash -# Copyright 2019 The Jetstack cert-manager contributors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -set -o nounset -set -o errexit -set -o pipefail - -if [[ -n "${TEST_WORKSPACE:-}" ]]; then # Running inside bazel - echo "Checking generated API reference documentation for changes..." >&2 -elif ! command -v bazel &>/dev/null; then - echo "Install bazel at https://bazel.build" >&2 - exit 1 -else - ( - set -o xtrace - bazel test --test_output=streamed //hack:verify-reference-docs - ) - exit 0 -fi - -compare_to=$(realpath "docs/generated/reference/output") - -tmpfiles=$TEST_TMPDIR/files - -( - mkdir -p "$tmpfiles" - rm -f bazel-* - cp -aL "." "$tmpfiles" - export BUILD_WORKSPACE_DIRECTORY=$tmpfiles - "$@" -) - -# Avoid diff -N so we handle empty files correctly -diff=$(diff -upr \ - -x ".git" \ - -x "bazel-*" \ - -x "_output" \ - "." "$tmpfiles" 2>/dev/null || true) - -if [[ -n "${diff}" ]]; then - echo "${diff}" >&2 - echo >&2 - echo "ERROR: generated API reference documentation changed. Update with ./hack/update-reference-docs.sh" >&2 - exit 1 -fi -echo "SUCCESS: generated API reference documentation up-to-date"