0.27.3

.github/workflows/check_helm.yaml

@@ -29,6 +29,12 @@ jobs:
         with:
           version: latest
 
+      # Renders the chart under value combinations `helm install` with defaults never reaches -
+      # the ServiceMonitor templates are gated off by default. Needs no cluster, so it runs first
+      # and fails fast.
+      - name: Chart Rendering Tests
+        run: ./dev/test_helm_chart.sh
+
       - name: Local Helm Test
         run: |
           set -xe

.github/workflows/run_tests.yaml

@@ -16,6 +16,27 @@ on:
         type: string
         required: false
 jobs:
+  # Go unit tests were previously run by nothing at all, which is how pkg/model's registry
+  # concurrency test sat broken for two years without anyone noticing. Runs beside the e2e
+  # job, so it costs no extra wall clock. -race is the point: those tests exist to catch
+  # locking regressions and only the detector can see them.
+  go_unit_tests:
+    name: Go unit tests (race)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          # go.mod is the single source of the build Go version.
+          go-version-file: go.mod
+
+      # -vet=off is the project convention: plain `go test` fails to build a few packages
+      # on pre-existing vet noise unrelated to the tests.
+      - name: go test -race
+        run: go test -vet=off -race -count=1 ./pkg/...
+
   run_tests:
     name: Run Tests
     runs-on: ubuntu-latest
@@ -79,6 +100,12 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y conntrack clickhouse-client
 
+      # test_010084 render-tests the Helm chart. The runner image happens to preinstall helm,
+      # but declaring it keeps the suite from silently skipping that scenario if that changes.
+      - uses: azure/setup-helm@v4
+        with:
+          version: latest
+
       - uses: medyagh/setup-minikube@master
         with:
           driver: docker

CONTRIBUTING.md

@@ -82,3 +82,13 @@ Date:   Mon Jan 24 12:34:56 2020 +0200
 ```
 
 Notice the `Author` and `Signed-off-by` lines **must match**.
+
+## License
+
+Contributions are licensed under the Apache License, Version 2.0 (see [LICENSE](./LICENSE) and [NOTICE](./NOTICE)).
+
+For new Go files, use the existing Apache header style (copyright line without "All rights reserved", plus the standard Apache-2.0 boilerplate). Optionally add:
+
+```go
+// SPDX-License-Identifier: Apache-2.0
+```

NOTICE

@@ -0,0 +1,11 @@
+Altinity Kubernetes Operator for ClickHouse
+Copyright 2019-2026 Altinity Inc and/or its affiliates.
+
+This product includes software developed at Altinity Inc
+(https://altinity.com/).
+
+Licensed under the Apache License, Version 2.0.
+See LICENSE for the full license text.
+
+Third-party Go dependency attributions for the operator and
+metrics-exporter binaries are listed in THIRD_PARTY_NOTICES.md.

README.md

@@ -78,11 +78,12 @@ The Altinity Kubernetes Operator for ClickHouse is a community effort sponsored
 
 ## License
 
-Copyright (c) 2019-2025, Altinity Inc and/or its affiliates. All rights reserved.
+Copyright (c) 2019-2026, Altinity Inc and/or its affiliates.
 
-Altinity Kubernetes Operator for ClickHouse is licensed under the Apache License 2.0.
+Altinity Kubernetes Operator for ClickHouse is licensed under the Apache License, Version 2.0.
+See [LICENSE](./LICENSE) and [NOTICE](./NOTICE).
 
-See [LICENSE](./LICENSE) for more details.
+Third-party Go dependency attributions are listed in [THIRD_PARTY_NOTICES.md](./THIRD_PARTY_NOTICES.md).
 
 ## Commercial Support
 

THIRD_PARTY_NOTICES.md

@@ -0,0 +1,117 @@
+# Third-Party License Attribution
+
+This file lists third-party Go dependencies used by the
+`clickhouse-operator` and `metrics-exporter` binaries, with their
+SPDX license identifiers.
+
+Generated with [`go-licenses`](https://github.com/google/go-licenses):
+
+```bash
+go-licenses report ./cmd/operator ./cmd/metrics_exporter \
+  --ignore github.com/altinity/clickhouse-operator
+```
+
+License texts are available under the paths in the **License file** column
+(from the `vendor/` tree), or via URL when the license is not vendored.
+The main project license is Apache-2.0; see [`LICENSE`](LICENSE) and [`NOTICE`](NOTICE).
+
+## Summary
+
+| License | Packages |
+|---------|----------|
+| Apache-2.0 | 41 |
+| BSD-3-Clause | 24 |
+| MIT | 16 |
+| BSD-2-Clause | 1 |
+| ISC | 1 |
+
+**Total packages:** 83
+
+## Packages
+
+| Package | License | License file |
+|---------|---------|--------------|
+| `github.com/altinity/queue` | Apache-2.0 | `vendor/github.com/altinity/queue/LICENSE` |
+| `github.com/beorn7/perks/quantile` | MIT | `vendor/github.com/beorn7/perks/LICENSE` |
+| `github.com/cespare/xxhash/v2` | MIT | `vendor/github.com/cespare/xxhash/v2/LICENSE.txt` |
+| `github.com/davecgh/go-spew/spew` | ISC | `vendor/github.com/davecgh/go-spew/LICENSE` |
+| `github.com/emicklei/go-restful/v3` | MIT | `vendor/github.com/emicklei/go-restful/v3/LICENSE` |
+| `github.com/evanphx/json-patch/v5` | BSD-3-Clause | `vendor/github.com/evanphx/json-patch/v5/LICENSE` |
+| `github.com/fsnotify/fsnotify` | BSD-3-Clause | `vendor/github.com/fsnotify/fsnotify/LICENSE` |
+| `github.com/go-logr/logr` | Apache-2.0 | `vendor/github.com/go-logr/logr/LICENSE` |
+| `github.com/go-logr/stdr` | Apache-2.0 | `vendor/github.com/go-logr/stdr/LICENSE` |
+| `github.com/go-logr/zapr` | Apache-2.0 | `vendor/github.com/go-logr/zapr/LICENSE` |
+| `github.com/go-openapi/jsonpointer` | Apache-2.0 | `vendor/github.com/go-openapi/jsonpointer/LICENSE` |
+| `github.com/go-openapi/jsonreference` | Apache-2.0 | `vendor/github.com/go-openapi/jsonreference/LICENSE` |
+| `github.com/go-openapi/swag` | Apache-2.0 | `vendor/github.com/go-openapi/swag/LICENSE` |
+| `github.com/go-zookeeper/zk` | BSD-3-Clause | `vendor/github.com/go-zookeeper/zk/LICENSE` |
+| `github.com/gogo/protobuf` | BSD-3-Clause | `vendor/github.com/gogo/protobuf/LICENSE` |
+| `github.com/golang/glog` | Apache-2.0 | `vendor/github.com/golang/glog/LICENSE` |
+| `github.com/golang/groupcache/lru` | Apache-2.0 | `vendor/github.com/golang/groupcache/LICENSE` |
+| `github.com/golang/protobuf` | BSD-3-Clause | `vendor/github.com/golang/protobuf/LICENSE` |
+| `github.com/google/gnostic-models` | Apache-2.0 | `vendor/github.com/google/gnostic-models/LICENSE` |
+| `github.com/google/go-cmp/cmp` | BSD-3-Clause | `vendor/github.com/google/go-cmp/LICENSE` |
+| `github.com/google/gofuzz` | Apache-2.0 | `vendor/github.com/google/gofuzz/LICENSE` |
+| `github.com/google/uuid` | BSD-3-Clause | `vendor/github.com/google/uuid/LICENSE` |
+| `github.com/imdario/mergo` | BSD-3-Clause | `vendor/github.com/imdario/mergo/LICENSE` |
+| `github.com/josharian/intern` | MIT | `vendor/github.com/josharian/intern/license.md` |
+| `github.com/json-iterator/go` | MIT | `vendor/github.com/json-iterator/go/LICENSE` |
+| `github.com/juliangruber/go-intersect` | MIT | [`LICENSE.md`](https://github.com/juliangruber/go-intersect/blob/v1.0.0/LICENSE.md) |
+| `github.com/kubernetes-sigs/yaml` | MIT | `vendor/github.com/kubernetes-sigs/yaml/LICENSE` |
+| `github.com/mailru/easyjson` | MIT | `vendor/github.com/mailru/easyjson/LICENSE` |
+| `github.com/mailru/go-clickhouse/v2` | MIT | `vendor/github.com/mailru/go-clickhouse/v2/LICENSE` |
+| `github.com/MakeNowJust/heredoc` | MIT | `vendor/github.com/MakeNowJust/heredoc/LICENSE` |
+| `github.com/Masterminds/semver/v3` | MIT | `vendor/github.com/Masterminds/semver/v3/LICENSE.txt` |
+| `github.com/modern-go/concurrent` | Apache-2.0 | `vendor/github.com/modern-go/concurrent/LICENSE` |
+| `github.com/modern-go/reflect2` | Apache-2.0 | `vendor/github.com/modern-go/reflect2/LICENSE` |
+| `github.com/munnerz/goautoneg` | BSD-3-Clause | `vendor/github.com/munnerz/goautoneg/LICENSE` |
+| `github.com/novln/docker-parser` | Apache-2.0 | `vendor/github.com/novln/docker-parser/LICENSE` |
+| `github.com/pkg/errors` | BSD-2-Clause | `vendor/github.com/pkg/errors/LICENSE` |
+| `github.com/prometheus/client_golang/internal/github.com/golang/gddo/httputil` | BSD-3-Clause | `vendor/github.com/prometheus/client_golang/internal/github.com/golang/gddo/LICENSE` |
+| `github.com/prometheus/client_golang/prometheus` | Apache-2.0 | `vendor/github.com/prometheus/client_golang/LICENSE` |
+| `github.com/prometheus/client_model/go` | Apache-2.0 | `vendor/github.com/prometheus/client_model/LICENSE` |
+| `github.com/prometheus/common` | Apache-2.0 | `vendor/github.com/prometheus/common/LICENSE` |
+| `github.com/prometheus/otlptranslator` | Apache-2.0 | `vendor/github.com/prometheus/otlptranslator/LICENSE` |
+| `github.com/sanity-io/litter` | MIT | `vendor/github.com/sanity-io/litter/LICENSE` |
+| `github.com/spf13/pflag` | BSD-3-Clause | `vendor/github.com/spf13/pflag/LICENSE` |
+| `go.opentelemetry.io/auto/sdk` | Apache-2.0 | `vendor/go.opentelemetry.io/auto/sdk/LICENSE` |
+| `go.opentelemetry.io/otel` | Apache-2.0 | `vendor/go.opentelemetry.io/otel/LICENSE` |
+| `go.opentelemetry.io/otel/exporters/prometheus` | Apache-2.0 | `vendor/go.opentelemetry.io/otel/exporters/prometheus/LICENSE` |
+| `go.opentelemetry.io/otel/metric` | Apache-2.0 | `vendor/go.opentelemetry.io/otel/metric/LICENSE` |
+| `go.opentelemetry.io/otel/sdk` | Apache-2.0 | `vendor/go.opentelemetry.io/otel/sdk/LICENSE` |
+| `go.opentelemetry.io/otel/sdk/metric` | Apache-2.0 | `vendor/go.opentelemetry.io/otel/sdk/metric/LICENSE` |
+| `go.opentelemetry.io/otel/trace` | Apache-2.0 | `vendor/go.opentelemetry.io/otel/trace/LICENSE` |
+| `go.uber.org/multierr` | MIT | `vendor/go.uber.org/multierr/LICENSE.txt` |
+| `go.uber.org/zap` | MIT | `vendor/go.uber.org/zap/LICENSE.txt` |
+| `go.yaml.in/yaml/v2` | Apache-2.0 | `vendor/go.yaml.in/yaml/v2/LICENSE` |
+| `golang.org/x/exp` | BSD-3-Clause | `vendor/golang.org/x/exp/LICENSE` |
+| `golang.org/x/net` | BSD-3-Clause | `vendor/golang.org/x/net/LICENSE` |
+| `golang.org/x/oauth2` | BSD-3-Clause | `vendor/golang.org/x/oauth2/LICENSE` |
+| `golang.org/x/sync/semaphore` | BSD-3-Clause | `vendor/golang.org/x/sync/LICENSE` |
+| `golang.org/x/sys/unix` | BSD-3-Clause | `vendor/golang.org/x/sys/LICENSE` |
+| `golang.org/x/term` | BSD-3-Clause | `vendor/golang.org/x/term/LICENSE` |
+| `golang.org/x/text` | BSD-3-Clause | `vendor/golang.org/x/text/LICENSE` |
+| `golang.org/x/time/rate` | BSD-3-Clause | `vendor/golang.org/x/time/LICENSE` |
+| `gomodules.xyz/jsonpatch/v2` | Apache-2.0 | `vendor/gomodules.xyz/jsonpatch/v2/LICENSE` |
+| `google.golang.org/protobuf` | BSD-3-Clause | `vendor/google.golang.org/protobuf/LICENSE` |
+| `gopkg.in/d4l3k/messagediff.v1` | MIT | `vendor/gopkg.in/d4l3k/messagediff.v1/LICENSE` |
+| `gopkg.in/inf.v0` | BSD-3-Clause | `vendor/gopkg.in/inf.v0/LICENSE` |
+| `gopkg.in/yaml.v2` | Apache-2.0 | `vendor/gopkg.in/yaml.v2/LICENSE` |
+| `gopkg.in/yaml.v3` | MIT | `vendor/gopkg.in/yaml.v3/LICENSE` |
+| `k8s.io/api` | Apache-2.0 | `vendor/k8s.io/api/LICENSE` |
+| `k8s.io/apiextensions-apiserver/pkg` | Apache-2.0 | `vendor/k8s.io/apiextensions-apiserver/LICENSE` |
+| `k8s.io/apimachinery/pkg` | Apache-2.0 | `vendor/k8s.io/apimachinery/LICENSE` |
+| `k8s.io/apimachinery/third_party/forked/golang` | BSD-3-Clause | `vendor/k8s.io/apimachinery/third_party/forked/golang/LICENSE` |
+| `k8s.io/client-go` | Apache-2.0 | `vendor/k8s.io/client-go/LICENSE` |
+| `k8s.io/klog/v2` | Apache-2.0 | `vendor/k8s.io/klog/v2/LICENSE` |
+| `k8s.io/kube-openapi/pkg` | Apache-2.0 | `vendor/k8s.io/kube-openapi/LICENSE` |
+| `k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json` | BSD-3-Clause | `vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/LICENSE` |
+| `k8s.io/kube-openapi/pkg/validation/spec` | Apache-2.0 | `vendor/k8s.io/kube-openapi/pkg/validation/spec/LICENSE` |
+| `k8s.io/utils` | Apache-2.0 | `vendor/k8s.io/utils/LICENSE` |
+| `k8s.io/utils/internal/third_party/forked/golang/net` | BSD-3-Clause | `vendor/k8s.io/utils/internal/third_party/forked/golang/LICENSE` |
+| `sigs.k8s.io/controller-runtime` | Apache-2.0 | `vendor/sigs.k8s.io/controller-runtime/LICENSE` |
+| `sigs.k8s.io/json` | Apache-2.0 | `vendor/sigs.k8s.io/json/LICENSE` |
+| `sigs.k8s.io/structured-merge-diff/v4` | Apache-2.0 | `vendor/sigs.k8s.io/structured-merge-diff/v4/LICENSE` |
+| `sigs.k8s.io/yaml` | Apache-2.0 | `vendor/sigs.k8s.io/yaml/LICENSE` |
+| `sigs.k8s.io/yaml/goyaml.v2` | Apache-2.0 | `vendor/sigs.k8s.io/yaml/goyaml.v2/LICENSE` |
+

cmd/metrics_exporter/app/metrics_exporter.go

@@ -165,6 +165,26 @@ func Run() {
 // restarts the container with the new merged config. It mirrors the operator's
 // chopconf handlers (pkg/controller/chi/controller.go addEventHandlersChopConfig
 // + addChopConfig/updateChopConfig) so both containers react identically.
+// deletedChopConfig decodes an informer delete payload, unwrapping a client-go
+// DeletedFinalStateUnknown tombstone - delivered when a watch delete is missed and
+// a relist finds the object gone. Returns nil for anything that does not decode:
+// this handler exits the process, so an unrecognized payload must not take the
+// container down with it. Mirrors deleteHandler in pkg/controller/chi/controller.go,
+// duplicated rather than shared because importing package chi would pull the whole
+// operator controller into the exporter binary.
+func deletedChopConfig(obj interface{}) *api.ClickHouseOperatorConfiguration {
+	if tombstone, ok := obj.(cache.DeletedFinalStateUnknown); ok {
+		obj = tombstone.Obj
+	}
+	// A tombstone can carry a typed nil, which satisfies the assertion - check it.
+	cfg, ok := obj.(*api.ClickHouseOperatorConfiguration)
+	if !ok || (cfg == nil) {
+		log.Errorf("chopConfigInformer.DeleteFunc: unexpected object type %T", obj)
+		return nil
+	}
+	return cfg
+}
+
 func startChopConfigRestartWatcher(ctx context.Context, chopClient *chopclientset.Clientset) {
 	factory := chopinformers.NewSharedInformerFactoryWithOptions(
 		chopClient,
@@ -192,6 +212,10 @@ func startChopConfigRestartWatcher(ctx context.Context, chopClient *chopclientse
 			chop.RestartOnConfigChange("ClickHouseOperatorConfiguration updated")
 		},
 		DeleteFunc: func(obj interface{}) {
+			cfg := deletedChopConfig(obj)
+			if cfg == nil {
+				return
+			}
 			chop.RestartOnConfigChange("ClickHouseOperatorConfiguration deleted")
 		},
 	})

deploy/helm/clickhouse-operator/Chart.yaml

@@ -17,10 +17,15 @@ description: |-
     kubectl apply -f https://github.com/Altinity/clickhouse-operator/raw/master/deploy/helm/clickhouse-operator/crds/CustomResourceDefinition-clickhousekeeperinstallations.clickhouse-keeper.altinity.com.yaml
   ```
 type: application
-version: 0.27.2
-appVersion: 0.27.2
+version: 0.27.3
+appVersion: 0.27.3
 home: https://github.com/Altinity/clickhouse-operator
 icon: https://logosandtypes.com/wp-content/uploads/2020/12/altinity.svg
+sources:
+  - https://github.com/Altinity/clickhouse-operator
 maintainers:
   - name: altinity
     email: support@altinity.com
+annotations:
+  artifacthub.io/license: Apache-2.0
+

deploy/helm/clickhouse-operator/README.md

@@ -1,6 +1,6 @@
 # altinity-clickhouse-operator
 
-![Version: 0.27.2](https://img.shields.io/badge/Version-0.27.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.27.2](https://img.shields.io/badge/AppVersion-0.27.2-informational?style=flat-square)
+![Version: 0.27.3](https://img.shields.io/badge/Version-0.27.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.27.3](https://img.shields.io/badge/AppVersion-0.27.3-informational?style=flat-square)
 
 Helm chart to deploy [altinity-clickhouse-operator](https://github.com/Altinity/clickhouse-operator).
 
@@ -26,6 +26,10 @@ To disable automatic CRD updates, set `crdHook.enabled: false` in values.yaml. W
 | ---- | ------ | --- |
 | altinity | <support@altinity.com> |  |
 
+## Source Code
+
+* <https://github.com/Altinity/clickhouse-operator>
+
 ## CRD Management
 
 This chart includes automatic CRD installation and update functionality using Helm hooks. CRDs are automatically applied during `helm install` and `helm upgrade` operations.
@@ -133,7 +137,15 @@ crdHook:
 | serviceMonitor.clickhouseMetrics.metricRelabelings | list | `[]` |  |
 | serviceMonitor.clickhouseMetrics.relabelings | list | `[]` |  |
 | serviceMonitor.clickhouseMetrics.scrapeTimeout | string | `""` |  |
-| serviceMonitor.enabled | bool | `false` | ServiceMonitor Custom resource is created for a [prometheus-operator](https://github.com/prometheus-operator/prometheus-operator) In serviceMonitor will be created two endpoints ch-metrics on port 8888 and op-metrics # 9999. Ypu can specify interval, scrapeTimeout, relabelings, metricRelabelings for each endpoint below |
+| serviceMonitor.enabled | bool | `false` | ServiceMonitor Custom resource is created for a [prometheus-operator](https://github.com/prometheus-operator/prometheus-operator) In serviceMonitor will be created two endpoints ch-metrics on port 8888 and op-metrics # 9999, plus a separate keeper-metrics ServiceMonitor when `serviceMonitor.keeperMetrics.enabled` is also set. You can specify interval, scrapeTimeout, relabelings, metricRelabelings for each endpoint below |
+| serviceMonitor.keeperMetrics.enabled | bool | `false` | create a separate ServiceMonitor scraping the native ClickHouse Keeper prometheus endpoint on the Keeper Services the operator manages. Unlike ClickHouse server metrics, Keeper metrics do not go through the operator's metrics-exporter - Keeper serves Prometheus itself. Off by default because it needs the CHK to opt in first: operator-generated Keeper Services publish only the `zk`/`zk-secure`/`raft` ports, so the CHK must both enable the endpoint via `prometheus/*` settings and name the port in `spec.templates.serviceTemplates` (a serviceTemplate REPLACES the default port list, so re-declare `zk` and `raft` there). Without that the ServiceMonitor matches no targets and reports nothing. |
+| serviceMonitor.keeperMetrics.interval | string | `"30s"` | Prometheus scrape interval for the keeper-metrics endpoint |
+| serviceMonitor.keeperMetrics.metricRelabelings | list | `[]` | Prometheus [MetricRelabelConfigs] to apply to samples before ingestion |
+| serviceMonitor.keeperMetrics.namespaceSelector | object | `{"any":true}` | namespaces where prometheus-operator will discover keeper services, `any: true` means all namespaces. Entries under `matchNames` must be literal namespace names, not the regexps `watchNamespaces` accepts. Cluster-wide discovery also requires the Prometheus service account to hold cluster-scoped RBAC on services/endpoints, and Prometheus to select this ServiceMonitor (see `serviceMonitor.additionalLabels`) |
+| serviceMonitor.keeperMetrics.port | string | `"prometheus"` | name of the Keeper Service port exposing the native prometheus endpoint. Must match the port name in the CHK serviceTemplate. `prometheus` follows this repo's own Keeper examples (port 7000); charts that name it `metrics` need this overridden |
+| serviceMonitor.keeperMetrics.relabelings | list | `[]` | Prometheus [RelabelConfigs] to apply to samples before scraping |
+| serviceMonitor.keeperMetrics.scrapeTimeout | string | `""` | Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used. |
+| serviceMonitor.keeperMetrics.selector | object | check the `values.yaml` file | matchLabels selecting the Keeper Services to scrape. The default matches every Keeper Service the operator manages. Note the operator creates several Services per CHK (CR-scope plus per-host peer and client), all carrying this label, so if more than one of them names the metrics port the same pod is scraped more than once - narrow with `clickhouse-keeper.altinity.com/Service: chk` (CR-scope) or `: host` (per-host) to pick a single tier |
 | serviceMonitor.operatorMetrics.interval | string | `"30s"` |  |
 | serviceMonitor.operatorMetrics.metricRelabelings | list | `[]` |  |
 | serviceMonitor.operatorMetrics.relabelings | list | `[]` |  |

deploy/helm/clickhouse-operator/crds/CustomResourceDefinition-clickhouseinstallations.clickhouse.altinity.com.yaml

@@ -4,14 +4,14 @@
 # SINGULAR=clickhouseinstallation
 # PLURAL=clickhouseinstallations
 # SHORT=chi
-# OPERATOR_VERSION=0.27.2
+# OPERATOR_VERSION=0.27.3
 #
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: clickhouseinstallations.clickhouse.altinity.com
   labels:
-    clickhouse.altinity.com/chop: 0.27.2
+    clickhouse.altinity.com/chop: 0.27.3
 spec:
   group: clickhouse.altinity.com
   scope: Namespaced