root CA and policy, a telemetry team may only have access to Prometheus,
and a different team may maintain the control plane components (which are highly security sensitive).

The install is organized in 'environments' - each environment consists of a set of components
in different namespaces that are configured to work together. Regardless of 'environment',

 *
 * <p>The EncryptInvoker is designed to handle encryption tasks within the Maven ecosystem,
 * such as encrypting passwords or other sensitive information in Maven settings files.</p>
 *
 * @since 4.0.0
 */
@Experimental
public interface EncryptInvoker extends Invoker<EncryptInvokerRequest> {
    /**

      <description><![CDATA[
        This is the property specification used to activate a profile. If the value field is empty,
        then the existence of the named property will activate the profile, otherwise it does a case-sensitive
        match against the property value as well.
      ]]></description>
      <fields>
        <field>
          <name>name</name>
          <version>1.0.0</version>
          <type>String</type>

fun Requirements.requiresNotSharedHost() {
    doesNotContain("agent.host.type", "shared")
}

/**
 * This is an undocumented location that forbids anonymous access.
 * We put artifacts here to avoid accidentally exposing sensitive information publicly.
 */
const val hiddenArtifactDestination = ".teamcity/gradle-logs"

fun BuildType.applyDefaultSettings(os: Os = Os.LINUX, arch: Arch = Arch.AMD64, buildJvm: Jvm = BuildToolBuildJvm, timeout: Int = 30) {

Most of these settings are variable (can change), like database URLs. And many could be sensitive, like secrets.

For this reason it's common to provide them in environment variables that are read by the application.

/// tip

    assertEquals(0, logHandler.getStoredLogRecords().size());
  }

  public void testPartiallyConstructedManager_transitionAfterAddListenerBeforeStateIsReady() {
    // The implementation of this test is pretty sensitive to the implementation :( but we want to
    // ensure that if weird things happen during construction then we get exceptions.
    final NoOpService service1 = new NoOpService();

   *             cancelled the {@code Future}.
   *       </ol>
   *       Given all these possibilities, it is frequently possible for listeners to execute in UI
   *       threads, RPC network threads, or other latency-sensitive threads. In those cases, slow
   *       listeners can harm responsiveness, slow the system as a whole, or worse. (See also the
   *       note about locking below.)

      <description>
        This is the property specification used to activate a profile. If the value field is empty,
        then the existence of the named property will activate the profile, otherwise it does a case-sensitive
        match against the property value as well.
      </description>
      <fields>
        <field>
          <name>name</name>
          <version>1.0.0+</version>
          <type>String</type>

	// so we do not want to override them, copy them instead.
	for k, v := range encMetadata {
		srcInfo.UserDefined[k] = v
	}

	// Ensure that metadata does not contain sensitive information
	crypto.RemoveSensitiveEntries(srcInfo.UserDefined)

	// If we see legacy source, metadataOnly we have to overwrite the content.
	if srcInfo.Legacy {
		srcInfo.metadataOnly = false
	}

                        be activated.
                      items:
                        properties:
                          authority:
                            description: 'HTTP Authority values are case-sensitive
                              and formatted as follows: - `exact: "value"` for exact
                              string match - `prefix: "value"` for prefix-based match