From 452a4982c86e7ef5527b20f222944c4f937572e2 Mon Sep 17 00:00:00 2001 From: Mukul Sharma Date: Mon, 31 Aug 2026 07:26:44 +0530 Subject: [PATCH] fix contour chart: was pointing at Bitnami, now official projectcontour --- .../argocd-central-ase1c/custom-values.yaml | 237 -- .../argocd-central-v2/custom-values.yaml | 246 -- .../argocd-central/custom-values.yaml | 233 -- .../argocd-dataengg-ase1c/custom-values.yaml | 236 -- .../argocd-dataengg-v2/custom-values.yaml | 277 -- .../argocd-dataengg/custom-values.yaml | 248 -- .../custom-values.yaml | 235 -- .../argocd-datascience-v2/custom-values.yaml | 291 -- .../argocd-datascience/custom-values.yaml | 256 -- .../argocd-demand-ase1c/custom-values.yaml | 250 -- .../argocd-demand-v2/custom-values.yaml | 270 -- .../argocd-demand/custom-values.yaml | 236 -- .../argocd-dsgpu-v2/custom-values.yaml | 274 -- .../argocd-dsgpu/custom-values.yaml | 248 -- .../argocd-farmiso-v2/custom-values.yaml | 259 -- .../argocd-farmiso/custom-values.yaml | 236 -- .../argocd-ml-platform/custom-values.yaml | 236 -- .../argocd-shared/custom-values.yaml | 299 -- .../argocd-supply-ase1c/custom-values.yaml | 236 -- .../argocd-supply-v2/custom-values.yaml | 268 -- .../argocd-supply/custom-values.yaml | 236 -- .../contour/custom-values.yaml | 44 + .../vault/custom-values.yaml | 169 +- helm-templates/contour/Chart.lock | 10 +- helm-templates/contour/Chart.yaml | 45 +- helm-templates/contour/README.md | 740 ---- .../contour/charts/contour-0.7.0.tgz | Bin 0 -> 267698 bytes helm-templates/contour/templates/NOTES.txt | 40 - helm-templates/contour/templates/_helpers.tpl | 122 - .../contour/templates/certgen/job.yaml | 84 - .../contour/templates/certgen/rbac.yaml | 48 - .../templates/certgen/serviceaccount.yaml | 24 - .../contour/templates/contour/configmap.yaml | 22 - .../contour/templates/contour/deployment.yaml | 247 -- .../templates/contour/ingressclass.yaml | 25 - .../contour/templates/contour/rbac.yaml | 234 -- .../contour/service-loadbalancer.yaml | 28 - .../contour/templates/contour/service.yaml | 80 - .../templates/contour/serviceaccount.yaml | 21 - .../templates/contour/servicemonitor.yaml | 47 - .../templates/crds/contourconfiguration.yaml | 1238 ------ .../templates/crds/contourdeployments.yaml | 3359 ----------------- .../templates/crds/extensionservices.yaml | 425 --- .../contour/templates/crds/httpproxies.yaml | 2803 -------------- .../crds/tlscertificatedeligations.yaml | 291 -- .../templates/default-backend/deployment.yaml | 172 - .../templates/default-backend/ingress.yaml | 70 - .../default-backend/poddisruptionbudget.yaml | 30 - .../templates/default-backend/service.yaml | 30 - .../default-backend/tls-secrets.yaml | 46 - .../contour/templates/envoy/daemonset.yaml | 313 -- .../contour/templates/envoy/deployment.yaml | 338 -- .../contour/templates/envoy/extra-list.yaml | 9 - .../contour/templates/envoy/headless.yaml | 38 - .../contour/templates/envoy/hpa.yaml | 55 - .../templates/envoy/prometheusrule.yaml | 26 - .../contour/templates/envoy/scaledObject.yaml | 57 - .../templates/envoy/service-export.yaml | 13 - .../templates/envoy/service-loadbalancer.yaml | 46 - .../contour/templates/envoy/service.yaml | 103 - .../templates/envoy/serviceaccount.yaml | 21 - .../templates/envoy/servicemonitor.yaml | 48 - helm-templates/contour/values.yaml | 1514 -------- helm-templates/vault/Chart.lock | 6 + helm-templates/vault/Chart.yaml | 6 +- helm-templates/vault/charts/vault-0.34.1.tgz | Bin 0 -> 54664 bytes 66 files changed, 104 insertions(+), 18290 deletions(-) delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-central-ase1c/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-central-v2/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-central/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-dataengg-ase1c/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-dataengg-v2/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-dataengg/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-datascience-ase1c/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-datascience-v2/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-datascience/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-demand-ase1c/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-demand-v2/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-demand/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-dsgpu-v2/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-dsgpu/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-farmiso-v2/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-farmiso/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-ml-platform/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-shared/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-supply-ase1c/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-supply-v2/custom-values.yaml delete mode 100644 helm-overrides/k8s-admin-prd-ase1/argocd-supply/custom-values.yaml create mode 100644 helm-overrides/k8s-admin-prd-ase1/contour/custom-values.yaml delete mode 100644 helm-templates/contour/README.md create mode 100644 helm-templates/contour/charts/contour-0.7.0.tgz delete mode 100644 helm-templates/contour/templates/NOTES.txt delete mode 100644 helm-templates/contour/templates/_helpers.tpl delete mode 100644 helm-templates/contour/templates/certgen/job.yaml delete mode 100644 helm-templates/contour/templates/certgen/rbac.yaml delete mode 100644 helm-templates/contour/templates/certgen/serviceaccount.yaml delete mode 100644 helm-templates/contour/templates/contour/configmap.yaml delete mode 100644 helm-templates/contour/templates/contour/deployment.yaml delete mode 100644 helm-templates/contour/templates/contour/ingressclass.yaml delete mode 100644 helm-templates/contour/templates/contour/rbac.yaml delete mode 100644 helm-templates/contour/templates/contour/service-loadbalancer.yaml delete mode 100644 helm-templates/contour/templates/contour/service.yaml delete mode 100644 helm-templates/contour/templates/contour/serviceaccount.yaml delete mode 100644 helm-templates/contour/templates/contour/servicemonitor.yaml delete mode 100644 helm-templates/contour/templates/crds/contourconfiguration.yaml delete mode 100644 helm-templates/contour/templates/crds/contourdeployments.yaml delete mode 100644 helm-templates/contour/templates/crds/extensionservices.yaml delete mode 100644 helm-templates/contour/templates/crds/httpproxies.yaml delete mode 100644 helm-templates/contour/templates/crds/tlscertificatedeligations.yaml delete mode 100644 helm-templates/contour/templates/default-backend/deployment.yaml delete mode 100644 helm-templates/contour/templates/default-backend/ingress.yaml delete mode 100644 helm-templates/contour/templates/default-backend/poddisruptionbudget.yaml delete mode 100644 helm-templates/contour/templates/default-backend/service.yaml delete mode 100644 helm-templates/contour/templates/default-backend/tls-secrets.yaml delete mode 100644 helm-templates/contour/templates/envoy/daemonset.yaml delete mode 100644 helm-templates/contour/templates/envoy/deployment.yaml delete mode 100644 helm-templates/contour/templates/envoy/extra-list.yaml delete mode 100644 helm-templates/contour/templates/envoy/headless.yaml delete mode 100644 helm-templates/contour/templates/envoy/hpa.yaml delete mode 100644 helm-templates/contour/templates/envoy/prometheusrule.yaml delete mode 100644 helm-templates/contour/templates/envoy/scaledObject.yaml delete mode 100644 helm-templates/contour/templates/envoy/service-export.yaml delete mode 100644 helm-templates/contour/templates/envoy/service-loadbalancer.yaml delete mode 100644 helm-templates/contour/templates/envoy/service.yaml delete mode 100644 helm-templates/contour/templates/envoy/serviceaccount.yaml delete mode 100644 helm-templates/contour/templates/envoy/servicemonitor.yaml delete mode 100644 helm-templates/contour/values.yaml create mode 100644 helm-templates/vault/Chart.lock create mode 100644 helm-templates/vault/charts/vault-0.34.1.tgz diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-central-ase1c/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-central-ase1c/custom-values.yaml deleted file mode 100644 index 154d304..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-central-ase1c/custom-values.yaml +++ /dev/null @@ -1,237 +0,0 @@ -argo-cd: - createClusterRoles: false - global: - image: - tag: "v2.13.8" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - metrics: - enabled: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - controller: - replicas: 2 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - resources: - limits: - cpu: "6" - memory: "12Gi" - requests: - cpu: "4" - memory: "8Gi" - env: - - name: ARGOCD_CONTROLLER_REPLICAS - value: '2' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 3 - minReplicas: 2 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: 1500m - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: GIT_DEPTH - value: '1' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 20 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-central-ase1c-prd.meeshogcp.in" - ingressClassName: nginx-internal - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - resources: - limits: - cpu: "2" - memory: 4Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 2 - notifications: - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations: | - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - url: https://argocd-central-ase1c-prd.meeshogcp.in - statusbadge.enabled: "true" - timeout.reconciliation.jitter: 60s - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: error - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: Ov23liADWi36cVVXu001 - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '40' - controller.operation.processors: '20' - controller.repo.server.timeout.seconds: '60' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, override, *, allow - p, role:admin-nodelete, applications, sync, *, allow - p, role:admin-nodelete, applications, action/*, *, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - g, Meesho:devops-new, role:admin-nodelete - ## Policy for BACKEND team - p, role:backend, applications, create, cntr-*/*, allow - p, role:backend, applications, get, cntr-*/*, allow - p, role:backend, applications, override, cntr-*/*, allow - p, role:backend, applications, sync, cntr-*/*, allow - p, role:backend, applications, update, cntr-*/*, allow - p, role:backend, applications, delete, */*, deny - p, role:backend, applications, delete/*/Pod/*/*, cntr-*/*, allow - p, role:backend, applications, action/apps/Deployment/restart, cntr-*/*, allow - p, role:backend, logs, get, cntr-*/*, allow - p, role:backend, exec, create, cntr-*/*, allow - p, role:backend, projects, get, cntr-*, allow - p, role:backend, projects, sync, cntr-*, allow - p, role:backend, repositories, update, cntr-*/*, allow - ## Teams and policy mapping - g, Meesho:devops, role:admin - g, Meesho:backend, role:backend - g, ringmaster, role:admins diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-central-v2/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-central-v2/custom-values.yaml deleted file mode 100644 index 28cc095..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-central-v2/custom-values.yaml +++ /dev/null @@ -1,246 +0,0 @@ -argo-cd: - crds: - install: false - global: - image: - tag: "v3.4.3" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - metrics: - enabled: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - controller: - replicas: 3 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - resources: - limits: - cpu: "7" - memory: "12Gi" - requests: - cpu: "6" - memory: "8Gi" - env: - - name: ARGOCD_K8S_CLIENT_QPS - value: '250' - - name: ARGOCD_CONTROLLER_REPLICAS - value: '3' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 25 - minReplicas: 5 - targetMemoryUtilizationPercentage: 75 - targetCPUUtilizationPercentage: 60 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: 1500m - memory: 4Gi - requests: - cpu: "1" - memory: 3Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: ARGOCD_EXEC_TIMEOUT - value: '600s' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 25 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-central-prd-ase1a.meeshogcp.in" - ingressClassName: nginx-internal - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - resources: - limits: - cpu: "2" - memory: 4Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 2 - notifications: - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations.health.projectcontour.io_HTTPProxy: | - hs = {} - hs.status = "Healthy" - hs.message = "HTTPProxy health check ignored" - return hs - resource.customizations: | - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - url: https://argocd-central-prd-ase1a.meeshogcp.in - accounts.readonly: 'apiKey,login' - accounts.ringmaster: 'apiKey,login' - timeout.reconciliation: 5m - timeout.reconciliation.jitter: 120s - statusbadge.enabled: "true" - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: error - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: Ov23lipLIbj8Q3kZ4p8g - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '60' - controller.operation.processors: '30' - controller.repo.server.timeout.seconds: '90' - reposerver.parallelism.limit: '2' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - ## Policy for BACKEND team - p, role:backend, *, get, */*, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, create, */*, allow - p, role:admin-nodelete, applications, get, */*, allow - p, role:admin-nodelete, applications, override, */*, allow - p, role:admin-nodelete, applications, sync, */*, allow - p, role:admin-nodelete, applications, update, */*, allow - p, role:admin-nodelete, applications, update/*, */*, allow - p, role:admin-nodelete, applications, action/*, */*, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - ## Policy for devops intern role - p, role:intern, *, get, *, allow - ## Role definition for different Github teams - g, Meesho:architects, role:admin-nodelete - g, Meesho:devops-new, role:admin-nodelete - g, Meesho:devops-interns, role:intern - g, Meesho:devops, role:admins - g, Meesho:backend, role:backend - g, readonly, role:backend - g, ringmaster, role:admin-nodelete diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-central/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-central/custom-values.yaml deleted file mode 100644 index e957beb..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-central/custom-values.yaml +++ /dev/null @@ -1,233 +0,0 @@ -argo-cd: - global: - image: - tag: "v2.13.8" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - metrics: - enabled: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - controller: - replicas: 2 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - resources: - limits: - cpu: "7" - memory: "12Gi" - requests: - cpu: "6" - memory: "8Gi" - env: - - name: ARGOCD_CONTROLLER_REPLICAS - value: '2' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 25 - minReplicas: 3 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: 1500m - memory: 4Gi - requests: - cpu: "1" - memory: 3Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: GIT_DEPTH - value: "1" - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 20 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-central-prd.meeshogcp.in" - ingressClassName: nginx-internal - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - resources: - limits: - cpu: "2" - memory: 4Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 2 - notifications: - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations: | - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - url: https://argocd-central-prd.meeshogcp.in - accounts.readonly: 'apiKey,login' - timeout.reconciliation: 3m - timeout.reconciliation.jitter: 60s - statusbadge.enabled: "true" - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: error - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: 281775fcf1df0edda53c - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '40' - controller.operation.processors: '20' - controller.repo.server.timeout.seconds: '60' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, create, */*, allow - p, role:admin-nodelete, applications, get, */*, allow - p, role:admin-nodelete, applications, override, */*, allow - p, role:admin-nodelete, applications, sync, */*, allow - p, role:admin-nodelete, applications, update, */*, allow - p, role:admin-nodelete, applications, action/*, */*, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - g, Meesho:architects, role:admin-nodelete - g, Meesho:devops-new, role:admin-nodelete - ## Policy for BACKEND team - p, role:backend, *, get, */*, allow - ## Teams and policy mapping - p, role:intern, *, get, *, allow - g, Meesho:devops-interns, role:intern - g, Meesho:devops, role:admins - g, Meesho:backend, role:backend - g, ringmaster, role:admin-nodelete - g, readonly, role:backend diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-dataengg-ase1c/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-dataengg-ase1c/custom-values.yaml deleted file mode 100644 index f19635b..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-dataengg-ase1c/custom-values.yaml +++ /dev/null @@ -1,236 +0,0 @@ -argo-cd: - createClusterRoles: false - global: - image: - tag: "v2.13.8" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - metrics: - enabled: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - controller: - replicas: 2 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - resources: - limits: - cpu: "6" - memory: "12Gi" - requests: - cpu: "4" - memory: "8Gi" - env: - - name: ARGOCD_CONTROLLER_REPLICAS - value: '2' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 3 - minReplicas: 2 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: 1500m - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 20 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-dataengg-ase1c-prd.meeshogcp.in" - ingressClassName: nginx-internal - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - resources: - limits: - cpu: "2" - memory: 4Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 2 - notifications: - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations: | - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - url: https://argocd-dataengg-ase1c-prd.meeshogcp.in - statusbadge.enabled: "true" - timeout.reconciliation.jitter: 60s - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: error - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: Ov23lierFtKEWCBjHPN4 - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '40' - controller.operation.processors: '20' - controller.repo.server.timeout.seconds: '60' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - p, role:admins, *, *, *, allow - ## Policy for data-engineering team - p, role:data-engineering, applications, create, */*, allow - p, role:data-engineering, applications, get, */*, allow - p, role:data-engineering, applications, override, */*, allow - p, role:data-engineering, applications, sync, */*, allow - p, role:data-engineering, applications, update, */*, allow - p, role:data-engineering, applications, delete, */*, deny - p, role:data-engineering, applications, action/apps/Deployment/restart, */*, allow - p, role:data-engineering, applications, delete, deng-dpcon/*, allow - p, role:data-engineering, applications, delete/*/Pod/*/*, deng-*/*, allow - p, role:data-engineering, logs, get, */*, allow - p, role:data-engineering, exec, create, */*, allow - p, role:data-engineering, projects, get, *, allow - p, role:data-engineering, repositories, update, */*, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, override, *, allow - p, role:admin-nodelete, applications, sync, *, allow - p, role:admin-nodelete, applications, action/*, *, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - g, Meesho:devops-new, role:admin-nodelete - ## Role definition for different Github teams - g, Meesho:devops, role:admins - g, Meesho:data-engineering, role:data-engineering - g, ringmaster, role:data-engineering diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-dataengg-v2/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-dataengg-v2/custom-values.yaml deleted file mode 100644 index d3bdcfb..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-dataengg-v2/custom-values.yaml +++ /dev/null @@ -1,277 +0,0 @@ -argo-cd: - crds: - install: false - global: - image: - tag: "v3.4.3" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - metrics: - enabled: true - controller: - replicas: 3 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: "7" - memory: "12Gi" - requests: - cpu: "6" - memory: "8Gi" - env: - - name: ARGOCD_K8S_CLIENT_QPS - value: '250' - - name: ARGOCD_CONTROLLER_REPLICAS - value: '3' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 25 - minReplicas: 4 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: 1500m - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: GIT_DEPTH - value: '1' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 15 - metrics: - enabled: true - serviceMonitor: - enabled: false - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-dataengg-prd.meeshogcp.in" - ingressClassName: nginx-internal - resources: - limits: - cpu: "2" - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 2 - notifications: - metrics: - enabled: false - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations: | - projectcontour.io/HTTPProxy: - health.lua: | - local hs = {} - if obj.status ~= nil and obj.status.currentStatus ~= nil then - if obj.status.currentStatus == "orphaned" then - hs.status = "Healthy" - hs.message = "HTTPProxy orphaned — ignored" - return hs - end - if obj.status.currentStatus == "valid" then - hs.status = "Healthy" - hs.message = "HTTPProxy is valid" - return hs - end - if obj.status.currentStatus == "invalid" then - hs.status = "Degraded" - hs.message = obj.status.description or "HTTPProxy is invalid" - return hs - end - end - hs.status = "Progressing" - hs.message = "Waiting for HTTPProxy status" - return hs - - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - accounts.ringmaster: 'apiKey,login' - accounts.readonly: 'apiKey,login' - timeout.reconciliation: 5m - timeout.reconciliation.jitter: 60s - url: https://argocd-dataengg-prd.meeshogcp.in - statusbadge.enabled: "true" - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: debug - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: Ov23liQLyrDoLpsP742D - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '60' - controller.operation.processors: '30' - controller.repo.server.timeout.seconds: '90' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - p, role:admins, *, *, *, allow - ## Policy for data-engineering team - p, role:data-engineering, *, get, */*, allow - p, role:data-engineering, applications, sync, */*, allow - p, role:data-engineering, applications, delete, */*, deny - p, role:data-engineering, applications, delete/*/Pod/*/*, deng-*/*, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, create, */*, allow - p, role:admin-nodelete, applications, get, */*, allow - p, role:admin-nodelete, applications, override, */*, allow - p, role:admin-nodelete, applications, sync, */*, allow - p, role:admin-nodelete, applications, update, */*, allow - p, role:admin-nodelete, applications, update/*, */*, allow - p, role:admin-nodelete, applications, action/*, */*, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - ## Policy for devops intern role - p, role:intern, *, get, *, allow - p, role:backend, *, get, */*, allow - ## Full access to oss-* apps - p, role:data-engineering, applications, *, */oss-*, allow - ## Role definition for different Github teams - g, Meesho:architects, role:admin-nodelete - g, Meesho:devops-new, role:admin-nodelete - g, Meesho:devops-interns, role:intern - g, Meesho:devops, role:admins - g, Meesho:data-engineering, role:data-engineering - g, ringmaster, role:admin-nodelete - g, readonly, role:backend diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-dataengg/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-dataengg/custom-values.yaml deleted file mode 100644 index cd39914..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-dataengg/custom-values.yaml +++ /dev/null @@ -1,248 +0,0 @@ -argo-cd: - global: - image: - tag: "v2.13.8" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - metrics: - enabled: true - controller: - replicas: 3 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: "7" - memory: "12Gi" - requests: - cpu: "6" - memory: "8Gi" - env: - - name: ARGOCD_K8S_CLIENT_QPS - value: '250' - - name: ARGOCD_CONTROLLER_REPLICAS - value: '3' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 25 - minReplicas: 4 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: 1500m - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: GIT_DEPTH - value: '1' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 15 - metrics: - enabled: true - serviceMonitor: - enabled: false - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-deng-prd-oss.meeshogcp.in" - ingressClassName: nginx-internal - resources: - limits: - cpu: "2" - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 2 - notifications: - metrics: - enabled: false - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations: | - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - accounts.ringmaster: 'apiKey,login' - accounts.readonly: 'apiKey,login' - timeout.reconciliation: 5m - timeout.reconciliation.jitter: 60s - url: https://argocd-deng-prd-oss.meeshogcp.in - statusbadge.enabled: "true" - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: debug - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: 7a1c7f48988bda76acc8 - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '60' - controller.operation.processors: '30' - controller.repo.server.timeout.seconds: '90' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - p, role:admins, *, *, *, allow - ## Policy for data-engineering team - p, role:data-engineering, *, get, */*, allow - p, role:data-engineering, applications, sync, */*, allow - p, role:data-engineering, applications, delete, */*, deny - p, role:data-engineering, applications, delete/*/Pod/*/*, deng-*/*, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, create, */*, allow - p, role:admin-nodelete, applications, get, */*, allow - p, role:admin-nodelete, applications, override, */*, allow - p, role:admin-nodelete, applications, sync, */*, allow - p, role:admin-nodelete, applications, update, */*, allow - p, role:admin-nodelete, applications, action/*, */*, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - ## Policy for devops intern role - p, role:intern, *, get, *, allow - p, role:backend, *, get, */*, allow - ## Role definition for different Github teams - g, Meesho:architects, role:admin-nodelete - g, Meesho:devops-new, role:admin-nodelete - g, Meesho:devops-interns, role:intern - g, Meesho:devops, role:admins - g, Meesho:data-engineering, role:data-engineering - g, ringmaster, role:admin-nodelete - g, readonly, role:backend diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-datascience-ase1c/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-datascience-ase1c/custom-values.yaml deleted file mode 100644 index 54970b1..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-datascience-ase1c/custom-values.yaml +++ /dev/null @@ -1,235 +0,0 @@ -argo-cd: - createClusterRoles: false - global: - image: - tag: "v2.13.8" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - metrics: - enabled: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - controller: - replicas: 2 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - resources: - limits: - cpu: "6" - memory: "12Gi" - requests: - cpu: "4" - memory: "8Gi" - env: - - name: ARGOCD_CONTROLLER_REPLICAS - value: '2' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 3 - minReplicas: 2 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: 1500m - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 20 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-datascience-ase1c-prd.meeshogcp.in" - ingressClassName: nginx-internal - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - resources: - limits: - cpu: "2" - memory: 4Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 2 - notifications: - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations: | - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - url: https://argocd-datascience-ase1c-prd.meeshogcp.in - statusbadge.enabled: "true" - timeout.reconciliation.jitter: 60s - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: error - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: Ov23liLZcNrymBZNdJWe - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '40' - controller.operation.processors: '20' - controller.repo.server.timeout.seconds: '60' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, override, *, allow - p, role:admin-nodelete, applications, sync, *, allow - p, role:admin-nodelete, applications, action/*, *, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - g, Meesho:devops-new, role:admin-nodelete - ## Policy for BACKEND team - p, role:backend, applications, create, dsci-*/*, allow - p, role:backend, applications, get, dsci-*/*, allow - p, role:backend, applications, override, dsci-*/*, allow - p, role:backend, applications, sync, dsci-*/*, allow - p, role:backend, applications, update, dsci-*/*, allow - p, role:backend, applications, delete, */*, deny - p, role:backend, applications, delete/*/Pod/*/*, dsci-*/*, allow - p, role:backend, applications, action/apps/Deployment/restart, dsci-*/*, allow - p, role:backend, logs, get, dsci-*/*, allow - p, role:backend, exec, create, dsci-*/*, allow - p, role:backend, projects, get, dsci-*, allow - p, role:backend, projects, sync, dsci-*, allow - p, role:backend, repositories, update, dsci-*/*, allow - ## Teams and policy mapping - g, Meesho:devops, role:admin - g, Meesho:backend, role:backend - g, ringmaster, role:admins diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-datascience-v2/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-datascience-v2/custom-values.yaml deleted file mode 100644 index 04f6777..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-datascience-v2/custom-values.yaml +++ /dev/null @@ -1,291 +0,0 @@ -argo-cd: - crds: - install: false - global: - image: - tag: "v3.4.3" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - metrics: - enabled: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - controller: - replicas: 3 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - resources: - limits: - cpu: "7" - memory: "12Gi" - requests: - cpu: "6" - memory: "8Gi" - env: - - name: ARGOCD_K8S_CLIENT_QPS - value: '250' - - name: ARGOCD_CONTROLLER_REPLICAS - value: '3' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 30 - minReplicas: 7 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: "2" - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: ARGOCD_EXEC_TIMEOUT - value: '600s' - - name: GIT_DEPTH - value: '1' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 25 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-datascience-prd-ase1a.meeshogcp.in" - ingressClassName: nginx-internal - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - resources: - limits: - cpu: "2" - memory: 4Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 4 - notifications: - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations: | - projectcontour.io/HTTPProxy: - health.lua: | - local hs = {} - if obj.status ~= nil and obj.status.currentStatus ~= nil then - if obj.status.currentStatus == "orphaned" then - hs.status = "Healthy" - hs.message = "HTTPProxy orphaned — ignored" - return hs - end - if obj.status.currentStatus == "valid" then - hs.status = "Healthy" - hs.message = "HTTPProxy is valid" - return hs - end - if obj.status.currentStatus == "invalid" then - hs.status = "Degraded" - hs.message = obj.status.description or "HTTPProxy is invalid" - return hs - end - end - hs.status = "Progressing" - hs.message = "Waiting for HTTPProxy status" - return hs - - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - url: https://argocd-datascience-prd-ase1a.meeshogcp.in - accounts.bharatml: apiKey,login - accounts.readonly: 'apiKey,login' - accounts.ringmaster: 'apiKey,login' - timeout.reconciliation: 5m - timeout.reconciliation.jitter: 120s - statusbadge.enabled: "true" - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: error - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: Ov23lixf317DQe17LLC5 - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '60' - controller.operation.processors: '30' - controller.repo.server.timeout.seconds: '90' - reposerver.parallelism.limit: '2' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - p, role:admins, *, *, *, allow - ## Policy for data-science team - p, role:datascience, *, get, */*, allow - p, role:datascience, applications, delete, */*, deny - p, role:datascience, applications, sync, dsci-*/*, allow - p, role:datascience, applications, update, dsci-ml/prd-online-feature-store-api-mp*, allow - p, role:datascience, applications, update, dsci-ml/prd-online-feature-store-api-v3*, allow - p, role:backend, applications, action/apps/Deployment/restart, dsci-*/prd-predator-*, allow - p, role:backend, applications, action/apps/Deployment/restart, dsci-*/prd-model-inference-*, allow - p, role:datascience, applications, delete/*/Deployment/*/*, dsci-*/prd-model-inference-*, allow - p, role:backend, *, get, */*, allow - p, role:data-engineering, applications, *, dsci-ds/prd-ds-airflow*, allow - ## Policy for bharatml team - p, role:bharatml-role, applications, get, dsci-*/prd-predator-*, allow - p, role:bharatml-role, applications, get, dsci-*/prd-model-inference-*, allow - p, role:bharatml-role, applications, action/apps/Deployment/restart, dsci-*/prd-predator-*, allow - p, role:bharatml-role, applications, action/apps/Deployment/restart, dsci-*/prd-model-inference-*, allow - p, role:bharatml-role, applications, delete/*/Pod/*/*, dsci-*/prd-predator-*, allow - p, role:bharatml-role, applications, delete/*/Pod/*/*, dsci-*/prd-model-inference-*, allow - p, role:bharatml-role, applications, update/keda.sh/ScaledObject/*/*, dsci-*/prd-predator-*, allow - p, role:bharatml-role, applications, update/keda.sh/ScaledObject/*/*, dsci-*/prd-model-inference-*, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, create, */*, allow - p, role:admin-nodelete, applications, get, */*, allow - p, role:admin-nodelete, applications, override, */*, allow - p, role:admin-nodelete, applications, sync, */*, allow - p, role:admin-nodelete, applications, update, */*, allow - p, role:admin-nodelete, applications, update/*, */*, allow - p, role:admin-nodelete, applications, action/*, */*, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - ## Policy for devops intern role - p, role:intern, *, get, *, allow - p, role:backend-ro, *, get, */*, allow - ## Role definition for different Github teams - g, Meesho:architects, role:admin-nodelete - g, Meesho:devops-new, role:admin-nodelete - g, Meesho:devops-interns, role:intern - g, Meesho:devops, role:admins - g, Meesho:datascience, role:datascience - g, Meesho:backend, role:backend - g, Meesho:data-engineering, role:data-engineering - g, ringmaster, role:admin-nodelete - g, bharatml, role:bharatml-role - g, readonly, role:backend-ro diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-datascience/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-datascience/custom-values.yaml deleted file mode 100644 index 4e2872e..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-datascience/custom-values.yaml +++ /dev/null @@ -1,256 +0,0 @@ -argo-cd: - global: - image: - tag: "v2.13.8" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - metrics: - enabled: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - controller: - replicas: 3 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - resources: - limits: - cpu: "7" - memory: "12Gi" - requests: - cpu: "6" - memory: "8Gi" - env: - - name: ARGOCD_CONTROLLER_REPLICAS - value: '3' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 25 - minReplicas: 3 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: 1500m - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: GIT_DEPTH - value: '1' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 15 - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-datascience-prd.meeshogcp.in" - ingressClassName: nginx-internal - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - resources: - limits: - cpu: "2" - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 2 - notifications: - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations: | - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - accounts.ringmaster: 'apiKey,login' - accounts.readonly: 'apiKey,login' - timeout.reconciliation: 4m - timeout.reconciliation.jitter: 60s - url: https://argocd-datascience-prd.meeshogcp.in - statusbadge.enabled: "true" - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: error - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: 37e058fb1915c193747e - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '50' - controller.operation.processors: '25' - controller.repo.server.timeout.seconds: '90' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - p, role:admins, *, *, *, allow - ## Policy for data-science team - p, role:datascience, *, get, */*, allow - p, role:datascience, applications, delete, */*, deny - p, role:datascience, applications, sync, dsci-*/*, allow - p, role:datascience, applications, update, dsci-ml/prd-online-feature-store-api-mp*, allow - p, role:datascience, applications, update, dsci-ml/prd-online-feature-store-api-v3*, allow - p, role:backend, applications, action/apps/Deployment/restart, dsci-*/prd-predator-*, allow - p, role:backend, applications, action/apps/Deployment/restart, dsci-*/prd-model-inference-*, allow - p, role:datascience, applications, delete/*/Deployment/*/*, dsci-*/prd-model-inference-*, allow - p, role:backend, *, get, */*, allow - p, role:data-engineering, applications, *, dsci-ds/prd-ds-airflow*, allow - ## Policy for bharatml team - p, role:bharatml-role, applications, get, dsci-*/prd-predator-*, allow - p, role:bharatml-role, applications, get, dsci-*/prd-model-inference-*, allow - p, role:bharatml-role, applications, action/apps/Deployment/restart, dsci-*/prd-predator-*, allow - p, role:bharatml-role, applications, action/apps/Deployment/restart, dsci-*/prd-model-inference-*, allow - p, role:bharatml-role, applications, delete/*/Pod/*/*, dsci-*/prd-predator-*, allow - p, role:bharatml-role, applications, delete/*/Pod/*/*, dsci-*/prd-model-inference-*, allow - p, role:bharatml-role, applications, update/keda.sh/ScaledObject/*/*, dsci-*/prd-predator-*, allow - p, role:bharatml-role, applications, update/keda.sh/ScaledObject/*/*, dsci-*/prd-model-inference-*, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, create, */*, allow - p, role:admin-nodelete, applications, get, */*, allow - p, role:admin-nodelete, applications, override, */*, allow - p, role:admin-nodelete, applications, sync, */*, allow - p, role:admin-nodelete, applications, update, */*, allow - p, role:admin-nodelete, applications, action/*, */*, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - ## Policy for devops intern role - p, role:intern, *, get, *, allow - p, role:backend-ro, *, get, */*, allow - ## Role definition for different Github teams - g, Meesho:architects, role:admin-nodelete - g, Meesho:devops-new, role:admin-nodelete - g, Meesho:devops-interns, role:intern - g, Meesho:devops, role:admins - g, Meesho:datascience, role:datascience - g, Meesho:backend, role:backend - g, Meesho:data-engineering, role:data-engineering - g, ringmaster, role:admin-nodelete - g, bharatml, role:bharatml-role - g, readonly, role:backend-ro diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-demand-ase1c/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-demand-ase1c/custom-values.yaml deleted file mode 100644 index da89a7a..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-demand-ase1c/custom-values.yaml +++ /dev/null @@ -1,250 +0,0 @@ -argo-cd: - createClusterRoles: false - global: - image: - tag: "v2.13.8" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - metrics: - enabled: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - controller: - replicas: 2 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - resources: - limits: - cpu: "6" - memory: "12Gi" - requests: - cpu: "4" - memory: "8Gi" - env: - - name: ARGOCD_CONTROLLER_REPLICAS - value: '2' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 3 - minReplicas: 2 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: 1500m - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: GIT_DEPTH - value: '1' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 20 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-demand-ase1c-prd.meeshogcp.in" - ingressClassName: nginx-internal - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - resources: - limits: - cpu: "2" - memory: 4Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 2 - notifications: - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations: | - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - url: https://argocd-demand-ase1c-prd.meeshogcp.in - statusbadge.enabled: "true" - timeout.reconciliation.jitter: 60s - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: error - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: Ov23lieojxIuQFqAqT2N - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '40' - controller.operation.processors: '20' - controller.repo.server.timeout.seconds: '60' - rbac: - policy.csv: | - ## Policy for live-commerce team - p, role:live-commerce, applications, create, dmnd-*/*, allow - p, role:live-commerce, applications, get, dmnd-*/*, allow - p, role:live-commerce, applications, override, dmnd-*/*, allow - p, role:live-commerce, applications, sync, dmnd-*/*, allow - p, role:live-commerce, applications, update, dmnd-*/*, allow - p, role:live-commerce, logs, get, dmnd-*/*, allow - p, role:live-commerce, exec, create, dmnd-*/*, allow - p, role:live-commerce, projects, get, dmnd-*, allow - p, role:live-commerce, projects, sync, dmnd-*, allow - p, role:live-commerce, applications, action/apps/Deployment/restart, dmnd-*/*, allow - p, role:live-commerce, repositories, update, dmnd-*/*, allow - p, role:admins, *, *, */*, allow - ## Policy for BACKEND team - p, role:backend, applications, create, dmnd-*/*, allow - p, role:backend, applications, get, dmnd-*/*, allow - p, role:backend, applications, override, dmnd-*/*, allow - p, role:backend, applications, sync, dmnd-*/*, allow - p, role:backend, applications, update, dmnd-*/*, allow - p, role:backend, applications, delete, */*, deny - p, role:backend, applications, delete/*/Pod/*/*, dmnd-*/*, allow - p, role:backend, logs, get, dmnd-*/*, allow - p, role:backend, exec, create, dmnd-*/*, allow - p, role:backend, projects, get, dmnd-*, allow - p, role:backend, projects, sync, dmnd-*, allow - p, role:backend, applications, action/apps/Deployment/restart, dmnd-*/*, allow - p, role:backend, repositories, update, dmnd-*/*, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, override, *, allow - p, role:admin-nodelete, applications, sync, *, allow - p, role:admin-nodelete, applications, action/*, *, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - g, Meesho:devops-new, role:admin-nodelete - ## Teams and policy mapping - g, Meesho:devops, role:admin - g, Meesho:backend, role:backend - g, Meesho:live-commerce, role:live-commerce - g, ringmaster, role:backend diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-demand-v2/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-demand-v2/custom-values.yaml deleted file mode 100644 index 7f664c4..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-demand-v2/custom-values.yaml +++ /dev/null @@ -1,270 +0,0 @@ -argo-cd: - crds: - install: false - global: - image: - tag: "v3.4.3" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - metrics: - enabled: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - controller: - replicas: 3 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - resources: - limits: - cpu: "7" - memory: "12Gi" - requests: - cpu: "6" - memory: "8Gi" - env: - - name: ARGOCD_K8S_CLIENT_QPS - value: '250' - - name: ARGOCD_CONTROLLER_REPLICAS - value: '3' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 25 - minReplicas: 7 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: 1500m - memory: 4Gi - requests: - cpu: "1" - memory: 3Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: ARGOCD_EXEC_TIMEOUT - value: '600s' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 25 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-demand-prd.meeshogcp.in" - ingressClassName: nginx-internal - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - resources: - limits: - cpu: "2" - memory: 4Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 2 - notifications: - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations: | - projectcontour.io/HTTPProxy: - health.lua: | - local hs = {} - if obj.status ~= nil and obj.status.currentStatus ~= nil then - if obj.status.currentStatus == "orphaned" then - hs.status = "Healthy" - hs.message = "HTTPProxy orphaned — ignored" - return hs - end - if obj.status.currentStatus == "valid" then - hs.status = "Healthy" - hs.message = "HTTPProxy is valid" - return hs - end - if obj.status.currentStatus == "invalid" then - hs.status = "Degraded" - hs.message = obj.status.description or "HTTPProxy is invalid" - return hs - end - end - hs.status = "Progressing" - hs.message = "Waiting for HTTPProxy status" - return hs - - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - url: https://argocd-demand-prd.meeshogcp.in - accounts.readonly: 'apiKey,login' - accounts.ringmaster: 'apiKey,login' - timeout.reconciliation: 5m - timeout.reconciliation.jitter: 120s - statusbadge.enabled: "true" - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: error - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: Ov23liYgmJQahK7jRnMt - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '60' - controller.operation.processors: '30' - controller.repo.server.timeout.seconds: '90' - reposerver.parallelism.limit: '2' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - ## Policy for BACKEND team - p, role:backend, *, get, */*, allow - ## Policy for DEMAND team - p, role:demand, *, get, */*, allow - p, role:demand, applications, *, dmnd-pfeed/prd-flink*, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, create, */*, allow - p, role:admin-nodelete, applications, get, */*, allow - p, role:admin-nodelete, applications, override, */*, allow - p, role:admin-nodelete, applications, sync, */*, allow - p, role:admin-nodelete, applications, update, */*, allow - p, role:admin-nodelete, applications, update/*, */*, allow - p, role:admin-nodelete, applications, action/*, */*, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - ## Policy for devops intern role - p, role:intern, *, get, *, allow - ## Role definition for different Github teams - g, Meesho:architects, role:admin-nodelete - g, Meesho:demand, role:demand - g, Meesho:devops-new, role:admin-nodelete - g, Meesho:devops-interns, role:intern - g, Meesho:devops, role:admins - g, Meesho:backend, role:backend - g, ringmaster, role:admin-nodelete - g, temp-mcp, role:backend - g, readonly, role:backend diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-demand/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-demand/custom-values.yaml deleted file mode 100644 index 8eb5eb7..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-demand/custom-values.yaml +++ /dev/null @@ -1,236 +0,0 @@ -argo-cd: - global: - image: - tag: "v2.13.8" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - metrics: - enabled: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - controller: - replicas: 3 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - resources: - limits: - cpu: "7" - memory: "12Gi" - requests: - cpu: "6" - memory: "8Gi" - env: - - name: ARGOCD_K8S_CLIENT_QPS - value: '200' - - name: ARGOCD_CONTROLLER_REPLICAS - value: '3' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 25 - minReplicas: 7 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: 1500m - memory: 4Gi - requests: - cpu: "1" - memory: 3Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: GIT_DEPTH - value: '1' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 25 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-demand-prd-old.meeshogcp.in" - ingressClassName: nginx-internal - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - resources: - limits: - cpu: "4" - memory: 4Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 2 - notifications: - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations: | - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - url: https://argocd-demand-prd-old.meeshogcp.in - accounts.readonly: 'apiKey,login' - timeout.reconciliation: 5m - timeout.reconciliation.jitter: 60s - statusbadge.enabled: "true" - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: error - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: f4f365409b0e82cf0874 - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '60' - controller.operation.processors: '30' - controller.repo.server.timeout.seconds: '90' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - ## Policy for BACKEND team - p, role:backend, *, get, */*, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, create, */*, allow - p, role:admin-nodelete, applications, get, */*, allow - p, role:admin-nodelete, applications, override, */*, allow - p, role:admin-nodelete, applications, sync, */*, allow - p, role:admin-nodelete, applications, update, */*, allow - p, role:admin-nodelete, applications, action/*, */*, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - ## Policy for devops intern role - p, role:intern, *, get, *, allow - ## Role definition for different Github teams - g, Meesho:architects, role:admin-nodelete - g, Meesho:devops-new, role:admin-nodelete - g, Meesho:devops-interns, role:intern - g, Meesho:devops, role:admins - g, Meesho:backend, role:backend - g, ringmaster, role:admin-nodelete - g, readonly, role:backend diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-dsgpu-v2/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-dsgpu-v2/custom-values.yaml deleted file mode 100644 index 7549966..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-dsgpu-v2/custom-values.yaml +++ /dev/null @@ -1,274 +0,0 @@ -argo-cd: - crds: - install: false - global: - image: - tag: "v3.4.3" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - metrics: - enabled: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - controller: - replicas: 3 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - resources: - limits: - cpu: "7" - memory: "12Gi" - requests: - cpu: "6" - memory: "8Gi" - env: - - name: ARGOCD_CONTROLLER_REPLICAS - value: '3' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 25 - minReplicas: 3 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: 1500m - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 15 - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-dsgpu-prd-ase1a.meeshogcp.in" - ingressClassName: nginx-internal - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - resources: - limits: - cpu: "2" - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 2 - notifications: - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations: | - projectcontour.io/HTTPProxy: - health.lua: | - local hs = {} - if obj.status ~= nil and obj.status.currentStatus ~= nil then - if obj.status.currentStatus == "orphaned" then - hs.status = "Healthy" - hs.message = "HTTPProxy orphaned — ignored" - return hs - end - if obj.status.currentStatus == "valid" then - hs.status = "Healthy" - hs.message = "HTTPProxy is valid" - return hs - end - if obj.status.currentStatus == "invalid" then - hs.status = "Degraded" - hs.message = obj.status.description or "HTTPProxy is invalid" - return hs - end - end - hs.status = "Progressing" - hs.message = "Waiting for HTTPProxy status" - return hs - - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - accounts.ringmaster: 'apiKey,login' - accounts.readonly: 'apiKey,login' - accounts.bharatml: 'apiKey,login' - timeout.reconciliation: 5m - timeout.reconciliation.jitter: 60s - url: https://argocd-dsgpu-prd-ase1a.meeshogcp.in - statusbadge.enabled: "true" - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: error - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: Ov23liYxSaqWZ67OmPn5 - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '50' - controller.operation.processors: '25' - controller.repo.server.timeout.seconds: '90' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - p, role:admins, *, *, *, allow - ## Policy for data-science team - p, role:datascience, *, get, */*, allow - p, role:datascience, applications, delete, */*, deny - p, role:datascience, applications, sync, dsgpu-*/*, allow - p, role:datascience, applications, update, dsgpu-ml/prd-online-feature-store-api-mp*, allow - p, role:datascience, applications, action/apps/Deployment/restart, dsgpu-*/prd-predator-*, allow - p, role:datascience, applications, action/apps/Deployment/restart, dsgpu-*/prd-model-inference-*, allow - p, role:backend, *, get, */*, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, create, */*, allow - p, role:admin-nodelete, applications, get, */*, allow - p, role:admin-nodelete, applications, override, */*, allow - p, role:admin-nodelete, applications, sync, */*, allow - p, role:admin-nodelete, applications, update, */*, allow - p, role:admin-nodelete, applications, update/*, */*, allow - p, role:admin-nodelete, applications, action/*, */*, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - ## Policy for devops intern role - p, role:intern, *, get, *, allow - ## Policy for bharatml-team - p, role:bharatml-role, applications, get, */*,allow - p, role:bharatml-role, applications, sync, */*, allow - p, role:bharatml-role, applications, action/apps/Deployment/restart,dsgpu-ml/prd-predator-*, allow - p, role:bharatml-role, applications, action/apps/Deployment/restart,dsgpu-ml/prd-model-inference-*, allow - ## Role definition for different Github teams - g, Meesho:architects, role:admin-nodelete - g, Meesho:devops-new, role:admin-nodelete - g, Meesho:devops-interns, role:intern - g, Meesho:devops, role:admins - g, Meesho:datascience, role:datascience - g, Meesho:backend, role:backend - g, Meesho:bharatmlstack, role:admins - g, ringmaster, role:admin-nodelete - g, bharatml, role:bharatml-role - g, readonly, role:backend diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-dsgpu/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-dsgpu/custom-values.yaml deleted file mode 100644 index 1732f99..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-dsgpu/custom-values.yaml +++ /dev/null @@ -1,248 +0,0 @@ -argo-cd: - global: - image: - tag: "v2.13.8" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - metrics: - enabled: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - controller: - replicas: 3 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - resources: - limits: - cpu: "7" - memory: "12Gi" - requests: - cpu: "6" - memory: "8Gi" - env: - - name: ARGOCD_CONTROLLER_REPLICAS - value: '3' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 25 - minReplicas: 3 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: 1500m - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: GIT_DEPTH - value: '1' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 15 - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-dsgpu-prd.meeshogcp.in" - ingressClassName: nginx-internal - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - resources: - limits: - cpu: "2" - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 2 - notifications: - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations: | - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - accounts.ringmaster: 'apiKey,login' - accounts.readonly: 'apiKey,login' - timeout.reconciliation: 4m - timeout.reconciliation.jitter: 60s - url: https://argocd-dsgpu-prd.meeshogcp.in - statusbadge.enabled: "true" - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: error - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: Ov23limmj4OwBgquaEZl - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '50' - controller.operation.processors: '25' - controller.repo.server.timeout.seconds: '90' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - p, role:admins, *, *, *, allow - ## Policy for data-science team - p, role:datascience, *, get, */*, allow - p, role:datascience, applications, delete, */*, deny - p, role:datascience, applications, sync, dsgpu-*/*, allow - p, role:datascience, applications, update, dsgpu-ml/prd-online-feature-store-api-mp*, allow - p, role:datascience, applications, action/apps/Deployment/restart, dsgpu-*/prd-predator-*, allow - p, role:datascience, applications, action/apps/Deployment/restart, dsgpu-*/prd-model-inference-*, allow - p, role:backend, *, get, */*, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, create, */*, allow - p, role:admin-nodelete, applications, get, */*, allow - p, role:admin-nodelete, applications, override, */*, allow - p, role:admin-nodelete, applications, sync, */*, allow - p, role:admin-nodelete, applications, update, */*, allow - p, role:admin-nodelete, applications, action/*, */*, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - ## Policy for devops intern role - p, role:intern, *, get, *, allow - ## Policy for bharatml-team - p, role:bharatml-role, applications, get, */*,allow - p, role:bharatml-role, applications, sync, */*, allow - p, role:bharatml-role, applications, action/apps/Deployment/restart,dsgpu-ml/prd-predator-*, allow - p, role:bharatml-role, applications, action/apps/Deployment/restart,dsgpu-ml/prd-model-inference-*, allow - ## Role definition for different Github teams - g, Meesho:architects, role:admin-nodelete - g, Meesho:devops-new, role:admin-nodelete - g, Meesho:devops-interns, role:intern - g, Meesho:devops, role:admins - g, Meesho:datascience, role:datascience - g, Meesho:backend, role:backend - g, Meesho:bharatmlstack, role:admins - g, ringmaster, role:admin-nodelete - g, bharatml, role:bharatml-role - g, readonly, role:backend diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-farmiso-v2/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-farmiso-v2/custom-values.yaml deleted file mode 100644 index 71941ba..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-farmiso-v2/custom-values.yaml +++ /dev/null @@ -1,259 +0,0 @@ -argo-cd: - crds: - install: false - global: - image: - tag: "v3.4.3" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - metrics: - enabled: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - controller: - replicas: 2 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - resources: - limits: - cpu: 4 - memory: 6Gi - requests: - cpu: 2 - memory: 4Gi - env: - - name: ARGOCD_CONTROLLER_REPLICAS - value: '2' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 20 - minReplicas: 2 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: 1500m - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: GIT_DEPTH - value: '1' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 10 - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-farmiso-prd.meeshogcp.in" - ingressClassName: nginx-internal - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - resources: - limits: - cpu: "2" - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicas: 2 - notifications: - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations: | - projectcontour.io/HTTPProxy: - health.lua: | - local hs = {} - if obj.status ~= nil and obj.status.currentStatus ~= nil then - if obj.status.currentStatus == "orphaned" then - hs.status = "Healthy" - hs.message = "HTTPProxy orphaned — ignored" - return hs - end - if obj.status.currentStatus == "valid" then - hs.status = "Healthy" - hs.message = "HTTPProxy is valid" - return hs - end - if obj.status.currentStatus == "invalid" then - hs.status = "Degraded" - hs.message = obj.status.description or "HTTPProxy is invalid" - return hs - end - end - hs.status = "Progressing" - hs.message = "Waiting for HTTPProxy status" - return hs - - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - url: https://argocd-farmiso-prd.meeshogcp.in - accounts.readonly: 'apiKey,login' - accounts.ringmaster: 'apiKey,login' - timeout.reconciliation.jitter: 60s - statusbadge.enabled: "true" - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: error - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: Ov23liXnf0kYudQvP6dv - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '40' - controller.operation.processors: '20' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - ## Policy for BACKEND team - p, role:backend, *, get, */*, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, create, */*, allow - p, role:admin-nodelete, applications, get, */*, allow - p, role:admin-nodelete, applications, override, */*, allow - p, role:admin-nodelete, applications, sync, */*, allow - p, role:admin-nodelete, applications, update, */*, allow - p, role:admin-nodelete, applications, update/*, */*, allow - p, role:admin-nodelete, applications, action/*, */*, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - ## Policy for devops intern role - p, role:intern, *, get, *, allow - ## Policy for superstore role - p, role:superstore, *, get, */*, allow - ## Role definition for different Github teams - g, Meesho:architects, role:admin-nodelete - g, Meesho:devops-new, role:admin-nodelete - g, Meesho:devops-interns, role:intern - g, Meesho:devops, role:admins - g, Meesho:superstore, role:superstore - g, Meesho:backend, role:backend - g, ringmaster, role:admin-nodelete - g, readonly, role:backend diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-farmiso/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-farmiso/custom-values.yaml deleted file mode 100644 index 784fdd6..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-farmiso/custom-values.yaml +++ /dev/null @@ -1,236 +0,0 @@ -argo-cd: - global: - image: - tag: "v2.13.8" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - metrics: - enabled: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - controller: - replicas: 2 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - resources: - limits: - cpu: 4 - memory: 6Gi - requests: - cpu: 2 - memory: 4Gi - env: - - name: ARGOCD_CONTROLLER_REPLICAS - value: '2' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 20 - minReplicas: 2 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: 1500m - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: GIT_DEPTH - value: '1' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 10 - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-farmiso-prd.meeshogcp.in" - ingressClassName: nginx-internal - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - resources: - limits: - cpu: "2" - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 2 - notifications: - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - # credentialTemplates: - # https-creds: - # url: https://github.com/Meesho/ - # password: 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 - # username: svc-devops-meesho - cm: - resource.customizations: | - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - url: https://argocd-farmiso-prd.meeshogcp.in - accounts.readonly: 'apiKey,login' - timeout.reconciliation.jitter: 60s - statusbadge.enabled: "true" - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: error - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: ac06a559c8ea634683ca - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '40' - controller.operation.processors: '20' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - ## Policy for BACKEND team - p, role:backend, *, get, */*, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, create, */*, allow - p, role:admin-nodelete, applications, get, */*, allow - p, role:admin-nodelete, applications, override, */*, allow - p, role:admin-nodelete, applications, sync, */*, allow - p, role:admin-nodelete, applications, update, */*, allow - p, role:admin-nodelete, applications, action/*, */*, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - ## Policy for devops intern role - p, role:intern, *, get, *, allow - ## Policy for superstore role - p, role:superstore, *, get, */*, allow - ## Role definition for different Github teams - g, Meesho:architects, role:admin-nodelete - g, Meesho:devops-new, role:admin-nodelete - g, Meesho:devops-interns, role:intern - g, Meesho:devops, role:admins - g, Meesho:superstore, role:superstore - g, Meesho:backend, role:backend - g, ringmaster, role:admin-nodelete - g, readonly, role:backend diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-ml-platform/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-ml-platform/custom-values.yaml deleted file mode 100644 index 725398c..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-ml-platform/custom-values.yaml +++ /dev/null @@ -1,236 +0,0 @@ -argo-cd: - global: - image: - tag: "v2.13.8" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - metrics: - enabled: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - controller: - replicas: 2 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - resources: - limits: - cpu: "7" - memory: "12Gi" - requests: - cpu: "6" - memory: "8Gi" - env: - - name: ARGOCD_CONTROLLER_REPLICAS - value: '2' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 25 - minReplicas: 3 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: 1500m - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: GIT_DEPTH - value: '1' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 15 - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-ml-platform-prd.meeshogcp.in" - ingressClassName: nginx-internal - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - resources: - limits: - cpu: "1" - memory: 2048Mi - requests: - cpu: 500m - memory: 1024Mi - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 2 - notifications: - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations: | - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - accounts.ringmaster: 'apiKey,login' - url: https://argocd-ml-platform-prd.meeshogcp.in - timeout.reconciliation.jitter: 60s - statusbadge.enabled: "true" - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: error - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: Ov23litpytF7pcdkCNXV - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '40' - controller.operation.processors: '20' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - ## Policy for ml-platform team - p, role:backend, applications, create, */*, allow - p, role:backend, applications, get, */*, allow - p, role:backend, applications, override, */*, allow - p, role:backend, applications, sync, */*, allow - p, role:backend, applications, update, */*, allow - p, role:backend, applications, delete, */*, deny - p, role:backend, applications, delete/*/Pod/*/*, mlp-*/*, allow - p, role:backend, applications, delete/*/Deployment/*/*, mlp-*/int-*, allow - p, role:backend, applications, action/apps/Deployment/restart, */*, allow - p, role:backend, applications, delete/*/Deployment/*/*, mlp-*/int-model-inference-*, allow - p, role:backend, applications, delete/*/Deployment/*/*, mlp-*/prd-model-inference-*, allow - p, role:backend, logs, get, */*, allow - p, role:backend, exec, create, */*, allow - p, role:backend, projects, get, *, allow - p, role:backend, repositories, update, */*, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, override, *, allow - p, role:admin-nodelete, applications, sync, *, allow - p, role:admin-nodelete, applications, action/*, *, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - g, Meesho:devops-new, role:admin-nodelete - ## Role definition for different Github teams - g, Meesho:devops, role:admins - g, Meesho:backend, role:backend - g, ringmaster, role:backend diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-shared/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-shared/custom-values.yaml deleted file mode 100644 index 5142896..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-shared/custom-values.yaml +++ /dev/null @@ -1,299 +0,0 @@ -argo-cd: - global: - image: - tag: "v2.13.8" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - metrics: - enabled: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - controller: - replicas: 4 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - resources: - limits: - cpu: "7" - memory: "12Gi" - requests: - cpu: "6" - memory: "8Gi" - env: - - name: ARGOCD_CONTROLLER_REPLICAS - value: '4' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - redis: - startupProbe: - initialDelaySeconds: 300 - customConfig: | - repl-backlog-size 50mb - dir "/data" - port 6379 - rename-command FLUSHDB "" - rename-command FLUSHALL "" - maxmemory 0 - maxmemory-policy volatile-lru - min-replicas-max-lag 5 - min-replicas-to-write 1 - rdbchecksum yes - rdbcompression yes - repl-diskless-sync yes - save "" - requirepass replace-default-auth - masterauth replace-default-auth - # 1. Increase the timeout (Default is 60s, which is often too low for large RDBs) - repl-timeout 300 - - # 2. Expand the replication buffer - # Syntax: client-output-buffer-limit replica - # This example gives it 512mb hard limit - client-output-buffer-limit replica 2000mb 1000mb 300 - - # 3. Increase the backlog size in memory - repoServer: - autoscaling: - enabled: true - maxReplicas: 25 - minReplicas: 3 - targetMemoryUtilizationPercentage: 75 - targetCPUUtilizationPercentage: 60 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: "3" - memory: 5Gi - requests: - cpu: "2" - memory: 4Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: GIT_DEPTH - value: '1' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 25 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-shared-int.meeshogcp.in" - ingressClassName: nginx-internal - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - resources: - limits: - cpu: "2" - memory: 4Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 2 - notifications: - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations: | - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - url: https://argocd-shared-int.meeshogcp.in - accounts.readonly: 'apiKey,login' - timeout.reconciliation: 5m - timeout.reconciliation.jitter: 60s - statusbadge.enabled: "true" - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: error - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: Ov23liJzfjWj4b5h6O7v - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '60' - controller.operation.processors: '30' - controller.repo.server.timeout.seconds: '90' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - p, role:intern, *, get, *, allow - p, role:backend-ro, *, get, */*, allow - ## Policy for BACKEND team - p, role:backend, applications, create, */*, allow - p, role:backend, applications, get, */*, allow - p, role:backend, applications, override, */*, allow - p, role:backend, applications, sync, */*, allow - p, role:backend, applications, update, */*, allow - p, role:backend, applications, delete, */*, deny - p, role:backend, applications, delete/*/Pod/*/*, */*, allow - p, role:backend, logs, get, */*, allow - p, role:backend, exec, create, */*, allow - p, role:backend, projects, get, *, allow - p, role:backend, projects, sync, *, allow - p, role:backend, applications, action/apps/Deployment/restart, */*, allow - ## Policy for data-engineering team - p, role:data-engineering, applications, create, */*, allow - p, role:data-engineering, applications, get, */*, allow - p, role:data-engineering, applications, override, */*, allow - p, role:data-engineering, applications, sync, */*, allow - p, role:data-engineering, applications, update, */*, allow - p, role:data-engineering, applications, delete, */*, deny - p, role:data-engineering, applications, action/apps/Deployment/restart, */*, allow - p, role:data-engineering, applications, delete, deng-dpcon/*, allow - p, role:data-engineering, applications, delete/*/Pod/*/*, deng-*/*, allow - p, role:data-engineering, logs, get, */*, allow - p, role:data-engineering, exec, create, */*, allow - p, role:data-engineering, projects, get, *, allow - p, role:data-engineering, repositories, update, */*, allow - ## Policy for bharatml team - p, role:bharatml-role, applications, get, dsci-*/int-predator-*, allow - p, role:bharatml-role, applications, get, dsci-*/int-model-inference-*, allow - p, role:bharatml-role, applications, action/apps/Deployment/restart, dsci-*/int-predator-*, allow - p, role:bharatml-role, applications, action/apps/Deployment/restart, dsci-*/int-model-inference-*, allow - p, role:bharatml-role, applications, delete/*/Pod/*/*, dsci-*/int-predator-*, allow - p, role:bharatml-role, applications, delete/*/Pod/*/*, dsci-*/int-model-inference-*, allow - p, role:bharatml-role, applications, update/keda.sh/ScaledObject/*/*, dsci-*/int-predator-*, allow - p, role:bharatml-role, applications, update/keda.sh/ScaledObject/*/*, dsci-*/int-model-inference-*, allow - p, role:bharatml-role, applications, sync, dsci-*/int-predator-*, allow - p, role:bharatml-role, applications, sync, dsci-*/int-model-inference-*, allow - p, role:bharatml-role, applications, sync, dsci-*/int-horizon*, allow - - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, override, *, allow - p, role:admin-nodelete, applications, sync, *, allow - p, role:admin-nodelete, applications, action/*, *, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - g, Meesho:devops-new, role:admin-nodelete - ## Teams and policy mapping - g, Meesho:devops, role:admin - g, Meesho:backend, role:backend - g, Meesho:live-commerce, role:live-commerce - g, Meesho:devops-interns, role:intern - g, ringmaster, role:backend - g, bharatml, role:bharatml-role - g, Meesho:data-engineering, role:data-engineering - g, readonly, role:backend-ro diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-supply-ase1c/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-supply-ase1c/custom-values.yaml deleted file mode 100644 index 55459fc..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-supply-ase1c/custom-values.yaml +++ /dev/null @@ -1,236 +0,0 @@ -argo-cd: - createClusterRoles: false - global: - image: - tag: "v2.13.8" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - metrics: - enabled: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - controller: - replicas: 2 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - resources: - limits: - cpu: "6" - memory: "12Gi" - requests: - cpu: "4" - memory: "8Gi" - env: - - name: ARGOCD_CONTROLLER_REPLICAS - value: '2' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 3 - minReplicas: 2 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: 1500m - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: GIT_DEPTH - value: '1' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 20 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-supply-ase1c-prd.meeshogcp.in" - ingressClassName: nginx-internal - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - resources: - limits: - cpu: "2" - memory: 4Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 2 - notifications: - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations: | - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - url: https://argocd-supply-ase1c-prd.meeshogcp.in - statusbadge.enabled: "true" - timeout.reconciliation.jitter: 60s - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: error - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: Ov23lihQK0dRN3aUfBaO - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '40' - controller.operation.processors: '20' - controller.repo.server.timeout.seconds: '60' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, override, *, allow - p, role:admin-nodelete, applications, sync, *, allow - p, role:admin-nodelete, applications, action/*, *, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - g, Meesho:devops-new, role:admin-nodelete - p, role:backend, applications, create, supl-*/*, allow - p, role:backend, applications, get, supl-*/*, allow - p, role:backend, applications, override, supl-*/*, allow - p, role:backend, applications, sync, supl-*/*, allow - p, role:backend, applications, update, supl-*/*, allow - p, role:backend, applications, delete, */*, deny - p, role:backend, applications, delete/*/Pod/*/*, supl-*/*, allow - p, role:backend, applications, action/apps/Deployment/restart, supl-*/*, allow - p, role:backend, logs, get, supl-*/*, allow - p, role:backend, exec, create, supl-*/*, allow - p, role:backend, projects, get, supl-*, allow - p, role:backend, projects, sync, supl-*, allow - p, role:backend, repositories, update, supl-*/*, allow - ## Teams and policy mapping - g, Meesho:devops, role:admin - g, Meesho:backend, role:backend - g, ringmaster, role:backend diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-supply-v2/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-supply-v2/custom-values.yaml deleted file mode 100644 index 1578ee7..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-supply-v2/custom-values.yaml +++ /dev/null @@ -1,268 +0,0 @@ -argo-cd: - crds: - install: false - global: - image: - tag: "v3.4.3" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - metrics: - enabled: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - controller: - replicas: 3 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - resources: - limits: - cpu: "7" - memory: "12Gi" - requests: - cpu: "6" - memory: "8Gi" - env: - - name: ARGOCD_K8S_CLIENT_QPS - value: '250' - - name: ARGOCD_CONTROLLER_REPLICAS - value: '3' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 30 - minReplicas: 7 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: "2" - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: ARGOCD_EXEC_TIMEOUT - value: '600s' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 25 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-supply-prd.meeshogcp.in" - ingressClassName: nginx-internal - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - resources: - limits: - cpu: "2" - memory: 4Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 4 - notifications: - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations: | - projectcontour.io/HTTPProxy: - health.lua: | - local hs = {} - if obj.status ~= nil and obj.status.currentStatus ~= nil then - if obj.status.currentStatus == "orphaned" then - hs.status = "Healthy" - hs.message = "HTTPProxy orphaned — ignored" - return hs - end - if obj.status.currentStatus == "valid" then - hs.status = "Healthy" - hs.message = "HTTPProxy is valid" - return hs - end - if obj.status.currentStatus == "invalid" then - hs.status = "Degraded" - hs.message = obj.status.description or "HTTPProxy is invalid" - return hs - end - end - hs.status = "Progressing" - hs.message = "Waiting for HTTPProxy status" - return hs - - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - url: https://argocd-supply-prd.meeshogcp.in - accounts.readonly: 'apiKey,login' - accounts.ringmaster: 'apiKey,login' - timeout.reconciliation: 5m - timeout.reconciliation.jitter: 120s - statusbadge.enabled: "true" - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: error - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: Ov23liqt5cdcBtj3Hys7 - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '60' - controller.operation.processors: '30' - controller.repo.server.timeout.seconds: '90' - reposerver.parallelism.limit: '2' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - ## Policy for data-engineering team (specific app) - p, role:data-engineering, applications, *, */prd-trino-atomberg, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, create, */*, allow - p, role:admin-nodelete, applications, get, */*, allow - p, role:admin-nodelete, applications, override, */*, allow - p, role:admin-nodelete, applications, sync, */*, allow - p, role:admin-nodelete, applications, update, */*, allow - p, role:admin-nodelete, applications, update/*, */*, allow - p, role:admin-nodelete, applications, action/*, */*, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - ## Policy for devops intern role - p, role:intern, *, get, *, allow - ## Policy for backend role - p, role:backend, *, get, */*, allow - ## Teams and policy mapping - g, Meesho:architects, role:admin-nodelete - g, Meesho:devops-new, role:admin-nodelete - g, Meesho:devops-interns, role:intern - g, Meesho:devops, role:admins - g, Meesho:backend, role:backend - g, ringmaster, role:admin-nodelete - g, readonly, role:backend - g, Meesho:data-engineering, role:data-engineering diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-supply/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-supply/custom-values.yaml deleted file mode 100644 index 0427181..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-supply/custom-values.yaml +++ /dev/null @@ -1,236 +0,0 @@ -argo-cd: - global: - image: - tag: "v2.13.8" - additionalLabels: - bu: infra - team: devops - podLabels: - bu: infra - team: devops - nodeSelector: - dedicated: devops - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - dex: - enabled: true - resources: - limits: - cpu: 250m - memory: 512Mi - requests: - cpu: 250m - memory: 512Mi - metrics: - enabled: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 5558 - controller: - replicas: 3 - enableStatefulSet: true - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8082 - resources: - limits: - cpu: "7" - memory: "12Gi" - requests: - cpu: "6" - memory: "8Gi" - env: - - name: ARGOCD_K8S_CLIENT_QPS - value: '250' - - name: ARGOCD_CONTROLLER_REPLICAS - value: '3' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - redis-ha: - enabled: true - repoServer: - autoscaling: - enabled: true - maxReplicas: 30 - minReplicas: 7 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - metrics: - enabled: true - serviceMonitor: - enabled: false - interval: 60s - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8084 - resources: - limits: - cpu: "2" - memory: 3Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_HELM_ALLOW_CONCURRENCY - value: 'true' - - name: GIT_DEPTH - value: '1' - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - server: - replicas: 3 - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 25 - targetMemoryUtilizationPercentage: 60 - targetCPUUtilizationPercentage: 60 - extraArgs: - - --insecure - ingress: - annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false - annotations.nginx.ingress.kubernetes.io/rewrite-target: / - annotations.nginx.ingress.kubernetes.io/ssl-redirect: false - enabled: true - hostname: "argocd-supply-prd-old.meeshogcp.in" - ingressClassName: nginx-internal - podAnnotations: - prometheus.io/scrape: true - prometheus.io/path: /metrics - prometheus.io/port: 8083 - resources: - limits: - cpu: "2" - memory: 4Gi - requests: - cpu: "1" - memory: 2Gi - env: - - name: ARGOCD_GRPC_KEEP_ALIVE_MIN - value: '30s' - applicationSet: - replicaCount: 4 - notifications: - metrics: - enabled: true - serviceMonitor: - enabled: false - resources: - limits: - cpu: 500m - memory: 1Gi - requests: - cpu: 300m - memory: 512Mi - configs: - cm: - resource.customizations: | - keda.sh/ScaledObject: - health.lua: | - local hs = {} - local healthy = false - local degraded = false - local suspended = false - - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for i, condition in ipairs(obj.status.conditions) do - if condition.status == "False" and condition.type == "Ready" then - degraded = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Ready" then - healthy = true - hs.message = condition.message - end - if condition.status == "True" and condition.type == "Paused" then - suspended = true - hs.message = condition.message - end - end - end - end - - if degraded == true then - hs.status = "Degraded" - return hs - elseif healthy == true then - hs.status = "Healthy" - if suspended == true then - hs.message = "ScaledObject is paused as part of normal operations." - else - hs.message = "ScaledObject is active." - end - return hs - end - - hs.status = "Progressing" - hs.message = "Creating ScaledObject or waiting for conditions." - return hs - url: https://argocd-supply-prd-old.meeshogcp.in - accounts.readonly: 'apiKey,login' - timeout.reconciliation: 5m - timeout.reconciliation.jitter: 60s - statusbadge.enabled: "true" - help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV" - help.chatText: "Chat now!" - dex.config: | - logger: - level: error - format: json - connectors: - - type: github - id: github - name: GitHub - loadAllGroups: true - admin.enabled: "true" - config: - clientID: d8f840837f2eecfd7bc8 - clientSecret: $github-sso-secret:dex.github.clientSecret - orgs: - - name: Meesho - params: - controller.sharding.algorithm: round-robin - controller.status.processors: '60' - controller.operation.processors: '30' - controller.repo.server.timeout.seconds: '90' - rbac: - policy.csv: | - p, role:admins, *, *, */*, allow - ## Policy for Admin-NoDelete role - p, role:admin-nodelete, *, get, *, allow - p, role:admin-nodelete, *, create, *, allow - p, role:admin-nodelete, *, update, *, allow - p, role:admin-nodelete, applications, create, */*, allow - p, role:admin-nodelete, applications, get, */*, allow - p, role:admin-nodelete, applications, override, */*, allow - p, role:admin-nodelete, applications, sync, */*, allow - p, role:admin-nodelete, applications, update, */*, allow - p, role:admin-nodelete, applications, action/*, */*, allow - p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow - ## Policy for devops intern role - p, role:intern, *, get, *, allow - ## Policy for backend role - p, role:backend, *, get, */*, allow - ## Teams and policy mapping - g, Meesho:architects, role:admin-nodelete - g, Meesho:devops-new, role:admin-nodelete - g, Meesho:devops-interns, role:intern - g, Meesho:devops, role:admins - g, Meesho:backend, role:backend - g, ringmaster, role:admin-nodelete - g, readonly, role:backend diff --git a/helm-overrides/k8s-admin-prd-ase1/contour/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/contour/custom-values.yaml new file mode 100644 index 0000000..6bb5f19 --- /dev/null +++ b/helm-overrides/k8s-admin-prd-ase1/contour/custom-values.yaml @@ -0,0 +1,44 @@ +contour: + # This is your live `helm get values contour -n projectcontour` output, + # verbatim. This is the ingress for everything else in this repo + # (Gitea, ArgoCD, Vault all route through it) — don't tune this without + # re-checking those still resolve afterward. + # + # hostPorts, not a Service type=LoadBalancer: claude.md issue #6 — MetalLB + # got a floating IP fine, but this VM's host (VMware Workstation, Bridged + # networking, over Wi-Fi) doesn't do true MAC-level bridging, so the IP + # was never reachable from outside the VM. hostPort on Envoy binds + # directly to the node's real NIC instead — confirmed working by the live + # DaemonSet's actual container ports (checked before writing this file, + # not assumed): envoy container has hostPort 80/443 exactly matching + # envoy.hostPorts below, so this really is Helm-values-driven, not a + # hidden out-of-band kubectl patch. + # + # This is also why ArgoCD's default Ingress health check needed + # overriding (see argocd-admin-prd/custom-values.yaml) — there's no + # Service type=LoadBalancer here to ever populate + # status.loadBalancer.ingress. + + contour: + resources: + limits: + memory: 128Mi + requests: + cpu: 50m + memory: 64Mi + + envoy: + dnsPolicy: ClusterFirstWithHostNet + hostNetworking: true + hostPorts: + enabled: true + http: 80 + https: 443 + resources: + limits: + memory: 128Mi + requests: + cpu: 50m + memory: 64Mi + service: + type: ClusterIP diff --git a/helm-overrides/k8s-admin-prd-ase1/vault/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/vault/custom-values.yaml index b50bd01..d7afce0 100644 --- a/helm-overrides/k8s-admin-prd-ase1/vault/custom-values.yaml +++ b/helm-overrides/k8s-admin-prd-ase1/vault/custom-values.yaml @@ -1,154 +1,49 @@ vault: + # This is your live `helm get values vault -n vault` output, verbatim — + # not a rewrite. Production mode (file storage, not dev), standalone + # (no HA/raft). Init/unseal are still NEVER in Git or scripted: run by + # hand and keep the unseal keys / root token in a password manager, same + # as claude.md says. This adoption only manages Vault's own Deployment + # config, not its data or seal state. + # + # `ui = true` in the HCL block AND top-level ui.enabled: true are BOTH + # required — this is claude.md issue #10 (Vault UI 404'd until both were + # set; the chart has two separate toggles for the same thing). injector: - enabled: false + enabled: true + resources: + limits: + memory: 128Mi + requests: + cpu: 50m + memory: 64Mi server: - enabled: "-" - - # Ingress allows ingress services to be created to allow external access - # from Kubernetes to access Vault pods. - # If deployment is on OpenShift, the following block is ignored. - # In order to expose the service, use the route section below - ingress: + dataStorage: enabled: true - ingressClassName: nginx-internal - hosts: - - host: vault-prd.meeshogcp.in - - tolerations: - - effect: NoSchedule - key: dedicated - operator: Equal - value: devops - - nodeSelector: - dedicated: devops - - # OpenShift only - create a route to expose the service - # By default the created route will be of type passthrough - route: - enabled: false - - # Priority class for server pods - priorityClassName: "" - - # Extra labels to attach to the server pods - # This should be a YAML map of the labels to apply to the server pods - extraLabels: {} - - # Extra annotations to attach to the server pods - # This can either be YAML or a YAML-formatted multi-line templated string map - # of the annotations to apply to the server pods - annotations: {} - - # Enables a headless service to be used by the Vault Statefulset - service: - enabled: true - - # This configures the Vault Statefulset to create a PVC for data - # storage when using the file or raft backend storage engines. - # See https://www.vaultproject.io/docs/configuration/storage/index.html to know more - - # Run Vault in "dev" mode. This requires no further setup, no state management, - # and no initialization. This is useful for experimenting with Vault without - # needing to unseal, store keys, et. al. All data is lost on restart - do not - # use dev mode for anything other than experimenting. - # See https://www.vaultproject.io/docs/concepts/dev-server.html to know more - dev: - enabled: false - - # Set VAULT_DEV_ROOT_TOKEN_ID value - devRootToken: "root" - - # Run Vault in "HA" mode. There are no storage requirements unless audit log - # persistence is required. In HA mode Vault will configure itself to use Consul - # for its storage backend. The default configuration provided will work the Consul - # Helm project by default. It is possible to manually configure Vault to use a - # different HA backend. - standalone: - enabled: false + # Must stay 5Gi to match the already-bound PVC — local-path-provisioner + # doesn't support volume expansion, same constraint as Gitea's PVC. + size: 5Gi ha: + enabled: false + resources: + limits: + memory: 256Mi + requests: + cpu: 100m + memory: 128Mi + standalone: enabled: true - replicas: 3 - - # Set the api_addr configuration for Vault HA - # See https://www.vaultproject.io/docs/configuration#api_addr - # If set to null, this will be set to the Pod IP Address - apiAddr: null - - # Set the cluster_addr confuguration for Vault HA - # See https://www.vaultproject.io/docs/configuration#cluster_addr - # If set to null, this will be set to https://$(HOSTNAME).{{ template "vault.fullname" . }}-internal:8201 - clusterAddr: null - - # Enables Vault's integrated Raft storage. Unlike the typical HA modes where - # Vault's persistence is external (such as Consul), enabling Raft mode will create - # persistent volumes for Vault to store data according to the configuration under server.dataStorage. - # The Vault cluster will coordinate leader elections and failovers internally. - - # config is a raw string of default configuration when using a Stateful - # deployment. Default is to use a Consul for its HA storage backend. - # This should be HCL. - - # Note: Configuration files are stored in ConfigMaps so sensitive data - # such as passwords should be either mounted through extraSecretEnvironmentVars - # or through a Kube secret. For more information see: - # https://www.vaultproject.io/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations config: | ui = true - listener "tcp" { - tls_disable = 1 address = "[::]:8200" cluster_address = "[::]:8201" + tls_disable = "true" # lab only - enable TLS for anything beyond local testing } - storage "gcs" { - bucket = "gcs-meesho-prd-admin-vault-backend" - ha_enabled = "true" + storage "file" { + path = "/vault/data" } - service_registration "kubernetes" {} - - seal "gcpckms" { - project = "meesho-admin-prd-0622" - region = "asia-southeast1" - key_ring = "keyring-meesho-prd-admin-vault" - crypto_key = "key-meesho-prd-admin-vault" - } - - # A disruption budget limits the number of pods of a replicated application - # that are down simultaneously from voluntary disruptions - disruptionBudget: - enabled: true - - # maxUnavailable will default to (n/2)-1 where n is the number of - # replicas. If you'd like a custom value, you can specify an override here. - maxUnavailable: null - - # Definition of the serviceAccount used to run Vault. - # These options are also used when using an external Vault server to validate - # Kubernetes tokens. - serviceAccount: - # Specifies whether a service account should be created - create: true - # The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template - name: "" - # Extra annotations for the serviceAccount definition. This can either be - # YAML or a YAML-formatted multi-line templated string map of the - # annotations to apply to the serviceAccount. - annotations: - "iam.gke.io/gcp-service-account": "sa-prd-admin-vault@meesho-admin-prd-0622.iam.gserviceaccount.com" - - # Settings for the statefulSet used to run Vault. - statefulSet: - # Extra annotations for the statefulSet. This can either be YAML or a - # YAML-formatted multi-line templated string map of the annotations to apply - # to the statefulSet. - annotations: {} - - # Vault UI ui: enabled: true - publishNotReadyAddresses: true - annotations: {} \ No newline at end of file diff --git a/helm-templates/contour/Chart.lock b/helm-templates/contour/Chart.lock index 9cf1ea0..e5c6621 100644 --- a/helm-templates/contour/Chart.lock +++ b/helm-templates/contour/Chart.lock @@ -1,6 +1,6 @@ dependencies: -- name: common - repository: oci://registry-1.docker.io/bitnamicharts - version: 2.13.3 -digest: sha256:9a971689db0c66ea95ac2e911c05014c2b96c6077c991131ff84f2982f88fb83 -generated: "2023-10-17T20:44:50.491291043Z" +- name: contour + repository: https://projectcontour.github.io/helm-charts/ + version: 0.7.0 +digest: sha256:17b7dd9b49a062c805ece6e977e16e43f5c0747c760cb9b8c7f3f70389a165cc +generated: "2026-08-31T07:10:14.970652+05:30" diff --git a/helm-templates/contour/Chart.yaml b/helm-templates/contour/Chart.yaml index 1910d8e..9466c1f 100644 --- a/helm-templates/contour/Chart.yaml +++ b/helm-templates/contour/Chart.yaml @@ -1,35 +1,14 @@ -# Copyright VMware, Inc. -# SPDX-License-Identifier: APACHE-2.0 - -annotations: - category: Infrastructure - licenses: Apache-2.0 - images: | - - name: contour - image: docker.io/bitnami/contour:1.27.0-debian-11-r0 - - name: envoy - image: docker.io/bitnami/envoy:1.27.2-debian-11-r1 - - name: nginx - image: docker.io/bitnami/nginx:1.25.3-debian-11-r1 apiVersion: v2 -appVersion: 1.27.0 -dependencies: -- name: common - repository: oci://registry-1.docker.io/bitnamicharts - tags: - - bitnami-common - version: 2.x.x -description: Contour is an open source Kubernetes ingress controller that works by deploying the Envoy proxy as a reverse proxy and load balancer. -home: https://bitnami.com -icon: https://bitnami.com/assets/stacks/contour/img/contour-stack-220x234.png -keywords: -- ingress -- envoy -- contour -maintainers: -- name: VMware, Inc. - url: https://github.com/bitnami/charts name: contour -sources: -- https://github.com/bitnami/charts/tree/main/bitnami/contour -version: 15.0.0 +version: 1.0.0 +dependencies: + - name: contour + # This was previously wired to the Bitnami contour chart (v15.0.0) — + # WRONG chart entirely, not just a version mismatch. claude.md issue #4 + # documents exactly why: Bitnami's Contour images hit ImagePullBackUp + # (Broadcom retiring/freezing images behind that repo), abandoned in + # favor of the official project chart below. Pinned to match the live + # release exactly (helm list -n projectcontour showed contour-0.7.0). + # Don't reintroduce Bitnami here. + version: 0.7.0 + repository: https://projectcontour.github.io/helm-charts/ diff --git a/helm-templates/contour/README.md b/helm-templates/contour/README.md deleted file mode 100644 index 65d691d..0000000 --- a/helm-templates/contour/README.md +++ /dev/null @@ -1,740 +0,0 @@ - - -# Bitnami package for Contour - -Contour is an open source Kubernetes ingress controller that works by deploying the Envoy proxy as a reverse proxy and load balancer. - -[Overview of Contour](https://github.com/projectcontour/contour) - -Trademarks: This software listing is packaged by Bitnami. The respective trademarks mentioned in the offering are owned by the respective companies, and use of them does not imply any affiliation or endorsement. - -## TL;DR - -```console -helm install my-release oci://registry-1.docker.io/bitnamicharts/contour -``` - -Looking to use Contour in production? Try [VMware Tanzu Application Catalog](https://bitnami.com/enterprise), the enterprise edition of Bitnami Application Catalog. - -## Introduction - -Bitnami charts for Helm are carefully engineered, actively maintained and are the quickest and easiest way to deploy containers on a Kubernetes cluster that are ready to handle production workloads. - -This chart bootstraps a [Contour](https://projectcontour.io) Ingress Controller Deployment and a [Envoy Proxy](https://www.envoyproxy.io) Daemonset on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. - -Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters. - -## Prerequisites - -- Kubernetes 1.23+ -- Helm 3.8.0+ -- An Operator for `ServiceType: LoadBalancer` like [MetalLB](https://github.com/bitnami/charts/tree/main/bitnami/metallb) - -## Installing the Chart - -To install the chart with the release name `my-release`: - -```console -helm install my-release oci://REGISTRY_NAME/REPOSITORY_NAME/contour -``` - -> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. - -These commands deploy contour on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation. - -> **Tip**: List all releases using `helm list` or `helm ls --all-namespaces` - -## Uninstalling the Chart - -:warning: Uninstalling this chart will also remove CRDs. Removing CRDs will **remove all instances of it's Custom Resources**. If you wish to retain your Custom Resources for the future, run the following commands before uninstalling. - -```console -kubectl get -o yaml extensionservice,httpproxy,tlscertificatedelegation -A > backup.yaml -``` - -To uninstall/delete the `my-release` helm release: - -```console -helm uninstall my-release -``` - -## Parameters - -### Global parameters - -| Name | Description | Value | -| ------------------------- | ----------------------------------------------- | ----- | -| `global.imageRegistry` | Global Docker image registry | `""` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | -| `global.storageClass` | Global StorageClass for Persistent Volume(s) | `""` | - -### Common parameters - -| Name | Description | Value | -| ------------------------ | --------------------------------------------------------------------------------------- | ------- | -| `nameOverride` | String to partially override contour.fullname include (will maintain the release name) | `""` | -| `fullnameOverride` | String to fully override contour.fullname template | `""` | -| `namespaceOverride` | String to fully override common.names.namespace | `""` | -| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` | -| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | -| `commonLabels` | Labels to add to all deployed objects | `{}` | -| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | -| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | -| `diagnosticMode.command` | Command to override all containers in the deployment | `[]` | -| `diagnosticMode.args` | Args to override all containers in the deployment | `[]` | - -### Contour parameters - -| Name | Description | Value | -| ------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | -| `existingConfigMap` | Specifies the name of an externally-defined ConfigMap to use as the configuration (this is mutually exclusive with `configInline`) | `""` | -| `configInline` | Specifies Contour's configuration directly in YAML format | `{}` | -| `contour.enabled` | Contour Deployment creation. | `true` | -| `contour.image.registry` | Contour image registry | `REGISTRY_NAME` | -| `contour.image.repository` | Contour image name | `REPOSITORY_NAME/contour` | -| `contour.image.digest` | Contour image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | -| `contour.image.pullPolicy` | Contour Image pull policy | `IfNotPresent` | -| `contour.image.pullSecrets` | Contour Image pull secrets | `[]` | -| `contour.image.debug` | Enable image debug mode | `false` | -| `contour.contourConfigName` | Contour Deployment with ContourConfiguration CRD. | `contour` | -| `contour.configPath` | Contour Deployment with configmap. | `true` | -| `contour.replicaCount` | Number of Contour Pod replicas | `1` | -| `contour.priorityClassName` | Priority class assigned to the pods | `""` | -| `contour.schedulerName` | Name of the k8s scheduler (other than default) | `""` | -| `contour.terminationGracePeriodSeconds` | In seconds, time the given to the Contour pod needs to terminate gracefully | `""` | -| `contour.topologySpreadConstraints` | Topology Spread Constraints for pod assignment | `[]` | -| `contour.containerPorts.xds` | Set xds port inside Contour pod | `8001` | -| `contour.containerPorts.metrics` | Set metrics port inside Contour pod | `8000` | -| `contour.hostAliases` | Add deployment host aliases | `[]` | -| `contour.updateStrategy` | Strategy to use to update Pods | `{}` | -| `contour.extraArgs` | Extra arguments passed to Contour container | `[]` | -| `contour.resources.limits` | Specify resource limits which the container is not allowed to succeed. | `{}` | -| `contour.resources.requests` | Specify resource requests which the container needs to spawn. | `{}` | -| `contour.manageCRDs` | Manage the creation, upgrade and deletion of Contour CRDs. | `true` | -| `contour.envoyServiceNamespace` | Namespace of the envoy service to inspect for Ingress status details. | `""` | -| `contour.envoyServiceName` | Name of the envoy service to inspect for Ingress status details. | `""` | -| `contour.leaderElectionResourceName` | Name of the contour (Lease) leader election will lease. | `""` | -| `contour.ingressStatusAddress` | Address to set in Ingress object status. It is exclusive with `envoyServiceName` and `envoyServiceNamespace`. | `""` | -| `contour.podAffinityPreset` | Contour Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `contour.podAntiAffinityPreset` | Contour Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `contour.podLabels` | Extra labels for Contour pods | `{}` | -| `contour.lifecycleHooks` | lifecycleHooks for the container to automate configuration before or after startup. | `{}` | -| `contour.customLivenessProbe` | Override default liveness probe | `{}` | -| `contour.customReadinessProbe` | Override default readiness probe | `{}` | -| `contour.customStartupProbe` | Override default startup probe | `{}` | -| `contour.nodeAffinityPreset.type` | Contour Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `contour.nodeAffinityPreset.key` | Contour Node label key to match Ignored if `affinity` is set. | `""` | -| `contour.nodeAffinityPreset.values` | Contour Node label values to match. Ignored if `affinity` is set. | `[]` | -| `contour.command` | Override default command | `[]` | -| `contour.args` | Override default args | `[]` | -| `contour.affinity` | Affinity for Contour pod assignment | `{}` | -| `contour.nodeSelector` | Node labels for Contour pod assignment | `{}` | -| `contour.tolerations` | Tolerations for Contour pod assignment | `[]` | -| `contour.podAnnotations` | Contour Pod annotations | `{}` | -| `contour.serviceAccount.create` | Create a serviceAccount for the Contour pod | `true` | -| `contour.serviceAccount.name` | Use the serviceAccount with the specified name, a name is generated using the fullname template | `""` | -| `contour.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | -| `contour.serviceAccount.annotations` | Annotations for service account. Evaluated as a template. Only used if `create` is `true`. | `{}` | -| `contour.podSecurityContext.enabled` | Default backend Pod securityContext | `true` | -| `contour.podSecurityContext.fsGroup` | Set Default backend Pod's Security Context fsGroup | `1001` | -| `contour.containerSecurityContext.enabled` | Enabled contour containers' Security Context | `true` | -| `contour.containerSecurityContext.runAsUser` | Set contour containers' Security Context runAsUser | `1001` | -| `contour.containerSecurityContext.runAsNonRoot` | Set contour containers' Security Context runAsNonRoot | `true` | -| `contour.containerSecurityContext.readOnlyRootFilesystem` | Set read only root file system pod's Security Conte | `false` | -| `contour.containerSecurityContext.privileged` | Set contour container's Security Context privileged | `false` | -| `contour.containerSecurityContext.allowPrivilegeEscalation` | Set contour container's Security Context allowPrivilegeEscalation | `false` | -| `contour.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | -| `contour.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | -| `contour.livenessProbe.enabled` | Enable/disable the Liveness probe | `true` | -| `contour.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `120` | -| `contour.livenessProbe.periodSeconds` | How often to perform the probe | `20` | -| `contour.livenessProbe.timeoutSeconds` | When the probe times out | `5` | -| `contour.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `6` | -| `contour.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | -| `contour.readinessProbe.enabled` | Enable/disable the readiness probe | `true` | -| `contour.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | `15` | -| `contour.readinessProbe.periodSeconds` | How often to perform the probe | `10` | -| `contour.readinessProbe.timeoutSeconds` | When the probe times out | `5` | -| `contour.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `3` | -| `contour.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | -| `contour.startupProbe.enabled` | Enable/disable the startup probe | `false` | -| `contour.startupProbe.initialDelaySeconds` | Delay before startup probe is initiated | `15` | -| `contour.startupProbe.periodSeconds` | How often to perform the probe | `10` | -| `contour.startupProbe.timeoutSeconds` | When the probe times out | `5` | -| `contour.startupProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `3` | -| `contour.startupProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | -| `contour.certgen.serviceAccount.create` | Create a serviceAccount for the Contour pod | `true` | -| `contour.certgen.serviceAccount.name` | Use the serviceAccount with the specified name, a name is generated using the fullname template | `""` | -| `contour.certgen.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | -| `contour.certgen.serviceAccount.annotations` | Annotations for service account. Evaluated as a template. Only used if `create` is `true`. | `{}` | -| `contour.certgen.certificateLifetime` | Generated certificate lifetime (in days). | `365` | -| `contour.tlsExistingSecret` | Name of the existingSecret to be use in Contour deployment. If it is not nil `contour.certgen` will be disabled. | `""` | -| `contour.service.type` | Service type | `ClusterIP` | -| `contour.service.ports.xds` | Contour service xds port | `8001` | -| `contour.service.ports.metrics` | Contour service xds port | `8000` | -| `contour.service.nodePorts.xds` | Node port for HTTP | `""` | -| `contour.service.clusterIP` | Contour service Cluster IP | `""` | -| `contour.service.loadBalancerIP` | Contour service Load Balancer IP | `""` | -| `contour.service.loadBalancerSourceRanges` | Contour service Load Balancer sources | `[]` | -| `contour.service.loadBalancerClass` | Contour service Load Balancer Class | `""` | -| `contour.service.externalTrafficPolicy` | Contour service external traffic policy | `Cluster` | -| `contour.service.annotations` | Additional custom annotations for Contour service | `{}` | -| `contour.service.extraPorts` | Extra port to expose on Contour service | `[]` | -| `contour.service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` | -| `contour.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | -| `contour.initContainers` | Attach additional init containers to Contour pods | `[]` | -| `contour.sidecars` | Add additional sidecar containers to the Contour pods | `[]` | -| `contour.extraVolumes` | Array to add extra volumes | `[]` | -| `contour.extraVolumeMounts` | Array to add extra mounts (normally used with extraVolumes) | `[]` | -| `contour.extraEnvVars` | Array containing extra env vars to be added to all Contour containers | `[]` | -| `contour.extraEnvVarsCM` | ConfigMap containing extra env vars to be added to all Contour containers | `""` | -| `contour.extraEnvVarsSecret` | Secret containing extra env vars to be added to all Contour containers | `""` | -| `contour.ingressClass.name` | Name of the ingress class to route through this controller. | `""` | -| `contour.ingressClass.create` | Whether to create or not the IngressClass resource | `true` | -| `contour.ingressClass.default` | Mark IngressClass resource as default for cluster | `true` | -| `contour.debug` | Enable Contour debug log level | `false` | -| `contour.logFormat` | Set contour log-format. Default text, either text or json. | `text` | -| `contour.kubernetesDebug` | Contour kubernetes debug log level, Default 0, minimum 0, maximum 9. | `0` | -| `contour.rootNamespaces` | Restrict Contour to searching these namespaces for root ingress routes. | `""` | -| `contour.overloadManager.enabled` | Enable Overload Manager | `false` | -| `contour.overloadManager.maxHeapBytes` | Overload Manager's maximum heap size in bytes | `2147483648` | - -### Envoy parameters - -| Name | Description | Value | -| ------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- | ----------------------- | -| `envoy.enabled` | Envoy Proxy creation | `true` | -| `envoy.image.registry` | Envoy Proxy image registry | `REGISTRY_NAME` | -| `envoy.image.repository` | Envoy Proxy image repository | `REPOSITORY_NAME/envoy` | -| `envoy.image.digest` | Envoy Proxy image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | -| `envoy.image.pullPolicy` | Envoy image pull policy | `IfNotPresent` | -| `envoy.image.pullSecrets` | Envoy image pull secrets | `[]` | -| `envoy.priorityClassName` | Priority class assigned to the pods | `""` | -| `envoy.schedulerName` | Name of the k8s scheduler (other than default) | `""` | -| `envoy.topologySpreadConstraints` | Topology Spread Constraints for pod assignment | `[]` | -| `envoy.extraArgs` | Extra arguments passed to Envoy container | `[]` | -| `envoy.hostAliases` | Add deployment host aliases | `[]` | -| `envoy.resources.limits` | Specify resource limits which the container is not allowed to succeed. | `{}` | -| `envoy.resources.requests` | Specify resource requests which the container needs to spawn. | `{}` | -| `envoy.command` | Override default command | `[]` | -| `envoy.args` | Override default args | `[]` | -| `envoy.shutdownManager.enabled` | Contour shutdownManager sidecar | `true` | -| `envoy.shutdownManager.extraArgs` | Extra arguments passed to shutdown container | `[]` | -| `envoy.shutdownManager.port` | Specify Port for shutdown container | `8090` | -| `envoy.shutdownManager.resources.limits` | Specify resource limits which the container is not allowed to succeed. | `{}` | -| `envoy.shutdownManager.resources.requests` | Specify resource requests which the container needs to spawn. | `{}` | -| `envoy.shutdownManager.containerSecurityContext.enabled` | Enabled envoy shutdownManager containers' Security Context | `true` | -| `envoy.shutdownManager.containerSecurityContext.runAsUser` | Set envoy shutdownManager containers' Security Context runAsUser | `1001` | -| `envoy.shutdownManager.containerSecurityContext.runAsNonRoot` | Set envoy shutdownManager containers' Security Context runAsNonRoot | `true` | -| `envoy.shutdownManager.containerSecurityContext.readOnlyRootFilesystem` | Set read only root file system pod's Security Conte | `true` | -| `envoy.shutdownManager.containerSecurityContext.privileged` | Set envoy.shutdownManager container's Security Context privileged | `false` | -| `envoy.shutdownManager.containerSecurityContext.allowPrivilegeEscalation` | Set envoy shutdownManager container's Security Context allowPrivilegeEscalation | `false` | -| `envoy.shutdownManager.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | -| `envoy.shutdownManager.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | -| `envoy.initConfig.containerSecurityContext.enabled` | Enabled envoy initConfig containers' Security Context | `true` | -| `envoy.initConfig.containerSecurityContext.runAsUser` | Set envoy initConfig containers' Security Context runAsUser | `1001` | -| `envoy.initConfig.containerSecurityContext.runAsNonRoot` | Set envoy initConfig containers' Security Context runAsNonRoot | `true` | -| `envoy.initConfig.containerSecurityContext.readOnlyRootFilesystem` | Set read only root file system pod's Security Conte | `false` | -| `envoy.initConfig.containerSecurityContext.privileged` | Set contraller container's Security Context privileged | `false` | -| `envoy.initConfig.containerSecurityContext.allowPrivilegeEscalation` | Set contraller container's Security Context allowPrivilegeEscalation | `false` | -| `envoy.initConfig.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | -| `envoy.initConfig.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | -| `envoy.kind` | Install as deployment or daemonset | `daemonset` | -| `envoy.replicaCount` | Desired number of Controller pods | `1` | -| `envoy.lifecycleHooks` | lifecycleHooks for the container to automate configuration before or after startup. | `{}` | -| `envoy.updateStrategy` | Strategy to use to update Pods | `{}` | -| `envoy.minReadySeconds` | The minimum number of seconds for which a newly created Pod should be ready | `0` | -| `envoy.revisionHistoryLimit` | The number of old history to retain to allow rollback | `10` | -| `envoy.autoscaling.enabled` | Enable autoscaling for Controller | `false` | -| `envoy.autoscaling.minReplicas` | Minimum number of Controller replicas | `1` | -| `envoy.autoscaling.maxReplicas` | Maximum number of Controller replicas | `11` | -| `envoy.autoscaling.targetCPU` | Target CPU utilization percentage | `""` | -| `envoy.autoscaling.targetMemory` | Target Memory utilization percentage | `""` | -| `envoy.autoscaling.behavior` | HPA Behavior | `{}` | -| `envoy.podAffinityPreset` | Envoy Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `envoy.podAntiAffinityPreset` | Envoy Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `envoy.nodeAffinityPreset.type` | Envoy Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `envoy.nodeAffinityPreset.key` | Envoy Node label key to match Ignored if `affinity` is set. | `""` | -| `envoy.nodeAffinityPreset.values` | Envoy Node label values to match. Ignored if `affinity` is set. | `[]` | -| `envoy.affinity` | Affinity for Envoy pod assignment | `{}` | -| `envoy.nodeSelector` | Node labels for Envoy pod assignment | `{}` | -| `envoy.tolerations` | Tolerations for Envoy pod assignment | `[]` | -| `envoy.podAnnotations` | Envoy Pod annotations | `{}` | -| `envoy.podLabels` | Extra labels for Envoy pods | `{}` | -| `envoy.podSecurityContext.enabled` | Envoy Pod securityContext | `false` | -| `envoy.podSecurityContext.fsGroup` | User ID for the for the mounted volumes | `0` | -| `envoy.podSecurityContext.sysctls` | Array of sysctl options to allow | `[]` | -| `envoy.containerSecurityContext.enabled` | Enabled envoy containers' Security Context | `true` | -| `envoy.containerSecurityContext.runAsUser` | Set envoy containers' Security Context runAsUser | `1001` | -| `envoy.containerSecurityContext.runAsNonRoot` | Set envoy containers' Security Context runAsNonRoot | `true` | -| `envoy.containerSecurityContext.readOnlyRootFilesystem` | Set read only root file system pod's Security Conte | `false` | -| `envoy.containerSecurityContext.privileged` | Set envoy container's Security Context privileged | `false` | -| `envoy.containerSecurityContext.allowPrivilegeEscalation` | Set envoy container's Security Context allowPrivilegeEscalation | `false` | -| `envoy.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | -| `envoy.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | -| `envoy.hostNetwork` | Envoy Pod host network access | `false` | -| `envoy.dnsPolicy` | Envoy Pod Dns Policy's DNS Policy | `ClusterFirst` | -| `envoy.tlsExistingSecret` | Name of the existingSecret to be use in Envoy deployment | `""` | -| `envoy.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | -| `envoy.serviceAccount.name` | The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template | `""` | -| `envoy.serviceAccount.automountServiceAccountToken` | Whether to auto mount API credentials for a service account | `false` | -| `envoy.serviceAccount.annotations` | Annotations for service account. Evaluated as a template. Only used if `create` is `true`. | `{}` | -| `envoy.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `envoy.livenessProbe.port` | LivenessProbe port | `8002` | -| `envoy.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `120` | -| `envoy.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `20` | -| `envoy.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `envoy.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | -| `envoy.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `envoy.readinessProbe.enabled` | Enable/disable the readiness probe | `true` | -| `envoy.readinessProbe.port` | ReadinessProbe port | `8002` | -| `envoy.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | `10` | -| `envoy.readinessProbe.periodSeconds` | How often to perform the probe | `3` | -| `envoy.readinessProbe.timeoutSeconds` | When the probe times out | `1` | -| `envoy.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `3` | -| `envoy.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | -| `envoy.startupProbe.enabled` | Enable/disable the startup probe | `false` | -| `envoy.startupProbe.port` | StartupProbe port | `8002` | -| `envoy.startupProbe.initialDelaySeconds` | Delay before startup probe is initiated | `15` | -| `envoy.startupProbe.periodSeconds` | How often to perform the probe | `10` | -| `envoy.startupProbe.timeoutSeconds` | When the probe times out | `5` | -| `envoy.startupProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `3` | -| `envoy.startupProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | -| `envoy.customLivenessProbe` | Override default liveness probe | `{}` | -| `envoy.customReadinessProbe` | Override default readiness probe | `{}` | -| `envoy.customStartupProbe` | Override default startup probe | `{}` | -| `envoy.terminationGracePeriodSeconds` | Envoy termination grace period in seconds | `300` | -| `envoy.logLevel` | Envoy log level | `info` | -| `envoy.service.name` | envoy service name | `""` | -| `envoy.service.targetPorts` | Map the controller service HTTP/HTTPS port | `{}` | -| `envoy.service.type` | Type of Envoy service to create | `LoadBalancer` | -| `envoy.service.externalTrafficPolicy` | Envoy Service external cluster policy. If `envoy.service.type` is NodePort or LoadBalancer | `Local` | -| `envoy.service.labels` | Labels to add to te envoy service | `{}` | -| `envoy.service.clusterIP` | Internal envoy cluster service IP | `""` | -| `envoy.service.externalIPs` | Envoy service external IP addresses | `[]` | -| `envoy.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` | -| `envoy.service.loadBalancerSourceRanges` | List of IP CIDRs allowed access to load balancer (if supported) | `[]` | -| `envoy.service.loadBalancerClass` | Envoy service Load Balancer Class | `""` | -| `envoy.service.ipFamilyPolicy` | , support SingleStack, PreferDualStack and RequireDualStack | `""` | -| `envoy.service.ipFamilies` | List of IP families (e.g. IPv4, IPv6) assigned to the service. | `[]` | -| `envoy.service.annotations` | Annotations for Envoy service | `{}` | -| `envoy.service.ports.http` | Sets service http port | `80` | -| `envoy.service.ports.https` | Sets service https port | `443` | -| `envoy.service.ports.metrics` | Sets service metrics port | `8002` | -| `envoy.service.nodePorts.http` | HTTP Port. If `envoy.service.type` is NodePort and this is non-empty | `""` | -| `envoy.service.nodePorts.https` | HTTPS Port. If `envoy.service.type` is NodePort and this is non-empty | `""` | -| `envoy.service.extraPorts` | Extra ports to expose (normally used with the `sidecar` value) | `[]` | -| `envoy.service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` | -| `envoy.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | -| `envoy.useHostPort.http` | Enable/disable `hostPort` for TCP/80 | `true` | -| `envoy.useHostPort.https` | Enable/disable `hostPort` TCP/443 | `true` | -| `envoy.useHostPort.metrics` | Enable/disable `hostPort` for TCP/8002 | `true` | -| `envoy.useHostIP` | Enable/disable `hostIP` | `false` | -| `envoy.hostPorts.http` | Sets `hostPort` http port | `80` | -| `envoy.hostPorts.https` | Sets `hostPort` https port | `443` | -| `envoy.hostPorts.metrics` | Sets `hostPort` metrics port | `8002` | -| `envoy.hostIPs.http` | Sets `hostIP` http IP | `127.0.0.1` | -| `envoy.hostIPs.https` | Sets `hostIP` https IP | `127.0.0.1` | -| `envoy.hostIPs.metrics` | Sets `hostIP` metrics IP | `127.0.0.1` | -| `envoy.containerPorts.http` | Sets http port inside Envoy pod (change this to >1024 to run envoy as a non-root user) | `8080` | -| `envoy.containerPorts.https` | Sets https port inside Envoy pod (change this to >1024 to run envoy as a non-root user) | `8443` | -| `envoy.containerPorts.metrics` | Sets metrics port inside Envoy pod (change this to >1024 to run envoy as a non-root user) | `8002` | -| `envoy.initContainers` | Attach additional init containers to Envoy pods | `[]` | -| `envoy.sidecars` | Add additional sidecar containers to the Envoy pods | `[]` | -| `envoy.extraVolumes` | Array to add extra volumes | `[]` | -| `envoy.extraVolumeMounts` | Array to add extra mounts (normally used with extraVolumes) | `[]` | -| `envoy.extraEnvVars` | Array containing extra env vars to be added to all Envoy containers | `[]` | -| `envoy.extraEnvVarsCM` | ConfigMap containing extra env vars to be added to all Envoy containers | `""` | -| `envoy.extraEnvVarsSecret` | Secret containing extra env vars to be added to all Envoy containers | `""` | - -### Default backend parameters - -| Name | Description | Value | -| ------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------- | ------------------------ | -| `defaultBackend.enabled` | Enable a default backend based on NGINX | `false` | -| `defaultBackend.image.registry` | Default backend image registry | `REGISTRY_NAME` | -| `defaultBackend.image.repository` | Default backend image name | `REPOSITORY_NAME/nginx` | -| `defaultBackend.image.digest` | Default backend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | -| `defaultBackend.image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `defaultBackend.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `defaultBackend.extraArgs` | Additional command line arguments to pass to NGINX container | `{}` | -| `defaultBackend.lifecycleHooks` | lifecycleHooks for the container to automate configuration before or after startup. | `{}` | -| `defaultBackend.extraEnvVars` | Array containing extra env vars to be added to all Contour containers | `[]` | -| `defaultBackend.extraEnvVarsCM` | ConfigMap containing extra env vars to be added to all Contour containers | `""` | -| `defaultBackend.extraEnvVarsSecret` | Secret containing extra env vars to be added to all Contour containers | `""` | -| `defaultBackend.extraVolumes` | Array to add extra volumes | `[]` | -| `defaultBackend.extraVolumeMounts` | Array to add extra mounts (normally used with extraVolumes) | `[]` | -| `defaultBackend.initContainers` | Attach additional init containers to the http backend pods | `[]` | -| `defaultBackend.sidecars` | Add additional sidecar containers to the default backend | `[]` | -| `defaultBackend.containerPorts.http` | Set http port inside Contour pod | `8001` | -| `defaultBackend.updateStrategy` | Strategy to use to update Pods | `{}` | -| `defaultBackend.command` | Override default command | `[]` | -| `defaultBackend.args` | Override default args | `[]` | -| `defaultBackend.hostAliases` | Add deployment host aliases | `[]` | -| `defaultBackend.replicaCount` | Desired number of default backend pods | `1` | -| `defaultBackend.podSecurityContext.enabled` | Default backend Pod securityContext | `true` | -| `defaultBackend.podSecurityContext.fsGroup` | Set Default backend Pod's Security Context fsGroup | `1001` | -| `defaultBackend.containerSecurityContext.enabled` | Enabled defaultBackend containers' Security Context | `true` | -| `defaultBackend.containerSecurityContext.runAsUser` | Set defaultBackend containers' Security Context runAsUser | `1001` | -| `defaultBackend.containerSecurityContext.runAsNonRoot` | Set defaultBackend containers' Security Context runAsNonRoot | `true` | -| `defaultBackend.containerSecurityContext.readOnlyRootFilesystem` | Set read only root file system pod's Security Conte | `false` | -| `defaultBackend.containerSecurityContext.privileged` | Set defaultBackend container's Security Context privileged | `false` | -| `defaultBackend.containerSecurityContext.allowPrivilegeEscalation` | Set defaultBackend container's Security Context allowPrivilegeEscalation | `false` | -| `defaultBackend.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | -| `defaultBackend.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | -| `defaultBackend.resources.limits` | The resources limits for the Default backend container | `{}` | -| `defaultBackend.resources.requests` | The requested resources for the Default backend container | `{}` | -| `defaultBackend.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `defaultBackend.livenessProbe.httpGet` | Path, port and scheme for the livenessProbe | `{}` | -| `defaultBackend.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` | -| `defaultBackend.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `defaultBackend.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `defaultBackend.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` | -| `defaultBackend.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `defaultBackend.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `defaultBackend.readinessProbe.httpGet` | Path, port and scheme for the readinessProbe | `{}` | -| `defaultBackend.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` | -| `defaultBackend.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | -| `defaultBackend.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | -| `defaultBackend.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | -| `defaultBackend.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `defaultBackend.startupProbe.enabled` | Enable/disable the startup probe | `false` | -| `defaultBackend.startupProbe.initialDelaySeconds` | Delay before startup probe is initiated | `15` | -| `defaultBackend.startupProbe.periodSeconds` | How often to perform the probe | `10` | -| `defaultBackend.startupProbe.timeoutSeconds` | When the probe times out | `5` | -| `defaultBackend.startupProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `3` | -| `defaultBackend.startupProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | -| `defaultBackend.customLivenessProbe` | Override default liveness probe, it overrides the default one (evaluated as a template) | `{}` | -| `defaultBackend.customReadinessProbe` | Override default readiness probe, it overrides the default one (evaluated as a template) | `{}` | -| `defaultBackend.customStartupProbe` | Override default startup probe | `{}` | -| `defaultBackend.podLabels` | Extra labels for Controller pods | `{}` | -| `defaultBackend.podAnnotations` | Annotations for Controller pods | `{}` | -| `defaultBackend.priorityClassName` | Priority class assigned to the pods | `""` | -| `defaultBackend.schedulerName` | Name of the k8s scheduler (other than default) | `""` | -| `defaultBackend.terminationGracePeriodSeconds` | In seconds, time the given to the default backend pod needs to terminate gracefully | `60` | -| `defaultBackend.topologySpreadConstraints` | Topology Spread Constraints for pod assignment | `[]` | -| `defaultBackend.podAffinityPreset` | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `defaultBackend.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `defaultBackend.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `defaultBackend.nodeAffinityPreset.key` | Node label key to match. Ignored if `affinity` is set. | `""` | -| `defaultBackend.nodeAffinityPreset.values` | Node label values to match. Ignored if `affinity` is set. | `[]` | -| `defaultBackend.affinity` | Affinity for pod assignment. Evaluated as a template. | `{}` | -| `defaultBackend.nodeSelector` | Node labels for pod assignment. Evaluated as a template. | `{}` | -| `defaultBackend.tolerations` | Tolerations for pod assignment. Evaluated as a template. | `[]` | -| `defaultBackend.service.type` | Service type | `ClusterIP` | -| `defaultBackend.service.ports.http` | Service port | `80` | -| `defaultBackend.service.annotations` | Annotations to add to the service | `{}` | -| `defaultBackend.pdb.create` | Enable Pod Disruption Budget configuration | `false` | -| `defaultBackend.pdb.minAvailable` | Minimum number/percentage of Default backend pods that should remain scheduled | `1` | -| `defaultBackend.pdb.maxUnavailable` | Maximum number/percentage of Default backend pods that should remain scheduled | `""` | -| `ingress.enabled` | Ingress configuration enabled | `false` | -| `ingress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` | -| `ingress.certManager` | Add annotations for cert-manager | `false` | -| `ingress.annotations` | Annotations to be added to the web ingress. | `{}` | -| `ingress.hostname` | Hostname for the Ingress object | `contour.local` | -| `ingress.path` | The Path to Concourse | `/` | -| `ingress.rulesOverride` | Ingress rules override | `[]` | -| `ingress.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` | -| `ingress.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `""` | -| `ingress.extraPaths` | Add additional arbitrary paths that may need to be added to the ingress under the main host. | `[]` | -| `ingress.tls` | TLS configuration. | `false` | -| `ingress.pathType` | Ingress Path type | `ImplementationSpecific` | -| `ingress.extraHosts` | The list of additional hostnames to be covered with this ingress record. | `[]` | -| `ingress.extraTls` | The tls configuration for additional hostnames to be covered with this ingress record. | `[]` | -| `ingress.secrets` | If you're providing your own certificates, please use this to add the certificates as secrets | `[]` | -| `ingress.extraRules` | Additional rules to be covered with this ingress record | `[]` | - -### Metrics parameters - -| Name | Description | Value | -| ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------ | ------------------------ | -| `metrics.serviceMonitor.namespace` | Specify if the servicemonitors will be deployed into a different namespace (blank deploys into same namespace as chart) | `""` | -| `metrics.serviceMonitor.enabled` | Specify if a servicemonitor will be deployed for prometheus-operator. | `false` | -| `metrics.serviceMonitor.jobLabel` | Specify the jobLabel to use for the prometheus-operator | `app.kubernetes.io/name` | -| `metrics.serviceMonitor.interval` | Specify the scrape interval if not specified use default prometheus scrapeIntervall, the Prometheus default scrape interval is used. | `""` | -| `metrics.serviceMonitor.metricRelabelings` | Specify additional relabeling of metrics. | `[]` | -| `metrics.serviceMonitor.relabelings` | Specify general relabeling. | `[]` | -| `metrics.serviceMonitor.honorLabels` | Specify honorLabels parameter to add the scrape endpoint | `false` | -| `metrics.serviceMonitor.scrapeTimeout` | The timeout after which the scrape is ended | `""` | -| `metrics.serviceMonitor.selector` | Specify honorLabels parameter to add the scrape endpoint | `{}` | -| `metrics.serviceMonitor.labels` | Extra labels for the ServiceMonitor | `{}` | -| `metrics.prometheusRule.enabled` | Creates a Prometheus Operator prometheusRule | `false` | -| `metrics.prometheusRule.namespace` | Namespace for the prometheusRule Resource (defaults to the Release Namespace) | `""` | -| `metrics.prometheusRule.additionalLabels` | Additional labels that can be used so prometheusRule will be discovered by Prometheus | `{}` | -| `metrics.prometheusRule.rules` | Prometheus Rule definitions | `[]` | - -### Other parameters - -| Name | Description | Value | -| ------------------- | -------------------------------------------------------------------------------------------------------------------- | ------ | -| `rbac.create` | Create the RBAC roles for API accessibility | `true` | -| `rbac.rules` | Custom RBAC rules to set | `[]` | -| `tlsExistingSecret` | Name of the existingSecret to be use in both contour and envoy. If it is not nil `contour.certgen` will be disabled. | `""` | - -Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, - -```console -helm install my-release \ - --set envoy.readinessProbe.successThreshold=5 \ - oci://REGISTRY_NAME/REPOSITORY_NAME/contour -``` - -> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. - -The above command sets the `envoy.readinessProbe.successThreshold` to `5`. - -## Configuration and installation details - -### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) - -It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. - -Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. - -To configure [Contour](https://projectcontour.io) please look into the configuration section [Contour Configuration](https://projectcontour.io/docs/main/configuration/). - -### Example Quickstart Contour Confiuration - -```yaml -configInline: - # should contour expect to be running inside a k8s cluster - # incluster: true - # - # path to kubeconfig (if not running inside a k8s cluster) - # kubeconfig: /path/to/.kube/config - # - # Client request timeout to be passed to Envoy - # as the connection manager request_timeout. - # Defaults to 0, which Envoy interprets as disabled. - # Note that this is the timeout for the whole request, - # not an idle timeout. - # request-timeout: 0s - # disable ingressroute permitInsecure field - disablePermitInsecure: false - tls: - # minimum TLS version that Contour will negotiate - # minimum-protocol-version: "1.1" - # Defines the Kubernetes name/namespace matching a secret to use - # as the fallback certificate when requests which don't match the - # SNI defined for a vhost. - fallback-certificate: - # name: fallback-secret-name - # namespace: projectcontour - # The following config shows the defaults for the leader election. - # leaderelection: - # configmap-name: leader-elect - # configmap-namespace: projectcontour - ### Logging options - # Default setting - accesslog-format: envoy - # To enable JSON logging in Envoy - # accesslog-format: json - # The default fields that will be logged are specified below. - # To customise this list, just add or remove entries. - # The canonical list is available at - # https://godoc.org/github.com/projectcontour/contour/internal/envoy#JSONFields - # json-fields: - # - "@timestamp" - # - "authority" - # - "bytes_received" - # - "bytes_sent" - # - "downstream_local_address" - # - "downstream_remote_address" - # - "duration" - # - "method" - # - "path" - # - "protocol" - # - "request_id" - # - "requested_server_name" - # - "response_code" - # - "response_flags" - # - "uber_trace_id" - # - "upstream_cluster" - # - "upstream_host" - # - "upstream_local_address" - # - "upstream_service_time" - # - "user_agent" - # - "x_forwarded_for" - # - # default-http-versions: - # - "HTTP/2" - # - "HTTP/1.1" - # - # The following shows the default proxy timeout settings. - # timeouts: - # request-timeout: infinity - # connection-idle-timeout: 60s - # stream-idle-timeout: 5m - # max-connection-duration: infinity - # connection-shutdown-grace-period: 5s -``` - -### Deploying Contour with an AWS NLB - -By default, Contour is launched with an AWS Classic ELB. To launch contour backed by a NLB, please set [these settings](https://github.com/projectcontour/contour/tree/master/examples/contour#deploying-with-host-networking-enabled-for-envoy): - -```yaml -envoy: - service: - annotations: - service.beta.kubernetes.io/aws-load-balancer-type: nlb - service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" - service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "3600" - service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm: arn:aws:acm:XX-XXXX-X:XXXXXXXXX:certificate/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX - - containerPorts: - http: 80 - https: 80 -``` - -### Setting Pod's affinity - -This chart allows you to set your custom affinity using the `XXX.affinity` parameter(s). Find more information about Pod's affinity in the [kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity). - -As an alternative, you can use of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/main/bitnami/common#affinities) chart. To do so, set the `XXX.podAffinityPreset`, `XXX.podAntiAffinityPreset`, or `XXX.nodeAffinityPreset` parameters. - -## Troubleshooting - -Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). - -## Upgrading - -Please carefully read through the guide "Upgrading Contour" at . - -### To 14.0.0 - -This major release adds support for Kubernetes PSA restricted mode out of the box. In order to do so, `hostNetwork` is disabled by default in envoy. In order to maintain `hostNetwork` in your current installation set `envoy.useHostNetwork=true`. - -### To 7.0.0 - -This major release renames several values in this chart and adds missing features, in order to be inline with the rest of assets in the Bitnami charts repository. - -Affected values: - -- `prometheus` renamed as `metrics`. -- `serviceMonitor.labels` renamed as `serviceMonitor.selector`. -- `service.port` renamed as `service.ports.xds`. -- `service.nodePort` renamed as `service.nodePorts.xds`. -- `contour.updateStrategy` and `worker.updateStrategy` changed from String type (previously default to 'rollingUpdate') to Object type, allowing users to configure other updateStrategy parameters, similar to other charts. - -### To 6.0.0 - -This version updates the chart to use Contour's latest release, `1.19.0`. Among other features, this new version introduces support for new kinds of CRDs: `ContourConfiguration` and `ContourDeployment`. For further information on new features, please refer to the [official release notes](https://github.com/projectcontour/contour/releases/tag/v1.19.0) for this version. - -Additionally, exisiting CRDs have been syncronised with the official [Contour repository](https://github.com/projectcontour/contour/blob/main/examples/render/contour.yaml) - -#### Considerations when upgrading to this version - -If you are installing a fresh chart, you can ignore this section. - -If you are upgrading from 5.x of this Helm chart, this is a breaking change as the new CRDs will not overwrite the existing ones. Therefore, you will need to delete the CRDs and let the chart recreate them. Make sure to back up any existing CRs (`kubectl get -o yaml extensionservice,httpproxy,tlscertificatedelegation -A > backup.yaml`) unless you have other ways of recreating them. - -### To 5.2.0 - -This version bumps the Envoy container from 1.17.X to 1.19.X; this Envoy version is officially supported by Contour since 1.18.0, see - -### To 5.0.0 - -In this version it was synchronized CRD with the official [Contour repository](https://github.com/projectcontour/contour/blob/main/examples/render/contour.yaml) - -#### Considerations when upgrading to 5.0.0 - -If you are installing a fresh chart, you can ignore this section. - -If you are upgrading from 4.x of this Helm chart, this is a breaking change as the new CRDs will not overwrite the existing ones. Therefore, you will need to delete the CRDs and let the chart recreate them. Make sure to back up any existing CRs (`kubectl get -o yaml extensionservice,httpproxy,tlscertificatedelegation -A > backup.yaml`) unless you have other ways of recreating them. - -### To 4.0.0 - -The 4.0 version of this chart introduces changes to handle Contour CRD upgrades. While Helm 3.x introduced the `crd` folder to place CRDs, Helm explicitly does not handle the [CRD upgrade scenario](https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#some-caveats-and-explanations). - -#### What changes were introduced in 4.0.0? - -- The `resources` directory was added that contains all the Contour CRDs, which are imported by the `templates/00-crds.yaml` manifest on installation and upgrade. -- If you do not wish for this chart to manage Contour CRDs, set the flag `contour.manageCRDs` to `false` when running Helm. - -#### Considerations when upgrading to 4.0.0 - -If you are installing a fresh chart, or if you are upgrading from a 4.x version of this chart, you can ignore this section. - -If you are upgrading from 3.x of this Helm chart, this is a breaking change as the new CRDs will not overwrite the existing ones. Therefore, you will need to delete the CRDs and let the chart recreate them. Make sure to back up any existing CRs (`kubectl get -o yaml extensionservice,httpproxy,tlscertificatedelegation -A > backup.yaml`) unless you have other ways of recreating them. - -If required, back up your existing Custom Resources: - -```console -kubectl get -o yaml extensionservice,httpproxy,tlscertificatedelegation -A > backup.yaml -``` - -Delete the existing Contour CRDs. Note that this step will _also delete_ the associated CRs and impact availability until the upgrade is complete and the backup restored: - -```console -kubectl delete extensionservices.projectcontour.io -kubectl delete httpproxies.projectcontour.io -kubectl delete tlscertificatedelegations.projectcontour.io -``` - -Upgrade the Contour chart with the release name `my-release`: - -```console -helm upgrade my-release oci://REGISTRY_NAME/REPOSITORY_NAME/contour -``` - -> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. - -If you made a backup earlier, restore the objects: - -```console -kubectl apply -f backup.yaml -``` - -### To 3.0.0 - -[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. - -#### What changes were introduced in 3.0.0? - -- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. -- Move dependency information from the _requirements.yaml_ to the _Chart.yaml_ -- After running `helm dependency update`, a _Chart.lock_ file is generated containing the same structure used in the previous _requirements.lock_ -- The different fields present in the _Chart.yaml_ file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts - -#### Considerations when upgrading to 3.0.0 - -- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues -- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore -- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 - -#### Useful links - -- -- -- - -### To 2.0.0 - -Most important changes are: - -- Using helm hooks to generate new TLS certificates for gRPC calls between Contour and Envoy. This enables us to use the same container image for the contour controller and the certgen job without upgrade issues due to JobSpec immutability. -- Rename parameter `contour.createCustomResource` to `contour.installCRDs` -- Sync CRDs with [upstream project examples](https://github.com/projectcontour/contour/tree/main/examples/contour). Please remember that helm does not touch existing CRDs. As of today, the most reliable way to update the CRDs is, to do it outside helm (Use `--skip-crds` when using helm v3 and `--set contour.installCRDs=false` when using helm v2). Read [Upgrading Contour](https://projectcontour.io/resources/upgrading/) and execute the following `kubectl` command before helm upgrade: - -```console -kubectl apply -f https://raw.githubusercontent.com/projectcontour/contour/release-{{version}}/examples/contour/01-crds.yaml -``` - -This version also introduces `bitnami/common`, a [library chart](https://helm.sh/docs/topics/library_charts/#helm) as a dependency. More documentation about this new utility could be found [here](https://github.com/bitnami/charts/tree/main/bitnami/common#bitnami-common-library-chart). Please, make sure that you have updated the chart dependencies before executing any upgrade. - -## License - -Copyright © 2023 VMware, Inc. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. \ No newline at end of file diff --git a/helm-templates/contour/charts/contour-0.7.0.tgz b/helm-templates/contour/charts/contour-0.7.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..d666a6dc493b8206bb937f9502290a075a5503d0 GIT binary patch literal 267698 zcmV(Dc zVQyr3R8em|NM&qo0POvHcN@9UAP(nmeF_}fc`YR(MO|#q!*~7cYGlofHooXcn#pF9 zYzFEENkq*?2LN@M%Xj}B6fO;Pqnk~UlIh<0q&~W{z)IW0} zG5^DG<+iGw`$9fA&zZ!MvRsTd5K6El6UOgG=p-L=EF_;Na?Z&HLK#g+E{GVR!vZH$ z(%%~lH*i6JAY4$EkI?nr1}+Nsb9b=6KX|o~5|MCPNO*RnxeZZ)aE@3(awOQCCj|Xv zeo1&vBoT<_6HbIciZwaQGQyFZVu@}TzY^&3ZUdo|6dAjt`2@)+LC5(uyF&$Mw|58& zgb^p#gbQLHL8=2GFdGs8j>Zo!EiJGT_DorGnK+edx%s1J_@;(D@i zMec4GPsM1XZ@a(IM@02&qmN9bjTxr7#55-y3g%dK!jklY;Msw|+~MgH&a9z4naNBKNMN36KxbTXCbYtC?*u-P^`$&&#(%rbPQUI=tX1mV{t9c(;9 z=cjM~Pyd}>4EiT2$t4|A!bj-v^zi7rV^|h8o;^eVOOQlKee`X{E^&qm%<+s!!i9Qk z9=>JC72$}^@Pt%KoMr?IvW;>kiCzHYlnQi1vkb9o!Z}R|i2rKkZA9}Vo2P1dNJ&BR zl;jB|Vp|EuF`djgNs(k|E_D5gMg?YoYWQf*Imso$*O+GbGIJ#wkR9nKXJkT!nqYMkxJxwA2V!#gqC{Y4&^Rl6?-{jvh=lJfQ6)+Y65>O15 z5CLmuj-Wyva!ST{p2>3$eGAmQLczN+>r;3QWlu}#*;*C(Rw}H^JXXtn^8R&0S3XSw*g!*W9XDj}N-09aJ z@QgqK3)-)V{{BzUL29U(c18V>VkkScjW`jK(?pWAf4zs!kB&x&lNq}vh|lvw@x35? zTYvqQvv~niZ0vo{h{ntk)6RCv5zaDpLsG}SCvU|7oiZT+54{kM5S~khHgQp8cZk|v zNTM)O?dD3lB-vbPd`g{lm~U+>`X>Z!7KB5~s%kkr2xm9=PHb(XlnNzXQnZ;eCFPK< zP!`^D<7B?X#zEs6h}*i(#p8LFsai(1 z60`||*s7$^Nlrjy19UatH~eN`B9s_dco8hrt2PWInW<4#vU;NmrqT+?w*n`fno%Sh zK#hT`XL}Is|t#3 zlICNYQ+ZdBReA$k7giUn)YxpXZFI-xXf_uTiGn0_e1|@MIJWD|m?_x~6a0oD237|# z2xbozlID{mfcqX7=p3M^DX0K|fMH{$50P6*c&?;jKP6+DlN6P;jQWU$8FG!K7Vw*( zr&57tb2$fTN^aFkL9fj!_oFURL8_>9Vv z9CRmA$^x00`7*{?c8Qa#enPm~VDq9=Hv~-;FjkLTAU{o}6Et{q0{L4&NXDvo!gIJD4_*1rt=V z3eeM!=O-5*4OnZCs)En0+K&F0xS~Y`vc!{0d5I@2n51+QMP3lO9ofUSBT~$>?386RxpT;z=uPNcElBWYLG|jsFak&K z2}K)0$mM)u7e_-5c%)XxV7sI_n7jShWSXe?W1iXp9-)d6(n=y#OybE1T^lR1dY~z9 zHdKJ*xmf{lxko#-#DD^vj7ux-l~c#uOioyykir-^^-8t_pv2Czf|I_Y3rYL>k-w8F zM`VOf#vhnGuWN(ZD1chX36QA{1O z{Ad1Z(XAlHq!=u&M}A4SMx4C`(FR&j1=0xh%(Gro(_=b0#U<=oo4Uvh7lTsQvXxpy zC?`cm6MV$xxkMl4vrEDibJ$i+S&B>%VUYK0jL>crYQZUk-C>4>08*WrCny2?2^NA* za%}^HEiy~Zq+e#bl+@i(tYlm57o3n8aKD;D`XRJyNmIkGG?7$#B9bXd=NaM9iw{OM zQz&13C6IfIHkq92L!#Vn>bJUeNKXo!&S*~6PQGt;^xiy~%`-`hjPzZ5V#jtRK(MhJ zQZ4j3km_5G6SeSDmY$P@<*7g?xe~nU>o$^fW=xXwn&ftToPx|!loOJI9&UjWG*K{N zGrQy<-Y|ZZF`NoDfbh@GGY{838}}V+D7~bu8_k_(1XH#> zV4E}SBg_orQq+zrGcb_~#PUXw2g3PO)gIiY0-Y0y)L#V;(Of9)!Q+lDU}i*enrKk= zdmA_-F-r(q+~2Ap|7tkggT=FZM8lAzeZ(9m|UJa@v&V z?qWwsER}E(MD9G(!23csONkQ=Azo&W64`*A-vV7>6 z&+SYskYKijWz}|AyA^QqpE(ic2qvR5DpyJR8UtBm&))66wDY(^=Mm~D+QgNJvM<%qsLgKZUP{Mf0%y2o&5T|VbaeVX zVjRuLjPX0PNrc+7QJhtXf}AikdgSpfo)ww39hW?0&k!vl?g2tcF(0A5^0#htgkJ9M zy{GoE#<^N+zg}y1xOZTx`Lt^kwOURcoxK(4y=P1`W}a;{FD4wP1PGUsj6kowy@#sl zHZvu#mNga(P-a>FV0Wje{AM(FD2B|ssiqFil^BpP0w>1vORYL{fl?wd&4g!^iZoGb zp8f{m-pwrPR_&k~3Jgq3gWNkeu2yZ-ku!o*!jCg;5I-}6Tif)Q;%M`olF(a7S3|_q z(^e(0J~@gtLvBRIxSyQ^Z4T2EC}saDp-sT}Wof8Qz=o6qbOI*ns=d2Pi64RQYL8(& ze{{&lFlj`)VCmslpDq}|?Qf&8d1a*Y0G*Vg^hf*hMj2rDpNX+HDv|@#z z8xcz8LbBOAdQEa7#3^T&1i1rutEgt?wLU*}d&_#&1#|WWhW5TuUPIZfKiczQ+CgiuJy=hK+C(rfs$K?7aKNje21Gp#JO&!8 zTeftP+S0iyrEA8+&eJU1^4BKVg7pV|V3LgLYxH(}S<<`K2*)@F61(lYnUWk)`2twY z5zEwRlw}I=Ip~OtmqaT$ytcaCpKe{mlRrZ&T8+3%mJx2egzOx>@SZ);h^uu|!swO= z?3C7D*M1|D!a$b}PLArK-sK9cRh{tQ?gaW!=sXoYZwZX51LHw*r2k+PzIKYnA_H^< zDtOp@Z(Oe{Af20IC zGWUths?u(0w+FSzXXBEuEK68NRb)I>mpPPcI;pm<#_)*T%AIF|$iAGCe)Ua%%y=L7 zoA|PT!zZQ~!Ffx@JEz2S(`Go8q9+)(q1~#$&vH6=+&s4;VhUwh31wr1?e15AvW89*+ozF9H znfoU&#Q8B4vi@_3=IEXsa@Pc$&3I9F%9{oEXsP7s?oE|UywFM_Nr?&F3 zNN}djBb{4rg0LJO{(XQ!%2|QlQ30;3!A$|l!0nu~qFA=4f+Pu>6{no3(bAj#;6x?X zIa3K0x>n6Apra@br@zq^P&wzEU`5{Ks6I42?13!@JlEw{9AvRE0h<0pDp~dK!g5!A>qNLIEEVsTzwP8v|_+x~2_lA06h3;ME zX*ftD^wM~$hXfy?S4N!*yWZro$OE%%+Z>2lcNaigI14H;7f*vq11ryi3cOV&LIu>P zo(UCnKFL%Faae9Hyo^nS-Q}jj{!&vxcxMM~6QO?m&{vyC9$MZI@)Ou(K0TQ}m~TR2&V*PAp)DZUe1 zLB}G1Mri-l%LVPP?q%&T=;UdwkGr(%GXnD(b=RbpI5vtnQJb&*!T{azaWgNCJ+BtZ zqDqyZxLZ@pJF7QS0{2I-?TRteiYc3CDM(&@`KlU>p{_-AM+0`K$L5MLddu<`61)g0 zcau>cK&#o4usk;rHOgi#rUV&GXDlTd_<0mXb~n&#CLG!`&CT1|P*bo}lu{~ToRdVB z5QBE%^l^%>i6ytWbXwjT;!@ZuRG8Zg+E>@WW4S>^(P!J11;7ecA^nb_F=sP`^E(p} zt^~7L#TcbTNOKhh@Gz6d8=8Q;s}Inzc6I~*276};=&ebju;yUCXJdVv0_UlTX5cUt z?MUh-?uDwFT!*J8=RjY$q~T6Wtp%yD;Y~=M77Xs#NCuHB`naHGWH!MaRlR^aDeAbh9TH(ES($K2Jox&-)@7?-bD30;b_jEqzx zxg>dd?{2M=r`KyOb4k^ivY*tF-`QUrSG4* zJK5sCD4eo1ip42Qt+UR3F)?3ay>*JM_d3L+*+C~0$0n+VzS12!;fJsEE_N;;Opo1w zl~?fKhL8?vk~4{Nnn9oxpKd?aqVAZT_lc~;RQR!m*^kbFr~1YZ(PsS?w31wK#lF(s zbX&sXJEGE>XFJc}MsZ(BhrTUW@zZG9^V(Ym=HSL$Zn!Ig`}O*4;z%#vC#MTQ74CAW z?Y!Np*^8!~0NAUf3xH^&f-f(_i=_3dq{z9>noG0{k=ufarcJWDh`~})UYvCRK%M^X z;=+;T!^ex`5lW_v2~*;d$Qwd(^gs58!{M;MzxVpp>;De69~N}bhteCf0i(o@NR3El ztWY^vWH1>xCU6x;=mX1xvG!gqY(HZ-{n|u8jv(=l;S|~T9xChMdBv1{g@KL1?DrzX zY{{;i!*1bBY2S7B3p-^lO?B;=2@U`%eqZgZ)P9_@JQ5@z$=E#Y7o1(wl<@wTa&m*S zZ0DH`W7s!f#*7DKuoA!<4o zl25?HC&?(uW#3#8riD*}Xm_00UqFk%QkSMw$Eq>67kryn;9(oGsgzQiZ=FO(UNE>wTV?GIEG)G0>U_h`_3zMG+>6g>>TRP0=SsimDM{NyjHBKWjKayO zW3ZF4_i#Hf;Oh}9@1>UN3fGZC&5lDrSeDZEydEKYO}U)otWOI8-pl5Nl1sNVj9*lt zPq4Cdq^XW^;q#9(6qHuwpoWDX1>{M!#1PkeR6lgscj`f`Lk4Df`KE59dZ#0JyjQbVyugJTS>nz3;aa-ZJB zXm37sHZLxmb89gwR&=(yL9uQmYBmwoOo?rVn?>fKZpNWyTc{a^7Mg{+7=;#?gt{1n zqGrQRJg};@>t zZq`VNlPSWbHmC}EZs~qdr}7T{H;f|^1Xl^+ds!Ov8U7t)Pl7;|Ww2N12ZSB<-dA3o zdJ#L_4G*my(upRYD z{P1s1RB3aiMZAe-FdKCW5K)O%Z=$|yNqen}xX3A9wJxy1wV}0vnJ%%JGd_dBTHs*< znw{U+Rs;hLyd90>{Q8H0H2?!cIhs!l79_t$*O*%$ew?Pn#l5cuF>9P5ev5V-?GV2I z+rN%K{P3?I4$s^mf*^$e(f_)}{9iiFjo(cRs!I=#-h1)3*U`TU5=ZYFLz(!+%!z{e z^8k2MPX^*aa=`YaUBdix50}6WY-f@o&gKvenzQ+2s$;VyF34Woc`#_fIJN!N>

0 z?u_fWa8qIf@@RXV4G^^$w7r1;9`ma>41|TdrVqP7XJP`XJ$n{}MEYJ3gwYHaE=>;< z`5T*qX~pJTQvZJuL+FL}2NNz$2hCIMGUZWr!`Q_Ynu_`+L>g@DAnvyx?8=1mkM_;b z-l%V|`jn;0!1yQ#NTgrtqX6Hptmb#-qL(+`{RjeTmq%jiVa6sXBiAIetuKs`oUzF_ z5WX$AxKsv-AGqt5lHAH|M5yK_aw`=h{abkP-yN(GYP{)J8cf~-#uoqbd9^Fs4ujz~ zni&UJ^%dX3*Z*?uS747&Jgg{ZOuEQXkfsc*?G6=)SA}^pHNKX@i=3^^RB(6ADf()j zmhr|y=w4DOFjrRd5U{bn5c)!gw}6b3I`$fOQ@_k%aLJeylH;OKs1=+gj<3OD@n0|h zs36YpEt(QsAVGg3I+7nwrY4FX&UK61s3)eJ=2uX(XVhzj6BS5uI++mej!HH3ua<#M zCCVAfSgyLF4JX3cI1ShZDHC)uNuU?RF95^0jw@#)W>$vQmNF!)re>*DmCxTAbEFnI+Etx_>pdIprK!rGXTiY}MdV>#N z;z^{Qdb&wxv$@n)aqvVS4424Ugw?G^luhoCI@HHWD&nK!r4;eTzA>RlwQ4n;NDYRc zOr$9(h+(NnT97J#X~!0u5ag?YzFG2=5ac(S5Twd?Uw%pp6D9V`PH3S!@%zl^5H7My z1hTILi3yAihp|X^x`{_gm{8wK>c+p=d}&C z-oTeM_ZxAq$b!~#pPOvxI6R+97_?%Sgz2^vncS}Q)LuZi7h67F*!N1ydOsJ91z*== zV@`<8fxe43Li1si$>lpA#GG6ek5yt&uG+RAlk&b~ zC?iy^g3UT3R<3|YC4yzNc6;E(AfDw4n6$>XTrgHkM!Q@A%X>z@TuF4SB^su)V>UHp z7qwWpkcOz3@wk``kue)%V>U&{>=qw09w9RpBeN+=W^0_xg^@D5XhhACGs6go_W&1* zn0BI{p%fygnY6v2dac@87(z{_)?I4@m8fbL`sZ4ksKs0RMn6E(Jy}OHwMc5`b8{bWG~ z&uy-K(x{(qrqv^VM%~ofqklHV|6FE`TXm-0FSlT+lQ-rU?ArA5`35VEM{^E#ZGE{M zgq4=#c?g46uV|j4lUzugW!ll(o$xY_QcPxwQC+q%ReV%=Ts^7*hr%N`k$y`ARg9~> z>ui2u?e<>!XuyF+S*scuS;PHol3r?bDw+7*g{?BkJ1QjOckkf3vO=ar zLdo%|ehrs9h+?_&TArfiB~GqN-mXJ5qSW~Inh9|@mrU)%l}K-Ppe@})Oxfzj*L&r{ zcjy)tzybQeJQNjg+{(-~vsEmDhi^-GfuHUD;7QCUL>`@fk1pUF9N^3)&FD|&F23{L z?F8w)KKL=f%&&XFyCiBQW*mKYdWgO@KYSM)Q?S`xyd=F{7(MEZ(C)7BfHV|vK97D+ z+(U~_gY2rO$~F$Ezp+HwHS82}+ejhi9QPI`(k@9>PowRT?YEXhyCdx)Nw!@!{!gCn zSPxxOvSU4XkCW=S5tA!&=OeOGn&ZYsDoKuO?LAY@~8~dSG*v;&-1Mxa5_^ zse#u(v$Z7#wjRif(*m!3r0<;+*jqs&DS`bp`*rGD71rBj3?HMs&2u@vKoxS z&&29EP<;BVvW{fU4ia{t+cL>Ef>}cz*+$qa`TI$PbGV zHR)~-?X?+`+1C1X*gcrXKmTRT-%IVrnJuhsRcIqBD%Xr*$Z|h+)!Y*hv=1sGN_e|$@I{3=m*Egm!4lCz@ zT{zL6vcP^eSzyZxS2jdxsVKl5t1$HClIoV$0^r7+TL{dvXK<@32pHz>RT)&8FNmeN z2rdsp6o6cqP@pdadi&uVoq8(BN&#-uT=aDpOrTr%(btb%8yg5Yv|J$MZzvZr@pk{j z1-iqf5#DV9n$rq|=RDDTb+N#&;g!8;$vvQW~2$)YhX}*vQ*_~$0+xvSt#_3Ia zqf=bGk>y?Byk?^AZ}E1Pb9VFE=-}uk37?s~2;Xv?kkeo;>P?+j22E5UGn{JMXVfjX z+iL@7latgmCN_CTu1RK^t3~*dD zAW{&*KcO+fat?Y!o)RvQ4Ixyf%@L5$0VS|S#X1&vdGT75=tF`m9ax=ytYZsy zln*A&B4Rv-j9#qcS~s zG*Q-@?lC?nC#O}%pIWB7lT+1s4q8==wkM~tOd1t(hPfq6kU&~+z<`)k45!G+{Y^TC zb5+Kr4w{KNCxmQnJxB*xO;L1mijGd+o(W__vy}Oy?t|Kbw2IA0>LBFdczgjV6~hkE z;u}1p*`1m2f7c<~|G8}mht6p}$;i3H$<;PGe^1s1+GLoaD!8bMMyzAFd2@y z7*%cD$4vq*md&x6+&tQB;l;Wk(q&Twx|K^FD$`Kg_%5B{iaKD?2w9BK!NGnf*fwu* z0Np-}!T0kMyQnfYzz+msHOtnf*wU_w>Wkg1`s)}>0k_BrFPpRI9K&^q0O48%BXh-?I`MaK0^=7J?AzJf$ zuNN|@`|X%&@v3eUsD`o6D!H+vd2ST{{b<6h{is=UYrT9HPi&4lC2$Qp`jozP_4KW+ z6#a6Nx32k$JS@S8a>OETcY}0BkNUPe&0Z&O)e+#4EDXD6V2Oc4%YHPD!Ktfd$NI;P9 zm;ei~-g8w>y?>mVw?D$7dU15R^HuC@sR~E508&8o2DuH2Rh_yZG~9C$07?j&&Ggo% zJeDwfAMfsSMEQy#b#fX-<>d6oO4}!=?U@ZuE7l6HN4~+Ly{d@T6^kne76-3-#pvLC zalL(HU^S^2I;wVw7y>7!wQirBnoff;x~-Ck)DrF0>RnY8?Nd|Lbo1mi=;ZF+>%nj^ z9PIji4IjE5`;T=*1?@B`Jhe}KGndvN?UGjh1ZwxpuX2iG4@AMyz`JFLHqFH=FbqhB z{(E=0cL4Dr=D9fl01wif<$bswF&Bi#B1%VE7iII}vD*&@v9g`2;IIM;8}Ufcmg7U7 z|Eep~uac{}dd2Yz$W(2%$2L!O=ls;wuKw1uQ)@asL~iODU!_)pOZS;x5XK$>nN;{kGcyE)e9v{We@dk=zNmgq2@O4%9%q;IFFS#)NAp}$QlaB z+xB5iJF4-O;gOTt;supos9JqJ2rnwjqAl~aOhLT`C~ne!P*(WP|^ z=_wNQYOu`)3Q%)qS%I-CHVS*(ks-tDmn~u{X{&_c1sG1rX&=NX((C}Q8cHb=#U2j zb!eD zA?(K?c)8+YV*?UbjfK#z1?XEW$ql}Pa0f6xL@IIr?AgXdzd1ZT83h~F^7%juhNH8$ z!la(lz6feZNm;&)=Ea2Ll)#9jBqPuw8wZW5+U|y23DAmKA6M&r6XI#@vc_7$*^J03 znG5vMoKcppmMo`|@#=M^_xf?w6~@3Fgrx@Vkj^<`(y{O9V;d>`xgdH6EdG)q?D1m> zYV$I~`IRXubV>00DvMx~6*+JacdsMfd=2=A-aLRkuHarr-OLC>*}gsf9Yp=XU`-WBc0!*`m&{Uycb{}i~_>90IH2B+D+pO)IXR_z6 zn3|#%qK`lgT;zPd0TbSWgO2gyBT&iXa*y_=EN9%D$J=)NXHJB;>p0~glRPaL&4a5` zUfrb_T!XY>G%lvZdMBET!aAyZ!bV$N2LVJFCACBISwlEaFD#HL z>bH|sV{k^~c{#t%=2>}I5yzi-3KQQQ`bWLbB?f-9OUVC6iN^Nml8LdYgbw#)wLN_d%kZ zX6Q##Xpj&tCnW#TXE~UQ12qWo2x%pzb3u*>mo^9K_ktkxyFW7zXf7l~m>jz-@}@z! zLN3Idzyms_2?!4GPkMLmx$UA$B5w%E9RSrW*vJev!se~?_``4fV}{P#R(|++aeO|I zw{mT542Q$vtAhjhI~)$HfA?PAdk1?jUk?8;+&wrL?*0J{*M>pMXD%e> ze;BUZR<(0q$mi(0!?O$Y;qd+O2>tvs8XTz&%>YEiufJ~Sw?7=8ou7RC;1~FTaJZ23 z>#rM!r>C(JhehEP+W6C-(5YS>F9|BJgo`#eQ)&YHz&=XJluM$tUAN2m)1Njre*U=+ zhMoVQ!4F_E8bt25_x!7MJ=Nsy0DViOo$2C*sNC^AIo+8u0WKw@4ZSH>tUp3063y@( zlK6@sjK<^!&1gQCF6In1Cgg<82yzFo0|Vo4Y!2)3jrJ|oL5t*Es5O_*^BmH^l!nIV zNbQOenJLMR#C4)bSa6!lG3xzM^r5Rgv`O8Y%ECU;Nv4;j*=ohuD{GQ72k46Q&;Tmk7+gQ*2|+K8|Ifwo*@we-{gcxddIdlk z%aw3`@jnWZr!=4Z_ltPAXCx`mF3bUvr;4w; zO$U2fvFBCURIA;lTD3Rf%3=e6%B9S$t)=U1ZEcwuXxCZ)z71lz2?d{J>_$D%KAPq+ zM7^EiWJ+^4F~RY&57MPW^QvuEO?0m(EUic;NTmZ)tYj0(br>R&4%|c^(>z6L`)IvQ zja!J7WuTQ`-Z@BdInXjw7EX)%a{h+TRu9GFA3nZ4{@2Or4*dP@IQQ~M=>z@>n`x5=SJE>1DC^lK`>6F-RfHc^w4HX6N!3eSEC*% z)_2|Op`H6$FEHMP;M|Gj+udiQlj|9iQ+ z|D^vt%ID{wcmA|-#ELskCsT>O<_xC^n{A_$Jb^4%=uEv3=#0RH$aJuAe){(R^xx5h zEY3L$Njy*aN|!qdUo&pNuSY~Ga-n)qNO~^3c}HNp8NMH!?P~r zLAj>05uDSFX-3o%_hzO>E}4>%S8T)B1+cT?DlvJ7{xip!HVWgS087kZP5>Q?$ zjY27*N@^!q?SO?+?>teb*JVnwR3OZWJ_oXQ!l^);m)b6^M5pRRJ^@?w)?njgjJPok z0T4$Ft@Y}_+GR>7STMj*ULkL=g+3|?q$7wmE(ZN_xwm4>zH|}wY?;OaZCX~}UnA|0 z=g^1I8%K73A7Pt`;_%#1=7Ryi$%H`SL!1!BeZ9^8|NQ&^!~LKB@sIQ$|LFg7>(BlF zsU#}9Ash{i#SPlo3ecnDlFS;rprvT@OLyDTVgD$4Au!!&Cy;sC`dxE&dA--?CB5Kl zvklX3#=u5=N2Y}2jo6r5N}(R|F%{|}9^&ddr*ik^Ge?NYZkB5D(W z6a&*#4{aj7w!`x?#$>516j)9Nk`3gP7?q(1P4vuMK(LZG5xLrs<4<^TfhTHi3|zAV zi6@GF>>PqFnc_Qt($lBV!ZhM!@E!{txiS?yg3PW7*Nz5z`{S3pDcS!D55Ic#DtSr9 z!^?4Uuy?sXe!c%PdA+|oe0}+PINUJ^4kql`yMx{SyMqJdxz{w#+Wg1BeEXmN*FL;I?Ehaix%>b8vw2rO*!t6!s`2Me<(~iO(W-AY06;;@C!;q= zce$aUo6P9|{_DA_gZKE~jC((6?*BZ6{?-IU02d9Cs#Rq1lz&h7M6G3+@nW-y8o}gm zg_~8}%;{Abtx`_OY+zs%oFpVAY7eg$V*#5nsqdK>@1t4C90S8MljGL@()kd&c(xWV7{WBNLWGC6Zo=)et`-5H$2PGF9?v- z4c1viKUXs!N;e2h9iR(4@u?;#F(9|5g0pGwAfqFXPUC%I!8WqBG%C%vD4?x9V| z{tb!(nY2@K_cZ+Dx!iwflMmpQ~jUOL|Stp?v?>UwankUb*G&ZJ|xg zVTMzKT0LZ0(lV=ui?xdQNSFp3YnO#fV^y`DspIi(l#TuHP7>!S=Jx7-j8XKPfi3AK zqKS14Z++WpTgWYz&g*R$#c*-W2)}~neh1|ic_nX}c-k8R=JlSFtDJzPaoMoCU zq{a;7Myxj_*=!)DJ4OL%sAkoZvR=JinycO>9{51pi&fFbb!q?dE>g(`gtdJK)^(+7 zCkKv1|I*91EQu9q*=bLMnB;VVuX%Zju1@|?y5{}mCzvXM3J@R1QM-Z8*t>!;Y^h>L z5k=dxW#Ig_M1<=YjZ@JnsU5vZw=QfE)IlK}W)~xnB_1`)Jhra}V|Y z)w@Th4BG?hEJt)Un@hL?X$&D^o=jEW^yYFP3X(V{r-2te2QiMsbrKe6k>g&~1){vn zQe2bc8-FDzg&<`&SR14>#tPUco5TUuiv}0w^a`}*G8U}CQ&7;HbV;U5 z&eWL9h{P$D*m`&Ak!j|t7=_odkQv2wv!KaUeaTsL9Ij?Gj4vMTo&BLssyid04q`r z^~zw0gR8If>apA1F7%cqSA?Szu)ds;2^EsxA6440Xs~ct-!WH$LNaYsoD(9aA6g%a-R~k_Qr_W@TpEt;sXsVDBagbOuqzZ8P1!IE^A3yf0YJczR!?T|H_y6{`+INMumiqqgo%{zGj||- z4_yMNt}uu&MawWKOdzQB^2ArQY*)+>teNP33#v*1nFcsX-_AMBC+9lM2F)iY`jVi2 ze0&Q*pIJTvZq=1Yp14b(@xY9zjK!!}`-mZwj*cS&n7P z=&dktk0bs}Q)`fa{+wQ)0Q5Pms{~Z~Ai_#bEU=`Pko7CLUaz)%X76Ym*oq9xG2^oV z`uffp9JI&$3{!nK77qB~*#Mp7CfKO0XfDHkEJ!Y;JX7}}f&$!Q`<+P~gK=SN4Sb-zwM+i$o@VbtSFd;#C#$vyI& zuwp?8x*J_PVc_h9IK_n|scmKS1`SHI?7(WxXLHl-)k5VuY;tSB>^N+Ntj##uRE!vf zQo-B77yyPfYK$4zJ5<wrD~u+BqNBKRVZab|=NDMBbB-K*ar+Pw}+e)zo{Lfx?n8FW7tz2b~E zqw-kQI}fXw*a?!sjjF&E02sOZ9E&$#T#uW_&!3X3kg|zb#>@$PjX7Ls;$(t(N>X$) zCAoFwb*cY!-~*cbfrw@-4QW$B$&X>Qe0O|HOWdg_Ue8>U?3Jde=o*Nep+$|bF-4|C z>VznE$x@u)CVKY;B@{hNtOG$s-{ur4o)}A$7<`8XEKwjKJ;_=-EZbi#PO%nP@B}&O_Z%0KJr^DyZZ+9{#Up#R8gq`s=1KW8V`pv<}M|6{wUP{ zdX=)(k@GMO@M?FQf)+IRAq_HGEt?a#gwF=VvuU`h>_P;vlh&05|>WK8q3Z)_F z(fyHrU7^A2SIq-gp)^GNx+m5;(9-(Q-hH{>Ja!@8!2ey@dN2$aWO%R|TMu3a3^IJ( zm91}Az`C`WE_@w=d$oJem9O_cCEBk-aJzeZUv*>caz!;K=uS9lLzY`|^OW3HU)DAB z*e!(Pv$Kz9BV@w%U6DKV;*a75qB(3q2RcERi@OK1A3R8)iOqjAnxo!!4{ctNJK-?c zf`fNV>$`*d9w6(08g6;&c7hD?Ia&^m_4~P;GERR2Enukwf9B!7?_v`wN(vwME$^0d?I0 zJADO6^|h(xu9uWnYInb6x99!Xt6rg8;`q)xNCFkck;vc5^uSJLUzBBi7Z$HLP3O7RViroLOEyTherGR5nm@Ez1gE$wB=;waj zoEh~QLouhZ=L@`y5Qw{63E^C#-C=l8Pge{D{{B(d8OAGsfy8aeZ&RFUC*s+dgMT=*09|RRyn{GDAT0*M{7U-9CwG(cf=~r z4%&&mv4!~I&QkX;{Gt7-3c1$b;DIN}qMliv5DA2y-M0D9{1RLBob z=Yy)|wvhkOQ`UMRQ`>-eaW9RHzv}Q?2w$?fM026On@CF~ zG_6w`!pdMjO$W)ZDQCGhp8gr4u-Kp^k|fiVC1P-CB2GbklDXI+`Ofw126NJvIR9zB z<7JubCs^W)O?Kc-Kla96x!aLA>8C7F)kR;F zP#2B&(__pBxd(`p))~khEL+#A9AaO27X-U;=i<0>idmI9uKp@b+%7mecAQJ*0GU8$ zzZ(;RONFl!^pvw}ni4)J%$J@j$FJdw&Xape_>5{V>mKSwV%h1_X8{D!5vTz_goS`i zyug29ct~?#0kNvJMjOMW>;n|hcvT+OaICy9e=VNqCB^zdga}aOD{gOP5m>+96QM?4 z6@)0$Rwh2j<1x(Gb3=T0L#rP~C$WQ5_qA4ArNF20NX_h7g1XO%eI&Go2M`Y+( zQYQ-LM2E{#j98zBVQ&$M9SKwUD zH}6tFG{Hw~p367GZR>n&1s#=T zza1X_73UHW>kqkAyN5@|)vlJ#ll_XtZ|6@A$I>O%FRH_UrEK9LfqvZp1vO^bR z(x8jWy0(=Bupy{}Rdp{wekA z&vX__;dE$lhmUD5K~}^&Hs>yh9ZVlF^49nIU>Gxoy-w>XrlDHBbOy;t=18%#7C(>g z7^goem>HycKb%V@5}Xm<(T`$U;HU$|bJfQm%AkHV4|5-gSJpE}R(&xHYBZnhT<@*s zE>f^GbxG|nA*X%E{uT?PBj^%QuMxoTTgciaiAz0Ca>;F&65-!r15=6Gj(9<~4o^>P zv>GwkXxW>XnBN1_inn8cz1IgFh{L=!zsx%wk>0*DzbYGqjZ@6AzPs5+9!%6ndOtjH z8EkOw64k50;{wWu@iYQT{otv7S z@~eZRxWjY^?#Q}p`95huycCSfk*}}S;@tW4^o(`^JpZMyT`-O|EkLT4Y`?-*`EHys zEMFZ|-`nP3r0NaA`X8~w#ilV_%Tk2ZCQG=@6>?I-iQLwgGH<9B>H<+IY(Pck1(=3M zt@B006N8Mgt9jvXu(?`!%$L3iV59HkUXeR9b4)uwgy9ZnceNmgvB?9GPb}wqjE4F_ z7N{3Ggu{z+J5lb93M|A8zP zR14M^an(HBhOAtuH@g%6$p#kj-T?hoO=5^kG^SigFVmhDg!V#?9n5f&y4#~ZdZ!qs zzuo3kBzryo@`@_`7E7$&Z0bs=r$m15+%QZ_m?E3p!Nn>v&2J4-1+pJr z&+}XJ6@U9|a7FHd3w9c1f8*yD4ZTz87!ATPL&Ip^2;OIgPSY_pTwgSUk?H>+1CgV&Y5EgkdF&-gBic{{?CTgxPQ_Tgb z&rY3C1^zV=D-U&z4^7Dtf_y-xuuU>qZdl9Ne6O@sTkXx|et5RfR#~2lnJ?AsG;N?7 zMPCE0ZLY_z)OKkf_1}&Zx3%s?bC*MBDXKR#c|W>$0d`Ny_iaAQdyc>n;qqIOFF6pV z(Uk_oVt&toX+UAM0qO#@aiIP>B@mNEGHcJR4U*b8GP!V2Z23W8Gxklm{SeW>9Dh?IQ-2)<0eii-_?)5GIY^dt8`xBWf*jGf)?8 zTP4PHa*}7No+p31WF?FW?$YyE6Qsm;@#@KD1wweoJGGnyaDiTs{Eb^D*vSNi&NnC~PQwl82_zjqr8^8fGc9_&`^f3IH-Uq0FY z9^<3t-Gf>H+Z2CDVPKEDN66u z7C;`kqmu<`7hLXa@0x=sNTLu?4WC29BlPpH8~uL2Ti+Bt=$Iy0l6nU#olEeecS>zm zK15OJz9R#4^y?TX&X`=TYpHQ!8KJLUzZwpw=o#7_qC0}Q*g%Miqr;J2VUUiw$otclXM84C%k**;QTk z>+U>B_ovUpeB$zdLh_w|v&+@Ye(tlt|L^6in*ZOc;r^5U|0tiwk^lY~UFk$%PU&g~ zrj3p>T0;6u#wC`?v|K3uH@ob*L0HOTsWo%*%F75sIM12XH_5bkcPZSbj9v9cs8?{( zH#g3<)%STZ;W#C|dg;CnfTk+##$Kl+Ba-y>Wuo2)U6L{5qz~`F=Zms@8-9s-k`R)T zGzi=hq|iSs5pPSv6$!S2!e}dvP`w)t$PdGE5RJN`-ODw1K+Kx9r1~yj{AN>X4X;FF zat(LBrW0#a6KHtRTApVv-dHn%Y%Y3KNk)%?M6$Y?O-dhhI7m%zo6o!`M-4%aY}V<< z2uE2hwo!aQT0;|6W}j1`?E0hG-=D(>Jqr3kM5d*>0QOVUjiw2(e5&Apty(exHwGq( zczXH?61~Wi-qSdV7sg6zYiDr?$)B6zWLCgp8-dXkv`^N9wu8SulqJgu59K35-oy1E z?zgf&+zXagGRnC%+f}V3LyUK49Z3Y^2;HZ*HC01CgQ&g%A{$I8VborTs_`F`tN9DNnSOPy2l(6KfBFFhUYu zd&8~?zu{EY>zG?{{W0S+EZ+c!B(he_X-sdPZytU8aPjf`vwwX!e1Cj?dU$laRV$v9 zc7lFJ$3)T@c@v?WRV=;o?@aNKh$O$Rl14L14Vj>nNfP@FXR}e|1=1N8y0rOf8+Iz;qYiprl`t9yj+pf(*uMdp3Hgfd7^|kS*tqxnA z_8lm8^uCHWOc?E+8XdAmGt3eiZxoMEP3c0-PCblKtGp`wh+Q;@EZ@yGPO8oGhU~NT zbqqcBTGoVG*D19O8Oj(?L236GM%QGRX|B5f7vmP_dDGTFn9MZ2oaLm~f=iw13lgF& zXmMS1)EkO(iMgB?r<`3@Rtw?1S&w2DX>l3;u=lX5H`hFP4O7AINiZkLZMo60pQx&V zK&})MPKwC$x*CEIL<_~)Taw|sbCR$;6;Zt>KtEEcDn<&zDQJ$}AO^*&u#}3x=CU)e zuzVF77+8e3m~tYfEK3)|tJbJO9AlczIavZ?wZ^K`;~l*wIT0c!_{T5E0Z;Od?44(rXXrp+N)cV zt{344p7n4p*-X6&%U!T5l1IB|?FMZXO)M?Uah8#cikVL8r1lLNF*ZN-;1VZSY&?EP zXB6^2eWH{2=JVg2$Q#D5Ojx>APJ$Qs|Lng$cvpdCldgAP#oj>y7vnR9d0U(_7 zmg&3JaMW7@ixNG0+zTfqezKcds+$!u-FV5#8pz|FL@qhxdbPQ@D@qqZ2 z{oB*7MK6xZqCb~`fK{E?W!`u<6`>DLPtGCr!Kp&k*SIVOKmTmtR>C+(lJs;FwqVxv zh`O>5NY~bu_YHAB%-!VCJ-cg|^0E4Bn_H&C-4x1Z{SQ)Vuf+jyf&O=}yIZ~g`)c>) z>nHv1F+Pv4{{df_;9_g@3H(g`zCNkf*D_jeEx-Pt)Sb^**7@4iXQk(^)vNM1?Kb(@ zx(D)kMoctoT+nYhn-^Yoz@8qc^6=2TG5#g+`sms7^+PdY&V)mIAAhP`eBGW78{K+GZOoS8Wqh0sSfLTyFVO0>Hm-M`E>T*_OQb%-3oH| zfhsaDx)|U83~9Ah_A}kGJY7|3woZNqicy=_Y{QK5u%&zI)r^nTfFE~toSRE^}{+lP-@p*=em5qRl;y=88UA_PNdhhj9{*OobJZ}7l zAeeO1qU{1gFI=yi15ZCK&cBbv`3pNGw#;nDT1nOs`lY{?L!@$MHF)(MM3$3g`Cmq* zUUdOzm;d`Ohqd?*uU`(IrfW zN=nKr*=^2A9fsH>XK(U)_AW|v7Dk_!@j$>1#5+v;=Pxz#C*0al8wXjXeZ9?bgeyDhsa+% zo0g9D0)@YfC@%%43~m(LTp?wR+N-G4tplip5R44l($=uWcPLuAIAuZ}W)utmPP6xL zJvXNOR(`utY@DlWfQp+ON_e*7XR1)`sw@^<&Gx|A>)>v(^~!L@-KKPKWo_tBX%P96 zt{Za?s0x|<5hjh!JkAj zCFwjPJX}D6$MMVMLB+)jMd78_Bk_|=HMb{<_yj{$y976bv z<}i5Qa-5LU_$|@aV$o6P2)HYrYHA<3xLIZK@cGI+-DqPSHbk{4Hug21?81EtL-IVcX3?eH^ICfgFNVCA-0^ceD{;6hr5ng2yx?Z@_C$>?C-Q@Ol_M z-;<^9mzSAnt#C!|YUQuUT~NO1@)Vdcz_t-be@rL+0?X+eWAWJW55;ON)S0r;%Ga`~|K3#*9PO7@7#RUTpLY&PrNe_RD z%lam|_$1l%&V!cA9kHnd=Lz0V$}(?b=$fw8eRx~)7!PXUAAJD|8Iv6&)Zy0h zQx8@X@SHK}1YlIOL)J>iVo{mi4rDom;2Q8@O-o#3OxMFD)Wl_CbAGWAlq+}rk=vU% z{VeY0xlmEH{s_0Js63Cy1Gs0)4f?HZ-MsFIfnm#>$)z@24cwg3F-h){jC{w~RRu%$ zZaur7N>dLIUiB&Nq4~(9IA_Tfk=3|u#cCY;6!h>Z=;3cH=%L!ze;b)75c+**N^mBp zKYf~6^b`#7vj~Q`a4P-2<4}Lb6X+>E^=A;D`YAU41I5O_X4!m3-m`gL-y8)8Yze6t zmJtGfAD!Mr8WmBjp*XLlnc`Mi3#5CAv!-ZuEL0xb=+?Yn>Q`dr^mt>w_O-cHlG zXUDzxW2dgET;-}4=$_lgVtV@VEnxYH5sc#Y^~uGD!}lludVBo!_us}4)PjTX9P>NW zQ|#75y)n)N>7mWYt=#iWN?Yiss~swiuE>WA~b zlH|UL>=5Qam;`@=ynYz7P?K}gHEh2%V2iHMaP(u&4b>VtLc>=F2jR9(l9{NAxIVff zcO%s3l7QS^Gg@S^GASa$YK=PN^4BqbehTIFd;A#QiQNA-XR2`Wy4nr!Me)CeyZhDn zU&Gy}``?f9`T3#mf1~IA;e0HXdGOvyB07esg(m{_X1M58fRu%T=QeiOufNv9d77Bo zG@qErj5{vei0_fmF+y0QyFqa0F^Zz~VKG8Dm}KD{G%EV0u=ai!nO)?@&rb>OzrdU0 z_U@qi%~_Ta9t0#PIQutAq@yj{`J>qB;Hp${a_ZpE6t4A8%l_~C)4cvaTK=ckFZcGU z>;K;V!PENx7@r4U{}<+es$ItWyfZm{7V%;}>kLj$K~fA>zx~Wj>&V#j8_(4AKpC2z zDap)k5SzSJ6)D`WbIzD=1w75*nY|JC@``;F6-|e z)DOoxM+S*rQ>hq^7Y!Ly>O4xF?w>7FZ_(&REB;o;wj7I}J7q?DoQ!A>p9$@=kPi`G z^A3weS$`ay^Y-g&>H{$0QtDL5jvW!Ko!h$rU#+2V`$5f)i;tRY@iY81+kXm{rd05Gp%j$Mc{(BY4FtTv{XfB# z-R$@pX2%z0L3%nj`a;f)zFcEk%)2VR9L#8bc#UbMX0fjCKZysVj8>~{Y2tpPP#NET zpJP{jGrG5^wPIKztlW%X*v2m|T)}Pwx}PK>bCl`7q`1aktfuvOewy{a$IAb`d+>Vr zvYP*UZ-4(u|9gzj}Vtq-P(|t2tyKwPcl3lA^ ziv6y}(ETu3u#Fzt%k=#%+bymky}Y}rRA(& zRNo(mPf8KR;ss~7G?XF<;c9D;U`bMvk;y0HArHTYpi@dk!mbIwTOe7Sf|T8xYbrV| zY<)m?^iaQNKCdGBHrnpwGTC8ca_BG8@nopkgY`?2L8)q3YH_q)e8zIdxb2(+4 z{sbbVoM!b+{=>70m|rTXV|HsAgYdR7%-Yrqs|#-^uX4Pz&MEl`3@1+~TVL`N{(YET z$TexObKF~rNEqX(N!qeNkAOJt_iTOL!ePmUy01k1lc0DK6!%^0pB8z|!0R~(Z9f0A z$qZIM0$gzZH{2iYSI_@mzubE||9gzjJm+(F^39}Kcpbmd>-lMM_`(+lw6uRz z#P!FDFx)+JHIUaYzed-b<-~eKdW8w4xP{tWENt_VT@V z45we?4Ce{qy{!%vKCqOWGA?_DF2q~{x!`y_rb$cA2MZ@!qb>ug4rVcrR14CiK07(> z(19ac*7m?vZpFH6q7}pCDV{TlHp#4zca0S@ugW>>NX~FRA!5slhKBd89crrdiTihQ z8tc`9!3m2t_n@i1AVNvs!yrL)YmFq_)BKHzvI@WkT&oUqC!b?rw;=^%p z{d=AB$b;TKdAiRw>)cZ{fn_XZBfW|HImFxr!NZQT)%n zS1+sazxMZEKiU5t)z9+z z3dTPhP_~Zlx@?1W$lXuU@mw-Uz!OfZ3wA~FHl@H3rltPVivLibh3o&!>}MWs{XclM zH>|Dyub$TbNBKPd`oCbm+))8AY)SLUAYq&^5TZL(wZH)Xr2cCzYkijh&I^d-3je8G?#>5`;q?alP%HNV{{JYS zXXuFKDOHQV5~Ec$Z-#R`AxCF#MUyLESt54Sg$r60t>g$OwI~Yk9f>*9(Lty*>1~-o;rl#X5(sNTy_lt%|@3k{_O) z{IGu>JVq!bBHgcX(@N{V z^n-T@DTH+`wOOM%(U_R7lhoqG#z;=7K%4+?YTr~joEIeVMhsyT$SIg^PB4^fL5;!^USgUH zG-EiL!1sir<}AyK&NVSzcG5vf=iG6_HkLY+)JW0OfZr1qmw)@4B4 zjB!GQ616lXmcUi2w)F)-rfC^We)(SMo|Pil4ztG6057qvW2Zl++6&=~Z&aY(?%wOc za4;O~_Tu##CV=a>+P6Mvzf=oLb?Mdc)v&EEick~6Yb6?HFM>4bigj#EeWeN*Q|f(~ z^tcHag2??sF;hZ>fEhJLk%A%uHA)Il%Rpc=5fWc!R7@4*i+AT<0v1(vUI@tvo;5%-j$`rp)=qh3y>lDhEtEYdxGQ*nC`x6a zoTPCOTEB031D!vsw9EOJW({l0;&DzWPv%s9%?Z9Dys=o9l!gWa zbg4@s9lIalgfk&P2eKi9nid=NIT@Q74f+rj=!RyQn@?EJbK4~B);a-ROh5#io7mV*_8nTRJB{@S{Eg(R5N;+CCfM_WBDF`X~0vXYbKTC=Nz|Uaj?>{zQ7KDGtgnWNr zncBKGsn2Pw0c+1|mBx$MPswUM6tMchFu(>ECsRc8lwQ+xjx#i6U^7FwT}!i{b<=o( z_M<*&F5WSAH7~xwGnz$q7_MMv(!c$1?t^p+xY|hA+pSt{LzokkF?K~#G%s2}{#B{T zZrcIN{0|3U4^gdwaV@(hT#p9JvpdCHikb)m{8r$gBK37%f{`yJYhJWAA;JBgc(B(eHi=guEwO8dsIn-Q)4N_v~@VYW0lP z{YN3GXMA=%+l?YoRX8F6ngAu0*BfzP<37l~z&^@-k{iebK(MMvf~8V-&l&N9-J>G$ zCy_{GCNh7yz`o4D>xpotz>jT2aa9V?7i~vrJ&mq)0PX}`lq*m}N92226iaftWK)`D zwT|k7#tem=Sr^Kku3jz}xPj$r+m}@VHCauYxpUDPIl`srYVWPo%p6Z#A#2j2Fth+M z7C1bdOTd*y4ezch1WC)Z2+z5Bw!A&4%uZ2uU)Y^H$#?0oTjDI7^nyu$4>XLcVIURIcWpqh!g3ll$>c?R3ZgY z{2$)QX1D17_y7FAiU@Wa`nXC)Q;@*7CD)ALDB;L~G4>pRl?Zr?3c~XuW4XTtwa$Xj zCySCUCHqg`@IN0sAosP%wI=_~ILp!wnby08zf9J2(&Fm%Wh4{6ufM4M*@m^uAFwK3 z;NI?`$|hlTPv=m=iv=q$E8e-U)~3~K#+(H0HoVzD2>4N1pRz(-fTd)*v&u?@ zGp;lfrV;Q)3pSUUQ|+A5PbbeNb_}Sn-_VT114VjG`%r~acW*K)dZ9r>{u_DVqOvBb0JITf5%xqH==>J`D5Kv zt>25UJ}?j1)uu&vZ}MNUFAfr@65faD?~KRpD#b3TS?>^PyX^`6pCfX+;K>5Q2I@`11SX zXTSgEpW&}3-yffRfBfudeE#nBzdwC`^!uOp2J~>z(f-But*;FK+3&w`%|HM4>j5oX zZ1cU_X+{GKkzs99$Ha~o6w*I~`g3IrZx9d9g!|g`8)#yGG z*SC#eE7A`6aJ!Mlcj6){N|wkxXChT3WAp~^ki(OJR3c+ak)^C)%d4tn@E>`lIxQrE z_V?4f$EC+6jpQfAB_D6WBb8aXUZt9I#W?<7->2o z>w&9{h%XPIZnA>YE@{0!6vU#ydy)8QfJ=Fi51=)=N}}jqZ?j zzC9X&{8Q?+oWCG@hbg-`R63QF-n$1=`4;0=>DayR_tGs~Rp2Jd+&aP z#>Ta{oxO5=@~k_WBJQ$@W^-9`y~uZIq#nCQE%XV>wvwqr3dI_81Q=>}k?Nz=>)&D0 zI9F$(IC{jB0v~T}%>TiQrolQbrOvpqKK`L}YW_dv3PNmp?bu7EwfDkl8GMP>NKUUE z$Es^ykiBED&&H=BktrAR7sL!_l(L!Ojy)F&Vbr^nm0(8E?3ON-iz}*xqYq0xO}j_Q zMAfstV;DuxD@diDmka@WUU3xq1ok}%?qwZ3`z~S?PS#q52o*@HhU{Ig2)m<+#-KAV zXMrUu#n8GkFN6UMQ`=TY$6G~6Jv0Azc=PPgpO9hvfD2x6KL$|(c0fUr{pM%eC@2e% zkE?v}!c)d=@pUqf$VVXC$NJ?{AmfG==@`HR$4^-fKh83Fd$Op+HB0STzXRTT+19x0 z7RBwwtCO*j6d9-9fSN0&*+y-=rMM%=cE#!k-e*u3N>S8AjuLO z%^u-h{(71zNfdK8^&IpO21sclSrR#$jnysJ$-;=!k^!KAiw%WoJn3rPv5ucA7bKwy zTs1Swv#MljLe8PWBqTyXtdCL^6ije$bPc~`gbBdzWaWD1d-yc2Q|4SRswu$uH9<8z zA|;GM9X@~dtX(1ON)PR0+07ZDo^Z%KZ_GMeW>hV96xFrfY|W>3If;;B?6BwvaKZ;= z-z}(K5V#}qlEubCbaaZ*3&6*Uq*ak&TBU0f;1AqE`~KoJbkeCmJQUFlb6{RUQk5kW z`Vyjvb{ci#L#p&^z%SJjvYW5yi z%qnJGoNiksvy$fUKDu!mscCq<#%x@l8BF5mO)!i~VGcyEy+=vGj7BKx45GCTC*%y4 z$zPdb1PerwLKu-T8Rc!~ajO?pkf%pSWLnuTFd)Z*DnPEFmSid`2>iC#9F?MTMyAUR zMCcMMA|*N3d=44FTGQm(*tFM-ocwS)es=Wi`S|Ovzy9_Q6UYT}e26Q18-|X%8FotH zO29I739wHZ$Jb1WJZI(WPMeWzy%l^^X`Qh{6U}c}GmR4R5S+RM6vq$ixX+IM3RbRs z9JO3u;-Y-MIPg^7ipNOsFD%@)$q{GoPL@g5k+HwCEed{sMiy>(Qdyi0JlNfd(CKCI zHWv?$kh8;gBry}35I0F8ZIZG zR=z3iQC84trHqKuSk19pw5Lq7#0U}MfQQ_bk=Df|r*|J5AwLwX{J`Z07@8$$SqaT^ zfDO=G%p2mXqtkA|*1s`-t@#Y@nD{j%G`Kk%LAuc;u_>j&yC-g**Z=-cn$!Rn?B(}h zY+p5OpItL1_3$v$+7D~dj_s=Gq!r3amV;|7pyENJ|&AD40k;@Yx4CRZQp+!1J%P&lR!oYa>!nr3g35eJQK?VuVm=x5nxL*`*CN zwi}CS`h#y5I-;0of1(S%%H}nK=dcIfb^>IW#hU5PD zKu)w4liH8+UhX#xBz;%(AOXbhn9H!i_3NE!#%!M+I1eu+Yw_Nl_KNC<4f}FU7)>MC zku=LD$MVnm>kR*Ne?$X-Kwm<|IbMg(Da!p=do}A-v2ljnZPzV7gvgC6v zFnI`+y5^lEC^cqT0-LY7!#gdZuiLPOctCIsD~RPp_Ph_ zY>Y>5ux8T>^6dA&?|#u8OGgoRF8zobRtv?tz@LJRz9F`ZIl=0}J76fdIrsvZ>g!)8 zQ$^h5=`2>3U%kHU$5Asc^~4a6o;U*XnA7=~(^)@{Ih{Svf4;=Q$DGbDc4;1SI{UwR z%<1g<@G+DLyAI-wN$6;oS$IAU0gnagBgzu-bofg*Lo&H0!-5fw13^XRrWf z-L_{8*4R`tKFL*v@ zsoB-AFF%rf^9n?wR@jw$eMI<#O~~`3qu+%|EGZkUG?bKF^Mq!$t>53>ZR`?s(zpzh z2bCv1hlefvd7sqAH`qjcPPr>K+S1-HCY#*OV^BIdy>t11&wl^B{k6}Vb?zp1-?Z}~ z?)*+EQv3SNzaXIBRyj$TrabFZ${c^14Qcb~eLZKR@d&BOg5EHqXwG2HE+h?vwIc=` zfaMKKF(87GW=tqDQ>Iy&*Tv89UcO5V!48J#$g^{Ip6&!g{^sfA=^rLX8~mL%q4>~l zszcMs3IjEnjAQt6j+CvpNLz~zRPXP z%G~^|(`{`&wQhj0^qI9~@(SFx2{x%C3v{o$S?z_5{lO)Qm1+>G$^r z3VZja+18ejVZd5##sRcs8Za7lCTVIbgqAj9S&fLQ46`cd5}{eBtV5{Voi;o!PaQ}f<*keb&Qxy;Z&6% zEasD2wT~ES8~2uKt025Kw$?4>>IS2pZv&z1-&RWPy3^py>TXI?T@Ce^)WufGUNakg zZ-k{>UCjIT-jiQ-MOe*qCabneiE&JEW!vbo{#-wwz78ykTRX-bVyf5{8#hszwB|ws z>GYOzy`l2)=BmeTJM|cmHfL=_=t|12oRMclu|$frSu6I_*RvW{_r;Q9Y&m6TicG`? zu25y{2LxhH5V)ZJ<=KHV9MIN< zc-byXz`|UG&;^&MN$+tnRAWy|3}wq(f-9dxlK$P!@8Dbu%%38HM#;Z|Wzpy(mjoMz;^ zcgH^-|GUNA0JJbGrAB1N#p(-~pIdXK@R6cVY@(QU^GJ#IfBh&o4 zo5MqZLQ5zu$rE?9JVE-n!^Kd^D9txCGqx|-?$`q6!ag~A(kYfKU@duVLs_{dl`y)e z-JJ@I5D~cfn~K(ynXev5v-&0OTjcXG@WkiXzYS!bmln-*7d!aPriL5NBwsilPf@B&^YpOLiM}m&6rn-jx*8#dfFMTkcJHpTT1P*h z)d2YgN^48@&mpH#|JbpmeYx7`HdZzO0QFx`)e^DI%HH&bx3;@>OJMQ%N))bF-+I5* z-POh8cG$2Tkg%W0>hE;XcKkSFR97W?mC^YI_h)18yb4~eH5WObXJGhZoqh-F1j$~u z@eM|4Yb0;yMB5{G=Tx&>y6l<3#@+uNep;7DUb%yS*m``&Fphs8oY3|h+t4gmD?vJV zD`?>))+y5Mg|-8@V6*!;*}wCxG&D~Oos~4F2B&WO{9ukkX^KW>Y5g9CBOWhN+Iw!< zq3ykngS8*Bu~FSRz0=3lrW^2xec>8lrJ&g{29o>(?G^y8Rp@b0gxPlpZM=j6b<-XP zj0Th!sn0CB;iax<1~D5OBt|#;n4Zs}ocVqB$FXk(wb}Y!q&YKNI2}-Z8_I60`wcN2 z@U!qj#bvw78&;M)O_?xu7Z)kN;i;hp1g6}hw1?2_u0uJhA( zD`vW0v*jUrM+(YId)Wt>z_r=hb-_^Sh0#kATq;DD^LK#@mR!5V0(4dCXw>EB2~h~Z zz+l1{$&fab$byZWF;a4d*$;s0-Ib{b0UZvIgK!~OiETMnU<%`mOefcD85OK(c*Qo; zr%H6@6uS6}T`1L%1BKyR0j9J^MPD%%o2%EOKEc_AG@IE7TeHC)FtW(2i*X0>se9dq zJeY&m;Z)iPBKL*|)NUC(unHoTTT!%XXm20#T=3pR-vOCU=Vv~3*Dg!RFt(`YI$AgI zV%A}gy)a&h;xKl^%~P5c3;J}gAzfSh+f}Gex5g4rw70gtW-PVdIK!bvJGicS*Vps}5Cni~0f zrz;IxxO)`Yw45_v>B$Dp#l}hOe(lUa)!_p#U5{j(QJ%dkSc?dWThg-`d1adcKmdDa zta%hU7-krP@BG-Sp)W06up861O|oq0bXHL?^H9M(?j(e^%;&u0)9)B}w!uqCGObJuzbYq=@d_(ZwZr&41T- z=kWd2)j0q(dA11d7i`g2_T1Ol4gt2Xzh2Ag#jE9ESrHbK(-*xFc~ zv&3g;qFCSdpV2Iv(&YN2&d&T9ONx9f;vN!b;D0O;1r58GD4 z0f?5%w`Za0Q?i8do9!{Fe#N&egp^Wh?=^^#b{EXdBJnqUD7k5gj#&g#u8r`H;3dUV-1MVjfG!Hqg-V+YnF%Ul{(+f}KXo(+2%D$$aRDg~<(u`q5d2$Bz9`8Be3 zdMift!;zTS6t&~%dbkIxGmqf+^uj&{nD@#=4i8y(*bn!MQb+$ zfsGg>T%g zY^#10oQ2)haXB6BO&OUp!AdM#BhoOEEhMc&Z6K#KX#)#t zPPewipZ?D1TH`u!&V{4h15LRpa~;dn)bYfjo-}?89nBIPpCyUxhLVp15G8K5eFZF< z;aN6dk2jZhg^qFKB(Wtlh89d9q5P_8Z^pjFxXHHhPRQvUO?1{(fx|sgIA^V^xS(`d zCE5c-2`R>cXMH4yUod=Nusrz-YmsfMPlI;f`Hurm3^s@1iI~X~dtXc_I9qrEW{cUV zK-T^_lfm;QXi&wzx((B~CnS$yb2B%4#;ww7(m;jjuV%M0n*bbt&o1nTYt~ Nla zm#H6EqAlqN0O}3mgmsDsOn!}!(ceY|XRSVi$<*y`Uwy`;UxYV@(iu(M97rxT>-3JU zKHG8rMc7e?cyJrv?utDe;0NpS>o0pWBad~^391S zkndgT?2X=_o>rqBUl6yk%#HHq7Si;APK|mj(T65k_YVhctR4;n#GaNmka6>A@`VXO zVpryE=LP8M)4a_04XoY%5*f?G#D<8~n9-S(*I-etF!2{gz@eu|gHUaM0Ag349Z1Hy%ONr{vL`+ZndgaezAp!L>=LY={?7g-F=lwlDG1BK;>U^9J?!QK zw7ECx6q+c0A4)W`yMiTpz>1PEPEePTDi67rI(}LY((^z7n&Q3JV0aZ$am{a7wzNxz z(TKX!J+S(?WhPt@Sz3|f91@%OZy!nk8G0OyEMUuk?p6l6ZTE1c5UCa6a}}fr*?7dE zmPdE&>FTrSa#(MAw&xn_=|+R!IV#pRGQ=0dbxv3w*>cpdbKTz>)yyfqMA~@VJ7}Ni zej?o^^|L+s906h5ok)QW@ZidCA#VZ4%>4we;U+}<_g7cvgSxcrfvPCz3_j(^oungF zf29DBKySYQ}J zvpEI4P@kq+RvA+`qkT4+Pr^|c?r;M*fO@{BZ^eeNB_UTOqxua8jJjiWniqP2mT8_d zsCR!t6=G8fNf?wS0PPECGNirXM-)EJYdh?#`)vRc@JGP-l&ETIvq->~?Hqp2uIemU zviS*=+W`)=;QQg4JwD8E*S&~}8>B&=;lm&*U2vUH2q0Z*!rTKy_&-nMe&ohR*M%Y_L`ticBB!xZPR|(=hPqj@aG& z+;cExCIoQ@O!fjioUuYq+QK{PES4BdBGx8{B!_2&}N;gQ)Vr7;iHN$SB} z*?h;(BB_Pc_ZQY%k+)64cS-Edgx~hZxdI%pn-t z`GkufP9<<>f4alvGp+llU-ZIRS53fLu9e+v8#v*7OVPTORYpsf#1Gh9n7bYvleI%?OZt9VS*+J>+)qvD4Q6&g_U5sL)HSAm4cD_R zq5W=QcU)-;7}YqA9mon0iKT=ptgklT6@@G{1_BQ5x#>$`YTbWQyKe^hM9DpN`LOFAd^$4sx&{}0 zfrC%Z#Thsc2j6ye1rgFM*V6DGQH}p5YiiTjQh!#CUDt?5i!JM7wCUj88#;W4qgPMlPXn%RISI9 zZ;{qXEOP3Fg(N$@TTrO8d?M3(<+z`=H*32zDmfJ@L#QfNmJorQGV=AaKenf~&&wjg z*Dg*k-@U&$IsI_@*YA(tUtXQQoFG1=FZjvzle!Zm-21o3KOCREKK}FT(+*;_FDnlH zuRex0KFy?uQfp1F-{(rgMUqu1Diwbn`!8A=b~pCHn`8LjQR7b+%9*hWLQ$jXPoA`nXK%5D!YIAL!*DWNr zsxs|hfBPa`N;aE#lsqkErY4-}831tc^e{E!9Tzgo_}EAb5Ef%g#PQMd$wKFw-R!+g zvx3~Y1=uIyDHD1V)MqzD9juT8@4tAxb*}2K8s}jbaD*OvwiR(?r1u$B4D`gC=penskTFxFUbo0QEisPffqv-V2Ivgwj0 zT+Dm&yRPu98ce57+=7&(J7a~x?ty}RDb;lI$z)dciW!@3qgLI6R8c7{^Q(ltA?!UoV2G>cLr3%YIJ_Iey}Y=^n+=a4w58br{lK{ve}jy zRRwKT)?zN!Gp<=lv*-k-9zV!yY|cWFV;V?3^B5n{d1-bctK&IrlcQz~AY7EWi{PHf zizsufTy1?mcWh~KhYb4EIwX$SwlyjNB z1Vom5VK}d}6&!i9texl2X14esqDZ;|LI_ZirWV~l#hqkqo*JRs+ScYcaeEBT{!LazuEkLKXz&#=8?QHr%QH8 z^CH`*l*Uu@U9+iXJngw(=xdIop23#ZB?DZe~3%##id-GC5l2 z_O1(F# z5z72eI#Uz#uf37S4Qu>%&6ay3i0uQ^S{p5~0oRW_;eW2p?)@vXX0jx&AdPQhr_LeLPCfH{ zglk6i(Vk>MwOm4{PZ;JXuE8*+Aj?M9ky)vc1*pKa+T5bCa?MxH zbp`)kT_UXS0JV*HZZsqc$P3JGsFRDAxWSa$&@D8@AJN_zRB&{I89&X4Wrm#W9c6PK{s^dc2+HI47 z7^>Hp{AO}dO)^Fm@+-zJ3?SOf5d(PkBNAlu&|k@NU3B9tmIYJxIME9#!b6YMyVwue zj?YI2cAbH)(&mCKQ3&|)egq~T5nrF)93f`L-4sHAu_lGcWi_n@7?5V*Sdeg|=H^wb zYdur;zc8R+*TchRl!yKh(h)wOyZ-h z6!g)Zux>u62-&M%J3{SQzV@t{rZx^^AER(_LCt!Z?tC(Fy?D~>LzAC>z zEa|Bm3tdeu(n(XQ;uh>_XSGnH+Z?b)PCh9~KAIVQw8@Hfy$M36n~avOG=6LEj8I(G zNv(GLM%5&Hz|J-s1+|t=RK2T3z>XQ8v1FNK-W99-S<36v+;F$CnkHt@ z9b*8XQ$HJrvV7|g2B#kPb9r2veco39j||R?2+HD7vZ!)uHZx7>G-Iwix82aQkNOJQ z1ok2da#y?Am$(A)_FSTVSA&bA`_rK6#Per=_~zTrmm|Zw@!Z)ZC9NJC?9!r?^OEK{ z1X}ou;4-9VeFS>z(o2dbieyGriKp;+Dbp%}s$0GacM_&!fpTV+0KGQ#27-VElmJEp z265oe36Ls%Fdd-d2OvML#S&&@L|(~^fi|ybNrh%CCCBGy{XFB+3hI4E$qCI_hWYam z>_fu(wr27+shIU+YXqFvS!0n5Nk*tkkN$K#{vUMwkDvGLKaR$K{4jd)^H;%t{(SJK z&Ba086UpzJTzsofgWoS3Zm_^Sw$Uk9aElH0dmn4O7uQ1G_HZu~Ro*?kG1)Vnb^}(9 z$sUZU?=3r~U62-D+o2%2vTlh`Wgs6t&wnIn)_t5wIbnA+FETbsWPVt`5hsaj3#{ct zug~p|a5%q`l}MrckF}?8!sTJ`Ys`j*%u2$wPX*(O?59FKefsSAWi`bdgjcyfJowZ8 z-z%Cy!rfb%vsby^>}PXNcv3w5CUO_<|Ac$(=l!3?_FrGQKOOvO|8JAd-w(br!wh!t z&p(ap?K}DTtAjrUzqM5Qbx(9KTz59kxVL=kxXbXu7f@n!ykG{~bAi#B>eH9RV-CM7 zfA(GR_VA_H{k7hr2S$g37K(DOBrv9aPHY8#yd*HE704=Evba)Cae(pq7LU)*>=|d90i7;MSfPzJ*EU2KNMeljv1ze$ zwK`a{M>&mMqx@4Sq+6(>kxFPUncN-OcL)#2+m+B*imkUuN@h(PF(#r zhN*Bx{y170Cs)L*wwwXiwhj?IPbD*ou&+fC-tu_^)Xk%Bk8q*CX;T7ynd+lX&gd#q z-EEV^vP1bf?U2u7f$ZA$xUbc*g}o7HX++o1^ZR{9kGUPf zgZj)JQ6IhLk6!afuQ_@2nm>BYAHC-5tvq_oAHC*{w;sLbk6!aH$$G%&(QEFXu33&Z z_`f&4)=q{F0(4BhbtQefc;gGH%1q>GbH_l6IdZ0o`M0>Oy)&gogXJTR~G_81+qQJUwUEdr{ zp8j!i^c$O0?s6DYR%CLSGojU_D5aUZ%WmZIH-1SWeyA%YupH^RpkGUpD@{IW?!A zqr1|=#w-Yx3+Jw1tB;(`R#d=hjs4JlDx2}*S50I{{2NQ%s6asiD1B>9qO)JljE%F| z%YwP4-lk5ZxM8KS5)(NW{2#t;zkFCRkA}`@G(q8 zz$TpJ>2JLV*dT@0jyTu`1D3~Z3kUxK0qbZb_*L+jT&I^;KIJKNeFZm5ZR=yG$;FI0 zGpLj~dI>~YNG|N16DGr{YMOJcLX@f1W=}v!1p&pYFPsIQ(@(rsU>T0hB1ElLD0)|4 zUeC$1;xcw=*W|!u!IA*dSQfP}b0KeQnXuB1y9*0UN63o8{W~B<&$PW|ejbRbdg!%a zg$rs2U0x?-ZJr5?ke0e}%a>&o4KgeM*GN!5w8tMQGAcIdE0AKOluS58w)?F*vTzT$ zePC$d+$>p<@r05@RvQu4-T3Q8L#MBhDKmpe0FD_v0lK7I=z7Y9+~l$Bc8JwFjfe^o%fRuE zZ?qd={XiQe=Jq${{@18`CDm-+frh@~ZNS%8R;XTQ-(Wj*sd*~J5S$Nq4xz~*ok^w^ z4^6P!7M62QoG;cWmt4%>gDBsr9}ydN>9-aH0PrZ(#Ft{Qm6!wOb|eJ%!GDYE1V`U( zv&Yv>%jw-^RrdL(35cKNyIKEh<0w{Je?JludpPp`6%@)uT%CIB0drx#s4dZ#ELd7) zEG2X*Z`kG?8_``ipVkionA^^&Aatr^R%zxs+h=z#$nOsbD9{Bf6Qici!O7%?1#^J+ zo*w;66l(ny<|PW}PCYX0_=euS7xaem3~ms(A}v@q&F6S!z|eA**s9~8cm>0rE=egX zk>W0iX+Nwt@a*^h67$I^de&aJ>l`d0pcus8JU{xEk)o)>0&h-$}Gh**Gf2-ugvZe7FCz{>GPw1S>=fd zd1q88(>AmT8G?{yd(E?q^d1Ise>Lq3s2#vMH`eH@k_F^mTy$^BZ z+bm?^oQ)Q*4<`PMSZLkZW{&3VKdf)Bhykoh&UU$IMU)qNw1hj=bU9iXUqr7PX5gjM zOlFz9ML2fz0uE%uF;EM#C~@B+&T%e&R~T`YWgyN}n>>r?4s*sgEXe~)yvUj#1Mkw@ zRatE(Ovni?;ob#9JmbB#1nK(OYpBC}zCMwm>HtkS4x}~?$+f+%g{{8uicwvaZAy70 zp4v)VHU6i->k2e1t#1HX)uUfP=~uHES{hG0-cTY%!n3yAg3bu7?ik5=StO;bbZf1H zG0~aod8591K!CyaH>WhYW+K&@f)Xd~6=M1`4CtM$4DTePhfCoa!xYy)r6eQNF@|&EtH-H=TytVW_5`d z+)XoDM#53$mNNom`z&n6aYt4yNk~}$M%c~!e{oln902n*#qLX1jY5RoRBFy zcW$_d*}V5#H&Zk*tZ6|4LEFuM=FgR=Hnqfl32pE8jCX3n`?O>2r2GBJFh4Au< z>~mBb5emyMp8J_9a?7%;QyceE#Z7i!9r$CacEv!B+cMCo%$)jg3%dgtWM*@Fb`oKH zRX2wq(})F!-f}HbskAjuy`pRE0zb!&#?1yKT+qU7w9@F+Fn>^$zS%AX*0+Wk+VZRztktanLqISuGDiOOnk`3oQH_=P|1HS(gtp9o z7!gg4to&E^uYc=WrdVGz_Sokx8S2eAg;s<71DGyQ2s`wZ_9q1Eup$PVExvE8x8UUn ziwl6ce4*A67BXro2XE!2-TfnSUa}c0>%YK3@m8MRv83wvqC`7_u32x5+o6>G3tM_9 zLm<<ZWdgXI7L-aJ$|~;%l~ypzj%;VAt3?NQzO-k}g2<^o}d7{;LJzllhbj9E?TS zlR@u69JTq+m|;ZI-3@Hl#DC`|9OT+kGxR5llnif~)q)o;8YQyAGN9%8K_j;!DSfeUgh*`0}SNw)%w)Xoi&(egJnABoJWRwN+q#*i|h?2VgDDun%LC_Q~ z;CTWStj+G9%l`VV(Mwx%_@%Ly)84DLp=*4#+QDjKb-_w5Q_$%gc0jQ0_7No2?ug#r zzh?vQe z-LR7EyK9mgp6G)K`5&y58$zqrACL5CH~ofk*GFU@nhm{~2dS}M(YN-4!$^P@-h~6EX6I-jIC>hwrFUWhv!l0o` z8+SBuQ9U0aqKnbBh(P!BhyT>*?luevsx%Gow>@jkpq(KWY4-#W1=hlw;!V*AqH#Ju z+uUb=pwd0vd~3n!t7M5;;1ih_m1g9^`^Q}@y%F$9UG5s{=CuOr^hSlcXF~*Nyrr5` zLFa7jCqDM$QkxCdh%z1-<-19(K7p3NMz2c|sm9&I$X7?@Xc0}^Pxx_f_Oa1EE9Gh_ zbJf2vq?tIFG9z`AtH4B;d+$3E!^`ktm5cdd@zyYxr z)0bUkvU)9dT;84uKAi* za@L$yA=AkQ7K;hlGHsqqNQ5m{^<2Y!u!K3ic9&^BFx`74`;}Y=9}vaBWQY}FW7l_0 zcw6+-on1ilWFZw3&AQ?a+S{{RiZUijNwkWe(dd^DxLk+pLnDBBP1AtVftJ{B(3l;E zV^dY8gQSnnis{Y^GZMKrQW#4u@X%^oCKz2T(Hgz)2M7E6KmFy+cUR}9Kl6is{v@jW z8vpB``#-VMpCcPN=uRBpI+!DV_e0@ywGz?oV!>!GD}hC|tsYg!8CW-G*RJ}s$`Fa$ zS1$MGkzId@?0Vrcw^kSyO^r^5b%ML+meTiN%%t2Ht*Jc$Jp+yi*A27GZX#ZzXtFzF zJaL^ZgR6nAo4?xcCJ7Y;ZliOTs5ov~%k>x&v`a8}*bd_twj+C9xHW2^PiwuGE%;-z zDSP$kL#TZHV>Kbx2sY~s4h>`ZmsR2cEWv7YscWql&!~~yT1D2_+a3`r=xpQXot8lC zcJXsXZ4JFWVLXr@1**KRXbrh|bwZv#efAtL_#vo77tUZ>CWD6A^yW2Tqr0?0wdsR4IFldFGy>v8yz0a zBqf_eetNrO8fPRJ!+Mxg2C-|oEqrBz<DwKJnCX5}KFOAr2$fhUR|MRbXv3Y!7N-8s2QO@Ha zXXNRC>^>U{5j)QQ1V5J_Ytv&l<){IJMRW$oWPp@wPXG{+z&XG+`=FlLatd}e-$Gw5 zqA~4;|HH@gr(Q5_*u)A-lGwnUDVt&SOP|+_w*%!hM(w05V;vW<;d51I;9)YNS<#GE z0>fK^Z{2Z64&N73|Jt4+CJN|9v2l4~-fJX4zx#Wp=k))$w6B(C@k zs|VnL%{0AcSUs9102~w`apxU3PxX^fqY%Nmqdsj97Ou*wh(Sbt%+tS@0A+K9#dxha_@g|&r(NTgIK`wj`+pntAWEtD)u;!+4@%3T zaJMn;G;s(bC`dKW*(5mcW8|dQ2%vq?g;$9t6cYho;lI*<`FG1D&!od)R-~e`o>J9)1 zY`CrZfB;+lR^H#WE4S4npx`5*;O6HMP|!cW5ViXeQ1B5@@DWh3{doiwTz`Juj*3S> z!AC&Bp63xz@DWgO)AMTw6l8b0q(8{4%Gn!PiMH_d2ANJ*zaa~mrD$S7d*lXwBsu=t zYGTneCHq)>EL&pCBN$b|pj3>WflSZl+_APg~8WJsJ4;{1&sf*59>jS-|OG4pH?%vox zx(djUCjDk*z;A61HDnBSw$scMoia@c7v$;WY0oJR{a>)8DiyzB7mTLw!2I_I^4aVh zE+{j=2Gi0aKBnt~^{y)zwJb>`d|E>17%Zkp82e_L=+u*<_^K~?v?=g?Da1M}^sUVb zbu!`JBPuO{cg5jvaMMD&W9PWhP>>V;bX#)Gg2az~xI-vOqaGO}o{sVBR$eCl;4wLtnMvSm|xMo<@eV z5!XjmMIlS=Vy|r!6v)P)wp71Es|!j^_wrWH${In^e;(jxon66^u`kON-gnSVgN}v`1BU~) zZWP%lKxZ<9s}aQH%x{!?3w%{gA5yuqS{$e>wQlDb?1^gE^P*+`-X7VOPm;)R+=zz!%HdPis^=y z9Bl0XLF2#d|8RWq;qCF8(*saJnVUh4jv0Ktvb!9(meTdCX?$+ExU3Rhi&>zZ8zv5$nlSt zMw(xTr9Ux!I>frAo!wklQcNMy!JVw$QGRA8+ObS{6Xx3ZO zPhw<41H8A{HDVaW_F@i=A*}IAmhRKTl-(Svls+B7Fmc_ND|4cX>^<$t-7?RmQ=vv7 z4eEA`z;hj%sq7u?fw5qEPN*Omvr(K*Ff0)Ts`sWXE^Y~*_}kAIClA?zdtAE?OSP;R zT6!~CCf=;GZVv}8Aws8j#8u4a+LnDTBlBPtj>^UUaZdjs1v&lmrEMtUg7=FResRcSj$pm|f6uKP{YOM z2d(FYvA+9|(zjRsU#)24@mks&4}!F+(eF;3pL`-kKE7B87oDdHSrZ=S3u9ZOtP4t= zTmr<#3lHxR$BKq`l{wBGQ~G2?@{-xgRWFF*Vm_qB%?-W*7_;;R%65XNX8nPZ^&Z>D z`vu`Xb>TXgC#sk}n0T*vzi^Qjm1JkaGG4{CI}vWb9!eixyP+ie=C?z*{XCe|H)H_D zTdT}bQu*SZDs`-S8>e}>1E=?;_ZMe7(awyN+o^VD8r-Oz!4H>+N%VjU8g#RTf(GAh zsh}A#|DX!mgPWY`e}*kah+;{}^k6lw{>&*w9xxn#ibG7Xu61P@{?eWr$M)2K_6?i= zh4rPxM+<6@`@`q!zH-yWV+{UGdc@Cw;l+u(n)uzXxiQ~Y>?N#N%yw36&$RaHvUyo^ z!ioiXb-6*v+5Bf(LRexU(k=i}3yP{V0@N3xJ4lVWa^8K;Bp zLNMi0a4pN7m$7o~LL9AQBl0HrDa4pXj zc~>CpHPpg^;0qsY6QLlNQtA;YDFkxq1;wp1tFjE&*KqbI^m-qD29(1gX{8rTXl@JaSgmX${o!ip%VF{OB{4Y#C$C*|U>TsON#6{Y@WP?m5Xsu~7*}vJ)03W(V zoj(Xc`)r_AGfr!O-GrSCa}L>&ZRr`pufaDY3ufd}ay^md{62wKt9+L))!(x*_B1Zi zn(=mE-+hh+`aZ95Z+cb^0|P3(l_z zXh^iAIn%7PbxSZsQuJ#Ja7*>BVB!));G@#qcpjDJjnAXfTt5#U9Ow2kPmQ5%gFWkv z1FOk=e%bkj#ke8L+8bI#tH=I}6&2Y3IY3G6_R`7%0Ap~w;)Hgf^I1VTI2tU1*@C8< zhfi+)GUd8HRut2uU}esg0=--c58n;So>A;08DGIXXHz0$bzg z4}bUr0{x^c;raTD@Ye62Mj-3{`|+FCkbF~Ug>}`jXVXBVaWx|U{qo&g$F^$aS1?FC zdHVYeJh6$+&g(E4bs%>?vh)f5_yXW%-EPxRtwnh#f zEeNOJ3K$`HEcE3~gNVDLl#Q?|(@cF=%BmRo+b~2mfP-URTbYvO5kpNoAIqh2s`DUlJ`x$Iy*9{5!wB1N-uFbE z_%_Wyivsc^pXZ>*=W`wR_?*pFF%SY#5Gq|xR`(+g)z8D9;P^b~IgZbe(;S~+pqO!y z6ZmYmkzAYw62*#Pl(aKXaB!j0A`l+Y`^O6N6(~&8!O$kc^8g0Ouo`vLA+Xw5aE4$# z4-oY6Ee#TfF$N?)V?*AEw~BU*gVixcxe-1|5KxR`E#9d%l-;*;rhPg`+9z|OZR&%&A)Mnr@+rv<_N$>P_Yy~z#2g%;$2%M&TOfZ&4*ba7yq!ZZQ9Rz=q&V3> z@u(jzD)~%kR?cX`4gxn+=iFJbU^y!d?QI(lYQy5Hk?GR0DPeb-m7=G3Q+)~Asp&*J zuAr%%`>dcY6CK2DXS6#68t?h)V@zNc1#si99Ei@ zV65UBS!MpPvrMiBz4P^#yB#@fy=_@_wuIYFwU5TvOBr#%5=i#Z9NZ*o@5LM^Vj#HX#72)Sr%bdHT4L0=%78~ zkd=_(xZy=d9SB`SJ;PPbjJ%FrA*>=fRxUM$tZ>vH0g$)-Ab=VJgj?YE$BWhG^LVkk z@p-&ht)B-EcBvt1X@D(?*L@X+o%z!~R%__VAJ~x&>pY^zT93*p})0CsEJRcxw z2C&3-*W2|3KzC)z9yVjUHc22DtqaSG)ZmDU)D!za%DeV-Z`H%&E&Jmw`{OM;S>3N^c!h3G>WnLZif#y{UV&n#(@)TCZaH7p zViT>IRjh@;z=~1Cq}}WFy+IJ^>43^XdEW7jD6|=2&TgQ=lR6vtl4VB!B+VFx*n1S2 zzQ9tLP;?uE|3@UFQ z2?m}34!ZW$_Ucu%@T`?D514BS4M`&(MO!tKSWp%*ygydY3Mg1gvyX zX)Dm<>a)8CYlvWZ3BOTRbmpfq*DClFRBKj>7vz8L|Lu4G93T8?fB&bW@gINw-TvPu z@Q<$!{&et9_aDDIIN0C+=`U}-yE;GpnIHV~CsF0s_+S6r|B0Rc9NEah!Jqz1^bqe^ z{n|Z_SljNe`i!d!hd53D0k_3a72OT)OVrSZgvtE^1K^@Y1GjfC`OdHrTzk#bFwOEp zmb6@w)Orz@_kfbSCpbL}G38wXHyS;TrM${_jvWWBh7`Po3M;mHiwj<|ueq{dG`U6- z&yzUD>)I&6vA1U!H00Z*L_h`kIp zY-oB#%^2L*nZj@+oV)R>DS!ekuFy zi`Dq~#9CnH9 z26=m9^FPjM=5A@HY=(hi_zgH3RClHzx&bq$A@Pv;Du5Whmdl$y?tZWA{W|ZF%k-cD zBB0PAAQ($A=P|1XURI)K*wX_tV^miqMp6l5ZDqdnBDm^GW>x}_8B3WHC1{}*QiH3A z7Bu0yH(5iMG`WUy%_XxV?H*QgU^7xe7HDR7>P0E5`2rFY@vS7I3Uf-k!wxpKZ5efCY4l5=1G2=5e6GRkwZuNWhzZb#rRmuM!TQ@B4!EsXZG z7|0eX#{9)Ow}Uv1evB>4yc>ty6ZB+wcJowa2@#gAt{)SrtmA?@+dMu$Lm#=X|7mut zEhq&)Sjc6MWb5~PXS?P^6Hw3jhNl(H`p+^myOYZ^?32$IdVI^kNshWkE!x~j`C0@! zS8(X{mU6ZZdz|YnT>^r)jf!r>H@Px7*nFScDtD))Wtr~z9)rwCr~nNct~dII>)J%89@*<;p=fOlj23IP<{k{=ARHS2?8BRa{;l!pB zqqrCpczET`3gN3Q8(?|-cN*WfBaW7N%QN!jsG<$r}%Fl&5;=qq5E;=t1x{84kzM4Sr%RG^rRg=BkV~Utg%L8iw1PmbK9-V7Xx^Ro zM6AK%#{nb>)Gxrbs1l>vOQ!YC_(EnwItRG{(E3Gsb2h3zjgYXt~4~eXd>RMWxuR%0PMTCk7Q**1Tki z6iSy>0;@;Kw3OFO#HLTJ<`UGA+(so4k|YZ%=FEeRkesH#IDheGP(KZ%UmiL$h6UHK zPE(^PxjWO|RxW&IgTH??#N^p7lS6W*X-YMXOAr};!}x~!Qsp)%3+NmKYgrA%*+a76 zA%4sG4<}LmfB^)g1*AxAIM&|j!%|~%jZ5q>LvTH!q-7~dt7!LsEv;iN9|!sKjmG*= zi*Z#4GbPP@g^emTUZFFgdC3CYo~W+uI#vR=Q*%Xe$>&U~I!YPO(#Y1e)w^(npxwDu zwr-=16N+jZ`9w*3W*RLaW|4>9FJnFbH!_XCklyZwztL5lmxk$&3S5@>0tCOP2KW$) z@ddq!25#BfUsfycV_!ZOhBby^jh{viATl7=JzLx%$KP4G=N{kMnK% z{GKi(cvHXeTlz=mT|5>`B-+b>Nzj=`=4MF7R1|cY8LcH?BtM>&V_wVPtqV4bCj~e^ z!%yS-Ks}-H;lxLWJHurF%C~zgS2UVxMozBu8lui^9BFLd!{eGD;v8Zj+k`sBl=2Oq#u5XG+|8%Gavv1M;-1x2edt-o zrn|eRG3&6HqVp;J0%kod90~BQc#ktRd^yU~gwNpErTga>kfvn)bo!AI!kBlBS{W6u_%{v&ORAje zWWf|s62Q`xrdh^Pe=&y(DM912mv+(p1qx$4X#!W3^$Hgmwcfc|B@&DU=6dOGX;zhY zaJDFLLdL6^GrWok94DT6;3Qq**=g*;`g+A8`I@89!*2}WtpKKDgj!mtOo=C9FbNmi zs*T~i_5)(Asgnm@ja1B6u~zYNkl45xT4|Y6%@gol@>y_4nfoetJ}?IL2hd(Dy$5ci z%?ju}2o})Du0oR>ZkmBUHE`Tl4lRY~MadZ9xiOch&?MzE4~^sQnY-3(h%NdfL@flZ zp$j<6|#=K`@ugPBTk2XM&Yf!#%FWvWBB?buh6WMtrug z)p`~mui7^+wtL6^I$)e!;JUm0Ibb38|I9Q!Anz3}k3SK7wqKNGZn2EeI3LjYaaJsX z-a{MLr)xK9)EL)EDV2KbK6!v4KH9(bd9;65pGW&Q=K0TH|B_lNeX2eEHq^A5axtLU zeds{QTd8eG1t`R{)xStVfZo#OL@;f^-JI+E!u9=KX_P8!=>+@G2>^%47xbbfo_KYH z2mJksvhf4vcgRmCjjAIPa%n@!Rytot&Pti4JO;@zeB7aQ)p8g<_@P67b#5A;)cDZu zl{(Eh2;UC#5$YH2dsBHfBNr@@H>^Y!IlU{WFedsd$}__tj#27c4X8cbj3o%J#Qd(e z3!V33F^7-Gt26D|VAG;xH(XZAWnokrk8P!`b-Lj5g?rh>Mni~9nfjd_Jp!evu2i#> zPy&$vpW*h`uk!;cf|ztC*qS7o7V^)w1I|2vpvj$4(VNL~|v#}q-xK6q{9DD)}^7Rvs>hQSf zHb0M>Zpbh$EH|xgJF6>nZM$vEP^&Z8KDiI7mh3A=;a6CBvDLiP;)1W_d7p-&o& z>^`l=_P~9u+uxEgadfm)|T~ZLp3nx zFn*s|GJ4X6YBq*~Zl!n=8})ho_T?~fFfi7T+*8;Qa@;`yq^kb~CUD(hx83%sde750Ce4^_yhEH2}wINNoK7WtVNk+)Kt z|2u`W6=2GjlBu^+!(Tq>YT)EP$6DA+Jq}lG5U7lRDUecaY3@Q6{km~Q&IFOACE-^4 zfVr-*Q+LBq-)3*>)vlE+8%wp*0ocyLUx>ee{}X~KT;d1Tou!)12Sjz$PtM9YzM$-Xl@V}v2x|)z?u`byYe{(QnkLS~UJY;C5QJV4gh+=y_-$`pW!_E= z{uH*@F2Y2uv-u>WcsumaR~f7QZK^$Z8N5^9$k{~S&*pmvT$AXOtHGOowV2N*Tang| zgN$U48*WzMhfN;@$=F;CU8J+wYFI`9-VtW^$kHZtuf+{RA;h{8Qe3^$`l;hRN~Q{l zakU#KYBi<>RS>5&v-iVARTfg&s&=bPJ}8^Xrk1%JQB0QhoNxAvN0>fd!OoK;N1@R3t3J(@ds5$#-xTQ*ezrV`XUz;Vn1s9+FCi z(MFJFH^OObj$yQ9jTfLedrHn3aw$?2%cst=pvI1!v5kSd4DK;Uh~r>k7($@y=wVn4 zgol>HNZxV1v&SHYS+rktOF0}<4a+_E6TDC^z#*YEz&z`0hI^iYKfvaYGxDk~>B<%O z#<{~uGt7#+2d~I+BO9q4+s~Gi-uj5EKX*EW%ZKnWH}PUdZp`?HpnV@9cP2up!I~%QGUv`0v^`I4}E#rr!nj3|vd)x6SylZXLV{*4+x);N<>GqM{l{T>a8l(1XRx|VMtvU)p>P7G%e>$ zo3@Ck@+m9(kkuci4%~xRcx}wPr!*_Ma9=_G3aB1i!PSQ!6l0!{+gqLv zqi_UcLZeOEJ3G+Oo*3d2o-(10&?ptzhcEiUEKWHB?LqrcfG3}FQR6+VyZ>V|OgENFqg6&3TXQ_|lBZ*xl(1@~R#zrHg3sx!s zr9fK0lxB1%x(9kt2JOHaF?H1|XMaKD|9%C0fZ$|U>qdL{9PKAK)LH8*um`I__ zU%-z@pPem>Elc-hl~8};isdy9>%gV7kXb}NHoMa$HOE121ix={MyOc!7C?^`j` zm;UEa26u8cCwnetxT#w)#z`+Kw;(fX-?gnn#f1Ub+6Z@fw~a|((9z^wWy zWM|#;;*h|p*qlJSRbG(2m|A7qI0N4Xr>sjji}N!zVOtrL1LZdi5Mdoqs!>eS3X{4V z21OHFA~w4`$nL4*N6v)O6yOM82IdGg=bgpewVa3Uc?W6`*;#H*$b^-Kxw0j>EoE$M z=Rjw(ykX@HXSatoOK@xkKeqYohhV53{ucf(+LJdxOOM)R+g|j>I19&CwY$HvFO%zT zb#s`e56!JO3hf`Qnjho*vyw7UgUmj24Ow79q6`bvxv7;9y^+LCO&^fAe8gCjK z!4j_j09d#>OfKXb`>3hCD^=Ex?*03-m%}Wl`a5Sxz`vX1iG<>Ya!ma1Rp`oq+8LhH zY7E_rE(iT^at0 zv45Op&eAiMgTuJ6QehxzKz0~Cs$^KrFBo+?Nfh@mvGZ#-;W7xNc+k>`^MutwGbvZs zzks`wRU_Ti$qCA0EoDV+ZOMU1C%_diUXW9vs*=@V@T*-Jy?bXa0Vr9aUVNf^mQTtm zWQgc4XsN-!uxpm_4Livm{6Xx3XU=9WZEj>y$bI2H*GL_00*C1kzIf&9IFZAY-5jcv zJ{`d@U6y`xPE?V-r+fW9T=JY}w9F6z&qD(Gc8sKR9YQeX(H_~CCG?z7K{Dph@~lKy zqP-ANbLA7W;KN+r73o9hXxM6?LNp2iy{wN>F3j0AA@A+UXH^a4h7=AmeB(=7jc9@J z;7+v__t;L{Uu6B7^$T5reivPw{fQiVZ~c_(3s%UTX{FfQ$~6<$<_}VFC{#@~p(yW? zDx=0$#fzi?%A@UNMPJLyw=-SF?qRBM_I#^@(p3^CB}TZ0@3I z+1^aexwcU4*pd0!wbt2XUE2i8cl#Oa#K3iBtaonS`V!<0%Yexy>DD`B3I@I zBVS96>-S_bc`|`R|H^G)i3eEal{jl3LS0uGMl`-A zpGSCT!Eanm!$I4y>^Z-&D6BiXZmNeihy%hISquH*_3p-m+jZcG>>jt{No1a5VXTF> z6aA7!97{3cCwfkC!n-Ewy#+W{E1Pxh{y`$#HMrtX@PD>Y7@{`6KoqJ4Et$eX+qRN% zU!lwusqTB|b_mu3d|;O#6KNs2=!ckTkk^0Z*wg(XC~RoK>Uw#zCW)4X%;dZ`EM|b& zrx&}o`1Hcfx*oc>aCAgM>jss~R+m%`htR5Dhn^1(FHVnNzB!%b>2ER1V@${WWg@?9 zeRz$0=zD;@=c+T-6$cAe<{WbZKb4~VpsTVg9og^2ZcUo%E=>CK`EdC!&_!XU1_ zrVuVlHugoRW;}!Bu3CEtWO8TY&Xen0!q`H#T=nSI`lolWBlvb-{Z3zU)q3yf9E(Vm z7TC8a`3=w59Lh#>F;_Kap}jBdY##FJSbhHZORG0<`{{9ja8tc~cLjyp;iC0H-MMBk zJq+4SL!kFiDzO&$2XsjWI1$lRJ<|_?`js|>J zmV}m?&uF3#NKrxM7pQAt4{y8UT5jGu2Xj@MpAbx?WOid(*HB{_tmUe(*Y=Ry>Z-Dz zS6Oy0GoCDcaRhXhq+nW1mMXS26b zpX0mDapQAHwnOui@15~MwRJV`>PW(8$0T&Kbx>VXaRo1gv zSqWpruRuZ)@UN}~1(>cZUM6ID*wk28z=fxFd~0{Os{#~)^ZI8SNMYbYH$kY|Yynzo zJ!c>Ca_dF@>8qb7H{lHfd~Oco11Rs$%DJmll2gHFOqms58uqaMJ}6ssYZwFL6IP}X zzrTEicsqgGu-h-?fvqPm#_WzIm4^KRH{)bqNb|Rzo4?CyiV7PvzcN%;l}iV!(n~2- zO$($Gn;8w`>E!wI{>fs62t4z{NA+S(8{lxn-ThJS}QFa$H zoooU+EwrC1Ji9$LAJ`Tw)`x7m%{$eu9%y;p&wp8qMyCMi{w z?Y8T__{fsVrRjRn6=l2cxIHB>6C`n!Owa&Q5qsJS%w)A^;?kWM(2M zN-B3NKiDcViI+ei5D|#@1<8Z}?1W-Ya*;B_SP)-8Gu0!*L;K=9=n`?dK&6?pWX%g( zH@E|wWjyEFgS#pb_rhj|ltp1|?TL(CGq_P3^9ezC=b6PpbD=##0_w4hNfur{j?Gfs z2ziwWng+Gi70LJ&Bgbr>iG>9(%TqGcRI_oB4I@an&45v^62-S>yPC$9Y}eD_(eU(> ziw(V-r(*xlFw-q41j&@n4+}j#<_ZeBbkhq~ejR|+Fz|d@EvuDzxmzXM&e5C0GeQeP zTW#T(w&Y1K=R8DM!Hs5Ye|yLIx>oLUwvUkv`xGPlAThFSLV$G9ZFtT#r&`GS2sf-W z?&BB=rNzu{g;VziomfBA&}=Z*G!IS!j|wBdf=SFzPWp+wby^Ou|7~~ zH~aTj{~83_{=3(PtV1YNd~%k=K+46h*00^<7XLM03Rl9Z|3^VHBv}mE$K7;SbTdp+1AmGc86N{)WMp-;FDmR~hq-iQ& znKw$`Z_KH#d?i-^E#P3wG0oqtN5e@dONb^@CU50|ZnO$2QN80+eJ zhDX`iALl6BYVZXAwMk<2jSAHGeMsQDIgrowircUBafrG{duXBWun$TsxV2PCk6X z?EU0QAk5Q_=w{{zj@GBg)=qHHWXf_PDYrnoxl!FB52`Yyr^j~|I6~?hA-9ZfUTt+L zVa|THf_=DUnNl4>Cn&S!@f%7uc3gvFcAE}dOM^trD%Ieo43&$c;psa*!GX9jlQE;Z zkgPwUy18SnNb`;DBg?iS$hKhpn`GRlDB>PZwB5S`_78%cjbfzZG2nh=-H&E%%R_*A z;n6zP>zEwDtqOfN@;eKDDgFzjRkY0azred*5Sld0%*u+qELEX=7;LkZ2Qj5HI=A7n zskq5+s7%S>S<^LPG_(#fcTD}e&fq#_(;)aYRw!g-#I>qa84X-x=0x)`H;^eZ@;k7D zZkH30XzEI1j+nk-EGGvC2Y9`4@Rz^*1p>24$`U?XeG%UJ^7-@jF8}lJ-CIHvutKpI z4E79b6*jJVqDqmT+)}`XFw;iIu(G*aDlF#I-c*-h2|^OY5xJ0s z(%%(^@^J+(H!Cc9w9*?!AJ}^?@R=qFQ^;MHm@cBrw=a<*k-drWx(;2=CeMxNrG*xK zsN3wYK4PnA9%l0??U4x$G}P7Z0v56c0Q@4hlZNpdiDR$bfi=qVx;dRONK3*|MRv7R zQ%vzm&Lp~1A?uW6bi^{-k%+jfz~`?n_lrp*=@g-p2^7}9W;SD&|5g?C|_e3Vlw-Xo*YlCGKU58nx~AWF45EI zh4Z;FO39Jgi(^~u8k2z2!dM@)#e)?-7gI)rOc_?v9z*zyZ!|bj0jq|aenwnNDi?T8 z*)@pl%t$$`@C|K3zmN_@+JVO0(@hAO2e@l!nJe~3n-@4H1p5MQcXgNfly03&?b%i3 zenQZUqH!@+_}C;{?sk_CAZL1D6hd9lEL-&1t&z%RgTToG=!6h?UgV1D_yXkw8G9}f zG(eFZoKG$Q4QK}&HA?NM&=}IyTmO?TbG&A9VcU=XS$B3Jz^FQzp4`qQrn7YV?GooK zH-)G>QTj^t5#uFJaXK`J3kaL)*kbs55Fm%|kK-i=K9L$y_1S!D;d9tP35#mvzCn;z zSF6dHAe3A&E5VGB1dbp3a_7NF2Kl>~j?5O&DE8BhlAH1>K3A;O^|S7&tb`f8Q@??} zSFA0Tdi~>boBT3RKzda~i>^c=n-p0OAGf-9CeH?p8unlHYhSU&Gljfkq{5WXv6_#O zna1qdh=K6=5s*4ux45%U^B#FGwE5r3Emu~(I2KI37aBf!@O8l{KGv#OcLRrDImj9S z)fA@UsP9k}{0eeKP65>zNx9+P2oNJox6T9ufDjuZz1pu`H6bgDw&fw%?!oPW-vCC{ zJfjIq9rzA4RHB+qTH=W7o*9!9@X#a?P;#r!Mh6Z)cVgEr87AwVJ7k@#J~7VUbx(f- zk>2-w*zt!QqSe>^usfl*Mq<#}-kKw@Bd2Xv>9zW7%%yh|i@}^xg__a15sClHXi6Y0 z{x_LZF4ce>I&7x!J8LHf&2%2X9Aa>PE%-IfENleL2}9f}GnQptx<_uNLZRB_lUjDJ z*kY&G!9C%gP~7gE<~yY)wjwOOG70glJMf*YL%a=zdZS&l(T_Gy5hNTtULs1jj|yN)+4FNpK0rI3K8~} zfsoQQ)ZbNm9lE5F0WOn63$#86#M%QFqjmug=AY|2j7>qa9oj^+T!2&o1m>{Qa-oB+ zt8U85r$8pZMn*M-ylvN-+@B46CCkqcf_HWmMTYkF4x-CEPv2V*yH^T^@ zyKdI7MwhHuS5}Py1p{o$c_7F(*rWD%!fi@NN@RtOEdy59Sa{aKpq+cK+X1)SY;aP7 zhJr`eCT(sgxHs|0clE}1uuJf{gD#~i z$#uCo1`|GyiNu7@!@Fxep0=w?@342f*@dMgDkL$-C|F|dZr4@_xko=?XK8cS3ka74 za(H&Sfj=eq^?Hv=tRE$4=hOG8oT8h=#h@7}a9mCxvWQvvbW#lOW|giC^R>})%AlG~ z=X|)}TG(8hQhTymN>|&h3=obFB`0^VcA=jL?8W7$Lf29>ZU@sh_OpwXv$- ztMdS!{A5plvVST+S)io2<86ZoFS6t?3sFg}*KC8W=rXkj=+$;EGv_bs95+d-7edbl zgJ*apH1KZoLXZ1jcW##DiAc>jv6!D!8dUPquYt7L%p*B-a}O`AVC-ErvyIO{hbi!S z8*1?e$3m$-`?^e)w7!y+)r(8?gN)C(jm9@}lc|n|jCppkkwG#qdbYvAjLn2x^n9b{ z%StcyjXhAKlR`?C>ueDRfwk_ri$3ki(=F7de5$gdEb9j@MXwocr0AJb%VOyDN>7dX zl;zhOwRlaX>bfV$T~+9mUvsrt5)923A3E z;E&JtzTNxX{p0h!z1`iP|N8Fxi?fqo_}=e7=f&&_|MmOs&+O!v$VT?|zWr|-47Oqc z@LczW?Bg=Of_T&oj&>yf-Q`EAYq&NyGsuOt5+8W8Z*B-~INeXc4&3be?H~9$t>akd zA`RdK?h~lP!d55`ks-lDm`{RIsW!Hk?9L^>rn=0l4bTZ9yGy2&=X+&F>RhB?O%;my z(h^2vyLdY!NyZ`3L`H*Vd5{qw2b8zhfdAb^W0#lsV>yuJ2S3xHkM3H4`aok z8J^N~Ht$LbvsE$V->3edBhAm%&7zbZ79J;FwuAq(hx>j`%??HmT+_=HTY&#zBSt?m zd=5WH^rbEsEvv#2aSlqF7>)xB8ct=kyIpw|F=v_uz=LjMFqf2^Zn0WMQ!Mv@B5Ep%43yoq=kb7$pQbFgBGQVdF5zW$f^1bp znLVb;P3A>Kw}?w8OsXoEWWoOGkr7L%neno85-3c%T~i?1>x`#;C-&|&!*SgzJusWD z9Fp5+(@6EHiWD^~GR@~1f(AlPbf+uJitc4|s-efT^V1&>FHXo`PyQ1>?gha{=6lq! z?1|Q)$1AqzI>1tI!wCXsADx_EoW4FiGK0jADtL559@heq z;$|%6Mpj4bU*`EiRXqtMR}-iX0CM6C>fS9YUZ~JGp6DVZK>c!?oob_HO3tp)cJ_i| zof8A8;kCAIA!Gk#Z=Gl8RH#}mYjw+t`q5>E9@ZpVEDO{X@pwa()7`B}--$Ih5MuTq zd04pxtNC=GJ{_pl=ZY<2N@JAI=DcV`I0WyDvFR3an=39P=a2LSOImBCRv!eC^WZm( z?3@n|UmpDB#ZC|Y{Nmu7ugsq(N5{j%vlm|m|9JWJ7du_9!R*hzeDU1E?(Cc#zxeXY z=ihV)Hr!yfX7u*tcFwV$%8(fg>_L*%*Y)eXE;D+|XT{9dWyNSRt*xiB8}|p>tjo%K z_nVmGbt$*lndF+u5!F!b&Pw;S-a-{`51Oa+oO^4yM11cu@Y697NUR=|1nSc{w-qyC zODLwT7yj$7zBoA8eengEibATr!P4s;`m~-UIF9XRQBxtcD>eP{tAhiw`y4vjvwk_Z z$dIE$N1gNyTnMhnU%vk8#TTaSZ=REsF1l$-7j;+7Q%Ec-nJ9Mb*zN(NO{VYmL$`Lw&GV8-(>#IGJSE*cCEYxM(=0tt;53~M_9t+fCvckD=Lwu9^7*F*r$Gi; zf~e_e&sa;e#Haa3hNn?x^%HiOB%;Xmg}7poa1l%1l$BP@E)BdZku(c^Fsn^IjH`tf zDQ9_?9G%UjqU+14BSwYFQ0S4rdNS5$9x3wlHe%|F$$FQ<348AZ7&a$zW zUA|zr3>*el)mR!(mpx^Mh>9zysW)6PcV}#GB!U@UgnfnSX5BgsreZ0$fy;aYLB<~A zrf#LvQoDtVF06~>%Zy&rjHl)>ba*bf)w-}P?n=* zFik=Wk{PqaoI>^8_*<3ZV58toQpb1)kNKfV#;DTd`2m^nywF|BHUuW*S6|%gmCYTB zJ#^Yxp{WRedwbEkac976bHQ`HY&{0iPhF)YxQRcZE1&x*HPGSZc#~>lLn>-CzZPP& zXwE(C!fdv=YSqR6upc682|RwM#wq}(lA2P=)J_`OisH_Q z{U;esKjc}fhrR2BUAt&;!Z8T}1F)iQybCt>98~rokN$Rj`F$nVo~zr@Owd zFwM+`$l8@j#B4?*%2wg69)*-;Wiu;sEooNHIKT+m7CUQ})4cWez3Uobt3=%RSndhG zX8AH7Tf5{tnq0AnM8_YLqiMRxsZB*QV(OY3c4z5Q`>I#QFhPxQOz}fabXx>06l+C0 z=}JD+=3Ql^9f{ll3zr%i7(p77c5er$&pY zQdN=jjM1|CeuFl?)M_zBX)kirIF>G)CP!&ihMv<@DDoX7ksLEH#qLXiIsfjsMR_r! zyJy8^tYSi_yKY`=)ma=R#DI^X4sJGqmzg&;i&VZcG<{3}8&K88{ zVrbkKdgPX6c`&;-;@fzfi2-8aN$Ip)0lkJf&6|*~_YZrjz}I z&8PeJms=*TZM9*`P9Ggi4ZI@GOUA7<^h}=gv^C#y7 z{C~ua^C(9Dx%*Nv4W~8F305R{XS9U-uOMJ>>My7N=j-#$6HjloD^ZZyAr|GQK=d_WVsB$2~C!G&u7~3ZzXSV8>0h6ln z4X2pi)h(kEnz7Rl+j7m==Bnx4u7N}U zjO(k}N8^V1iTG*kR=XXyNt5lmbmHAMKHz_)jqN#V1~o34E&>65xg`%OArq?E4eh2o z+ut~n12t@3r900pi?+_|@a&X)kIijuN^>bRnz+YeMtN(zU1e^|KX#K0wb0nfo%yzi zZOmaXV440xvXofo*w$u$@7B1)8)ygc(N&;Y>LXG zRCbcnQPv*URSn+uKO?U*Iw1`Hv7d5f{!fO(w-AO<~H;<5BD zBG=RJ>WeAQ&&mt`ZOheiL>`h^g;jFh8z5e(Pn*U-=n*r+ORj?P5h0g{+({AZ_}gf1 zw$nI^awvygOtk=di4Rx)TjB1s1vl0chjB}a)qqB_ElbiHD_5ARRe@>(yL!(MfG@6RxbPR(fo zySLad*l??^0usM*;yf@o0MV#5b#lUBgCB-Vkskiz`wQ^!U9^OFxG8@sK_35nksI4i zuK9HC`O~L+{>G=g=U0`I^3G2SVipu`F$xPOm7DwU?6kF)vfzsvtkcBZ?Vr`}od!;| zX0v(A?k7*z{7={X_&i>PhHCXB_FElZyKkN}<>~Hx*^N;_STv&C;8>STw8=BQq|gkoLkgoDRkj^2t;)iQWSlS=4ICwB;h;LM@=wUT*((`7kh5 zce0GwlwNaDM5JR5@!Z?7KLy=qAqs!PgB8j=_0;M*wRZ8o{4qF#QsG?MeRj*0UZs^= zB73v9C8m#(MAvF=B>0c5XbfF;M5WQHX>vV;ui6X~i`RyTDP%^IDbG8=1N>MSK*d5C zki#r1qYaf0cy$&_b?~~a%!y$f$x^sHEK3O{iVtiem0o~&!w{(fYq32s!9azoisp-WI&jXyHX&?K=WOBjH@=0xPBp@oe+ zQ*eaAAhJb&OcS0@c6`A&MRwndl${BwRnL$1^h`AcP8h}Ot)S_5G&2^zB&TQ11sXB3 zhUs3#{kHQ~7@n*DVT7FF^Vf97v&HsS?DQ;bG1NrCd?;wvSDGeQ{hTQkKqU+5MGzS^ zEf@Gk?CRJQ7bAYr&22-Ce4>jr(Y$xZsr{<)5<&|y1aQKk8R@|FrrcfdPVnsx+4WF{ zr)OjglizDv{+%;$P8}CCb1mo_;eTu_Sdj;m3Zs#etWcUsMMTrZ@alj}i};yq(>Ao% zGnC&sN79#LYG}RtXnO$!`Iz#of!QN?)?w7=xvkpVptG0d$i@t5un3XDD_h-1sro)cyxR05tgR_Cap?U0Sl{RJOPvL&6dE^!_aqA5%G42h8`}M zSPMrE+oSEHp?yEjra=rDi@cn*Vy$0J&V9E3=S_7bi{I>?d=4da(m* zlUs6LF0K1z59nzV(8ybWJ77{hBLKde7qgK$w+vZqenN}1D-|#^5p2apv%!%M-w@N8 z5uk+@eVSz=vDE?^9U2t^Pq>~Iqd_8O`!?LsFoh`OzWYDaXIA@PeDTdUja%Ue&%4vJ zd)f=W{ZDZ-tPJkc+70E&)A#S$Kj0FmX=>~B?=>gT9rT)(liKWovy3L-O^LA#!}kM& z3HFjorYtQo!(SEds2RN&TdtXlv}UE+O+?f2kY$kX@yY6I?}I^l&ll9dSK8Q#Vm8A< zL1Q6jhAv1>=D-un`tdF1UwK(YA!<^Lmog>PfV{R|^11L=#TlRQQDbnc7DN`tkTpg< z1h>L|GsA>{wkf@4n3-YiT$ePPE)Sq-28v{K#4<&8IR?l=v*qHsuc;z8ENjyD!_8$U zyQ}s}I}JG%B?!$IgkDpg;jO4h@2L2S%-u+AL;t-fnwy`tQFrCjcZpj9({tKK24PDHryiz4JF>*F$ z6ha;r#F@hy!05w!HcLs?a=VGcYvP5A;D(W_GVUScs__bB$XL_~QIU50FrGfm(|*Yc z`whK726@TjDbti^4fAQuD(P}hbm1g{InzsC12VZAJuUoFC|D_&AuiR7>SWsD&IU_O zLUn|Hy<&?VNP`}R!~DBdNTB?VY0LZrFOh^K|LXqw_ify=VUOFsWjnzPff6MErVA8e zHhDnc)CS}P*lxyXuJ9v5v#j!RM4kj_&p}icUG*}*7el-Idj#D=p@XwfGMAO|3Y}>^D;3izT^uJ<@XUb-4h+Iwi+})F73S(=t z=#6oMMs7t?0(nk;EofHF`NfYSu92Y;vtqv%{F-JAarAF^mL^oDSTY494^hG<_kie2 zBFcICqsTLpLimF@m6|6-MkO)3e!Z6^EC72YX{jOM@+H(5<0D#Oc)XfKqxvirYR%Ax>_$H{QdYyV|f zmJ-P(uyb)QK4h>~Th>!cBjTFLOwjZly*(B;#yDhjb|mr~4aOQl5w~(5>e}{~z=p&O zEcZz!Mn+}z?-^6o4uWKS#xZwJiYzPRgxuiC4B|Ly1E_v-age@r(**XAEth$)wlO#W zEC7}{P%`H*tm(vV&k4_M`C99}aFirBZWI&WLF8AT0hKoandG4 z0*-vc=zPe3s}Urfnb0*?VZRx@<+EaDC^{!IHWShpz(vlyKep?&@m<{-84dt$!VyY_ zb#=e_^8e?CUYV8Rzp-vL}7hb%DN_;zv}Sz2J?*a+#1XKj(~kj!1WgL-5GN(($*{8F7CnBQy`AP&nm<6 zyuJ4R7M85dRZ3Rwe~rR>CdG{DDJz0(o%tM{jY0w!-$<@C%h9him&_)nHYxNir;}v! zj3@L?r%)IJ{DWfT@|evtv6!)34>5~N4bE*pm&AxVMr#8=-HT2ONtuFx5WGDq9no&! z5dZO$kXMF5FY4oltzNlPj%}y6UXLA+4^H{$*{Ice6qN8b;6>e>_!zMnnhAqRoLoT& z5~3X8g<9j!S`UdD#DN*ljaYd_4mR4Vk|DO+ofzjx%;p8u`m~LO@jt=g02fkq#65z2 z1i2RTv?-9kV=7bCQHYYS@2B1O<5KITVY{O%$tZ7f4#q3*N6-@JDrM3)7`=YHJ(t8z zI69;T?koIplWm6fx5Q)?55m>DFr=DQmog*EEWS#U1$vBSLLE~a;*G9Ru*Qt)LNdVk zi|o~G>)EW(=CmJ>Q@pBx>?aHX1Ib&i<+ePz=OJ-Jyl1nwS+3>6tizc|hh`}%Z#TM| zV%?`P8JS&;Lx=?j2LgJ_LUe)3wB{lmtYNX3g8Vj>%IIEl+0B5dRHvr-L}(w@u4wez8~$w>c=kYoNCQv{)+t1-M@eSdw=iS-QAxL`rrKW z`R?Bb@W*F+-|qeH{_*+V-tO+te|`7;#o5U(eDC+4^I~>||N4FRXLj;SWFvcf-~P9T zK~GDd46XO&XmQsE zf#4UVX_lb_pw4lp2IOceAXUSdEXS11L_TC1%(+2 zMa{-1Z&7Iysax6PW!jYu8LmCyU1qZb{md3+#vue#8(qld z$Bi>qcWlSFXgSOEk$Gth5rfyQ&jqe1(>tMb&;Al2SERF{TT^4 zm;BoN-Har=bUYEJH1+9w7jK7^TXsQ;IffQAv}hAT>-TM(i?iLq8ELKMao|)@t+o4~ zTKqfxayWOfqb-fM!>rI0nTjk`igi^f;rpt$|D7Q=#oe;Jhj?bHnf*!!xaI2C41H zcwP~9@M3Eexp{9fi7kwyq=R$7_`Mv7!f;2~Ip%B5(-MWD1Eq*E}s~hKP3H|7q1Q-E&{G zj|8JlbM;n;tHR>%Y*S4+em@MGu0TRLD5C%kHWT8CrKG64M05{CDF)y!RFNOQz!=Np z_e1ajX4g#OO2L({jfW%@`e^OIrq@|qC94^po?U-oF>JtV`{P%HhxIvE2hh?>{qSlB z@Rb`tyP9_R!^MZT0a{daE|uOEiQEXmxEs?f8`0znb3fP3t)-V5(jUHkTfx7ro7p?4P{naPv>mRq@nv#`$L4_w1t*rwM=_Uo9~5Yuh0_?Y+L5g`P~e`ISy>8t-UZ; z_U7hh0A8KB6t@e1&jcUsXH+w#_vxJXuV1=oVB5>S`NWFaxfEIqrh1nB8GhKme%Uua zVtFy^a*pvOH0@dOWO&&i8t1E#t2*_vLZd8d4U@ zN8OF{gk*;8fZY<2A>UP5Zl)%l#O993{ru<_!U|+;84lX}9m<#^ z+hGSr{h|C-d6!^V&wMaP*vay0A%a@#1m2dMW(l89nH(0pbuX?=Gs^rr3fiySBmi;X zOJ)7|6&P?dsxICRBl;+_;NTV@XA_}0LWi4Po)2CO>^RV%xTYCTF@?6wZHwqfxjN<+ z+YrZFDYuPkkY8MvIqE{Xix{kKVj86BHH8@2LK&3_lq`=}pvnpkHY)^Yj`>=Tosi`@HveGow3U3J-IHaq}p713qrKlYi{bP?oH7^b;mY;Fbs zw}(+vS-pld10p=CW-TFovh(xF(eay;{>jnt@UVY)GJO8x>;Csg@A|_xhcCYT>i6*5 zqc?{~Zw_A^^v^!L{m`KUJ@=_Buux{+*5@~%JL zeAL}KD?{}xh@B!Cqt_TG5S}ouXuGS>1E6K*AG4x8Rf8y&lIF@B z{vVY{u9#N)I#Zxli`h)%POJ7m==&e^?GO4oQ%0%QnTl2gN!8h6PcA}@Cc>nRiM+9K z#2`g6wnmHO%IYkmf@i6+$(%wli<$MEFn0fN_?EmrJ&P!36j_eGV~OGT0>0KQaAwWs zADL9GP6)D*{`zihPs{fQM)A6~UjesXgTo)SzldI(${MA^c(2j(!HdhD`QOV+?>dTU z;I6(R(rsa_P4*CrwYDd}ST@xE@fNG%;WNwj$*oq0^s>g6>^$FGT%6fe*j8BTaaCc(B0KvjyWUqi6@}i}0wemC<5%*~ z{l@P{%=E{Nn2CukPh04Dq1!|fu~j6krp{VZ`6Ib=^Bv|(Blx8~#J2tr+slvMQIniK z>@M4SVhyM#_rA}*_~PZ$J`10xeHJ(R$Jl4C&&aLj2@LRw4e|f3-6mrIwB0*L_lw!w zEOob-h@~VejoVTd z%AvK)MGj?Q$~i-7w!2jK*&F5eKm?q-v(y}Yx{(GSZ*fh2`C zr(8k!R+Qaub97O%X%YMyEwUNCa@?)1_?+wRk<AGa$g1! zCU#IL49;!~@0e+1&u;gpa00 ze#KI&b8L|}kLx;d-J|$Ee|^+95+~!-J3Cx@e{-!#V!ds1XlKXh#4Oi+>}1DDI6fvj z7n0^`%w!-H6CBYFX)HEF;7C(~DCVL%T)h`2CoE4EM2yFMb;AK{P7nZl*Tls&!*rgt z_25{`Pn+i?p$c4IW6HBaGBqG)02KkrhY(Yyl-b|q8*S5&jIbQQoLLKs4cWN#+{+g) znw8e36z~|{-Vq-M`@#jK*(wli$Y zWGv|neuJ*{N}4EMtuh;XYVkWQ4G4zuc?h(K!;F$SGn#5%riHC^3b2y^S6J46)4~<1 zu%@xNX+72fmHhd^0T~rKM7Oj>r6HGB3o;S~Bs^Gb%R6Ir{OW|Ki}q%l;Q%eDU>P29>f~xY9Ra%7mL~t3)qySe7;+_-OH_)fDD4 zCf~N&!{koe#z#n(8E`a#q9c{mXUNlWY8$Ku{;-T+Zs~K*P*VTRLtQkZ~LNDgUR; z|8d9AKVt%ro4XOpYuzyGQh>Zm=K5v%_dih*5CmSxH{evbsMv4!#k|x*R*fo!a$VJV zCY_H%9(_mVZ*D} zYomV;NZd%+++TMEC3IHHnd>C54z%I{| ztN^&CugHjNay&db!|(R&`(#cb+?@!?Cs5bcm2Rls%SPR`St|Scjm>C_&*^xncpiE+ zv;c62J^~py{Dz*>+iV3Spk%#ca4ydmEu7?>*tTukwr$(SiEZ1qpV+qT6Wi8FZhrr_ z-l|)5t9sXT&+eJ|FzBA$Ywbm1R~(F1DNSO>u7YlT-A(i})HnV+I?j~bTLi5bwHg!0 zw1o~O*fedf8w*jLDY&s^(AE69Tr}yT&&8;FH@l#%(hHNp<5P{UZ5?#09(yh}_RHEp zV;0JF`dP~TudMRRx3ATP$rCL;QlkGEJo1_t_Wgf~+pIF3+ce;c<3Ol^nV258r1gyJ zpCF@?+t;4`x8#;jm-tPbo7a|ov8Ie1o!lNuG&cw3pqrTK(9+cb}l5CiU^!*n_6mIgPE+Gxp z>9aje9=s&3#AtaZwf3)dMq>rJ!4^o;@>Z$tZ@$mlFIIESj%DbK!R2G=iI}^;yLya& zJFlRp78V%DV2CQxH1nv9Fq$&>6gyPJfpFbh;a?<^%Hd;phP6m*K+=Ji@*BAj!gyy%?=LL zCO@TONs+Ab6lB<5Om1#A>jvuK<~cqQI8pA`XEM@yHm0Z?xUZ@3v;<#$;KQj7%v3Q~ z|L%5uYoqV+UjIBVOX$FsbJIpZ(XG?aDpB$TH~tDNM$^`%HqE@RRxNPxwqv--(^NAMk>VgwPNRVYQ2NDEUA|04q zEZIHopho?$J$d`Xpm>czJdEfGx3YF@)NbG%GucJ~7`m zQIt8Zqz#2E*EajpF@;nWklgwhW(L%7k9EBg1Vm3;|CAGiyGSB7F>e(m2E~DENG$xE z6%=%`i3spy?EGOm(fAN&){9A)M}FJ#`087BX)OSzK5s$0A!o@o-p~Z*OOM&<{0mE% z$H|pt^RpY4sqH_E34cgsnpR%}5H8r%WuWtBIux18r5V{N!-9;yMY3H1B>omVi_GpL z_BA78PY?YMKe2|D*Bn}jzMk#qkJ9!yQ;AFQF2@js&CI$v)_+&Y@}(IC8@=1HqxcU- z&x!|1J}fTw8DnISv(}jH1!|0ED11n`YE`6p`Vte&x$-*@C2_-QM=%ocdzo@PFAt3K z&(w)fSFfzM0*QzZ%bNk;Ke&pfIc4DG$b=|uFeW2ofB=g=O^UpmWEPwIOurlgVFXIZ zB(jCPGF}`nNoXAkP*UF>?3lccylBBH81f#R3Gcvz$kaxhwY{|<4TH;|-I+~p!_V^4 zucn-6D7GT5jCX5eX2Q^3$>AyQ6|WitU%PD*L-@^&^=5Rbm->c)RemnB4~z0=MpWB= zbnVSe_%mBn05bDNaEW~jSmNuRZu2zk9#X)+Oc-2?X%-`zK$*EEwTo0XBK@auDi~$z z69HH!ae^1YCkTMBZQ;u>iwgmF>);elFtL~tA0G1<`m@{A zq%-vT4645bf_|1b)MU7vtdtNxS_4&Ikkn4w+A)6?)pT}7QkzgkYif*wZZFNHO&_)^ zoUL4?N-F5s?wC@B=f>qwV~oneNLO{~#TOvyyK8$# zYc^vGcVb`g>a%SoQ?f>7G?dE&<$Q$Oo72-5T#_AGS+Qw2qMImG1v_bpqs_C_H;7#* zdG({mp$j#L?whnW|2bN5x>c#0jW4w7{D}EbDn2=cJsMQeKdn`t;b z91ir0csLuZW;}n)g3rD{3~>>zNxn@-@tVUF#Okxysejz(X8q;J`c3Hn=C@42T>)h{K9?o%xsVkQw>`bD%&Uf)>{b9VH_77+!Ma; zYqaLFGSZC~>}w+~wa1u@FybTuWyOR09SQC{Z7J6C^MA9r=ch%3FCg56R4YEhqwfp+ za3fvo>a7X7Z+Z6K7QgeEn;wzKIn~t4!(6m-+hqVjQ+f=-9PH$F;PykCie*iDp5Q67 zRX<1>m#H8kmS*W*XgB%!C`+09VPyT;E`=82w`KR)gth5oh}mvAdNzBD`5;P3K8fq* zRZg7;m5yU7xIVz))U)+ zESl0^oLYO^t?NT$DEqhG4^U$?>mL}`#?G8(rF1I#*wC%+bC?LaNUl_3H#$~-DIfla z_`-hgi~oAi@Zt#yd$~p=XzyIstGy~X+YWrDSYm4l*Yp-z9L}X*2Hup5mhLSpQ_V6!%q`!&Z4W_*3>@SCy z7Jz;M2g4*oz+NEZb1OfcO@}gB$ z9Y-Pmad|IY#mHG}|4#7z!R^wsk~Cr(?^7`6bVv z0bqB8r(4&^yy0c}Q!3?F9c|)`(e=B-e7wE%yZS9jpx34jwBEw4g3MKysde7$z#V7D zv^whEb=%hzl55ZP7IW!xd}N)#Jj|q&TJT9(pr_5*Jti<`*iBc?_=O(L?Zh0Le;hDT6J}p zDLpeAw={BjDboV0h2q?t7M(VxgV(7mqqfH za_vp4P5$5tSdX@=JR!MQvef-0B2%({QQW5EDcUl9&84w+wt9^Sv%jaPQ^_-c(u$;p zvY)ak$v6i;3ClO;Qvbjh3c!Jc-}0CvZ8~2LporCH#MZ76ae1%YCfibp30h6VxhZmQ zvXB#CBL;y5Q33a$jU-~~>aIhGBF-omAFYjqXHCBe+*#`>#;Rk;ZOPjxL@UDKK-I@6 zI@`ZCLc%5iw+y_asCChHl3nAi@t-JGeB(aA&dT{P_3CnsGbGXyy$Yzu*QfUJEUahk>Wl1a;1qFg=rJp6)e&2B$ z>lX<*nBFko85!R)*p5r|(N>`f=mFZx=^zh7NPa|by3)pvid z3@pTe%u4*^27kO)sR$NB7St=K&i|RCwjF#!taydMes9~BMn#N4Y zT)f0pj+E=b*()=4YTFPH_1cUNOI<{gSEG;sX7Q&)Z$HNLJc+vTZk=1%Ns1<0Nl&(X^OWrgM>M3n5q1$V``F5h_Za_={I5~ z)Uu`@r*0TZrXEHWxuI&tP3@6TRxJjsY;lAF>_G zolOr9V+t&LvO!(P+E}{1`YtXv)0H!mnd{^oLx^_6+TMHU4lY}bggC9}C)HQ78Q4y& zWE=n_t<0l6F#i|9KQ9+~Ujv)gt7Fq1#&vL`&?ug9`l@QRjxdU_iSi1-f|!u+Uvc~8 zU$OVGI5(94;_VEH;-YqEyUAAIZ>bW?c)3!2WCHZ*NQkM{ZkjJ` zO%R}XK0@M_`pXkn9u&6AE#MK~S?s~(Dxo)p@?HEh5xm&!`%r<7Qw4OwVpgGc${0|p0BT~9eeYaax*^M? z`+BCBV~Q-PD7>i2eG*wrqyTOY6%2n)29F~in}ylyN&f~dJ~fM&Rjxt&bx=5Y33G0O zaHYjAl*JD?QYd0T^|7b;e2^{MP2;EljoKySU`k8K^r@X^N2BbKy7k-04jwP#%>6@L z9|tYHMCH0R-+|X!a5FM_%52)k{n1Wih-$Nxo5L6K12zc169TWRRo-nt?1)>Fhnm@I zxXJJX7RD_EJC2llwBA$FnjX)oqwohE-Ac(~YC|D4Gt7bL527TBgI(urSjIwcMPP&? zVS;yCS5;mdah@cnBLQywB&!C3uH2Ah#IV(rMoT)2SnNNxp!D#OCB_?O;+EljJaQ(B zV1sIzz86ofpPkE?FQ(185PPftg?`FIY>kwar;(yO6@O}KDP-(&qC^wAY(!WlSu6-6 zX?~?)6x(TvdRnj4-*7R>FwX=!&?+`cZV{n&&Dxxd3lQVfwAax%9|1W#%R)fQh3QN9 z7U!+*6;X+4f(86RT2xow15GH&HX05-28aCD1eVG9y>h|HOHY75U{V%+o5E=q#1NT+ zW5@%fG#Bx=z&Qt2e9Wo99KqH7dujAhZoG-vMSA^66P{a}+LTI2*tR4$$6VZsEw=hG626F&5Sei=8jG_QM5qui zwBo=xoyaRKaI*OF)u4G1Da0onJm9xrn5?vcOSgIC)DKEpATG#4X~(okiD_?@#{Kj< z-e*t%6~*&Z1yg{;kO74Jc=yuc*Hif;#4tA*ZR~C}UsjIPQ92jy zg30m?eiQP<0_+SDtxf(dzFa<1r`3%%{cc*G6+)!F2`N?qF(-AG2}Bm8Bk0N@62Naj zWcx6=vfef9Z_4D0!98kIoVyA+EW_dCY$}QEx+{9dW&t}NT*hUF)0Y@{*G(dGo}V4R zB+06b6V!k^G2`*jBb?h4;>PwFE0iJ1*$b`J`c*b*$AMH51DN_GTqSxt0MbzjZtX!F zNdCwkzb`!-`X@c3+4=w-so2N48v4ZjfrkHWHiYGHs`FO$!K^ODgt-M^6>zJ8+o^+f zTPo~tT?m(n$%ihuksounJ!EAS_o3%oYMTaik=yB*+?^mm9_D;pZQ~pMFRY4NJ%f0+ zrIsv%!X8rk7*#K`MwJm~OslMit1Wus#O~1LcL=Q)iBnfPM6G|>K3F`(w)$>r9U8Bv zv!mlmyY?hkIZ;sVzB2r_<+kv$&SCysZb9TW@lA-EpZoRGn3qOD%02!rQqb%!ef;Bz z&48UQrpYiDU5Te2Hl6`86vP6btR5PsG6z7HEgfbc0i)J2XpI*&rbty+H;;>@Ifm zDa;9Y8Qsgrd4mV%+B#wIuVuQM`KYSKAFZ^V<8~v?O3SSHm}LJ%j|_zr>Xkx~`HMkc zcKy6-ELgs)`J0P8TN>ExkS>;0b=cd9Gwxe{htXrR3nN@}gaA0mpiPZy?yE$d(^0gy zz4`q)PPTV}G^hW}^CEb(y`M1^hrQ{FM+_EYyz1Vg(zTutQ|u~de2tvM zE9U-T!RDn_Z#~U|r5U|WdH6!bF2&fPZ3cFx<&}*U_+^h3#PXkxSlnHrN@w&$Mc8`M zducTwM`lg<7&PK_o=*YKWl+cZ&!21cy(x+;Pg}uej{2NM-L=u|kG;A#$_}YjljCOz zL(>N($^b`Bhl1A}%We^tWND~eIYa;QbmA`g2`%v=ovGEc%AIGm>S6-|kEw(q1jtB5 z=F6hJ@Ak9IBw`}6$zRXk#%~AVPsGXb<-eYfZ^QP6$M1j|{Cp@KYV%TX2^sx7{9X_C z&Nc^cc5<5#>OIdKvHTtywze0Vh{{_R9?yBZ2zcZhi9}0I?0vqYLPvB_#BSa2zc#D9 zU1nhL@4W-(k(cW-Z<^gIw03;U$kFS@DGk_}w)soa!CNpI12#i+Q&eco0e}2jjJf z$nh>}D?%$E(%Own_JyILt2T9}YZ~ZyF|V0NmRn=ykl?8-{LNp^x)oo^9oi+R&)w2o zZrYYHN3?Cv&8a2JiDW!^B8O^vyIG{W8W{|bmVT`xR3Y0CM;^+RmeX6!1ZGe4=?%`- zwBZmgIYO3f|Lq{!0D z$z^U(aZq0C8Plhtl2?BZ;P}|-2hlAq_3`k#+Y5V$I}X}g-9#TPWMZgDH0 zzV-L#ba|`wu;WkPE#jq4*Bq9nq%>^EG-bATSV?Bhz7W!MZmJMQdIj6Qv>p_Q>eyF` zdi~+Cp|P*GeH>>y#OkdyGe~*>5L09wAtfsI@ zA@ZJzj%yDltC z?z8cjJ;=~RdvOQrtHjzfHs&{#vMOkvp5LT~o1@I}IXm{ za!lzaRnC;x;HqziuW-8?R&Q?`w00=rS-DCjcxYAa<;PwMwrvQZaWh zNDDbfuK=8@J`{oEzV3(hd)~d2nK&~ZdCBzHQ37L1)~upLn6Sg6w|LVTW&7o_l5bv@ zLK462C_2EzP%0f}vm{=zCh!d2KJoSro^miAz(K`Y2xj#k$HrOg!D?%8iMAXiLiZ;P5j8Eb!>Nu>=3B%)YI`fG(T}67aao+il6~DEU|JD7WOu`6ydMsIORGJi*EGzPibX+GL%d0kNs`N= zI0tjWPMSjE4A5%e98b-ok9l6wWNNL>2?g zz~|d%3i0W)O6_ayA7=Y*+IHT@bKUHg_zz_E%V+NO-;VjmPZg}|X>#^oVgp#Ocgu_I zt*))?ELtX;XV1I!V|#O*X0zdyJH_LQZ-`FkGd1%$tG3XdiXGSzRe6~OxrT3w@X%vs=%mSuf9!Y=oTSQ74I`O$8R?vTupVE{D@45L>c`= z)%@(~Zyd5YMvpe7Uni=U^jCfVrD|)Wd#Xuf)?l*H4XQ}sE=8Z$b*Voz{NtP@jIwNg z<3}t+GJG9aMV0;*2``~~TxtE??JEa(OWsc?PNd9I97QymxgP{9;_JgvM)VLQGTUXj{dT_#fmoCC0bt?5Nu zL438m((o~Y2ZjL|PM`M8YMhUq zSG(DB<-gO8j0gyg*Lz>@;`+1OBPZxHS45aZq#u5=|7~#^nko;?^simwJk>x5?ObY{ z&m;+=(ig>R3X9yn=U72G%X7Fgks&ez5S@56!0!jfLD3d($gi_bKBMM67VPAhMQC>W zaGm(1OT?yZ{qVTEleLM()#2#Y&T&&mFMZHce`6k%yT7a6-c^zhMkQJrme^o6Ev!^& z;|t5?8Y`L=rFU$c_aJF1)M=p>VXjg|m+RO)LsSXHU{D^9d}#@~bHKV}fa_7$)4!V` z7OGM6=%(uHxk_#j7noV5iB37pBu=DCXE0UD>_+RPNV~g=Ic1>e_>p6F8#UHm3wM%w zHkIZ`k+C}KCLs0*i-~d>X3mK~sUpV!zRS$LFrVVPAh+RDu?C`ol{0PNjT-oQVG>qRx8B5CemiIPz8UpY?%-vPL%U} zPD2Yi)>S9<5Zc!^-*6qoT;W=|IESkQOoVMZ+}&<1-OXm%{eK9!*1_Jpl%g-BYb+^e z%P||WSYRxrW-2W0PEJ#xi8{GaMDnx4;U{Sqt%k;-5|^<3_xtn{C3Pl<#$JYc323=2 zPnIi0^v+0-%jF}hT(rhU>N0i03c>QTEh%^pWERX051UT(q)hQy;muugv+-aKqAP3t zNPnG=VElnOX%#sMWe8`{)~Hf50P5h8&H3X4%MY;XQ<~Ro>_s}n=EQV2L7`>`14<0v zgLAioU3<5KWs8k8>|IT4DXf&hbC-cY^Vpl;2ecA4=PKSYp|zHRhJ15W5QkY&QGg@V zyWtD(lEIN7cW?t?dv~)hzOI8H#8lN@CX9>D`aP~1yJ)IUJRW~4# zbt@}5709si%WQpUGIVn~ofo{8TfZgOxuz6D6;qVE#oUn>9NueV?Yxkf*6Yh7(2h9T zo~=>-GrhX%cimQQHAoA&imL%m^cG$htvF^YL4_JqI~B3E#B=R3T(P$4W6)1f!gMo6 ztPcSVXc~*73$>hB;iGCApTTH2HP+4a*&w{F@vAWmrhWbRIx^dg-KD?=V6DrrN^iRwW?se%Z=x9*7yCvl4Y_P` z@_sbq--XD2nK_PUWpR<+WTz%q+WC<8LuC{cV4NLqn;YhG*V$gs>%D9Yrz0^;TE^~h z2(9F39v)Wn`TNy^P^Z7bg@`;-cU721?dIX8^)9mdcm61F%fEQ2d_sv)7(Ic0U{c5Q z!gUmdh7w1Bw~!P!&U1fNWSX>y(r|U^^i1t_k)~=76~7&D+zBsdO#f$Z0+*ZebVumD zLvXCuI>?3kho>@@si~d0kX7TwbyWq(ZYyNcA2j!Kw>{1o z9Gk8$sW^cYfoyvrXPJ{c)QsbYsS<+K4f0F2aj4*qcr-9Kp~%7 zubiAkysp@N!pLYh^N=xxHbPsacH;c)#-|HCcW4a6QT;5hzif-g;Y(P*WB6{@xDwWi zo7oNXR;(Y;tZ2^3u891}py_6RhE*@iO&T^2t+ZAQawfXVxvBKh{ZNwuG2uNuz;!Y9 z1feA7uev~!QyKvis#ahSTU&hybtQ|j$~8}}O*ll*kfo;Y)2d$Yi6 zT$ARH#_id%@7u|X;QkggG*nw+*K+$#9nIgv^)KT<>X0F@f!fL*sKiXI^}hO*ez%}D z9HNsK@2N$%;GKiMkNme#ku~gI(VIp5fDtlf`oash z+&x+h2Til3!Q=qP?`aY_UA^+ZOzSs8&;XUdl9}~>HkcTbX~s4#D-?% zRE7k(%%Q*frt%rWAIQ~j`^gfIv8FIkDU?IWT!sIL+v8@cdTN^mut8^Hy5>%WD0wG0 z06j<6(mYLw%PKz~X^uFQgVKX}s_j z1I~%ioJE@Wg_p-fMTvE@(RGi&%U2>+F7=IDrVN6^)rWhL(M$@4DS;Ihg?P*T=F@YjcTqRC3Bcp*RPx9~hIZi4Z01ubfg!tl-bKE{SLtIxm1 zk*6%EZlllDwSX%4()NEcK2HUkpecluurYT8KM3Rf?PjnhBQd+ETct>S_*|8~lctC% zq@zW`o}K45H;Xf%Tkh{bmSAEk#hNIhQ+FwLpidFrldie+*I!N3?d&Q*@+V`%2r?Wg zbu89+FsEVAolStB9S>#90bmAE_@(KecYwh&g5IqF2#!MrC?Kp>t$d<(545McPqq!= zX#^Ps3V{znrjCWIGB<^H?8=KCjJFIXY)`Q=_tP+Nnb0-L+Hamc*7v9%bqJoXOD3_| zLG~KYXVRq^C)TRPO1P$lYp-ZqS&WxVEepCr1!%Po{tQh4-9sviUF^1_1#~gGh4h{C zvg(3wF&9B!fK#Us=wRU^n>j8imtp5<*P{aX3#RI5?k4?=m435Z-u7(LT89-fIY6$L zNLdjQbx}N<1oAv{abXh4T1HafB0Uf)O3Gia2cRBD zkvgRZAqI?%zqSEym_%)Yv#Cp;Ag`eDdt9n5VK`kPwZYoip#VVvSQ=bI>7oHMJ40eDH!xZz|En)u}Sl9oj2 zF9tWpN~($yh6`g^tvMPe+aLdHLB`OniVzf(c%s&Kn>(?dJi*3YKu_@j8^)q9c`^%EultfKZzeYs_eao3N$r z^4gj?ax}c9?Mr-hf%f%#K_EzawE<$aEW-uoh>&;r^h6#Y;M=C~{7Sb7dgXyTCg9r? z!y7uOeGRHjnV|@N9Wq4Ra5r`)X$g@ImnZ3EH%8f4-g_|wFCIXvMS0ka0k3qR!mwKRT~Ibf%!g z>>n=UpLTcNG_PV?+^e_IY22$#jjt;2T+yGR{#&By{J857tkY2kvKUNF+u`|Kh1tCS ztL%9S@zz~EK|XbP|9_ruM}^sl7r7l(nyfLY6;F~FASKI;IuDpx0s^oEv5?{fSym^GEVCs>ZJ1=8JE@DC*hAj_ zC{GUTGEm_+!|t_xjw&IZRNiXg3d~JqUJr&|gzldQ5iZ&)U`{EIkFe(*BabIfi`T0` z*KBahF9UKb&3RR4--A?V??1dtY*OC}Ui5PDM~`LidB!7Mm=C*^KeV-3K^bgw!bBnm zj5b13kQnMFpDm5aY?4Jdn_XM#rjNqXeP4d%P4rrB6yWy$a|l*-n*-NDd+^U@4OSCy ziGLa^Mz}_d+~fI;y+#6`Pg%t37IMp3xx@7;IYH#i96W0~jzBws>V#YgDoV&UZo*?0 zah<}am6@4`En0gnALi^+@&?L@E;?x1z0fFeF6d>`0}GpP;E2NfLojJpWci_HY>awyEW^9~Rmc;{UwqF$J3%Jn*-jsy)au1Bg;x=Q~xA!HgfOLas z(P&o!jI&%Ouqj|%K#+CU1YBfgqCVJLATFzjN1-B&?TR{QLnO ze)`$-xADz(D|Tyx_ud<~e1Mx-$EB5Y>P4#D^!T`AXC+r|ZPch+Vn##~1{oowZKMKn zF|DarPb(L_L++*a8a9w%1c`tqmHNWI*0$q12_1IdNYB?Z*OgA&1{xAF_ndXC#U3!j zMzPh-vZ9%nAH|3n+xotql|9ScV;Cw97s64NRX=nWtSc(asN9Y4cG!5+EI|_va04Fn z-#^<`hz5=P9>NotMK4IA+y*B{VyqIxz_8pdzux9r#RJolgKb?Kb*NOXb|zSII8z5< z)3KqtLTSSH8)#g1tV1_7 z$%pjpL@-FMpOZBlp$k=|csW&KlTmWrJ;nrpvL zpWatdvOBUg6ubI#pHmoboe|iSsewavuBKhndGzA9k7}Fmi+GG#{6>Mrk0g3>WgbF} zc&-<7M9?R_medKLAqsh6^)yCGDOffI1ew63t&4;Q6BbOi%wPX z>5*k@Ys|DLmbQ^E)zDih4lr;{7>yInoWkb^!_iGR!Z^m5OAE1MbcF1z=0EQ&9PW7s z-ztka-8(||^%9Z_Zzh%K=rCLJ=J`=|J^fpF0M2oOb4>?kI91h zJ#F^5eVn}9+@&*UjJ(>RnkC7PX4-i8k9m!`0NUWS_$LmZQ!Gb|Qo;+KuM@tu4cwZA zuCmw?7QzDDw__I0V=HQ+t?9HRT^~x>z~D$saNlh zcNQi#nR62CXq!j~hn3OU*UpalooB-At`GoI94CAO;#x}=XK{dr5T{M%gLSUJad6L* z<+V2ms=sEByvMfYo)Y?~T97d#3N2#mlx)A&4jL^s2vq1BQ3*jj=#fm?)GIB@YBvX+ zFl!8k60_GfLfUl7{op`$egRc&Hzd#iT|E8yoE}I+H>>S?vZL1FL8+A&YmwF7p?C`^ z?q^t#8g6*>cOZ4$#jPQ#OfZ?HjRLi7215Iwxr;?nW_PSK%>m*C^x(d6Fk-EGb3}8n z2K`cHy=E21)ktDkhA@cz2OataW2`cG0+aINAyCRY(|73fB+yR+$mQpG*yad0!2y*i(r&p8(N;R?ScH}MM2&mt#V8#PCTQ#Rjry8o z|3?790*{p}uCBD}cNk1%@z_tkSpqTKS22;&qhqUGUE{3g{#alyKY85zWbkp>G=NtPL4kp z`R@c5`j&9w(ZOwdm(km%JmzIs8fQJ%FVM)$ea&U8LC>iAJm#J^81F1z)YFK^QIcVC zY-};KM>NaCtLn|Px;gi~sHT{2!PF7E!lm#1^jYqOxC|oW8r#`rbjCBlIYqlizBCf`4vvx zvdtSK{(z>M90OrgNMIpbt$0^zS;cadc(F=IYFV$u6b8V_<2dI z%dzJ{w}f!&lzvEvsA$U$Xb{@3RO#N<0i(UN7p+Q$4@n8bD77O`*mwOYX0#)7897lZ z%`lV%byobu=p)fokTK5bTF=~h8#u!jT9&>a0gJ>Diih~k3$39VxE(s}D|w>atSl%c zY$a{KnOM!I)gDASmeLMJXeY@b5!-x^ykZcnzIPWaXZ0|yGp;V07N2JKqQ~Pjw=s=C zTBIaMwC+jJq23drcoB~_u3)fj$8iX8izCKvQ;~Z`D2k_em3+c6Xqr^Ej0LsFzXE0f z4*y1p>`c*FNwb#7%?g&(sME@5p06TG25dL!=w(h}s($l--%qxz$}sMc2bDSvkdznK z=kY$`WH#r1q5UwxAOE<~inprI(rz{fV;znsY&iWGQ z7$%6uN4fYV%?s8$>|W#`ev(r=9C*TT;(EZML=>Kd2j~~rAv2$;r3`A$d>qCAIlM5+ zhVn9+UX^-{ld(*DlDt6P0QlxY<}IRijaTI509#BXO$`?w&=kPYA-*YqZJC=X8 zaA!v|%M9uHap1r{=)r=zd%9g>Ds1tY4a&K=q8{w8qF0g1j*#O@VqKI{*Noc3I?OGL zsGP2~jIIS!U}cHAK|vnzrgw?v13z^62%G07NAEk)YocX(ZQ6GB`s&a^ZuuViLUjVV z+7jHa*uIh>w|omu)1*N@)QPkE3b=5zD`y*D!4SN0wQ}VRNS}Sv^`n`|Mu{TgMCY%~ z^fvG<8QaY=HXu7{CZ-j&5VXu)rb9s%rbmQ8Rj;U)RKUHLo;vTgF=uV;C z$d3#wDLTBHQm7YPnM5`>xHJoGAC-+FeLO*%9!U$h@2nT6Z)TtSVnVwnj^RXUB$jIKUlUSFi|bGKV2h;(c7ib4Z+@hA43 zLPZdaLNbv^Ij6;F$p7Z%7?kpnGUCHwrXmF&Z`5{uJZGHx7Y?X{jY^Dg z9U6aPdM!_s5#k_72T>SEO!BqU-5<#bTaF ze{W6Nwo7Qt*q&?rGxtLeS7wm|ryBr%b!#q$*al0fY`**2#-Gh4?`PY+^7z_Y zd5pwtvww{iwuBnKxoE}#I!2bi=odt#7Z&@II=stEQmoC_@aroEeU@|Id&|zhdw_nX z%(vnkY(TCH3Rz1&ATaW(F7=t?L{rMZ(xA{n76ZIxNxQn>gH6MDnp9EIDVA8RBbF+B>(TaC0Hf>%bB2uU+>)4Q zxGne7Nwxhv@m=3s8#XKK+2-&8~LkNzCNhP#WC~qMLHSV@gwnU4o}OanGHg8MVhpb|I)WJ@KpS z+ou%l$`ka=?>hz?3A1obcrx!tl}da38lP*REb^)LB2>%h0J|su@o3SF-}7ni3beU9 zKQs4d^Jqg~-U4h#U!G~WbrJY}q5Fk9Nnj_Nld}wSYqh#vsRs0R__wE*0n-*NMvEn& z@xb{ezsOY>ym#SheQ30kG3Z174&pPb<84XBaUTq%1Juvgv4fO-rB-dZEq%ivZ!ABH z+P7*p*$uU+rFNtkSd|&u=Ggx){*eh$@{j?;51GkKKTz2NX=gEN4ESP$Zom|U3MW|9;Dy7jEM>G6EU@upBj=A1!{ z=GT*~rtNm_xKMxeJV`=rq8o*)_7Yq6FT_XGZHiLY=b_0-hn`*Lcg(j4a;BKr6pWe6 zxv~@NUn;cL=W@wus@?*pOKAo@Ed4%64U3NI5(O)GW2#Y8Uwb;B(LZ(#gj$_#PVa46 z#VJ$FnE*rz>Uj-`R3eNX+3e-1nr+gus(cn0^g_mdl1_OKyViyZ?f~$T?y!+i#)(ik zRvv#gIOB9#*UBqq1{42&*ySrn*&=M^?_r$bDrUvvyNtHuvt_QDL*R(7Wm_hCc1e;2 zLVQ$B&*6C#lM`*cUujJw4*|5{O}}9%0OBhtiDe@JiT}pW$e12_95>vXOs23M@>QmO zyTbL2Q!1TiO39l*@Ijx1Q7@}GZH{erxIxE+XDI1 z$mK{?kI%eoNw!Y}_3Q9F-BP+E;650P4_QHFavNa`yNhwg1k%`XkY@jH7MHa#Y7~&6 zcJBOpOTl94`bfoQLYgzp-jQu|2+ecT5vjC%U5E6_xZGTebW+SN_C?D)8^28X$nz3n zw3J1val%n|xVd7$*;+!n4D>4`lKs*?=woogiU#^z4c&2g!3P_$t>g+_tB!#B29}cV zWj%qW;6G_lOf<~&u}Y}qjc7uhdX|6`aR^DJ4b=hvkq(JG>#0`8_wA0QXXhe%HQ+$j zUbdlu&B2Az?Q01}CA2KWhz(aMP*Y2pQleC!d)#1)Gdh}{GV!M}OByoukN*SHKrFu% z&2^t#eb4x4oU`~XqcYdZrTRT$4_vk1TWb4Oj0(nNP^34hxJyfII@Jt5Y+C~cikYDL zs&I;x)#~6OdM%ghNR{#KMF)>(Jr3ms3w{+RLiJWA^CK7e_UvtAV`w08-yTzmA+KN^ z(-q{-F@fcNwlXN(dg=v+T?i9&zS4iXHl9B-UxbNmx8qo0P>-W^-Ma@f){m09<1;<` zQ9HuLvz1_WLt$vun5%5;+q1Wo83F!45Jk;%VyewmPCuCcKyo(D=o0EQur}Z#P4FHE zxjDt`>Fc>J@JV?JzIQ;TPzT4UmKV^z;&LF_Lk})FN;^CfM0I%#$-|?IiDsWxX76h=+=Yb>rs}z6=y0;?vsSkTaa>;d=NsIBAtlX>k=?e zWhX3T%hMzQ_5((HJs`V~A#%xF*GolwQe5)I)d_&m>LOfs5Ud?Wuo-k=+q_Yt7IEt> zaRb>WK1=)ij^|_T5q0ZdVOfp`B5!Eox3dTzN7(dB3Q8HtPtta1so-kXkQD}|16XBn zdCI9sW2|(Ky_DX5s89|HHb$N)W|N9+LX(yxAy9r{*h*9Y8w({@+7AmAz4Js~>3Ao9 z(I>wOpybE5e8N}EIRt@8DJh9+1Gro2hjj_Lk4K5PZr4$}9OOSkYc`Gn8($c?Rk#i6 zN%;$(dzz=J0W%;`S45kpgw0GgiS4&t#zG;H?4G?nH>t(trzB<(2VirNYH$|6W*907 zIaBd*)UN#Wl|v=79^gdOp2sCB2I1Ny1v{=Ea`C3Sg>^wgbzBDzX4z|UTy0uhu*5S)dE7ZrTIjxDM)kmbvM4afPKAC4lRGQLLk@ixa zgpsD}2EYe~&!fMvfGTR`Q=#miZ4=IpFArpgW^q@}O%k`vY0e`>a9|XHwGPT>6?zan zgWWz@eXE(rC7wD|YR)!>&N39BPQQX|8CDmj`l!Yczfker9lZs9zG3s7F61R$jq2_b z2uECfDpW??VV7uKxKH^sk-1|-o&6Ezvmz10eH7&r0^M6TxFCOpJG6<&*%5|+ugq9F zo})9j(^^(kWiR@S?ciX4*1_uSP(zE4;!9L#*_x7OPOSSQS;Rv}UudD_fz8ss$tb7`IqCu8x;GS%L+2TXH$>N;gj~NFkY7m|q{;?H)>0 zK2^M}GFIq5G_5aYp9paSnrM*axcYQ*URIx9%Pm+r9G$-G5IIyn_vhOn?SMz%K{$BX zeHUKdsXt!v-90ijkfo^wi3yQIrPk}RTN%$;#wjrM6n>Oi6@~Wp(bpb+I?b~%=v4;+V5?3SwIs~u$PGwtG++1VF!%?*AySdA>yo$!@t5wG z)|2h*mr|Aj~zp<@8<*d})Jq*($3~lwLpF{>qg6_K>>^1xWXr$k?bzXhzsf?Enbi z)75{S3%fM`-HZAU$M^GPtH47pLyeKbS(NJ4iL}p(#K{u8-!jbHo}Pd?cSV0_dlF~evyH4O zpWj+!Rp(E-Zoe*@u1k)*jyCqb*dH{JPSILm zOi#vf_$_5em~0ON52(|@j{J1W%_TrCZg`N5*)o6wDmsM_Tz7)L{x6E~> zN-_o#ZS_*shW8SQbY+`7gv#ymp3sR?`P4z^Micp^1$v zutlp)I8p$%j)h$+!2`L3#puCe_zmr=q#!wwS|nrIY9X=8rLoQ*gbFEB%Kb;Wo7*|j>xS&o_ca5y=Os^6#+-Zu$(So5^+f86-&o_TAxhhKf_&R_R_`ZncNfvzfB8OaMX--F~>^+3uzCVx&G{NhsFV6j1G!a5RO zTqgDGV0Gr5eX=v*X_2!Xh`ibviz4%8rumC0K!F12!TTC^?|n@TENJz;tTKd2_CnUD z2fOHg>YDeJN@Tj+2)NUPrgQ|+aTT~!N#Y_ya1=3{^K{g_E&fv!WJ2d8o~LxeBM4SR z$S71^zH#c?Bb<-T%W7=X)-^X-ULwskA~;r>o@4Nre zL!$PS)U)?5I~IwtCW)xAZ36-h;6hyb(J>#t|8Vj8B{`*YLUT1CT}={^*Wed4A%L5~ zb2LKh0utZ}gPEc&8pY@4o=y?D-?}y7x{1Vu={mAmA=RyfNYpI@)+4?sodITPxeld_ z1qABy#ICCvq~a$!e(0Lf)jOhv`&Lw9~BU{`duwP}Q2Z7^ID4ATPFtO0Hc&ni&s+lj%P<3Ia-{|&?-Z{lW9d;HJdqu@Em zQ<}Ht7X!7mT`Ygjdrtxb$N6`4g%RPBBu=NyKz z%bnt6dn+9GP&1G<0lj$s{OR-d1Mc^HgqeQ)P_~_x(LnJoL~p3&ly`JmrmC{oz_*GF zPY|G5wzhtO7lQg|>A3wij+BhXY<-vMIkaZMNbz5v#=&w1)crj9tZh9q&hx4Fg*LS{ zY_)<6@irO$>7ecKR~9zR0I%1vmFPSTS{*-0pAOoXP0uqs_4hWBMg9E?&)@&J1{NE_ z6a!@QiU)VoCddUBaIg*XtO8O0NQu^uoQQt#kC=$ftzl_vSlSwvmR{HzmO^Ka#2+L&wJmEGrux2^oG}X^to1D$x8{Z$24FRpWu$tCAkn7g zJFw`OfZotX1{$zsq0UZ;{N%yi&@Qv37>C0^)%3-)5RJ3929=X#7uo!RPnamyXFzZp zU8tXu>)%enQ>V7F(%L3dPqrDN4nSG&>b`LoDNH%s-QB&6AMalFFXP91Uyt|x?*4O9 z{ij^`>%zZ_g@6CQ|GV&uRPOEl;qN>h@|5Ru^8?$vw{i-bTW#r5J6U7h?d7%?R&h}S zl8f=Yc=$Z$?V?fwURPvM9ob3>b5Yn5CRcXOJ?yy$Jzp6K>q?D#{vo}>ChsZbgog`- zhV_KVtQk&Wohv#2kS;8q%^X!U*8x8uzr$$^1AIKU>198_UMSoAaToOYmj?%TcXxfJ zI3TD;eJ&1S5y=Di)j>jYCi8w_j5o2+{7m8VBDNRDQF$CcB*lbK8BFFnlk*hpdddxE=E;BQ)U@Gjf!8#$y^#BP|z%rLxFa3H@P3J7}bx`S~LZd*u17y_{5! zRM?K^U0^36?<}w!&nF9~$Mg0QyYUXlVK&}(T~-s^u*+zIKhkW*^L{gv@e$P=T+e$; z$JX<{Ikf(5uyABOA2UwiSIQ~*xvn*vfllHHs=Qc96k15pN6+uy2x43F>p{QzMFeMyTYpI^IyoWV!!wg2Y z*s@1e56Wojl28DY!DTN=rJ9TW9t^q~ z3Jm+onKxgTtbn802`gY#fRFFY9b555yP?>6+GXADE>MdAs%i@Ut$=0c#PmEHeEA~u ztL~r#A0^nweLAMFbwND{M?2^QSrD2cxNOC*K|Mq!84QG?i$7X+<`n(xa00vUrj9$w z*+oC??)|U-{eSlV_2uQ|&gH=mmp^{})qnpFxy&zTUkop2gTdu&aCkWzJh_|=o?gxd z&n{k zfBZwpF732KoqFP%V)v(I7k*|B5i2XR`cn+J`Nv}P7#a8v!{&eb*I&<3B)`fFL(&O5 z-ylOc*X{ecLHXvY9Kp6w9*~v!Lr69xfn_<*Gadvc)FW?cNUiK1c`wrNg$~?p?WLjJ zXQgGvlF+oYVi0mSf>tqhl4?%e3VTu*XOVuTv)e(a(?=a^pAD@E3G~kp4-qya1 zlm%h}58XABqLQ2-=h|B$kKeb0+mKoUtAjqKw~S1RB&1`&{iCjdY6EGZ&{Y{nC13+#N3qw;C@hveK%&OtB|#DG_ym_} z>!j#}Bd~fR-SO$J4Sme0cYGc;_8p(##oQd^ULfdRcjI4|vP2tz-do9v))~2Zbql8_ zZa&yTsn>i(5WbH=rEUhhK&bQ$S@uHtU|^%262|c9#yZ!ZJciFYQpoVxUc}prxc%8) z#QND@#P-=<#39f2A`Wd-CgScqr1d>DM}^!FI@NCHus_(@z=fhj6gg!qc1d7qXE9x+ zOXoBecOh4YTm9&;KiDTy;H_jRO70*@XvA`o@RZT4TsHt_gq3p!7SbueSvZZ9{KEPV zY~cqDc(FMBj83M#Vrt2tZoIT-Mi?@Piwcvn>s|Kj40>Pw z_=nve`aj}Ndtd*({MjFJ(1B%6c#4jVQ=sh-O$y5@0D|k#O$%PlmkfX9nfiCoBAho zP9j=J<~RX(>Ynh41~M_Oxl}luL8H`;c$z}}h~et|p&kv~I~Iw_}z+ z^n!FdhI#+1;fUTuQ)mcxLgf?Pk4D=@_pj0*v2JWc`%xAY&2(X0+B%5BiJU-GI9!M6Z*()2$7+^+5%*5R6lZ&_K$0e0su>>ktiqvL9;f%HYqO1vw4dz0r5NS?m6fr3c zdIQobNHU`{l7OP<7v^r<~sdN=lB?3E&jXCZoI!la}lwGPf+{$cQ==KX(DoY?sj;X^Nu4}qf6 zFUg}ZmAjH9!@k@09{HLq{ql#wkKUE~>Z_&i2u2q@YWWs5x(!5{5#rXJMBTZTH~LCOXV~lK8<_S5$wyNC9NCoi^s{@pluD%lNz0p z@DpKfMF`u|644#yxh}(!L(C%hER}@BZ+Sj9-cWU=CKiGAz&cHLRqNkeT$~;p_7C^a z*a8K3%0E2uXq#r7Hq<`P_-Mp3Ju1_3&LRnG6uvMf?q$-!>hD~+NP~0RmWA>bM-EbDX4uI$$ zNxKECnfh@254Z&kQ`yAgqxlpZ8D+$WU46CAEF*N7vrKITrEZ#cG42vxjS}w7D(bMt z&*eYdB71J^);~92<#{xP^SiupsyFwsuI4@#Ni5Yr^|9wE3P`nuUfQp1OeH!Vv*@Nx zhFFpy@H+xINK0Zw9!*<-O8jyJHa@=?XH2TO9=C&tE)A{(`P3~{hFhlgw(JF6-F_q&I-%oL$=`@*J^Fm7pAq1Q&$t4;K$x_J8q!#eb z@0l^%y&jm<*QE3JW-&IOD@s!p?Q^o9U1upw2WqtT5y z=hQl zq}8+#7>%Jua1Q?ZlT)ADt*Z<28>ekY9yN#qS)ngvGcg@EaB_-txu(AAUPNZl7H832$M&@zTjm|L0U``%v4bPIF_n3Uae{WLFMIyXKSPcW7YM%F8uewYS0 z=T=y*#SRwMtg==*&c9qJSO{+)zutxFl5c{<2@A_u4K(Q++e01tqAqbMEj1R3s)c3J7__=KY0)r840|C&rmL0>!$5`qAUvC#k?*%wVUPh>Iu;ZLVYbNQWST za3H60^@GlSfP4OL1IZEa2apI%;DDFghpXe#;YT-!=5vBwILjJMnUc#f94x zi&*Su%PaKLtL}<*v5TB#6P{8JFirOzcA?wFiV(wuj&RF3<;LY$WO*;*SyXUs=b22= z;)5BJRF1vrMi{6;9&xStQwOU*XbOgm%)10t`Pn);?vHLp$^_UoD6+S6VZ=-GAcRVG%fF;UxA ztAf9Y@)DlR$*_8m9ScirrmRF*QHg*!-EirsV>yZLlF`OXNvyAsL^oW64hjFOA&YOc zfW-Z9#aBTU?+h>Skqbw3ifRu>G6;ny=m1WzYRTu;ViB045J0K>m5S)Pb2{ys-%yc= z4!f~afr##`Xrsj;)>RtfSI4?nE(!7LV%)#3QV_qMDls?#O;e$`9?7_N<9t5+(t_2Um%N?w8Xg)@%gWpJ@gLRZS=u+gMLy3dn z0teyc4Z?~Wtg_|qS=ivg${K9AsKKXP(x5{DW1oZTVF9P+dMGQiP zs?Y)kT~FVqRJ>q)r3*ev;eua9*@A~GTF|LvK?g-MSgz_&tf1?;dALFan=4b$sYt($oPd1EDN9pifC2vwB=q4Y^2mG9mJvHssHCshAe|SY-T{ z7EwPGq|O2*8rUpM$7QperC{B1qX1c^wqQeBl|hwOIlUqP0ox}>m6xK%Ku3tLy=LX8 zVj|K?TiTli5p)-C&rMit)1{)lR_e_vK$za+QlpUvXf2CyYRex2SVMA0=h9#&8fCnN zb}Y@+$3Pc=v2H~t@T*O#O`n-PT!uKZttnP63AIL^>bg5#Y)zLCEPvRC`qN6ZXptsL z=GW1EF-w(B<$$?CL}*LXVcMnAv)Ig|TGBY?s6?Fxd-j55lWxM?F^(58K_oL`9r`c9 zJE>0x&6J{)nowm=vkSXWqxfsduev7zPQlR4C&wvfDQ>ws1!_zwVQG{I5Z7fSrWo{2 zSej>CgAYttHu7SL$O1w-5iOJOG-VmKXM;f{nb15MtB#b^YYP;38diHsH`Okq1`1g* zm%y7k)HL#L0noio#(-twx+l4C_7+ywZ;wR{8)-Ro5JN)9;fr7oAey~>&e$-JdA&BD z=z!ZZHeA3wDX%nRc4(81Y@~!?Z!Dajg)tpE<=?T)?yv&1M9TA6WI+=dBBt$$+r-{CO+YT}aC{QmYrOCoJ#ngV>YF!n?pfiHzVo|BOwQbcYOg%WQ>7iu#k-VcD^oxR%2o5^g zF$JY|P~((>P*hI|Pp3r=IB2C5lnPS-r$u)8m6XQ{V0en-Y7DqPi8xdX{=WK^L%wBT zamgTcu~m*-WOt7wxmNAwqT`MZlq!=%+?~=a=QMez&9vcH_{oqQEjO@`oD3D%Jhvs@ zti^DsgUn#cMVj-3yrVNi-+8X}JxI^<-NB*Q0F!D5zUkXYq9^U8Tq}fHoP;#8g<)(` zX$+oVL}Co-NS@cT{HVyszmOqMlmZGg91A7!q`e87h|HsZg$L3EC3}WP#!P8+b0mYP zUEOS_<%d-f0SKZk7e0-ra*EEi(E`GuGI~d@=N?qOwdt*%7b4M~HBt?Dt*EZ(V;318 zacg0-RW4dhJKCWAjkt#$Q89$$jKwTfJR!8MM>&JLF#{0SicqfcYooH=`-v~mp3cn) z9O04k$%3r_3|nb#O(Bml_MoSJpNXUgz4dfb&f}KN{b;KlTYshPD@xiRJ2D!x z343{PFcvcZ;pJ3h`Hwqf_YQzRrW#tvM4#>L6HxI$MQQ0MV*o2G5rWx=eHek3MsAzdZvyQdi&CVVt*;btMy2%AlXO%)FIU^w3_3V@!g z2K(CzB;;3i*G%Z_s7*l+KUnXeC2);LG}mZewnV=cy&-1{f?MrAw^mpkC>(heaoy8z z&8+qzP3B}OB+vORGxw-!-rUG&(jAmORydf7TsnpXE8Lfq{cw75^5Ok?OP^@!1hZ$7 zRJFVSFXIDR>IV0*%=zkfx>9=ED=1X0qKXgy7T+^$ijiTFBy;k&f+m<$tQnM>JCF%s zN<hdqNR_P4k}Oma5K<>Sl# z-q#yJRQD`7pW?ND@0zM7r_j(Fu#cVEIvgeD0iWJJJ9uFXXjzeHMre}eFc_rK1A<4+ z$rI3LzpvyLL^3GfGSXno(w2I*z*a;Gd!lamN;Ew=eZ|sw<=2`Udl2E&KEz2@@b)xn znG-a{Q$opEGkRX@tshiJgU4$_<2*ijb%x6dKV2sxx-pBZL~cI4eL-j(!-WHmJ-yx{ z)vi57J@AIKy7UO4 zmh2N6MWRT-d8$tE>Dh<>_)j%Hk2RS5NAHbsCaa&6;*~NMdma2ea&^jBRyRUDvIQk% zA1l_W0j@f@`ym0U;kLejG{4^l^@o6~qu=<))CRXy!~3`IFU$xV()!hai16DRLijZ;V$RaW zT7xy?^Dv$x(;(XTVXUr6CKs6hqis$*w1{^!w00nwh^CG4w~%h5v@>hEBlX+Pru zIjVsXw;_3?CRk-n)(X;>d{lzABhB_Oi@VXSKtHCYW?fV7E&nT*`v2udE2Pw!pj0-M7TNxRk3iFC2I$))mB;I+dIFHsyaSH13G;RGBT` zT0kZ&$~_RAUWq6F_WfVZgNKb04N>1T+~Vp4@KH+hB5RK&3kS1_#@6GpZlH&6tk*|q z{{$YGznqgqL^Mg}{bk%PZ>tdX`AFIfATcD*C)&O31=jct;5ZQyr}C{3H^uY~o$#a; zyppU41NQ3uxvMy4Op2sf%&WDl`R&8;25t8Pt&yx1 zv5|Z%)JF1aL2e`ujNVAPA~=%nx}rOhkGGaV^+8ry z%!fpLB&(u6l5pfl(!CN%I07W;gaS!A)Bp;v`VoW(NjjiHl5UkhRzZg(D4Cwl+uexJNhN6BJ8TVQ}TbJveFpZ_jbTckh#m3+A32!a>(pDrC?tw(L0L2PI z-K2iGb(Dx}+ES)Aoaz1LE|jz=4Aib>MCqvJpT* z%3fQVH7=Rmv$yAaMnAP5l9)vtF{DxgrE|TB7hzh0Gl_K~3%zn^W7a@z5);C;M7ulg zacdH&;=)pv*$grVNY5perevSIrqMW1wG)}q6eKzPgSw!5C3c@d!fU@NgYL+xpTnHP zl3JEnWwe_eijY|-S(P6&6<=aVbXlJ0(is_okxFRUgt{r zROtC<+kmsP%R?93DDJ>HD%+IEoaQ_NrCu?Dpdy9k)140Lx#>a#vhv0gn6?CE;Zf4*V!KFc=3P<7H$2!^#jl9ga%a4yVxHY!H_6yUBh&q_-GvLPk{f1D+7I&514 zCF?zsWGbdb0&*O9j)Rm<^H4J4w=8w)CL05ZRzxf$@sH@ykm2KVOyK?zH8h-`p;~mYT@ki&hW!GJJZin9Z z(A{K@q(y{)B&!nZ{_qd_H&MoOmT?NqcO^Dv*z^u|^)s})v){^uk)>~%)uLIx<4O}3 z(lF0Dh+gF0D#Yt@z;=IBvELAB0+dOEw2;j8QX+U_?lqw-K4uFLo)VF1wq*=Ab^CJ{ zY;TG-2uGBP&~s>>g#oWRgdt5N>mZrob5X6Ys^+nZ*5rrLTztkpG@H8Temly5;Z)Kw zmkxgkg-Az~r!seUTUV9L&1!SthzvKY6*2TK>b49WOh)B%KXMv^!Vx_dDb_P_KznpV zNo4*6kq4UhYSMmladFzYTfKEqL0zMf3;j#96BPDZK7*fEuij45D6v*D0M7`t}X4qR6Mtak0;W31!d zzr6n;AUifOBm&4p(KXF`>) zXpQnr12<|{=<4g!U82FqUo@uvS;x{~>_e%pFDu}c+qZ8&FxTd4>!J;35F-a}CL)8SPQ%K1}~uZQ`sO!B5%qwNOp)@o^f>@5J2sFib# zB4rE^x=+Qg04*1^fCpP5y~`f(Txbz|@%mV%A3)w3W)^EYu68`6&T@sG`_5Hj5`LU< zLoQgY>-IP2o<-aRYq(3+sXR!^3O_TW&XFBbvpD26y4P)CaR> zhn(JnJuhvkF56?(Nz&_w*-?N?{ZRV}1wi)-$k?bzXl6iVA^laOb(dFgX@t86%^!xR z=ga!~LlM8mbl@yS^*Tg~XGK!#5%=2g_GCf&h^}K=x$X@d8W0R~ml;?$$SWr!6VB;s zg7CL#!u6>x(wJolF$3zy>smOAy{I*i>ReKSW z%Qm9YOx4*=Ozz1Qy1UWvX$>}RdRB0X;nOWbf3d@mSbg`|Mh^XUB8NJD@bIZ1Iwsch zUhuR+Clof7O_aEPrQ3AtMpiJU6!Ta2MLS>%akT!F&Ee=bNlTX*p0Q_M_7vZC3*hkmthyzvq3v7Lg>|{Zt8XJoo`cK z6}zf3kdcrO-XK86RFAmTVTq^%*xG(pKwxoS*PAMfL3!HTkt`Bv3>Bw%TI6g8qKkIM zqR2eCO@0Ke9>LZ0^04|7!GLx2&!#d0xny3Kj>}h8WuL9w@ZL zSrSYA?KMLvrBW0y?t7h^-q0pwtb+sc{QZe`!dGg5qB#(fFqJlBdV|_(!@tF8Qz)G3 zI!|OD0d_!usKX|r75pRUndg!vO-3l2sf?&P+6J#pma5M;|NiRzsww!G!t`ALI952z zI9_P80s6empmGV)(k{xgPNu#7n#r7ACtQxfdjaTLB28I@c4L9pL)-C(`V!h})y4!4 z`{Z?s#pj@xrNKKWV{QFC={xl$fhe`4up6?hqzaMC?Od=NLWy-OG9qvIbjspZJNA2# zvzO#tyYE`3r@?A;tA2Ixnqe4bp=%UIBK>QT;u2w^p0lpBQc_-GNqM#HTRPCVn$is0 z87h_5m;@AMsVuTOg8S?uQwk*(X(H0meT^ewNNwHjX#)^MYk=5{li0A5V(?OQR%ksx!T%JW;|2!q?IyA;(8@pA;zs2wdaV&Uc{L;rBJfGbHHQhmXrG^ z_*Qxua2}F(;MqjYICHZl5QGz z%8a5@2#aBn*BttC$I+UGab7w_jYZ43kIWr%E%NdGct`1cT?d(+Q7@#4qodJp;?Z<+ z8WL5itxS!oZ)4xdf~)sBTbO|`;m#Cna)I6-$rfibJ{vabebNR!FB@nTEtx-X;Sl3c=(=OQVa8b+C-ag#b^EX4-!7);KP8f}w@V+eT2_4$hBR56QVH!WSqc%)d_Lg#J6?sGkY z<=NcF+2nUZeV5VNo^(uDF34D5RjOX41yEd!6$=V$#(HcdV^pfWVXiv0F&WvtP$xlT z)^=))uWeg^kSmsDB9m7zvN{$~9jvJjl`%4;xxpE(VF~kHT*WN zReg&}<^aR9meJtn#U((p=&A>=kkeX_!|7O*LnOOUvMB_6+AN zJA8?Zl4FY%rl*FYI0H~wZO-e2O&a{zC#kz@_ZM55Fq+B|t_3fBqS2nf+04@s8k2aM z3x{(m8B7q|qTbyzp>ra0&A}}g1adI^B~N3JwPGVqoxzIflKN_mvQqT_g=NBIRGRnA zX{jBGOn6i-m15GZi{p?943SNAQbZcl7;z7E-Cf-CI2aNa0EaWpgc1bRk1iFPwX19nk}_gp465W&nnn0`M6vaEwdq$)mAE9L+;Al zux36eUTQ5)k1)4e-n5KO)ed79?U%TqYQ0o<7Jjr`JfY4Z1!b=+)ov*VV_cZF1W4g} z#_+C4az0HMvL$sEoKe8Rhiz?#P)9;v1Obk%$?yb7lo%x{M2Qa1UI#sX@_%}ByA+XCb zby|;KiJD{wwzI~9LaC+I!gDcpwqwGFESg6NGcvlgcPTG#bK5mA5$Arj5LkFzN}8xa zw~PVG&Dq&xY$9&KJz_2fBOd#Ad05PmDc8A1ukSl-5_j~tm{4_?X$)@BiTN8IH>_@m z@=9sC$TJFPls?b}9TutYC2CJKSiwBOZ%%dRCttj1F9{nM0EhR^dNU_Mj&)AyG!vtY zP9{*5jK?g^`H(A>tfXgo1zPRWa*9WiBuZ2Xr|@Ye;v!-h+}qmZ8@WJeAe^ZsKwm(4 zfK2XO8iNE3?7-d=z*T&}-XP;Uo`o_SPYpn^yo@OYZB)>Vra5CVIXXQFiT%X9V+U}7 z9McI)5Gglc`&0sQ)#NoSDDxw5J3H@i@Z?$hyP+YP8YJx{`RRwF-ha{FFF)?;9|pZI zf8Kxj<74NaKkj|~&+FLlbw=IAr_SWMtR8FZ_X`M30R7#!HNH)6QgP?my&;*EJF3(6 zl3YEq17q^NrN^`m(!y(NWF!~bEa8d_)li5&o6*TMVQ8qcZ-jB;QUhza z(aU@L3NGh2qDW)t-Zd3+ap3$ln0qB9~-0PUYd@lc(p!HQFBEO!9-huXq1e z&;%S;@9BiSndJ3$HuJbQ#o>#L|Y1poL$ zuROl}A0O|1?fh+T4Tm`-pI2YqEpN0aUiboXjFuPFU_Cyr*60`?+=06MF6`ZR!JA#R zq33J4MO$=zV~l7~v*m5uwr$(CZQI?q-F@4(ZQHhO+qOOZy*Ka2%w&?v$;n2Yx)4G z=dRKXNH>(w848L*1Z?`U?M63ekNg|5c zm+6wI35M&U{cQG7W0}PW8)RPUI}j2hEM#wd)luoZup+ctI<*P!V#Ttf zIn|=-RNs_tS9Ppa@#aYN`&hQrb+`JjDL#@bfSjtOOg>9IOmD}^+?UamOSTg7KTU(Z~B7@APj+rBUoo=cBEs8?@ zK%Cv_qDxa$dYp;4m=d4$aTQ%LzIc{2= z>{l`zt5BA`+6YaE;8)aV7eX53fhna3X|4YQ_n3t1<`khWqqsi#%V`X?!1J zaFfyj8DTYbn-M3lN*T*&jU0i$$|gWgN*(dzfFXfe^TIB&D?G z^pxcyG+JS1R!y3j0`|VHv-mun4hYfj00rkk9;ouKH_V2=yN`R4`+r9^>9S5wD}!BS zU$xBx7^bMoM1`X*;`tF>80oO^!if=F!x4-{5EVJaB-U0yf0AWRUL9G8G(l=6zCFKd~K<1G>% z1EPs<8|x6N=-TpJu!2WsRqOFrvi29+atXm;ayEB1<|;Qs)njW^7WFHp66|&NoY}hT zH4XKTI5#M^$dLX7TA7Gf67F93IdkoK{Op;`d}a>z`2NE~VtH*psbI}VkKDujvPn|L z`V%LD1>&xJH@Y{vL7C8P9iGDp);y9`mJsobX2P*mMwH@bsM#hj39%^f*xmrJm1q+? zca*NN61gK%;NB;W^J-6}fj!z4kkB}Ip9JINO}U$!9sO<-`%_$+RAl_&4ItCNN9T|* z0gR!;WX$id0Cy^%;g|S;hQXDqv>gyu=q62ecar?HNIzI41vRY`a-;wT&%$pl>FIMt zi5~K{cJUB_xI7MF=Ez)G{G_mWcovJX(kx(UW&tfqiiW6;x`LFQA`&P;i<-d$dVES8 zM%Qh>FFfFV*aT?jD@P+ZYuQHadv|1FOf!{(mE0VbkSV93%;8avgEj2@Tt08u0DD2d zVRCn(OV0cBX(w31t{v5zKBG{^f^V%1RJ63QvJj3`;NK=1276H7Q^hj>(dfNq`0&|R$c(jjYajj+1Eq(}*SygzY|~zy-O@)n*8v6XH&uQ$7OPD? z3FWBmCMXINVn$eVPChx-GW5V<}263SmFA?SusX@wfPE5gTk`%pT9Q9 zBc)EEgUYCjC|Tz1$o#&}s0iL6s=PfEc`FFA^&jNUO+ZLn0Fah{{#yKfG`YK|^0VCk z^Y-71Hj71Vm55r(;x-mXZ7dI2SsXJkHGZuBYsh5fcktLO1M?TJ{lB;W_ohHIDDu_S z3sm`9ujc=8ecu3r{GYG=C$_l{H2hDL6a4=~xnGAxt~U_muM{VJKQF#7;8I5Sd_NCs zd_1=W3-fS}tZ9PFHv)-6_xi$4f5lFCMmHx7*K!sl>MijC`t)!2*O*>!^yy1KU(OJW;twa7qWz~E)mn>jl@?9e%rTdof<^Q_`#q}=7<@xizb`mRPM646R2wE#_ndUFNzn{n#f+0}Ki4N_78|rO+aX&{4;TBF1^q+;-Aq?M zC*V&v9?(KIQnQoObIo%Gx0_(M04zWj_Z54=k+)#cPc+Mo`gdC-&26`ap{EU6jrv3Vwg7Ppy3Ws&ptXm$HBp|L*UEF$;YwtbLn*dH8#YC*WHD` zgO`E-4t%iBpHcJq_)d35+y;f?e?VXDN>shpomNECrG zHH}dL-CMkdu0ox6Rw_^VB)-YmNH49yx~G_*Mia&NkxA^;4v1*2V5 zW2Ths(3>pPYm{COj3Xd%zjpG6A)hx)nDdZmXc9K{;TQV$m3ZVz*r9NaT-^BM^{c0r zJnT+bLb!)uHu}i>;dKy85#iNG3Llu^tX|T3H zJ!bb1*SH0{QWJ(OQi~g5p(cm~R5SOe1L%dBPm2;BkidrvNx#BWU*y=6|AJcO3@UF+ z5R*;rW~A(?CzJ#j3?M>|);s-m62+;ZXeI;T)y=KhKP*7iaYqO#NXxFSY7`4gl+WOb zklZX7nqK{_9F2#hkRvMbR{nL(8gmxQIo!Skd1(+=NIVExaUIScFwilA(ibk;Lzcve z7g9tx8uUBkvo>M-2qb+|X9>InyHvWSZ;jUX7xtpn%B>H2RxIL}L67@H zyAX6DCU5Es_gJYm!u4c*t)J#SMz6cb_tm^o`Ud%?r`Z}KvAu=Kz}tnCqnP<8*MPkE zCzi?xwIZp^Vp`ipT(qe*QuF|%^oV!R)q?A+`%AQ;(F5^Tg28VqmyR4T%?y;8abKwj zaMYhF?y(`AG#Xkq){ulyg(>lHYtEO@AIcv~Z^ovwK-K~qH9YU}msR+vdfQIJzrc}~ zV8u(>%d3@TF;k9Fhtfde{&Mvu0@O-_sp+{83G)^?L=JkrabSOhnL_rU3!Lu-CnsK& z_p&iGtY5@JiqDy0x2pX!MiA&3esSs^-RLVJdrsE*I2JgKZ7OUj-A4n;HCV`DG?0|5 zNPD?bGyzxdwj_D6fk;Fi-!>+$@|z;M&4n}Yq1~=yLv|5;Kq>cS75}KWgi!Y^ z4=|J>Et&38`fVA%mswnNjix!&IF-SnQQl8NYNzXH*q5w^!?V!n2H3@;O4t%o16<(v z05Jjw1FOwMo=ZseyC4l4uPBHr6>*?*30>X(4bZfYg;N0(QceOc`O+8eKeUQoPTVYRXULJU2vHAMqpY2XX zn2uj{X**Q#%ri4`LLvdkuE=vJ4gD89M1{r_h&)be3!~O#FxLEO(UL~Azs!|=Zy)`U z^aDY63yG)_3mGl$91=@A9bt~UWKKP<$A?Qu2P$q$-5v#kZDXJQB~Aik7-iXwIzRs~ z-LlJj1>=4y1qCxbmKdKHzd}`9H@Xja>kOqDP1s3b(*(?&Y8;BZI-U^~NK*%LL|(l& zC|JJac&n-QyJ8nC*P*;mKz;4QSJe)489WE$xXLv~WAI<k=T10p2U^rWUX?>Y>TH~ z)y6ZX@Cjam}{C8_Azk%Ov} zW~I~d>9|EAvO@s-!=PYNl4A_QJoZ_)txR}e7jX=+RIqnCamT`dx8nD~7;hTxvqI|Y zITfRKzVG+f&C(6la?q*T-uw`o-`>96-bl^Z_4UoL^0h472Q0?(=+2L9d5@*#&s>36 z%=02#dluQmm9mdXPgzXN0DopzmkGAfjK4)wl|_@j38wIMlA4u!-9NnX9FcL>7So;| zo;4forghSanmx!%0WJfp<<4i%+h^M?b)O$k#TE8xirl*(xR+#BY4=W^<(eBwsOBj5 z6<&?TEY)vaOv?^ckEl|hQf<2=EljO~PG_&iS#^%TXb5%f4me8xnp6EaH)exuW91#+ z-*sY&;$~5;9leAzEir+KV4?LZp0#4NnHww4#=u`K#!`#xey=k`t2KN^oB<;gc$ReR zP!E&`VJykTNhXN*6v@m&trh+l|EjfTRIev!7f_w5l@(3HIc$)Mkuq$*eLA+=?2{Bf7LK_M49tRJW~5s zU|pkk-BIZ!yo!BUf)M1foBk7hW>Ib5`EJ-_32y6;Z>f zr?vu305*yU|cSEOihNe4S@HedooM-dSWEytE&c2^YL*Hz@qNCpC9s((r)59t2=x+m9gt5H;+;X5}UkNd+h z3x_*No%DKi=KWr57dLzAWD`anAbH$)z!-NDSUm3N#;Lqw4Cwl}dN&W(o63FS7M_oX z`|Z=oZx@7{qwVXyzH2zXGGCtUjg7B8vR8wb`-|Td{(9bBA8)pLU#<)7Vo;BQe{Ka^ zxmF&{yaS`uqOwrE>{0c@@+YDS~qY)c+H`=E|3 zZJl@al-$uUH_Mz7{t^mPT87Rsg7P*F%I9nc;P+?|i^FjE{Cwy;e!`AA$XTLG;sf=T zH6sihq3f^>{QjzlkK9pqH>D{)&34_N^N^V}jo0Xh?<}U9^Ge?zPcEzbjvCE(JMF{y z)mtwRqXC_+m`h$w<%EqX?WuXg*s-?BHRC=uL+{YsnFmp~MFy+8x@b$U%7wppRtvRl zl`X5+*O!+Tt{3q?^o<|PJAIYODr4kFtVsZ3)b41 z4!310=I2NT+krrWD~EBk_%bBTB{QvNa|o4pGn?uEY?U+Wpjnu0C5Hi=K_vBF2beU+*3Yf#Kvhh6#G zcXcW)`Pr*Q1REd79Y9 zC%0o?h-%sdD*FC>h*GG$DJd@(N^o5sPYH*D<(iuhqJG=%4}8&c9xzBUxo)O$QmoR zb|;>Ms>`zXyOmG@_0@}1mMmYDMPTU}vjg)x_%*BGz$1*Q9b~^A>5Ic?x+b=e3 zdVQINrz(+jp^Ad$1Lh`srCVUwwJ1}Mh~KJ@2VQ|9y2QK|_UIKnZGBu-wxCcZxXs6L zBSw4qXsP*0sC>255me94?lfGrzeGRua&3w7i%904qEe8CpWuw$#A4kd8b>Qd4tL!( z^YTX-jO`0i6^`ac=CfLkLQ9hc?9_LEj z3$^Ry_!!ji<8o$o;6Ka26+UeQWs679A-l+eC2mn}+H-cOxL{!)%2}n3GJ>k#YW>T0 zP4@ZV8Lxb67tLfcj*Z>AkrrVE)axC=JXu3gxfp*Y!T`lzh{y;}X4r$wo{Y*QuB_W4 z!c6H!X&5zfMfKM?Ne%JZsWh$9&oI1}G!8F}BQnpazduGa#LSSgRcupXx8%Zf96l zckfT$9EMiLj@zei10(%Rjw7_bq0Z!X(*f?$XQ?WQkV(OjZs6>QI!D106#|mUPRN3; zGI2uLdx~5Va^1VbBaJja4gS5cExr8(a?q5)8#yY{wwZ&2kj>1BqcXA77!XDFKFtu- zd06!wU(8ED=q25kD));q34sg|T%#9;)1*Kn=UgLTTnbRp^oJ?Cl4wU@Er}~91_m<$ zq7bffzgLef(NwUh9R@$7fv(&*v1hKa3qDibs*&A!oaSt?>gpNLZdO9o@v9K620?68 zr>Unz&F*c4uFQ%Q(U)6hN(@xan`{E+F(JE4r?A7<8#XNmn|Wvu8gr_tdzT|sg+Ms} z@-Wh>t<5M`8pfN*j$vguAaavFL0ns&AaU)-^qNyjtB%#4Txr(SbDaHl2 z^MiqnbpX^bD|2?-cToAEC-8jrgvl@H98Ui@KK}W+Hk3scwu-T_DWbKAAhFLu5Gocm znj4L1JOVrIqZcVXVvI5Jds;;Gf+PvW!lVk3^(#z71Ubk zT|(AQtTak>Q&I*``Ji@(qL7Yk(Zs3a3FYwP53l^jxzNGa7J#gK)JlBXYyww^NCKZF zb}CASW^KNCLl~EYG|zkQ-0>fuL{a-F-_O##^Rb%^fYUMc=gm_mL0S&Z;a#_9z*X0$ zs6RZIq`R00txvfx^G6c)%j=%~K1n6^bBS12QCQHU)mWlEFN*|FJq@)ULzOzKYu6QT zm1)qkay26);tuXn=GW}U6n-8dgj?IR0+z2D<`A(E`+zdBI$wB7(d;7k^)2OZo#Yzr z`eA*s_#Jks>VcT(@k)_X99%8p_MMb$o*I#%V(B5gAS3n@uFeLIYx^|c55!cDwMM?Q z0}J7yBT}CD%fj!egMt|qLJVwM(-KW*xCE?4G(Lt%!kvHvggNu|8$hS6JQe$f7?yDc ziue~UW4D zV>k5cdbcE2`0^bI*Qcq@M-tE}q}Mui^Db45t6HT}pAgTGi_0bl{I1L#!M^2vop$mQ z2~$E(SBB+rQz+z>A`1&8eaxa`cVuTIuFHsmhZG7a1TUIL`QYyq%K=H{Ex(!?Koe=R z?%&`IB?vS}cJY^^diHq$xDJkH_SR=h)vVX$jw{=X15a(lp`__#T6og#B+F8&aL_1= zDuTM_U2Ry|C6v?!dx14rxuW%ODTVVUo>tAq4sx~>q8|E6Sj!FWM4LH6{}f8)2)GdtP-d3G zr(eOKQst@`dUFE_C0lP_#yAGRZ-e$qEj?J3W%6J>%&g07yhHQc4*%QNuP3OqETf;9 zA0g>BfpL&sO(le|nH4lNs>c4p3T?vrB@v0`HE7;nOSE5`lO@;V9;l|YR9UqNu0*%7 zt+jV4VMc<^!Oo3{1WjZCY9|{`Wu7Ah8h^+Oyjl(gu?AY~Ux)KJf+b6=1%9SLx(GS% zr_CGV!=81vBv>vBTv+GD|BIKPYGUVHgB*ogig8dL)BOjYiUB@QpE&L1(5qsJ&Cti*1UD%F^G{{^^05Xyc0Ly2>ch;^5Up2SiPoBx$PzI}LibBQJ(zKwl zrf9KK;axl}%~Z4?<4Kdc5FFL(KmMX(GUEBn^ z@7s`+y;}DtLe%upwuT8D*97=m47Yk?DVwvt)_SwA{_Wm2US3FQ3H&}=_v*s8@9vN$ zr{>30X#W#gk8K_Ob>Bb^zJ3L(yuQT4!N~ zK@o(nc8|7i|E&;wNHHl0<%H3VvGhi@sQ9W= z^+s|uAfSB}CjE{-?xJKSGZLjsKNvQv;>{VT^Blu6hK}{P4mc_a=E)kBDfX*#7_G9C zc1zHLFcnw>*UtSb=*9*qELKN}dl9O*tNQOsVz514cXoP#ev^+05|X?EwFP`*MwI?~ zSG*evO&je{G{j@37a%*Uu8mxCd%IlW5ZC5}x;5`()G9dSCor)UL)@E5%DwWyNm!1L zf<&u~jH-1Gs*yjR7ab1zfL(?&&#? zGMvf{^Sth^7Wsz3cnRLh$n_k?rO0n=EIPCnO42mqHdnSX%8$E3I^x^ZlhN{q9G(r? zRC*-Xy~ETO;!d?_<6DtuA@cLswsw#rp!&KPRpIBN>Wv!C_s@?sd`s?cq%>GOCehDg zV^itNjh5&c23M8N6)DAxl{`G9H18QCVTteqN&>RFC@7#B$uxt}uzHV-=Fz-o7Kvm9 zKluecof|4Y4(#vumTsT6J8xz&0W@09!S{+AF(WtKq-JjBrFpxw7c5wY(Vlo#pXz;M zS)?v_$BB#fVD$@)L_Wfx^u^sRi>bH)jo#||H2s!pdy6zhMjV*1fQ%=b0T$uOZO?cw zvoMRn4tQYSr+#P||A7PH!1}yAjMm@0ZvAqir|mprdMCZv2--SzWZ3TN71I#yazkZ1 z|8oG{6U1XCGb0$SxY^0f>>>#W0N~(j`?M{cCtJ)Z z0>%Hyj70A@XDa~)RA0=mxjA3|N{$-_;Y+EM#D10<3-iIcoz z{|5`p8}uXb+j8Nr!nIPu(-l0xb(*USz<7qP*^5+Bajj(KZ)I|mwj8Mes~S#gt3X7O z{G1glKv0EIvu~WB@96unK#TQ zNKKrYHrUtP4F;X*neHO&uJSZEsaxXv{Y9?wTmpqP9;gv|4Al7F`FgqbN~7|Rvvho+ zX37!SDoe&!Ajrp4j#$AQS&q+rnSUE+>T(0n%9RWJlw6x)k93i;iD75n#C?JsUtWda zlfCq5xqc68rT_P$8CZ*0&Tgq(o_aUyR~IA58{eF(YpRpV-7pAyeuW{hI!=o<>+|3` z!`%FJu{r7mgt^Z&1Z6muK_Q0@3Rs1U25zU<8=#8+sW4nEE!<@4~ zMR?N4U{SGlO1eUoa#%2}nyEYfXLe&L=8So~7ny|rn!?y($v9&qcafc&&1EUkzWks8 z#mi_QpVZd@A17beaxHZF%jX`EFP+ z8J{1F6+Xzc)h%fDy<=CU^urI0n~Q9bGmcQCvivfB)79B+Sce}@-U-`E9nx>b!uOBS zZAA?zX1jImi|r*v<7(13M+K2l_jzr^PO(Bq9fy(MIbxr}M<=PS%XfDr1i3u~HQw^5A^COASx% z4{FQu^b?-;Fs{nG#7Fj&Ho0sjL|vk8SNl?x<}xXj2H@@dl-H~s8hDh*pIpDj_;o2$|s+vM&3>4aiT`uxQ#W}2kxUUtN!@{T?h z5t-PhtBl4&SQ+eG1VOSty(%#6RV)D9HZ>Z`qY-ArTy-2jVm2ZXCfTA1M|31!rg4L) zF=#cU%&Vy_Zzn)E5c_Qn=BBCrUQcy|>~jP#UbYZCm1xey#&Ix1p9a$yuDsA5>ygtn zEA8$wVF`WKT^8Px+C250}ZanN_hiwHqk~^!1IsK>+$}4xV1V(KtL{zeBD#rVj!`Vi_DS&N@aSLn*zm(vc|sv zQyvXem}DsZ{5Yu<+h^oQ6?Rtm?Z&VEG^0wd{U*Sdp;E12`g+Z3)NP-(h>g<3xzTyu z%GJdULnhKcpgWlX-C@Hvgwii16qoXBPcIb%ylKI53Zyp$8f z=2so)Mz?bGyYh(3^BqP*4aeORYPtzKGj(d~r=)4IO58W+j>i0xs48SyX6)Hp1;iBQ zV01i_GhkO-wn$D*mRj)rC4Q>8U9ozBa#etq5uO|Ccn^wove;)^3!t?&7>l1k@dx#L zMjwP%3TX^YZN%i!>1|DD1^);}1gw-lZAk${4le@7mJn2#Ha=hWrV|P&My|2zV4&e6 z7$td(Ax|>OCcYo_3sm<<_RM}N*kSc;;mi)n)Rw$!VY|;Aw{Q`fPp>Rlmm+R3sE1cl zX%S%N%Rn3!iy9any_pc*mgU4Z6&_`-Na6g7slb5W8WrYh zp-e0V26M^B9{)W98@EFRSXwM^4r96{#ec#~5|S;PCan3pvOV4T_h8HOq5ls`%o3X| ztwGB+69Pmebf>)$x2%S3yPBOHASr@Ywo;q=)w$9D zFlrRZ=4A+S{1)HKtuq66!x#I2w8z|f=a7hFRV!Jj6U|g|=8~x*V7n&s!bmxA65SWD zhj>Py6U0=a5JV5Hs%u=Gb{#aYnaR6zH88~7zo|@0Qvw0o@@bK;e*O$MW;#ua5OA|& zT(}k7uJF^A7@GGyGU9C!@w%%j_6LEo!t*9Vcq4>REqZMCbi$Vl8wWQEHii}sE@toN zy8>&^nE8cI$yq)?qwNac{v^6dd>Wyq;i2PsZ^*DH7M`Z%U$&bi)bS#}crbV1pM|QP z?c7yBb$?fKE_HnXes~>vAe@_ML2Z{<_=J>qb4rmwJlxjnjT*0?^_LnS$1jQMC&7|9 zWF1y@u4U>LZ9!nCo+5rwmNNdr;c!#PJO$9hSR2Z?tkiFpp+-nIV)A&GP2C#GQUW)JnjhmF{&@?JosKA^|ByTq`0PHyPp6w=d3P(h>Fbf-Uw3$5;b zfK9Mf`WI*{3u9K+tRWquZ*b=0X4oF;cAcv)r^SK+o6xt~)?^Of{XZ_%XXX$4dHk$ya&c{{Q?O2e> ze*9EqXxKtXAv{b+$W%$eFuSzrL%Pk`oMvEnFpScbmDWuRYcfXiasc$$@>81TNtPTZ7hxtFw$lfv;VO`wBz(;2vDUco`B&!(F&_p;`k(0W&G#G6kKWEE2x-2TXu6S%|VNi^nlkigm;i`laF z%9;t9A+a>PY(MpheTL zIwZr1CIKG!iX7)+oCA#0P+Kf`!DXOtKzxGHHbuDXOfr?krWoqNe^C?4O+1`K!+`)2 zTrafQofR%}ybzl_q2A@8LJCp&SE%d{;5?EE<5oudO{;rzhTF!dh_=$0@`Z0~2 ztp2fea(Qr>V%i`>8!u)LdJnd*4-fH*7~QvC5GSzTLWE7If(6d@#W-Q!a>)chn}_7A+++ zk*L5$URQM`a7Nnip9?pCwE4v3BU&CzM32MR6=sXG2#jsDPQ#8z5q9W*-Sjf2%e)`b z-zXX|KhQs2VzY#D&+UT|_vc2^l@n}o%ygQ`pV3p1&7L(Mb`>yAOd+jm1rmC-qNj<- z>&(i!aPlI5tH=C~f1uxP&1D6AQ@Gu=vEJp^{_tnih9oHS9L*jc4dDp4Bs3x#`9Bd+ z$}-QR=D1I#j2zO`^pA`tV*uNnulMn!&dLd2`uJm&i^vHTaEOkj%W1xOX+0Dvd0XbmZ|kmyL~x1+IOKr8M+ZR={dRX2kp_hl%_+01~VPVqL8X6_wb=7 zG)Qg`14n=XBPvsEOuj6ea64U*2jak|evwu-5rw;rxy>_vr$1Kh7w;X zg0gN+XsKzJh4~57tjbpsXGG^Et4eDnQsO22ipXJ&p<*FU>@>^BlT;velqvOTYk5fb zbA=ro^b8K}tL>=zI;`U5y;&>%DMCFuG?!ivD2(|G2m_tb{_AyWse(#@7FoNg4yG&ecYTIyCM?cS3{D`fqSmk@ z*|`Jxx;u03$MPYgBuW3~G1NCn@UK^`xbjFC<4D!7Gl9C zd9oVUy#L+U#$dwDlY*p&^-UrpxlHa!K%uc@ASHwUR$;thD@x{?di)EXiV&}4YY_%3 zO@Exzj&ypX1LGHTI+M78PxUn|Y%$ zRE$130Ay1UN17s$#7nQT zFp^`bnI@hRyv#Ofg9)^EM59aMzOgnWeYDxcSX!E{YBy{YNJ@*+S)wZe5#0wTeS4og z<)iPk=MgI14XA50CuU42(>T_jOFER1({nV%QIR476e|gVOpItmg2z~~CoxIwm#Y!? zOt;!-3KN)bENB{Jgb^wcGyH}7k8yst7oEHuU!DxB9(5O|neZ?(Wr%sY^DIlYo>m7U zm1tj+3asw2-X?k-x{`RbSLMw>h%q!cfb0@_eC2}O?I^!}ZB~f!h~+qW=afL;)F_K{ zww^my&Tn1#9yyQQ1Ia-R6@$;tB|%*7dOi+-HAB7Frw}I|ZU2^BU7k3mxD2~YtS^Z0 zEizdoeUgL3KA#gw%J$B>lia;b8Q>u6E8O%nUe03E<1%t%r@O50PBg2*6&=R#_we#= z$W6N1xgiP5D#@9~sC33c`;w#p0EL@V0BYqZPk3g37=q3HCSZpuR(dnWO@Io%%lxiI zw6PL*hUSbj>+pktht|4?)%W=U6-=2fc7d_ubfiaY^GRiva zorcm{m2w1m4m(@iMQ5W8WvR+^;6S+j$85kZ&Zyo9HRi^83rd4UB{1mGj*nb3oT{#W zE_eGhmA?s(;(l0qKgXNNuwES;m^>xO8oZC)I)fv*=e8w%7Hy6vX=SFOv=|w>Psf_L zP>n4RJPvO7@p(Iep6b`2GG9vtF_tv)hirP(4;d6*jYEJQvfVMfB6XiwM1&quyS6%j zYksFCYa@vsMJJJOuB|mMFt8m5cN2MWj6Tc{_NgYx0J_$Hl7xmA`Ld2BH_u4|_3t~$ zFI?cw78t@c20GKP*INU3=nmE$k|X>`^{3Hv31gM5m3An~WqW@R~|6BmLs#5S{vmu}&Y@ z?Y?}A2hf^2Q$M9nO{w5(qGgw{3qz9*V%M6i=+6`F+MKc(wGjGCB&5WzPVP3mAM8-# z$~~N#rx4>o6n@764~p8JGxca7i)-YNOvZXe_15%KqxOvA+~1GGsbey-5I*tCDRvL8 zKDKDx&R^Ntf(>CIj+7>7n;`+S@nF?RO&OjB_B;*?6XdV@4L@%^`Hzhwro zi}5bgb$_TNJO4ND3db53cGYOqlM4ukg&9`OO}?sTQ@}mI@N{D5#LgZDk*bnK_%YOX zyv9TLF*>eBnIVGvRh5v?zWc-F4Ql%dYKtZDq@Z{DJ+6Em6;K8{cM)=pI*-Dq2?&&+ zP}g(OYTsE-)?a_Qmm#!jSdO*}n|NI|<9vcra_}uQ2~wEtzS+ zUXkZSTk+spi3DTqo;fVU$H{m9(a#2AG*D_swQ|M}e-gI}A_u*9+>5s8DIUV4 z5^_kcAAqYBhVr1YLzxr4r_hrPAAkKb#)SMkx1$;q4%==#1eL`}J02cVLFkckTP$5WLZ2!0a+ryWWF>V&XRD zX3bP2Ler|FuX5oxnwHgFOq#ZplKqJ#`GCmvEW8&xOLAe&AvMn0;tWf!>xmIGZDw)#Lpt>%#U_-DPk9;Z_wTz9LNv6 zyph7-bS6Ig{;uPEdK5r?yS;z(68G_PspbQBx%D0z{r>*NseF7mqCK?dsQ^V#jgZaQ zk&`Mbw{&)bXoIiEg6LGKlPEtLnMb?=5-_s46rmp8KW@fv*bm3b3tX#fjQ{+e+E(yq z?+Lm2H>^mVq?bs2>g{{Yn;ppmUC9G+f=~@+vO;1+3?F=vq-D;|;OOzh&m<7F`36E1 zR!9=?@qbP2Cgdo$SGR~&VETTW8T!OP)-vV|+S4-4_8aG%_&r%FH#NncHJP@6=s_9N zWXKRMNn{8e%ML3q4LgK5&n-$@N7Ax)VqP37svJaOc@1OEO8${|u4epFU_uFw7ph7s zF-g0;k;Ju9lbn{knj&=|@b@=A{7Lbph_EPd;3H-VB>5`I@maqXqHWYLW)~&HqJlFV z$(u3N#nM~~1X^okwzi`3OJ>QgK>T(a$67ogL5resS+XaApVC8Ql$KDW2u8)$_R{CB zu{z#l^K%Iw?$DrGgS9kB&EFaA$bwLw4OuQfR&rO!j)TaM3i_%hH&fD_dCV9seXsHR z>#3EwP@g$_=2;)%PRtvvdKzAlZcWmt4X61O1G-X}cZ2b2R%{I#4eo=rm|YF_@twk6 zHJvj66MxaS%c*U&%?@{%EXpSwRc0#+$AoO6qJ$QoFJ)_UOF(4#0d?ShK8xzl0d3UO z169UO6Mr4U6t-TZqC69;hbkxnRgi~Sst8V%i8>TjJ*8Tef<(c5j1G>tE&=;ZX|37^zwXXN4COOod$bA+ zN1wB>63BM7-Zwhp*hboD>rEkMFH#MbrDrHwd1Gx7q>;>XVU1g_k3pu#ui6n(&q3xs zV?oH*$*D2|oT0Pk#2C0y`Hyp~*9T#|=>eZ}3rJuk%(k^03GD=0cLo?k-7>GmguV%< zr2>i*;{3cGWgcPqDI7|Ru!Zk$o>JQTA>WjNLA`n@kk&ReJpSf9c^jZTZa(qGE??$k zDoRy`zb1%y)xU#lm_{9k61xqhRn#J549LZ5T~afvV|45&^$O?HRatADTf%S;Xi9BM z(+b0P+(m<~ciT4v6l0<5@bd5_0ABYm&el8mSt_<7)u(@+iH9-BX`3%L>si5B0~r5o z_%FoV+*@d6gHL5%2%`J+J!&f^JH9N;h~S(aYE= z{jW5h5S$T7_FHhDIq`+*D;=$=2J+j{aV$;$ z5_DoHLjyYyL-+o4#f9?)^3+xuAIL{0>j0iv&B?<8p+XIjQrs%Z+;iB;{;tM?-dsiQ z!1(g0^}<5wgK@fz-q3Uo&kB%RhLD40cyoX`k1Q8`_Iv=me)ji9#Z&NYiF+53MdxWj=V1yl!;prf!z-LJ&haeV= z4fOl28tx@Z6|(z@yLJE>DHlMQ(S2TofCV}UG!4b<_^aY%U`w!%r@cZ~>Xyr?JLa&E zrV8WNXuTDC_!v=5ZDvRnEH1hMXmW2ANU^smmM(s`5uB?PGub7^jT{Yp^XzigFHpAv z*tX(UzDCk~=bp`Qc{~7+60;*KO9TApVoMCK#yqhFOu1PfM6@bvRa-H^dwC^L<##oy zBjhBv99Gtp{Oy-_m9O@uo28M~l zlh1mBEn76{1Me<|S7WV5x$VycMQIJr8_QA8pc36vikc@R?|vj$dnG*?IaS$+y!N}h zClR4GR_mL0v(HXEpsy5uctJ;linIRQO75@KdX4Ffs^*|o_a=J~gCt#UZJgcnF<)(L z#45Nvg^s?5-JT41d*(Kc5_mKtCO<)O)2QrWUgPZW>$HkoB~O+$!chn4%L0 zd<)p^3?qUeUIIct9{zVS9sxdKAD4h1chJJINX%)#NAuM{f@#iQ0mUHTtJG%hH5yx^ z+C76CU@`=JlI7JHO!hPwdH8l+QUCSJ0?;=@Uxf_y9IOV2=(XAN8E(PM1s)lt zry;|XZuuis8p>XnpZ=2Tfyu3{dV+u!>k<W8U~mn6 z4EPxhjVgC-lWJd__&GP>>}(AXScnpRaL7d`_)5(Ak;faR7U!H+*$M>BN*~SW*0nD3 z`0|`bo@{k6d+^-ohhjT2YxoE(uuES2t*KN|@`exx4nH@f`tG_pxfQa7!BdG}LG0-|c8#33&#(mkx{iJZ4N^@=oZ zCKce+1axF(oI}cC=bu|-!r^|OfOUtP0YUjkiq2R-PkM`=nYJ#P5gxlhde^9?O;d;r zFO?mM{6?-t0RFMg?iR7hg`9T( z{*6QNyI-hlBC73$Uo%0`-58}vJk3k9ODi*eux`i*84?~t)`VU~?y+4~M82yrl3|{#Pd)7-_wmH;`+N$9q z=G&eIS+dCnr*si3Q6lCs${ep%mrhC7;fGJYSBGymB6M#jYsexL1Na*+Dex^e>Ht^* zx)|Ifx*Ax+CjpmY`Nf-90)%zPSOPDFE&*T6e%Fczl-1%9^OBWPYs+_#Rk9KD8LN}G z8zM^8S@!b=TWhq#C&KE}x0AK{5sC`ntX~!u_^f_S)mfeOg3`|I^yfKyt_3uf*ELOV z#{wkBlNb4C4h0?W*aCzV5I6$5PLCM%4u5Al_rsOG87c>%mjsD*5T&!tsVw{VyR;4&iShe;&!a6GN5x8 zyoUQztI+B1cl#>B{#Z@f)uj5;U!4q0Yam9tOvD0L%kG1yP6}s1(d(Gw4VrO;V{s#s ztZDRyJ^ZrZV1Az7-uW9TpS;>k=V9Kbx5@bk#imdDwZz{F@YrS%%f>bj-JLZ_n9Cv8 zv20Z=Gp*EAtDxm0wkrbmCt?L<+X1L<&%#XvYfi+d8u#5`iuyP&okq*<`fNGGok|_t zl9C6cPKp7(Jn#Frv5ciIZH2|JvCrxvJtm)Vj-X{!BiwQZ>1kSS9T?hOXt~=>U76#E zUfrJYf&7<{@^34veEoQY@rI|--&=$Nf-M~ZX>=Pu!5a}eW5m5U;xCwGiIj2WS+!)& zbFk^;$p|i`@>gc{iq)5k($cIp$Ad6B22>2dQQ_#uImmY^<$Fy*c=gX=yfyU zaCvX(M1s(MxCP}B5oe=!pe82c8WLIFzicJ5TBOv+J&r5{5gd5STd@s*3yVQ=%V%iD zRDs||85+|a^A`O^OIY{0ZL0+|;>{w+KZV+GqU%l^)WOhy-Pqc&naMQ8&P6%?XdBe_ zr0EJOd!%;RfH&aUuGL(`C`}shD{CXs#7Ge+{0+BtPJ3kgP}iSm&^z#~q4UP-z#t?= z@i)%bNE&7fE!VLWF*)YXR!?EDKtiXiRqh~qcYzXcp@3@MM#c-s|IN2^zgf&>ZB(uC zd7@M0UIfD=V++u+|NTR_KX69j_SO}=J(mza)3)E8yet*+|fT4ZWCJ&21%xDcN zWW~X#h4I?pCb9lSEqo(lwK_X|S!0E5(4;#bw31beiOF<6*tR5L$nWY%Lcba+;FW(9 zyyn53bd~Bw7o3;r#1HS)zG>`m-u7i45zcfPW@{pf+vyzXv+3Wo*UbeY+VY~WYhawO zDjZeI5l;L2eHgWy0IJreXW!Rx#+7L;Cdp&C;G8}qkm2%084872x9NR(tOrE!U8V}k z`eRESv)ldX*Mb;6hgO=3cF5^6WF0lkk|}kuL0?q8Z=)V#;v{C^>+rPT$U44ZOf3&X z3|cs6GH$qf{Sduby&SJlQ>)b2+Aey>7#LgGtLWb$Q-@z*8*N(*G%hsgDo^c@4%LPT zxjNwgd~W2|M&JRRwBB#;B96@MApNzbI7mrj0j9Cd<&5Y7m2_CBgK11jJny?db918_ zp#%4_*NAE%jX(OIA$*GN%vdRdM^&GM8_S9HbE?;`vXo!y!F2{b{Gb8uuqV6=elq8V zeSKWwE7f7E(`5Y}N)=;1A;Z^b;WyZ|kfn%{87RS8!6IzW8N~H?e({~Q(N1VNMdxbE znp0-2zy#V0HWV0-U!tCl364JJ>h*ywg}(h%eV|sNNAUeh(pFt_;7&sAf0gmO4`etj^2<$3 zOl4@07uRVe7uz?RjJ$vTWHYU%tOoNmB9mdL%wFIjEx~G;OxNRv#ejXXcuC9`wmANj ztt-d7{v$x3ZpM{nHdPM=@YDjaYhi9g?neW`taCY^_$O1vAgh;ATsCvAD4)|Qtn(Ow zo9Cb?F1ygshgKuZXh<>1cuqL%MeAdfdpLrpJK_2@3mH*4=0kc@8b z*tZ>w6LWg%vVcF!5;qAhx)meX6DPojnJHmXA-+-Zy5B7CF@YLWbQ*kzjG~b0-aYA$ zqR{`!hfa`$%+Fizz1m>&oLcqqp*2?R$V;CJ&S+U|-s7&498fRez(g z&PI^~!`Pc7QwG}HfE*m5TlH%5TB2tfvauP^8-R~r1i!NODm6#LQuUT6^m+!OFT{>| zfkF$Pq%ABPVA|-ogclO5KBXZssZ&U`z~Iv((Nd8{fg?m*WE(m28=zguMKPYqr?14V z0spS6hSgF=+5ofI6`CSPs%nsD>*w&xW+yS6(@AY06v+P zH37vomH*C*$w5N6ehe3;bGOx zA(=JJO_8So%&`r>>dA)}Bw#=rP@SQmU zp|)1!q;XEolq*e|c{^!>9XILg@ps+SSAxe0HuDr;*v3SoB{D=7+Z0Mp`=84(g_6ZN z1u}z_EywDFnB+P&FG)ByQ?*f8i!|Y4H^x; z9B+EAToC3=F7wkmeq4?x+kt1gm5s!&O(nnph);%ch0mm_=nETZi>h8V5*B-zNBFIs zkbljPKU!1q(7BhV8!MSf{Ou!cpU$r}k-stgS7*ea;9iFqM>k7NNJ?Q7MZr2oi4gvn zS7k$TI_X6jkMN0v}&->WNZjDs# zncIM88vHG$nU@YRC~-$5;GO1KU>7)}T_a=Q2@0bwlGUS&*p}3))L@WI+`hX?bNIy_ zs>wf+Y`5dm0^R29QU(TF@4#ZvQjH8I?5$U>#l)NCew~NtVfQ&x;sK4RsSm8RYo^Gh z%$q zO!~ZXoNKpX@x7g9wmxUyg7z!uf)uZ(Dbb>COI}n05u{jW#U@DUYA7Jf`$Rpn9G2k}qg^ql0VZGFKrN+zsHAha(!^+!OLi`;H?014*|J&is zL~5#}kwE_q=MGCT=JNCuptH~iraz$ ze~7?%Soz|eHPqKj)+Sh4U$gbK+Yi_iM?=(;bg}6OoN*i3cAW2D9@DII>imml6*)HjF? zLGYNpbfxibKS8&;ax8Di8l*c2t5)bly>>?>U5)lTDW{v(1@Zemw@NRR&Dx!eEE2Vy zT@_JQg5 zbKalcuR#3o56y8zARlQL*Sd{sO8Y7IXhaU54hRyi(pVx$;P0OZBXnX>lb=XNYg#Ig zjpj%BOmJSqsb6S0g|l2;;uzx?<9LA~;^fm}tRMj);p9IZ2Z>ReQVG0PetwMpM>>g3 z4B)h_wVH;!=!s5otVgVt&LMeVq7HXEUWg}o%$D-yh}Dow8@|kmLqgbNdcRcH8=?Vb zFG7uGq3)DV_;OZ_=kGs0Ojvwt9T1^|25LxY*N@LFALi;sO9!%&EtUtISd;@sOM({s$7kl8bqTz{3FI(q4$6_dT9jse3%u!ag6wWm>Fpk-47wExZZqcR5al( zZSql~GlxHo(0C7PHCmTwi!m!I1!Z+pzD_I7%}*dkn)7L#U~Xce{$d!OcoW@|2xaTaV`8UlH^~rsKE4+S<=TG&t=zD4_P_h)L@A z;em;Poukv6U5$Fm#ibo)V$^1ZBA{h|PM<_E8^&zoXS_ z6ey04Rcf}1bvI>G%zDh=^A;l#94~n(_{Q&d@JD^3q7XX_%A{WD>!pENJf|W`Gb4Ga z!!WRpBJg?_q8;PnoDt)%i0>ZiZ^nYF&_evU?c$q}a3q~FTu4MbBxjZUs?b6cvf!3P zR`}kZrIgthOYK18abiPHBPG;rhCw%gb)E0PG|$0`5#xDF3fE%=m1UEoRN}rWuFR+2I`YrBGYBz*D(dy;a{CVmyh=Z?g zLAw!R@UuEQCpsmEz1Dh_i9-}Ju%=fQ)!mGolf1%ha!Qp(E3x#}XyZ^V-4@oi_$l^R z$uK4~#TJMZhCJ|%N3Hzse}i`<79E;N;e7DVcOB|^zjQ(uwwXrK&bd2l*6pIQf<

n}ywo4nQh^0#GloF(>@xDP8WsY;ZnXVv@Uvf!l zaMbn(sswK-d>dY#>V|c10tmFnaQe4)J~rR%Z}ROjINaTyI@20SUU6Z1cNHgE2MZ1> z+u0jShvo?xxk$O1K6l{`Y%lLXHgIUBMvGrM?m%e~+b3`0#fG?~#*~iCN6Yn}=enm( znW;}Qmo8U3@LsjlCkKgSb`ETco2wcxA4C-|QR`dV?$>T3GD>wADYd9%dyjaRi|u2d z+@``Z>j(d>0M>36h&Bhpt%dySV!yb<`RSPDTWFAb)X0lf_LAr$F}F>pQg*OScByTe z>})FzmoB_YgLTN&sgSZakq>iaR_7yv5+|dxMTv{UV%i-j;XNCQg_+d*S$YF3CBrB% zETh}&b5$snw57CFX35kvb$q*ZZ&}dALlOsBgQn;tgjrdG6EqgW{XN%f#W2t^Vn{Ls z?YvpRMOh#n4T_f8w(02WY{yo>5vO$hlF)!Y7PO@sIon)!TkDWYdJb{63$^O3NPs27 zxbPP(l9|8k0oR*;`s@s2!Y$s^*tNgGh|LlM?Lm1cTn8kRYGC6{J{Vk|lL}_}poyR6 zEe10}(%a<<2dq3TZj7M0Z%d5q!}Wl1CTKYg6=f(eazOHW@<*;k6?A! z?0M+6&Ox!@GANm>VT@KRbvBDCm|vWYX=iu^4al|g3jljlXIS<5M;{@&Yx~XEHYt<# zV>nPk0dFqIx3RtfIbT*;fsj4Kf}Nf>!~#81B7v+^*%|Kk#dBs1K#~Gk5@X?P(E*AOX_oEJDwSHvw#B8ZXQBPay)b{j>SjR7|Rss3z$3V2z z%Rz_@*m`zXbvm(S4dYwzoKAR+{@f3Kf>}UI%TjBRIGfWVAl;(&14%jvZWpm4sWNpu zpXn-h*1g^xw(!tow7dTvN{a>*gN72mEM+ge6j~cpwF_cGV^b1S7sVnq=@3FlbzH!A zww=XXPBGCKBP0Om3RxLAxhMpK42ue9 zu)}UaSFq+aqWLXuFfEiqq3jKE)Tv^zVG%dX^5`8Rd_D8l&Zjv)v(!v<5}l#RZ0qhKUs~G3bqnYWm0Tzo%iF8*TTPZ znW6XR+a*!gl+xr)x{PE2n9=oG?k)k(%hRwo^VIgLkjcD1$59B>!^Ax6;3DS<+1Ya^ zqiBGHv><$gS=$&c1zSWjyC&k)ANV4+d|U@C-Ml zAPEPDCJ=5DR&kyKVHPkZWT2K9AS=TOdNo{27>PU1QVZ1pRrEk+dszEi`ZAT}An}$u ztLU{B;{o(&c3mJKcYW@wBI0^}gi1LjHP-++4Ebi1aY#r`@sgIrP-;Vlb@fF%1R~+m z%o<#S*ih_l^P^xY2Z@$^hM0)KP5cFQ<{uAu>aRa1z|KNM6u~2@{z9h6m?$t+Wh0}F zHA{1?o;sfbr| zRaJ-)^fo$uI|U#8b*7P+|4t`Z-Ft;z3|X6=J}Tiu5ewu*+QfR#QYI(ppQZfe!Zdy~vs#dVdRHyg1^Qj`QOkULW%GU|I zwq`lR7l$XWfBKMjbrDyvWsS{we5h_zu+0G~Z7OKI$R4DqVarkXNko2}b4exj6-y&# zVjs?}J82BIEqMTZ#MDSB0{+aPBO|%RQQa_yw$@RVhxSC;9^|!vkRolj8zEy z8?yMnN;Y(%<#Z+-8sTtRt6Ffrs?qJB$_o3B zKgwBATB^GWkX%)=DePCYzJ4wKFJ0HZ9`-eO8J{Y~FEpp2^OHi2GrE6ssgOzr9YKpr zBGdDe*(L-rQ^xp-Wq+^*vv4n0jD47x4;$Iz1aZCf($YGxVkzSgGWBD)wMhH(hUIN>*pU|0Z&$qVYX61@)&&MdRcn%@#i&1tWj-=L>bO_``7nMGvU zp&m6!G=iO$S<~-nfleUbkC*$yhxhezd}>=~Q#QDd9v>vqu;zfDhNerO!~$9f-Z z)%sE!>G-A4>04CW{0X>0sp}EgVMAdr|5nxTx*YC>8^l7q-YVRb82O{3*{A=>Q=~iv z`5n|x;WU@IAD8Dgqafbv5K(4Ul4W7afvCPhAXmMgZ?^nbMd9Y3oT8v*jls78xI<$c zGzOvId|_1N(sg5dPjrx7??9++|Euki@%>EG|y52FHm%>P1;n#apk& zG6fJeqcMh|9rS3FPMlB3@+SW|Eh*Vwg=*#(`J$qE*d)CN?N<8}+%s;tFmJd-os*1h z@g4%2&2dSgO*t+g3v{U~J(xQTnpO69@>$*P;hg`R62n{!x9>8~+u>+7dHYxI&8hp1 zH*s1Op`K=Q6Y{qWcIK<3WoYqA8q3}=7>+|*f$fd6FNG-eqL4Y$XO9|LFCDPjts z)d9`cav8-_-yV7oyMFaF@Ng(Gks73`SZKfM8JFf(jHstua3c2jD-6`@GLNV%1M?s@ zhvARGmRxap*Os)ZY>3vn?AM)|QCk}UvAS=|z8GVp>4{b9wIJ7Wmukw~>^-%sAtHJx zIFEsTAMZJ_up725W>j*m>P@CfFFP-vVWxS=ssm)XEer~8$m(t;nq_N?Y6PvuAbHxzd40+UaZpC`X=7)gVDyBVdyB zD8p=lEgd;K3)SZINl9XwME*E;7s>~Yw31n(OLbiE_2Jhq8FZ$<8}(KZ3~y;;wc~Rg zUspLec#bRFzLASWZP32IIbn4+zP}7Ep-_9>=8Vd=(1!HjTTu$V2i5;iL6Jc8Stmjk z7zTeo$wz?+cfkE+OuqSS{P%F94#+!YWwyHLd$7%4El$8_xZ;OTfK~s8Ph|afK7pp8 z80Ov$67$^hYXbW!S!WVmo-T}##*fe^*P9-TvSp`XX~-({4Q$3lvD1?+6e+FCQ#@2_ zc{5Y>ia$iZE4-Hsckppo^Exml`%6)|_8;^4o?K6rAd9D~ZGufy`-jbV9FF@Gca6w~FVvGg#jh870;N z!{^C1H7ql3)bdSxZk-~WyL3oG%n9xG(IxJ`Mtd(oU+XQwXN5%9?_t?Ha`-*UoHr4m zV|`O&kvavoqo1vHAyRU^WM8*c8{U8cwCBifHpUC)Y$>=}{G85S@RASQ5F+(Nwe& z?kw}0>sDBQHrV7fX@uUT6BG_;nOf|7!`^az{qI@_cr-)gpGJii9Y$?^Is0E?j%}%n zfxWUGY^&JQNMrmZA}N-hEu3OlTFghSpTnzvlV-d~C$7B|N7cFTVOfl4@lC0T2p<8q z?W`fJl*L!ilR2}B$u`LmzjK@)JwhDudcC-RMqiChsbmjL8AY{R6ZRVowlDRLDed^_ z?Kdxgr`@@)4j9CQy-7FxO9tIpXo`g(B|8i`s}0Hz!4p>Ch(K;Dm})zEwDtt@2wjW!`mRI`tK$8YB~XjQ5bPP3)RZWZk|8l1{?o%rL@8rGZ25 zEJ%AC!?&@z1k=YAl*<+U5Ic#tDES(CwWLmeu99+;SB1l2m!(G9Nic(y8k^Cg!%O8h zSkTu=#oahsIC$tQYo(I0SoP^HE8u~AY{=56Q&R4sX&cCC_Gi~FM%GA9RCd_HH#_6T zwmV4Z$oVqfoZqixJBeU`kak9qr&X%E`5oO3=Dj7lbqZ0E8ikPI+87fqFtKJ?8i`IU zYVU-EevG}(z~Lfz4$%B!+SKYs8ArZQu1ypte-lVljt&ZX;8Qi}2fo2OB^yj{j<9=zYjS;e6`advUG&dlC! z(HFdXiV^X=dALw&v4srZw-P1yUf z&Xr5#Ymp7`j5wPcq?JfI-cKM|u)=Y+e5t=QSYC4%7E*Jze{ZQ7jY*Wm%flyT50z^S z7PF3xZ)go!+7TzDbcHEt+ffD4*6W{;t)A0l<(Gr(XD$(3$2Sa|YKlwnBBt_Dt?*{C zWCWq*&wtKHT!jMRzr5Jm`VoWk#}5-DGs?$rU3Z5ugAoP)eVTtv#}Y4`!xuD~x=fyz zmC_9h{=8#;ux0HPM6&{;p<(G*U0_1o?tSa}KW_A5?I268mA^vM&B3HuL8OZ_L^s^` zIE9a0@=2Q?AHY`hRUN~B3eeDDY#<*NHc|oqMu?mG3C;96Rx;@wB^fbNxYMPzrnG8) zLEUrEJt={3diLnoE^ObBl{HTGB0Xzct!JNgFGm~#sjH9DyAr7-vo;iwOBEfb2q!jm zXAgUx%JX?AiuLpI_7Nca$po(xhVi`inV1Fs%UI3%^6!lG{<8oG z9!)<;J>g7~q6O$8Jc-^kFb&#_(i9aFit3JFLM3VJVUB&0)6eQ{wQYYwFB{8 z)n_a2i}^@VIex)>=qt~ax8$F3CM!P~f?hqhaaEZA?8tdB!+enP!>e6D*JR(2vFapf zIWL8;lNQ}!y`7iafWt%njBN41$-W!;- z=~ja29WkJg9IVsyfVmKrQ|xaE6)a|A*5rk2K}t0SoL?X|>pGU(uc+-}RhrlbbOXe|Ht^d#e zzYgP%*MD~yn?{K2fTYxXb>MjQz=7!s}rp zuXYAg;`ssvTASZq%f_V{fG;_1=sm)rUCc1DpN)%uEa0O(pY{iQKla*(@)6W;KtwPH z;q`y29m-dJoN6mF-4hP@ea7llR9R9+uni_K%j3Eu z*1QkEaB3=%=(&;_WWdqkh+bu{n|{v;98II!$3)u}BK|GKyRnzdwMsv?vC-)!8RheG zBLqI28|yxgB=HtxWUed`oW=G60w(>q1I~;M97&;U}%LER> z@1Jr?Em(%Z10JmMG3l%(I1ge@f@_FFdhqb}LFoB9sCM=33I|IBZLgL>0HoMB zYk$UQs9M1dZN^Y%b~PyPu_JBd&=6&FMl`NA!j3UTVu%ho+|89PF>UeXd2M15&> zrcrtKvB#_Re~%Qw0HHr{kb-Uv5Xx6~m_Ff|lpDz$+a__br`ph-7dghj1fBQu+Uc&uUgjK_n{_%+m&;Li@3cWYSamX)vMA!&nlQ6SnTFq9wKTh8D$OVPL@IjRI*+ z>SMH!SCpKig)wjbd#9-v3%DNV8;2~KMLiwbz+Sm7?45E@GFMR1q~iecJyv<8aRvtQ{|_-qre{018?i`*&77Tsvvi^Q9~Ql7XHNt zk;wTJ30rn~`sG+0zDz`Qm|hc>#~5j)RLl7PE6LErB>YeTKF8Vd)x0GS1y{#bGFmlX z9I!J_*ZD=>)>W~1Du-EGWli2-!?daHgap4H$ujBfLk ze>oy_R8lsAM`_h{Yo}PPHWB2n(4Z>?5wzgRHDZ^Ml&hI0pn)s@Y|P-9G|nU5X-C3F zr?0~hhQA0?BvaCL42}x~)d`raVU=@tShWC$PM$RIJCTBmZ;BOq<3SBZANeF0~%#2*lm(slR zy&N@YXTKc6{_S9D?f2Y6>u@8Vb+{cmnSm3e8b3D0aMA|@AoS5&A;zrANV^=(f8$Bk z02sO#(T4yZN=uq%+OatkNKc%|%(+=J`Oz`i`Y2EE$LNB^hF6)NqCuaNKv<~34pTN; zUuyZ<{GLDD0O{?|#1z=N&ZeZg{8{7Uy%&o1Jahtl)Ju?l&{hT0s&CHZ z*H(*|u}B83@z+Nv{pTN*ziUB?1YxJc53#5xh?wWt4pFoqXZE|lh&JauW199*AHCgZ znn2!Y8v41zl=2>Jb?o-diGBRG6EgkbB5}_(5Jym(p2bfmhJI>O(1+Ds6!<|3%(?97^n_he$Y8J0?? z8`sGTR}nCg8HKgp2dz~+J%!B9DT@-J?O@=WScAMj^B=6tv*E*A9ucQ--vO^~a5pP@Wj#X2 zsjFarFqB-y@atB(9!rFlLoFikpF+%+x@XXfEh(+os6Q8pIKt^SHJ=K81Z~ z3BfDJW?SV!MPa>JtVwZW4z1*}jvoSF{3Uvu%qpCDl(2jIFmn8sv5qk+4XWF^FBnOa zifa!kzRCpjvacR!HNqa$fR*eM4`_rP)ah!h!g`Oc>1<5lnoHwi3cV_qsMy;;GwQ3( zCdEpKX*{e_;tXW~W((n0HOhy?00$uwzasq{#O?^SL0W&lcj~OwxEQ%50%?{&D)j&@ z@ppdl3H0l&pqb&QF<7O`Z7VK^#@Kqo6UrM53C8wC(8F~{JGN!yJl7Gw9llv)Fv_dP zt&-^6q4^!meR441n95EOXwV%PV1%Ws@moS-CRjCc_t%%Ropirkc2{U# z*L@wEC>)e#^(TJ{6MSMj(O>QHmxF@Xo^f?^+5M|-Ma>5@p~}O8R~8|EhV2lh;5hZP zqnvu+P3PD9n1|kg*uf+?2F0U)6Zt<`$$Xb_L!PsG7`LbWE9~29U9O$rV^x)ZKa}H# zl91OJP`r(X^RTa>;(1h1`ORDL6ZvyBr9q9rpcOZ^!+9U=+Ro_9hL!w=Q?JPGQ=zDa zznuutU~MeCA?)&X^;=f0_xUOT|MMY!hcARn{kr^2ot!l{N=EiD5W`ZY0M=(5?xL>F}V4<-b>tGRK>Z~?txH( zxf4b3Z|I}XTj}@!`^XHfN4&Zl&`DZQeE1zyrGl_wX6<<-BI?ea(rs_B>!Rv#6mjxi zb(czgOjEN96SADI!2{ZgAQ@$Dt#XcR_!~|t%>QvG5q&pgG%o3Y>kY!XSWEI3nFEI0v15A8kN zmQPJqK+Dv$1;j2GHr@HK(KerM5V01MmU7|)Pm5kgg{6>YnxkFU#9a}p@Q^h$p5ao` z<|rusE%&tVQ4t!f-jg04Ri;GLWBiRb9VL4M@vG!Hb>hRn9Dv*0Vy}%wBsAK7Vm|4coZ-T)7!|@p?}-X7J--}5~N-AIwh@#LZ zzi+rgoh?(->>$pPsUm*+CxKX7d0bQH3PSR|fzs$E0|}LJ)j_IFF{ytaCyu`h#DcX; z$h1>k50@H1P=%Ko&}Q~jE7f_ly+^g30;D}OX-3mg>f%z5S7uTk?n(p(S^vH)M*lM4 z=Qo(js)d>!%=N0E`aA@(nS`CVqw9Di{BpKU+)})clS`9Wu{{mPsTp5G<@<1iu%aX; z`789=D#KWg0c%s^bI<&7uXBJ6g_nLxU=*{!zDYD+2~Hd_E-}d|yJk!NI@RfY^rY%G zDDHH_d$u}4y}3Z{&(1iDf&Z3u7M&M2D*Zw2!O)Y^TpG}DU^L-+nA(_MzZwm4cL$(<|zo^XS9Fokw*%Q!Yy2LZ@dItd)HZ=JqI#z z8Q~;co$RhyxF-5cy+OBvc=b8t&)V3ExCNW8U3L(*Ap|4)(A)(qvuB$qy)5T6t(?o~ z@la=07$5e(3r_knFB@w?vIHh0PvZrn;Di$yve%aRQx(<;j??yyRpKE5D?F)VlC$l+g<=2#VpmN=A(W(1UqrX-Y#<`k6Ds@{mb z4=Mv~{gV7EGg)Q9g25Xpen!jW-Xag=-Y}>Xo$c7Ec6pe2)^lVp3cCI_s^p8uGUS+M ziiws0vaKzriPRjr$>+Ba?{e9uR&Ey8!Igc}4cr9+rhwy+)%MXebB0fkXW*vV_#nQ% z&J??T6>kgK``2<=7s0ii?2(s3$#Uw{ZQUq;uv7}~B<)nbPV1k`JC!dvI+gGD%#ZSL zPe~-6BQSa<+j7|UvkOMfU&g*MA271eR-5$jUiVfC09%*r-Dv0YCW6oo)w|bL;lK$j zjUM$TGrh(YFeQNaKDvOl{j~txp%p@S{|=3&Sql822*{CDEo|yMFe_6!Guo^=Gy~}| zI*zOAzc%_m0MbA$zudf|8NaJUQ!~2MhEfF<(6fv>)k~flx~CbTo#I-Bz^Ey;D}-kQ z>SGn|qmUI9R>!-en;{Wvgr{He)w;A6@>c9=PY)R=z$3RPf0vepfFeW=4b%dAH0Zl% zFBN9e!Y3e^(rTw6Gd3+&x-=$qjtjMXn;Z$kd`a|NYImgn0=$HP3|pbulVT^_!z~Pyo+v+in5&+cT!axPwtHa!P5)34D|xf>ljXGa`z=mDY#0zQ-j(D0+hk_?~SJkYfM?2MY^8HUZNWsV-k%q@7Hi3>3iJ@Qp_;Yl!|v zN$x(Pfj>_2*)6L<^77i&4A;t?s75Bm7SoT-HguCw50;w|hU|`T zXI`gy_{Vm$z$G;U@C0=5YR`pN6ULP&4-3#uyZ9XeN{&)n>@h%pT989l&_t#8NFS=l zox_vYS~fH#Y(Y_jD`~UF}a?}@Q~EKC3REjf~zg*Y9u8| zce;_u#_-ve0S99~H#&USlzx$7%XB_;)6YBKU0$B=49U*r>G@9BBC_-2tMi?Ap;dO+ zj+W(aIV9!Sq>>gD`FRJMm+eCb@E@|dopKE9{I%C*u=YeH%j@lB zxZVfRg7n3_IqW)$l+lh$pg+R5p6E=kdu*@+zu@gEG}JFj@fcFPw- zQXY-<=*k!HpL^ZOI0HL%%4zcX|Ht0Dce!mGdBgwvQ?%))30W^3S+j$4)c{VZ!=u35VbyaoMuP7&7 z6HMC8rCc#NwNoTPbf3uz(F$Yb-Q7=|=48nxt}*hBRBiH?Y>j4 zT$}jdqX#n(!69t~ISB9%#7Z>W7?S4`vaF??R8hO?Zb~264IZ5r=xWNIvB}x^eEf9$ z>14c`U(%GX7c-jd2?HGwhaOtgZ41Z0{u$zZ!n!P`TP56uh-kxxO%9+^alG%`)%J18NN#HevE6BqsOk}1C}BA%}0+%)~vHEB(r6Gcp6J+W9?7%MT&6^jt_I0cxt zJ>kCm;`)lcX{ce_rusQH?T+flW{aj;RF*?6e5Ep|#nW$#01Zq@5rXT6`WKLmQhyl* zmZ~XtuEBS}2#wZq6PVtn3m(r!FlGqh%poE#PI3l90^$;5Yv;gtb&HbRm=#IQK!yqM zmNfM0hN#SkfahW)TijMbRAO?+HB!+WkRG!rmVgb!1F%)~-w+%fkgJJV`E62Qw24`= zmQ_(DOyg4Axrc7|^!#_9*M*R^k}0{xJIFtaSfq_fxxN(JY|$?5B}p<~ikt^L=i|9~ zM~CMa{=4T`4-xSJi&YZ|UnVIFLFP`ykcBgMCt;=pMzm&U=PL0{urcnTu{k8Z|M273 zF_kc5e;8KA8DY0KTYnVjKrhI#=1_EpqK)-{>&hBR}VvQ+F^kg z1Y{L~uI3X5fQB8$^UNe1fn2MPZk8Y2FGQ}Q%1k9&&tg|CN0DeGXsZ8C9We>le=leda|iHB&QMUK_B&h zuUE&J7Z`4%v&te!PCh70q{SA0foNs3B(Y)IPxRk?j;Pw85(`d!M@#l(@I~L^tslQ1 z8O9p_cs%&R`rBYjHfwfuZ0d7O&I;$>Q0O`Tgk0);$nG=g|g_a@?~0W+gUN4iY%KIaQ{@P)^E|Ewt=_0 z0s34O`?Csr7-H&ZRhA_Ym56Ezhpb$9fgKY?$-O29o}xO-HnmDFeO(`EK&wQB0->p+ zj9qi7`k4^$F}t8Sgjp@2>RUIH1{*BQ5lppQnO?nfl({BW&l0b{v`U>oWg+sU>Pb*n zN_)FsBvDfo2|gOn04lR+1x?QcI$A*&=H0$siOeZ1i6VwSOnEbcA(_E#UZ~PE>@2NB z)r?8Q#3^s_K~ezh!^TQxgRz-IlBxE>1_ZS!B%eHYHm-DdOD5 zIH+x2N=73#K?s@SU-^KZu^HeaNY;f$v3;94TgWehl7x`@XTA{2Ohk7gLxEB4%-CQJ za^TxcR26apG>|5DQrt!&TOa1oD2OmCuI0ydDKF3U3 zGfRF3#~(hwc=sPZzD_`VJaai(9D?|CTgL}+4&t+gi;%|X=P1O-la&5WLwveX_2+RQ z;`1wTBjU3+XCgj6E=7D=9gFz1A8PnCI~nom#y&r*!x5jK$L)yEzMYTw?COG4t#o!o z;^XIzq<4MM4EE)k#K%)~HoGbD+1gpzLjD$4CO&QPbFFSo{ZgZIQ@z#f;>5?3w9R3I z>|vaq_;|TK@%e>0Ks!*p9gD-$C8}PocZ{kxYTcvig<2=6dZETuijPO?VmoR_I|fG= z7plj&yX3mDE`>wes)Jf(>09V-JY~{adARu2pR3lV&Yk{C7zaB$WZ#xr)23pW^N;e|#QvI3^G9gvl@k4a&4L|xh@LTzDfm_8 z*9}o$YDjyWHx{PU=!LeFu{rHD#y{WT!Ie!HV#(D8PF5nmxW4-C>D$uJO{Rz@u?nrp z7-#n!(hz`-Z2so@QrC%5z-M?BOS#~D#c#tX%x&43CscV^SD3k7Ylw#-Hku)hGyT_6 zvgpd2H{@rSGmPAo<4?`xW zG6A?j#6^+@tS9ySUP+6V)>75DvD&18$VSbOA#YB~-XvYB+XdBTpbi|2N4PCy`&NS$ z!^5)DbhRYp8*sqILIm&*&W#-Lx_ztNB926sN#PZR(=dUC6Cw zFTTEhJ;wXh4UkU4e;gv(V*j=xNM_E!&E_+i!f3cHVJ1=P4dMcXI2$MUJvS}oEnu`xPyScn({l)pz_Nc3) z{QmxaoX(~r5rlb?j+1nLlFp{`|Nri@PftI|aH6B9DOo&V%`MP{U?cs~s4wjm=6z%a`G5*sOsS+WF1NWmbzwcZ=$BxhjM=BXD~TECsWq ztvCDk`!PlFhg}U{T)C7Efy5CiZF(M9DNk|@8LXOUg+hv$%M)%nC zqhEq)0(#FXz;m(u!j*Nw^}uTdSKgz|Dp@tFWgA@8mp4JC$o8mNTJRd%TPzS6)D$q- zMCugrMJLi~{x;}D+8WS<;tDiXw`&u!3Nf*XylaXXUZs~J*qV!#@ zV2LbO5aNg`;PRJ9{(gDM&d$!CT6n4$Zmj{xK*FBOgM)Bwr6{h2EIJ#rtLscV@Hs{y zyBv4tV|HPIzG3W>hEb)%<35anDNh3y@mmqG{^WQ(86bv-`jgv{<@lmI1-(QDyYhu>3*7mo>oOh(W=-H+b)s^s=v|((NN@nK5Ga~63b59F zsFF8$=XkBVw6jImYRAC_E$%TaNHRV2IA-6VSqp)w&XyNE4u&OMWoo+AV=Qvjx}*~}?qXCU zSM?R4m$aaoiMdEusc->yP(jkHn9afuYIZk3Tft-19m(t2CUeo~;qQ*dfo7Xj#^Q35 zS(1z$f0JgnB*&!8#cnCpB8sXEW^FkhyFC2Xmt~pdBjOPf&fcv(OnBg2DJFVr#a-w zsc4@J3go!1`QU&XvOr*c7L#OV+?0y%hI0LqG!SWxiXr(Yi2`YaBDpYRJBjt}1mqWh z7u5z{iEO!iYF|hpu@!s#-?Q1R)ga( zCPyc$Vp&rY9y24YhF z`|SMbka2blZ6E8)j*LpSNY+T9*p0J!kR@@k6lplMfdrG39gU7mNnp9jQw%N>aiIN> z_UF#_b(3TEI-%;~t0JD}g-#u5VBgkApq9`UD;#-0_<}X(Ty3Pwmgs^jor1fKOU6pz zO|6p93lmM2v3`*i0GmwrblE^D{wV$Ld7L|)D5ZkuEKkN3hvwxPpw(38Scssen7>sT zU3=I~hAVbDP2^_D$;wmX9+F)sZI>GLPF+Q+{;4;s1MpQ+X0P&4LpYW@x7Jh_hoMk` z-qKJIZ~^~-8;GpqTcPo?-H|`07AUIQy%pu(^iW9w&w>1YDY9zaB-*NYV7kaGrv#Jl zNf9CUEwyUsZY>~sX0{ExyZoMN)Md2%OGsM~F^WS(e(u@NQq%WrkjLMMZO z;v^j8ASx+ROZCXA>}nB{+|iD<$yw@Fi>$JW7(SZJs*Fw7GCirE^c3}LR71s!eGAAD z($(TA#3anZ$XO=iSkJKkO0K)(vmv|0TJl%dhQdi4tp~Lz?-$osN+ZyB`K2OO;DM$4 zGb`MnLJ5~Xt!U$1;rjoeuE%Jy1$iOs@O^?Q}>8|pxF zc@mQKprx$y`&sw{-YU5LgryOHj4^|z+dRn#(h#&UKJq%H zt^%D>X&*}wY>v?S%5BLcOQC#0Zsq>CW|R{$nO{pT!0sKVd{ceA4cfv@vmAb@Z8uZY z3`&ZH*3s0RbF5}G&}gS&*yG2|;vATB46ea?kjd)C?WKWZ%{tOpCRRMNe07R0*bFxxp)p!Q0J9F zS;><*B<7B7L;+$yA-_9Nu`vswGSx$2@=xi z22c%yO94suSau4E%dSa_NJ^AT+0MwcV`MVC&wr*(k`XV6{mDyjt znNc)`unB?Sbq@HLl+Qp&Iaq=$vwOyBw2C-6Pv-(^iMv_ToDykSIRfsq)-?O+KHOlHR5mX96%rp#(j($5IyT#d&uPw8SHFE%a=HM1h zn@xjGbZfztWkV+bIlysB|Ba3boe&7|Sxw4)D(3RwO+~dO1E^u;Jtn%}Z2%Y>a|O4~ z67-f_o#RbMu^;Iop^3xEH z_Rw>r20N(7vA~%sHnBp%p~HmrdaQ3lBh|TxnP+i)ue{2K$f#^h4s6Pz)C|}R$LPy$ zDl*c}zBG(h&lY?34B@kjL}iDOs?0DKBHMvxXC@eC)gs+*NpJQ5MyO3(?Tm}CWwL53 zCwjw6G_Y75@`MMQ?QL7{UKq>rOz(prs3uxe!5^xmafozt*wsTps7UZ+%A?KJ>m9x{ zKKn+aVhxh|Trn%rnyA>7we1^w^B^`PKKrsH>yxt&Vo&1ZwkoBKWh~1r3`=|tXk|}J9{0z-2gbG3 zKEiV8W1Z8b*cg@~8?!5IQa6Xe(hwA{M{5(Nm8+7Mn<`zy2K%cDNvmFbL+}boOFF-3 zwBVw4*C4kad_%H)Vrng8h!T;3D^InR?53q85UAgT6HPZghMWUQ$0NL%O~o`>E^&9{ z&Ih$St6OfMK~HUiG@MgE(MsjqBfqP6SGwd=E%Zdt8InHx%v12PTd&t}q-! z9hHc-EziAGDd%OLE0dOOWM-EiCF=kZph7j)x8WBCEyQXRz|BO2A9o>?E7{Uqcc^Vc z0ZJ7suHHM)kj;xtAvmhbGDHOWNbs~liBn+yY?0ibgflG&Ey>m(kX}+q$Erx>4gvgD zh_f6*?3Rgt2{Sv)+s5i|kV#2AS0`?*qJ2LxmIq?I4G#tkgc|Lt(VxhizZLX z4zMi;*mo*L0Hci)pOLB&De2z46KjVT2)eD)6Ktw!ijUT0UXVMs=1rg40!#h@(V9R1 z?6aqz)vG-CQnQ`g1mVfRhH{Y@*Y(WEoaFwSDIHOGUABMZ6(-~0D$J-vH);Z8%Vmr@=`nl36_Y9}>YoF(i#~?}$Ew#W*tvLP~ z&csqQfVul$myW#B(N^Ku+NS-Ey{gNo;zcKI2+(fISdk*m!_)_Jarc8YoYkd!vQo;Y z5)q+W%QFY;(BmAFquf`!L7r12~9(ZY1JnD8?EfMNgDOhtA=Rk_hfu8$+)= zFkRx_QY+-PFec5dZP4GBLQ@U+n3HDbvLUD-W=Hxb#wk`Gpj$-Z89T~EG#m3M>aWg* z%>2jskgd+fc+dI#Ia{66zn?sjzt>`N;;Z0xz&GKb!(ZW_PoA)TzyI-qXZ_XL_}x1# zDBitu-)jBz6RW-`+dDcsIvPN0*w%TaE%>hTW8H|ME%>7E9GC3I-N}@qJj|blzY%r)0V%z;uCc?J6g9yMJgR$mc z{ki;R13TCsRwrJw5$#!Z*ogKzV#{Xu`oHOK4FiT(2ZL&-aKqD*u=YmZ0&yJ+{Aa+! zgf!YT8?qUpUP7`G-n#5LW>4qG%h8m;luT*OnUo$1B9oV3LG?X>vvC6o%=(lYJQ&&l zong-UG{*s6l+BX#o~MB+-GtrL)JLs^72YDyrxb{TZKA!b?{{@}{K+&`qAGQPE_pZh zs4m3Ra7ED=De;nrQIQIL$-tnaK&$`+HHpE@T=IBb8fCdCL(>h3{v7dDD7dc42tMXf zbZlqdR6C|t^kpeU8o)hHoTzKw{fe^b`>r&Ui zplu=z&xX4q${4v-_`VhQlH?`G_$YB0_zuzp?k1{msO>W_gEwU}nr2YjIF)4CmaVE# zI{AH4LkEnz6aOf9#O_5nU*r^%0O(^)4kjYlXQyl>(y0o#rfuXm{<_AizPBY`E8p7! zvY&Zw_Zwyw8i}t905;ZNv~8-~njT+QqWJU`Aw;+8z#HXx@(UJ3(lQ$btd{7K zH6jDb+Tek7)@GG6y@9@VJlH)-5ff@+LS^y=kDWnhHk975AxeZ*4>RrgP;NjK z9#;+nQc3g;jz!Bgca*W@K1Ps5@@SRPzsFjNmxtBRcDeMpWB@7>+jKE&-CEH+poWD=wy+^3RqyZQgFPg)b>mln9udeL^m<&_WL?Xo0+8HD%kE3 z2Wrr3p)WJTh7R85JPvpounWwx2O_I>Go4Nx#_TUIu18OQcm8?vcxP4|lRdΠwd1 zk+K1@bn*W*)N501R}#+h=)t!0MVb`z1q*ZFKFpdPJ8va?+Sl!BkLeo&#%@P6+G?mr zs9XtVi|`4!PUMu@8XX9gmQDR=O+KH|Yb-0(PWjqEDL0#Ba)YK)M{1O ztF{xrB2=W&?z29wDv_YLUzPBS#GL{}h1?1;1$8BykroiGDW0~aePxS<8M_q_bBO1M z!5&p>rbZz3_(s-ZKBsP9>N>Y+0x-BbI%TFvIAld8Jch5xLvk)Io4(`vOaj(^G~?54 zxh&foho;ZzY6T0*fF=i^!hQ)@P^3+1?)IbBE&;V=mBg7~Q8*LR^)wRW>PS$7lmZE$ zmUzr`ZJpMh2;Vwk;=?KxS!p&ZlUq(BK=50Ar&Kw`#()se+M7ZUQ2tNnM3+fmmDJE3 zHCHdghZj;HouR)DJr4a z$Iehpgc6gB)mEF?PaY|9(lWmhv-Y>UbG&?BSbacfUaT=Cs=ADk0eWC0YP@>tA%S|@ z5i+jWP5SP*w_Jk}r#=W{Ol%I&phJ6uae1yb5GT~Hk?IvB(lt3->_?|@lIUxd zt@yM_Sie@N#y3bRy9$ps!vV+94&Z^Sg;WYxj}E%9Df6r1Xr68Ol=&rKmN}{+$I^!g z_-q7i$R4b)jbSzY(kpwj{B$TRX`Y8GF=-ypVw2`+FFR=-X8}rQ`lDQC?*$}wU_A{* z+XEy;l@`0jBDK`Dw7&7JaA}@B*19xL=XGmJFRVUZ)vVidq|47%TVe}xcce^vWl-~s zypOGxYNGawHPIy1$D;tLc}PwB3Tj)t0{u*+htfFSxH_|IbYMLm%w4Aw4pmirSJ!6o z>J964bUvFK{DSt=^_b+rcEYg3A$bu5vKu-i!#fcZ4f@%D^|9(71Y-`Ao!Et(3_u@d z^1uU+)f8c!t`K22CKStf%^)N}*Yn93&$471@}`8R>Z2`xs<{G@dVcH3pbF2bsLk(k zJ%4_2!%k*NqKkxe_;$G-;V7T6S(5k<@)8QKb{S;{7GhdpJd-*#jj%pB)b+sfJ!8FF zo(^yMKYRXD`=-c$wgni{a6KFF@+X+5v^C{eQI=VisH7Ps|IlFqUl}F`>lN!@@yteJ zeDl&(m#FUf-TBi~e>JzOD8r|Vnt;!?at)t4?Lrb;kq|*<@Jcxt<0txFzrHR;(=+9n z7=>{r&Br{v6JyqYD}=7#l_yD*jYE;opfunjUq(N zRjG*F@dyId4euaO9O0VFPu3tuJNCp2}i|`5J11m1x+TB}otVVecjUD{aNWs(;Lk{I?^ks=%8l-Ho4iSA_Ag ztdEP)-_Sz*_>HmKGt*_;QPiOlBA3S}wmoMLe5G8qm z5;d81mCVdY=dx(ob}>Ia{lf#T=2m3yV&dTAZI!6kVJW=d?_|s1(+F?h)QdZ+-u;wf z?V~WuM@zmMy%%fmBeWCYHoLMog#VzG;t=qh=P94Q7pYMnf@G>y zi1W|SKG!P5r`=SDpT__?Lknn&FVCN`TkgLW)|XG^m;XGZ)kS-UeQ)fjv)<6Ms-E_K z{KcC_oe12~Cfeep`I%%ija2v@C7JMEr)?$XTaiOy^!qf-MX7SEae>&PwCu&%!EN(P z7bOSxrF2+awqIY$ufdOUFj?{FKhe*l|K!ns^5{Qlc^>^IkN%TK|B3zjqyGe-2lSt8 zbD{n!Ow;7h7wOoE*9AJfsqfDl5`rAvP#zOiJuE{#TF9hWflCE@w&2Cu4;D7JAWk7o zj1H^A$HW=GkXKh!-F73}1F(B;g^9_h0BIyWh5W1Wc=e>x$ht-_w4j>VPgm8|B<3F4 zG`8|?Z1`ytDoRLgpd7>{x0l=kw}Q=*B39Vv&iqwVskejK5Twa! zY4@f?yr(7RJUTaOI42vR((vy(Hk*)o#fXdU50rs0+nsFx$3Uf^zLsjs~)R@ zqyn@7Q`hbl!q_N7e`1qy!Y&mRy?fGl2za*Ui9*dsNE^(nq`Y}b?!Jx0vcp_9ji=dC#^rN4rGeGn>=Y zHtX`~_UxwO{mWU$M$@a!15gausW&V5zteYLB5@$h)zsC3>sl>{n@UGkJlOoTg#8y=#s9+o58f6TthouN1 z5KfB-j#G8?fnX2)&kOnJ!qiqy-53ix1E!3e1gVo5pMh>d*{t%Poo?3UbNSti(fR55 z+35VU-+g+DfJq5}jv$tEn8bt4oMp;?fBj88?u_eE7G7xyRsE`tY)}Tw=<6z2=-Q=h zLsfP>E_K;ZB&)Hf+BDyC=g@VzKmX3QNt|KZyX_8=K*P2bzg=&54w6j6b~){~T!yWw z)mX{P_3U!&v{(Gn;76{4Uj(Yssml@oi_u%U4SRpUFP-|Wns&GZT_Z$Os;2_eGj<#Y7^kjw;g(Lq{qeb7CEiRgk8?I4TZh7 zLwlRtD{K|LQNUxfY3EX@g$8gi*JC^Y_FO`RCW+`e)}Mx;fm!%ME5H@%(&fv|DxAYj zsxHI%0#v;~q~V?I<5Ps_)TuTQ)baqLNSA^86!>sGUPV8gAGQ?&aXszDK{lVRH<6vL z)3&%(^am%e8=nScepO^Sg8petHw77`&jSA&TZA0%XW>6Z9}tznuK=*pr|iiSL|OJs z(Nzxs^wOA)jt1-tz_W#x5YZOFr#GReUC%7Vn7u<^xV)r(>{u*_hf%*LvkDMnJ3eal z(YG~uvfX9GH*vHEyu@T?2Arhqn(zq;)5aL%P%we~qaYrWkSBV1Zx=&5X zSL|%#G7LnVETts%yHPfukvr$?^z5k_>!kJy=nc4#s z2o`4Sl=Z_n064CA&OkPHijtB8#d1}lY##L~)BM?Kxr3_s?Gg|A>pwHLkz86u^%wq~ z1zlGm*9}3%#G33oMr${zW=S-gwKOzyYE&ja{Z?sMv zn=Y*YKdMo>YM^X1Nl{%7g%jiIts_tjHsRIZmPj!NjI(+~i+MzgDLs#9G1l{l7W0_x z)bc!LJ3VGQJ!U(3eEOK}^qB4RnCy=<(AmZEvx~r;n>dri2e6@9$6)en}Y520uqUi1f2*9>LSr3O$}oha=Wey;MmjvLBI7m`Y zlqH5q9)it^yhz1RjhtnRH?jf6PW=blMO6WrU)K5 z1~Mom2$G>yH`S{ryJlzhK3uIJPBYGO!GmEX^z|MhUm-)}R)|;?zV(-8&~awoOTXAcckG+zr;d}U%a4U&)z%@%*PZX2 z&F##1d!gO)z0=OdBDFZq!B0L+Sdwy{CsM6+!|%&9D#TgbdFL5>d-;5Qd)p~n z7TKGQ_L9A^5+1n(R!$%`(Vq>OMJ@M1Js3mQc>B%zAD_3llS>n8I6Dq8Gv`6Duc>)} z9s0r>c5{I~B!uDNKnptnH$5CMp{Fg^4nEikZm`?(9~x57A4G6(uz?2$3OqbC;K9KF z4-Ege8{pp|A^r{w>gSJ2<$Z&?N2oqefz%#Cvqu2F4wBoOWF6+|0i@SWpgss#-gfYK z4+n_%a1eNh2EE%J=FT73?%+aWOSn4EZPX4)*KG$q0PNi1f#x0rTJC|skUJn~DXlBOo}jv(wYoQ{-xfRdteBnA#ckB|ahpu?3g%3Oi);RPbD> z$ES#|(`M74Zjz^58ZEMm3ghwIFx1sd^<+wkoJtASww%h4?!=g~v|-HoxX40Nd}6 zTY>?-?u@%TF!zUG>5o}iMWSpZZ%33$51(+GH<+Sk>S*SB`ltXcikmTa3|7n*U#+4L zH+?x+1Y(Tqc>&a~B5J~uxslR*HWSkvd>ctB6%r}At(*cCS3^OPMJn}^Xl=`a`ke;{ z-IT{{y5R9#C=&z2#mt7D2@yzH#)2YM5l}o@EjY`hjBl91rE$lMFiwj>+H06$*j6d( ztt3Fo@uUqwog;Sf_1C31MiYW%htRny>mi;UzSY3NI(D+2lB2fJtNJKHk0vWFmvU$r z?)NxBH*mqFktRe&L3|CO2O_Uo}_JKUmEYQj^mk`a?#8w^_e@kMYza61BF~uw^ z%r}bRlf0efVx@#PU9?J)L_#v9k$p`EC}quBL3}IcAgI0q1Dval2Dd(Cl29*Rnv4e!etofL+ z+yYhc}iFKA#h6q-}0!svCT=L2jiD#*FzHYOtda5-(_mgMsK-JB_pd3 z!WeHL+d8oBK&jDjEb`u9T%MmDlnW&RXA~bUIijVH&T;x}R~&8M?@}VT*(vFr(Cbb$x&3=`eXJ|%wlBLCq3M(~ zx#tR99ah6HgMQC7xH__OCsKOP-7lhk+*#-u<3vkUo z$m$LH>kU`q4^%?{2VSFYgQ)Qap6LoX(*F|v24n9gV=o#0_SfnmBxLWbpjx^+{S`V>$oLSZnaNl($paa{GExv2hP~?Q-f5NVytJuT8=q^C z8z_1lM{9(C%))pcl~Wr<96&Ur=gq7_jWrV+vJjAJr3!clhu0#xXG^#TrnYf9r0H+n zk)P374g#?-S!PKQL%MURQ4D^991+lvh;Tk8O`5D$c4i|5iGu$Rl6TT1iWE?ph_ixB z=-wN`*?c2rnUASxB9jah}r8TzZU5-%ySX+G@wUyU0ti@(bJCW8Z#=xkBF-#`}h^6QYnLV zViRq`E)~r@`Y=g*aJuD*6zq3lAP_kO)8Yx>gz{N$BeC=v|Hgp=O2cOMb*HxK(oH}g ziPx3P>DHFJ`6WCfSXl>LC-eR`PK<|+d}RlZer4Um2HAs0!Lsh=mR~e1>xv6yKH7$T z4viC~9)G+j_3RBdN<9b1k5bR!air99a6BpX92i$hJ-gvcsppV5QyYC825(9|-2&0s zHg2Om2c)y^g3;g8zvtj|w%tk7nZ#Sr!vnucJ=+QX2f?%2m{BKOD?QW)!?#k;!{Ja3QuOE|z*aZr664EcI-+Qy%~~tJKv&@w3$PAUIm;c_2J3 z^=yNyr5=BP8TE9)+0vi*;ccnM7k3LE|63)`>yu9RMB5fI*(W@WdJY6rqn?g%HR_qA z7+-Vhd=UK4LVq$Lz3nI`A;*Zbq7yqUR z2k;OQQ3;reK(vqt4;IVR|CsClnCss% zipO04$6Wu)^O)=3@;v7HKic4rHu$3r?s^_=@cQS`25%kRqYZAg{HwRYJqZM_?eT8# zX1x+D3`Crp;L>tQE4YJNt)lgqT~ICqhEiT!U*WBL))rMQ8zhrC;#r0%V_^)EITgZA zUcqu(SwkHyd`1v`{ERA}sUEO~V+bWU@X8V@NS3Sp7?q}VF?*$0=boyd$yR*&p3lXQ ziSc~QdQKSi-k4oP?eX!|yno7ok;B$ic<^9TxiNMLu~yw+q_0>Xj#jG2HhSTWdv9DS zN!Hp=my%_z#HmT%d8RAs>GFAs5|VDEdTl!4=T5{y(o`r-Jy&-1x}h$ul`WEcT7f%} z&LLkrjCF|{s*~o6`LM}ZDzv4dmqFDeD7_QLhJ;kcrnQsJtve>#S!Li#EG7Gd6gZl9 z`#kKbs70oVyOrwjV1PB7NO3kXb@d=Wyq$CHrg~Vyr&PJFy_jorO+6~hNR3wNz~Odm z9VV^}W!F<~EePYfl1jQXl1C+4UV#WG&mRv21M-kks`=2WM%B`XT_-7fAFfsqy%lG< z;K8sG{&o-1ZxDTbD@3fyhWSV#_?`w0U8Z6x!aKn@Du9?ouYy^ccdCesWm{~LJF=$r zBgbjs_YF$SmUnG#_E0%mG)SLfva+GtKOerBEY(AER!h+lsc{&waMo%HQd_|Bgm%$& zy*8u6oFg0P1OVvl>m2P$nR{4C&+~b6A?s4P4!6k7K3C8Cbn&W9`4!xak#`DH{ZHa!a{R< z7ufGKM&s^jS(d34?nz1<18>v)bA6+aJj}a^tb}H^fx-LnQ zhJLQoF%0s9k=csvy;OOqns^!(06EK(`gF-%WWsoq})!&;?bl7@NsPn3pP zxr(_F8`Ct*MH=!U@IV+B^2Y|a!aNk&n7tC|T;Igg`2*$SZ$*ADL~IQc9JRXsZ-ZC% zIu%n9fa^>74KcPyrShQ2rLdofr*pZR2(KcUHL(3LyIk;;Pr)k~#_9%KP9RR=(R~;N zQ=SHFkz_e0rWlf(_Oa(D^^9INvR3Voq8zehbz1;}}1-}(}IOP$|pwS!J`wKP?68C6#HW%<|4IxxM&qoy(m@0hUSG-Y2+9s+0#NGdUZGh zBy#H@gR{s(Nvx`gdK|YRO72l%CFP@ZSm}PlJX6A`p_4FUlUb5XKz9i9vie~3hP$%~ zDHDy?$W5B4hc3#z6*^^azWBgfgCDf=2Qfx1FMDaPI+~K`)7B`4%=GTg8Y3v1i02pl z=Qa3l!3=odWENIdiP;wRd6Z@wyGte4wqAQyH{Vk57*KDGwr%NXa!-|O8qn0+m?n`% zvzQY8n-n+AH&$N3qg|sXrKlrJ-D8Zb(Y7w&wr#t6wQaAqZLGF!+qP}nwr$(Cb$jo7 zPtL8(q{ff$Mqa79bC&YMdbHo?vOV z$SNCY3sH_QVJMy=jy5Tyk*N?$1s5yuk#E~H2})c{@(5rwwZA1*z|wH zEM9kdN#WEF0T(xooZEVhc!Z6pzmwxlHDTk{fC<-iBHZBvY}!*e%oB9d6I{X*T-+0E z%oZ#2vcdgE(BQl2^49dF>TEu#2<0%u+4i5+hI!->H7(&h*Lsz}1tj(_ghf7BR`?~G z+_%a4@L!d%r~bes(z4*((*znYUsf3aIFE>7q6|eSz8)l^9A@KEo(Hgs-b9;zht3`i z67HA;MnTU>!h9j0s>(m$Vyaqsjy8!p&C%KYyKE=!^pAdGo69Mw;`aSOm3k-Z_TbMc z>4TyxXF1na%8DQ{WfgZ!Kmv)?(|US|f)L=bUwg+=VLYhDw%d}dX-$^ylgbrfIKXfi z-cWbP_Uza?vip~kpw5sjcGGNz4?a>g{B4a*f+r!{D`M43+~*wx`qO9!QYKv~zHriM zEE30-A8evj0Y+_(HzVJ^>H5kVxXxO>@4j3riQ36wt)Uu}O?i!qhR3yq%lOWRPGA83 zu#V@9=#S?M@uyC2Ye~Auvuwb@PUDm~p^}eQ-l{C071++LnYSaeu55OrhaGF_7ihze zht%|v_xiN1CtwEp~Io#&MI?DZ9{2;j(W345M%sToK^B~yr zI69JI)ix~njMWC+;pd`xjhI51nP!VPW4+{v-*&st+RZK4G+40Lc;nP?+V=zDwzc`IqH`qc$|L-+JC>~UBru|jR4?E( zA?Uibv~W80+sLrc8b&DlJF}FnaI<=p_EgJ=qB&5bWy_H7m-vPsC)Ur)ov$I;iJbbJ zn`>A|^_&7Ik$g(?Mbw zGuun79a7UW)WeH|(Eha8O1A^OKy_ghuf)@8velJkIcmX6Z^F|0OoDyD3J38<(ip_X zcI}-ZLgcNb%8|={^I(mVp;0x&6TQLyPVEfl=ET=ps0EhG=e(#Vf5_wtx$$ulqng){ zxgjm-(k8F$6EoL{JI4?RO(P;DWib4)lsv?EHE(_uA zZCgQBL|>lp{$*o3BGI&exX$SJ#{KGnW+jBlM@qb>)ej`uJ8sGE{Id;8!Zdawp*kgQ z!4ebWb1kg6#?*dS!^AOb%H@9hm)zY{9Sn!+)jh+V!arydERi%a=F>idBO}7}`t4K8 zY+r`yC7Qhx6bN8*-7Ilb3x?v*aoS531R4{jmYNm>5*nwyET-D%^h-v-Us^ClgbR0^ z)K3oWOJPTS7oOn97PTsa99$BX?PAIroQSFKo0HT$JJ zGQ9yc+|k9j3Qy(jbH>NSM#Nn#Xibf{`+ zEn{b~e>h^K{6oYi`yxT`gcqUN-)5-{S9l!QD3@Sb5|@;T`UK%PVlI7FDL(wq7I$uB zeU$!b9CbE%n@c2m4$FYQ`gl)J@?<8tvu|APS+3wsOY&seJll3#z{^VVaBp4iomKOA zYMk#aOyTivHHFMb@OU<_4VZL1-@28B%&>X9damGktDf(e{JtGc~t60Pmk{Lx%}X|XcA?Pijb)bgBWV3Tvz*)}uY@iAG~HRHU!V{!!R zeZ0D7!ew*UaF565V0qtA-SHVSbL3Xc&)L@UM zQ?4F-vN|3~!7}&j zF`8BSiY*}tDuP`pHCm|TzKFCl1FGy7W!i`2)t=oQK9w4Tv6B*?bb!-9D6HAj6s)g5 z;Fiu0H3#Fw`gfl?qwJ0&gZCN-4tNO2j|3$28iJ`X)*9$^5beyMPLB+gj}MLoKJH7W z0(jU;1M<|zG^}c$rzp<16%p}~S4FY}H$|^Fgs_E&t0*NzM+bO5S2RK9iPxb$ah8(M zfh+w7#XCIIN4^j##|@!$P&|L5bsuE((gv4C)-4hdzQRyhD4xXCNcyvYmKRks+tSv$ z8{qZVC-L8*xjh zGL=K_2(@fSIz-<}Bq=5W$TSRze}XiLOL@C!vr81y#RG{N(s!zZJI{*EoYnSsj{mk! zl}w=1VC&OhFnmz$;%m_=1IOYV$LKlG8~jhGRL|$0TvAP?H&5Q|o!nr|t4lK&%=}OH zFraO6sIY{O^;ouw`n)J6%{VqggW!~b;$Q;UZ=32lS;d<;5_aIGgq;vOfVZ04rnDT= zVA2|sAxktF!8YwTN6LDz$YY!#U2O{p7^2wcu81?GN_)gdm?ntLJU1Z0Hlp+MGDmUq z=Reod=e~e)CqMau=r$?l9=Uc0fUZ4iY}8Aj4G2jSZC1;h{g?+y07e#m*jb#ms}^b2 z*2ByRE8boW2o!DP)Hef(Cax7yPx_fuwTBi?l+378kn{<(`wK6#jp~OT^w4&HV1M&M zsO-Jj8M~gAt3d4cVuGOw7_ZulyX7ikR?Ud<{2*-A+xN?20YbSXB~b@k)UFoHBa@BiBmCP5QUN(}(W%uR&@;zgmp~Tw8*; zCvx-Av~xuIs-?E@+E`C-QjP`&k$UxxiWqbJKa$$LP$>lMk~RZ~o1YljTf+O(naAC)MZrxt}5uNlGe z)$+o_j@Pzh&yn=_AuIA(7Q}btu9&am@}ebMxplL3ibK31Hl6S^aQ4I9W~YIq`2Ma3 z++MLGm2&0!*e6o#ZbRmXB17UyPD2H~A`!VpL&F2%p?+_#m?$IV;tRev4i_1U@g@Ag zxM|VkNQC#;3k|RnMJ!w$`J?5hv(~TAfjII?J)o9OIkQ>@{wK(e_IL`Q$KT|`2;XuJ zhfyp1^Oxw6%nnghJS1*vAzN+^fKO^GK|dxZuDk3~uUQ}=FIIpQGoBp&QJu%RwK%jU z6BEAE3&P6o-}X%;;$M(^E|KW8q+;}M&zYlwO%JI$v}2`X*M$q?A3t}#D`3o>I_p~_ z)d@e1H|b|0yc#Zy(J03nWwaq&P9HhWg6IN7`z1PZ!8);dKkioFXYj#wm<_;O!(~!# zs^1e|yDWLk@vta^K7Wah*seqQWdNR_nHGl3&5nbw7sHY%08ZlN0EVV6VS{yWGp=P2 z1w^D|fM}ZN-~a%6RLB`KZt3Jd?>FBe){^?|xKoXqVEtpe5#2+5eBOMFmt5a>uD3x? zEq!>YYb7N8#l;)9jAc@=Ho2kJu7EC*1JE7Irt~jwPU(w`kxNlNQ`oqADP3|9SSHJ; zZoL?R(t9?zI0h;frPSbK@ga9(;V01gOhz`E@@>w#T2>dRJzO2KbCP7RxJtvfs|-h3 zj9z-XbL23XF_k1L+Yu9?CeqQh=;RF9b=mQ_b)&MQA-s%HY@pZM0F(ub@ujKt=|TD0HCd;Foegu(kh@u zlqEWwRqa1SNZNkv4QAr=Wq#6Q^?daFyuY%^M!)|qx#503-WuHHik24)i@1k6!m$qQ zw^y$>-wjL!vXa(T0Zi)M{Nj$x7^W^ZKb@$~58TpA#Ov;%@JY>xNTID-?ml)Vq}N{S zdI+CPIFOE#{q@eUVLIn606+aR7KoY=blsZ-uk#G-$>tkj@y^KRWL&j>phZ_y^{ODI zmx;-v@cyBe{)JCZGR$m(LPo$>k!Oc3N~%GU_)QUg{97+a`XKXmyK+`ppYC}(lcT7Z zR0U20EraxCB;ErZF&pHi z7+DMDDnZTl!B8H?r!;=bE>M>QZnK7EqvjMLDxM;S)g!mI&Tb7ZmS5fRiwGJu!DwRarW~A}s&AU+DyfU=^ zndKw<7q!=G2wOPGoFk!(>L5@6a1+7%V;~pWT258q)?6tMRoyN_Cr+k-WPp{HekN9%dk)KjO|3tY@=1a5kt^3S91?|UGbK;J_#RR zt7rHrzh0us$zziS|L$EiTa3*s@NY?vk@S>AeJ9szL>70g-XB*97L(Wqs(ZI;yT%&S zj&mV6a}Oj0ElVYvAiXZdk?suB%7diZhtQYPh<}WdE@Kk8a$iG3Kpfum-vq5ImUZH& zGww^TGi;J5%?4c=yfOiH?h#`Ilpg)bk8sER3pfFeV7pS4H3;YtF)#R$M(GsGKbCmY zr(kL-IsUF(VBVceuH=P?lbnaLjou8IZtP8Br+PHPSawEkm2866`g=T4Nyl3$gyp}4 z1ginDLOGie2E}(R(P*x8UlH*$QXC<~7_Hom-;`D^yncyV)+}Y!7d@Pz+iK^m-oC4! zCE{N~BT-0+IgB>;CCsBXCK&Raq0RbWPNX174E02uzNJ=?>u1)my!vHjHOP9mwCweJJ0EmvYh6=s}T+SZYg9D3GnTklDzg;8fzyTIfYn zbR0D=IzDM^yx2Y#OIlWDF;s1QDHSg@5~69)H>OTvdHMH3K!PRNGrwQasWO+Cd9hL` zqwjCrkpboTF@rt}r4wi4&FZ=ynE(Fzlh8(ijJhZS6qW9=nU}UeG0{g(-3;Hy<(bJ; zIa>Fsbwi8rlA#FHHGF$N#Bz8=K*jf^BW2>7NQa*4RsZ%P!NRaY%zaoRpO8^tP+9F{Z1F#5zFxwD+&AB) zH86?FKx^p*oYSAS5!a4}6Lg=*mhi6u+ynSaIX?D8>W7Df#vvn?WJ)tgKXY>rCCCiB z?);i}T%RWp1-nyCCq(7zy>j`)pqhr4D13%^Y{c2S5N>h8iOo-i&GQ36Cn>$0OP!zZ zQ6b-Q9J*HIKDIrPq^H@S&hYR=(Z?K>e4+?wa&f{Av_2QL8M!ZRtSH|1!va}|w@1Tt zus_dh-U=R&Kh|+4RF4zUE1sBMk7J^qsNN;z;`hqrg&HtkbASH0nBeb)(nV0qCR2VK zOEN$kU|fn)dg2{pkBD0rtllcK`%4{iAx28Z3D2ZLv8RW;<+ldyN>YW=K%b<+mF`#E z{;urj#uiEfsTH}#5;ln7h#2a_4Wo0SWi@%zX#u$h%Yo_1bOTMI2kIT@AY z()t&{l3V}unoB$dRR@dMg|qBJp^m~CJ*u49EY7y8oBSCPM`rcKOs#S~J_``eG{U*N zaT-$e5~-R>lxzi(&Xk`}r{2f*B)tFyuLdcx8~Ez1-N+C7pA{e$i*sfn9PCH|jtf-}5l z75B%?87Y(tG0Skzb8z8|XmW^|PQi`{lwOJitc?2~Sk7s|gdMweDQ*TJ|I|bQkxMJo z`%orQ7ZfGx$y7uOo5(^)QonE=W8e9I8ZhgRk^fVoi209mf}wb+2EwtYZr1_xFj+03 zZS|}GtU?eyEaJJIl*DrT%bfh%LKI?nt4#JnQ`Ol9Ny{@RGdA0)9&BtJ0*VXL)haz? zqWSg&G=7Avg&mCKC6_7#ZWWd=F4h*n>iz0aCxR-hvmBZG6hN|?C4b%C#jlxVJ}tCcWNA_mg36D^>Mn~ry+U_)7H8UtEBX~ER3naQPU z)y@$h2r7qyJ*8dXL`X);{ssu)m7Mp;25a3aO(RmFXOO_!-jCaB-0BYKMH^SjAT4W3 z=T53jg62St)OCBfkI%}=;u{KrYua?K!eR;7^E{C%&#|xG4^ZlqSGDtW{xt$tFhT84 zDBXvTusHA=pckOG-m4TCp!rI7?WV5>$WtYNgg;e;D)~6@WWfv|ZdHBku?=3k+iOs` zlNR6~q=cBRK0z+=UFXEtDliX>ee=9X-8)2P(k(@}gh*pdhw=0;6AIK(2{Z*ld;{Pz zS?@L<%jPMjoc;7mqeZOPu{`9G5J*N+eh>4c084q}L~F9zSmaR}RG{yupL)#^sUTth z2JT`}FEs^f7lOjHyB~HeLtDG3LMja~tdkfe9L&qoemh8gzV?}1Wirdmt~F;i;=wx> zf+_0@A22p_c}$~GCE#&Fgy)I;2R~s8^P-alF`3X>Av4;^1rhnV^&jbrl^!ol#!bYE z5#C;GEu=u@wc?(0Y(kQHbWQcgQM_GStT4{4KmQmM@!KHZr>m-SIHpSamAm&q1jT<4zxhVYhqau4#SdOoyxf9cGT?HbX`AotT zly*9IRhYy##XQHHi+~}4aDQpZEp|V3B>1<_9kn)Ko8R1-hvi~>7K>l{z*tVX-dK-2 zW)RFN?_hjQHAT@xfstK*t;fyH&H4S2X_CU#jY8dGl$|TMImQlm_g0`+eGH3Yb8e;7 zy#h2Qf|LYPZAs?83d*gkKUqU&2}k&t+7unF*R`b%8;5a?a%x|BXo*`Mp&!<2%Ts;* zQT)7r+UwqH$lY!P@TNTLwzRc6#NQqCYXEMTHyBa^jXhv4DYk`|PIpBy1DRQ%Ws!?k zsM#`i7*>6BeM0|9SUwnT{%T3atf~#COULxlsrUr5!eQyypxnWZVGG(>r=La5r}yok zrZc#kWqCMul%zOQ_#qj-K3E~LBP)uG;xfCW`3fdWlzApZQ;PZ^#iRm$eDt)VMBRIA zb&BHoGIjnWUd1VGd$8MHaYJs4`nERi1;YMq{V{F^icI42XsRA? zBnghCZBT$%uBjc0E~sY2E3CFUb8`0v1dF2_R%qE*Y^Y&|N!I+O{ozs=;8?(JH7slq z$8bl;gpkAT$oxraIsxrVc+;7JByQ22h$d}22cVVR1i}ol@$sLf$O zV-Sx3-@fSB)+ZWfAOr@Jxn~0Mi~>l|*twYZOq=GC^_@-k8+^1%4u2umgB} z)@UcanFhA7%K=gd(wYLg|4*w4)Sz6(QVw61wXl1Vk0qIy*7EoR3BPc5H{2=^b4Jj`l zBuDQ(vj}8pRyHg>tT5mRwr_7wisyAC>F$teA>x#KfA5Z8)&_bdC_BFfaZ1R{wu;O0 z9?g6dG|G3G=HnAue%rI3f=|)&Ztc8px4b|1_#fS4o;J}d7K%0NH*&U|HUX@SQ|!67 z>%2%_F#uv0r*6fPsSsROvbBFXiVtG?3s?jDe&ej>n>Cmrbk1tn8m-Mj@~;rF7yXEg zfb3e2;X)DW|Np#4qGeGl$uI9wKET{xX9YWSoZ;F64YC2ay8;K%)hxTplJf{(vltWN zt6?F1V(PE<5UBcK)Iy`T1P5H!OqIFrm%I23U2qIMFps(KAbHxTB4g<<^+v9 zT*U)%E*v4E)<_G&L5;I+EoT}M{MQ2kqH$m#2N&V}GPl+wB!rubdUGvV&Lkv&gNu1^ zEpKlM4%TWJce%1)b7zNR9do!6_qZLfdlGx^-L}@qBaoU4M{BJwZyXL>(b+V#K42gL z7cbosJ+KPgm&5~ry&l|`hzka0Est>2IRKxF{BhM!Zv-wv*EXjsZ$^f7m3#D48sg=OkWm3KO6-7 zvCAbc9@^z>tZqmM@CPbR&6G^6&g0!Wc|E*CC$De7>#m#*O?RL%Mm3ge&DVfMow?Ot z+nIF;*(1L)q|Igx!j>QgGi$4W?{1WI^IW@3X08-inuNwfHnJE3_MvlN#|SZQ1JPd^ z%>YmMmr96D`(ekgUs}Vs;mF}Lsc?9IN%(W`()N}$(5KpW9VZFNa(2%lqd5 zbmqOH;jY6)L$1@~qrR-Shf`1I04_dJ1^HjiL&;1j%T!Yd1Vf(7m>%BeKmAgW*cGZHkz^L6@ z|4ik&;GI?F)>%y3ab?wc@U(-aNMWh*<9LkBVjnh4yRmtkLRq;R1KZAx`DH?M5?%(jmMzu=#(|`tZDmr<(lbEHhXC`X_-hFD5%M zqLiaa2B&%>5ockb!bi{E<>07g6xu^w-IJM zST>|miTZW7b%B0O$&pbeXkRXs-4sJikd`s5@)6)1zso^MD;zejpn~R;ql-g7=Srk! zp&K|hdKMZjn!i^THYG?mWpoLIa2g?|6!=9tY82P;B5W#E?m;m=dgv?i1dOX_ti7ZZ ze=)yG`)D$3U!@Osd8|>86Ak^#|3f|Og|RB^)z&HLljcV&)zB~SG9J;Z_$40sGJv+s zswD~d*!@>}AdtKFO7;aBevhSr{|)yXeV)97zzIzcloq9@MmyIg!wW-=XG<63Er%us z%bKc0)tg}GTqYzcx z&@pcxcNS?N{2%6FlFe&7i8eLyx=ozS?bj-k6y)n-Ba+PL0wnu8qZS<-1@vmo6QH;J z!Adrb>Zc!;&3)cLQqAYHQOV~yx@bzH4u9L%J! zme2Cr5%4j0@{r!31!!OK4rI+2c-bJ9Ohr-~J;tGh4s~IJ84yMvcZ^w42&bM18E-)K zx4{8=iZ;^0G0`_o2ovuX+T?xM?(CzucF?h^nxDG$0SG8H`8=5z$cMaz$(iZ@1|=ZN zKNLs+snKK7s*&c`k^AcYNO`Ii5m8Nv7=2BcfrQdl-r!T6tYXZPXm}`^B9E(HXO_bH zSmCBh3x_QYKvTrqJB=E;{T?xdNV&h&$fM8-t|7dkh++Ky`U3-9>mpeod)-2sKtn>7 zUIzr%AM}d0_LLf-ev|Y@NK(&s`*u&-9=C_(-+plEu&G+1O!6YYz2@Z;Fg48#vOoqW zY@NXpU8L6h^baa^fwC#*apz|Ow#AIWXg z+qg*kUa5Ucco(v6WFl!Oe!shmbVlWh8Pp>+wa01zO$mzAe8#<)X&%a*HF%J3k_m(= zjPy|OD0)tE4avS{(=ui&KHY00qM5ms?78zp$PDqQ^550Knk7tbWq8p|F=kr)zbp8E z1Dj;xB(5K0Ba8pOp-jK&KT_W*ul8))$#-(7Pf2a}DYBa9M%o!_$~Xp|2&sT}Bwn5a zh>eSp0ym-TeHglWI2)fO-ptXR8xC>#WeOMOyFf#|k#FFrP9WwJdt(r4#LP`4r{BBu zY9exHhkpkDt%l93GHDkJzUkym0}KJoLbae9H{!=rkKaIbw>wKHQ|!{E`ZCx_3zVS? zjNvz_RI9rnH^}w$+WMKba%ZrOc0PMvYVU6ms}DHVn#Clx>(Sg9l<|WTCRsZXu+UA# z262r02y2zKmzc%Jzn^YpQ5K=FZeu9n{|K)lOM-^cb7-9k69FB7!2Io%&yp$;e(z;& zqrV*$5z(}*KRgv3+#?t0vx2@fezh2JSV-GOfP#KcVlMhK@;xs%6IJ2x(@i}rK^cr@ zr1E(Gj5NRHc;>uDq1^dVvFY-6W(1k%B;H-bHY{+S zRxZonn@cUQ=ODwAjQZnWH$k@TjrR76vA zEK|nI3>~-Sc~*SNw?^H~_7tuNO8@BbxPn0WH$MT$d{ca;xi`u;TP5wLGC5@Hx}vxy zI}~W6R%;18%pN$5yCR5mNX%Yk)uP>B!A@Fign8Sg;$QMkoz9*pyEmM6=gBX4G{ZgP zKzLr+bXC;};nBvwr9mUr;y(^Es~F`$oMyG0V!X!v5fus(DQqH1VtMV8Rw|M?-=oE| zWTmQ%>jQK3F4ZL;3ND2nQ^>wr1WpwiUS3`f99eP0 z2qqI8GYcOQ99ffoem)->X87`SFXl`R8t&AAkJpAP6Y-7AWM_0>NuxhOU*&0ci}e!k z(tI|l7>kK?4t&?*6xZ!17TRXUqY4ZsW&o?CW0TJ39~a(7u08QFA~a4W z_|ik(R4og~d--p8^8-cTj$-gD%ZmjOAd>z|S7Jt+x~d`ewiIBMPgYJ>HE!}6UYdr4 z@0u@LpX^Wnk~o{+WM9e?Io|v_DbYSYnCcHuEHuWVI`(D!*LRZgAx*U?vI;dfx^12c z9nY(V67o5#;;_d5&X2h*48^Q&fA5RS#r7&pg zY-)Kg?R^y-Ol2OooBTQWhVN0^=!VAd|EP=al^p&^9NBe}*v|~9D`e5=QD8XRHS2c- ziAVT8M&Bp)+~nir|3(Gl{NrUIA_%VMFM-r>8|YuOM?3 z#|HvQN~39QrflRZh^Pv8W#(+hvLKYTMYzTizXo3vdzV^bn1Z0SXh#Ul2wZXqX@@JL zoh3DTuVt|Ly-@q42Qnm)VtFrmdF+#&mH8>}e9!k~;*(hQJ(D}ZEMc9c9)I3fvX7Y| z=8$SG=4aHYI1#!kluhipDIq1A!?l>keSqf3mN(hS#FeCC0DV|wPA^Rf)eNb0|@e5Z~2R0aUNleLCqd>k$HS$Ve= zm-t9Of#GxEgW3+=CU0dR4k??6Yro-?HZgn)Vp-kc0dlGjld+rg4NMfG-)r}J_zKwO zVXoN`q(>L5hg6qCQx&TZKPLaS@9!M>>1x2B`MHtSceyy+xM&W)af4X=oIE)F#$^tQ z1xpvEuRS5Y_63`Bt@o^wg@kFly&QtZ`fGXsdogK?xI*=xuQI5Zd;4*8{%!z;67fwe z+fDO1)^}kd-!Vf+siG2pRc;lou8c$l`!}U5@h&9`KSKtO4_3G%4rI4;^>9|O6 zuK0I^fjfa-X?3$5`K&dV;IeW$jCfPwD*Y)exm(VV!~)cAKj>)_f5!f^=?N8ZyW_2S zYz;D_`96mZ4Bz*PpFF0v!-XI@@Y)`8wm6;9p|A9j2mhHN)*S!Zwf%vNr*cW3-~VU( zl^kuUWV(;ldEG(9pNLLxx17dLB(Hz^So4&_kwsdU<+y4v*ZaIXT_d1S%G0F=M_SrJ z{;5`V)_>`TQ?a%C11hE^lAxR&YD?+1ZAdGdo+ECChy;%*E;-+<1D)kwN9srzlOw&M zCt|H93l{UQoF|Mn^Jb5>+YriE$zN^}V$Nt{4SjD}8gc*ZOJ|N$Cf+}!Ce72A{kO_7 z=cIWHiEtD2I=C;mm|j7}+xXPwGJApwR^}W9feuG8IDJP5`)%7qfNdIxu26TFNAh$R zy+);uScU){qSIMm!!8s`hGD@{TTe<~7jaUm`Q6+sP@<-5QsMDOWzY?Sa8#)k<*4=g z-1Xlbd_hE8Dm~(z^0Hd|gs?E`O6gMV`ZMlvIb8tbvTEib6|qo*Ft+en_t_PZT3xb+6LJXyvv&tm)c$ z0KKtX-Czy2;*g7!bc{jV3)sQEmeq`1oV?OBv)?L7PZtfd2m{cS+cowq9Rx{KGv{NC z&DBx#)TKa#ElVs~T+Ps8aR2F?nCd2zT8?1H<2Q_vg&5&57VCPY@ae9EQ5&ANL=;W7 z>(7TJ4jGS+v_*kX&Sf9vJeyE;TWfbd10d(ORACw4?1+lBWdZNkafx6OM+I-zQ^kwk zCAI&tyM*Um3Id^lvfgc!(epokeemUl(NxzUfzYBIO_@JwN=^y8X7a5*!1L7mwN*Y7W|D1=LvZw zg#&#oX#aiT?VQ8FbFRr?I761^NI9~NM-&NS;Zz_ySGJYJl)s1BZ97Im;RwRSge~~B zuB31rNLHeOfXXbxK+O)FO_EJhkrt%7ge|u8k!8=dNQ!B+Ybh(;m-}?PeMe`>6bVJl zywPvQ_O0qm%Y>I$QX0Jy)DU1)PmpufA~XOUlr5K;1!`A1H&d(IOg4O{{>=B;zZfU| z7(>sN?D6_qt)y8%zoM8HU+F(Taf@)Xw6jNZ_VaZuKBj=5ZBsZNvsBUJI^H=N1jK!MB>Da;Ehdd#guQnJQ853T!`8xNkY zy*2FCjl*e0KoMrjP|ia5F!_&M^5#Rh9`iQyv=UrSWyes?{(xeS8-b%RqA7R2U!&l& zGmFYQfw%+He6&~kXX&}y+V_Dv<*p^Tt2;|g5AKZ^>1->L6qD!2wSV28Q@t)IpM$uhOb+vHuo*R1BGR2$*x!>ZBi`qkFiD9c7N z1f4{*D)txp4bRJb!<*(rxQGd73&}T>OLC6{RPc{5FSzG~fUiT{Uw7?)syiLNRoPoN z{*N(MxF=P+-ic>Z7WK<$ikBPEo1J#Jo325(}*x0)b^as zs8=suEYIdA8%Wu2_*Y;ddYxBKO}Qd}$n?@$(jWumUdUoNe&J@H}o8C_Eh`ikw7fI!6Z z%wYTnNl>alkthagLesQpo5C%nhCvo2Uzst~vqNF9(aJR9%nH=dcw6~Yd9wkmYbAII z?*^d&14*#==wvaKQbippfxd<03T_3}ktdUfM`TpbgbX1GVo^XPPm;z*5uzzhauey? zNH%Hv*>Rso2hX_Ai}C3-o%-m!q0QphiX&_ovlURQ-a(W<&)34W*u5aAC!NqwX)Qf2!p~5<44} zVr(X)Pbf3inOM+DpTi_Or-o*ZKpq&h3BXScB4(IQXt!MMd4f1T@aUZvYb((Da`>)fMvoQI8 zoi^kBFO~o|k1cceCO3d!K(41_&>xrgYYP&%z_xW(`YLUFhz*iLrt$u9g>2s{Wxa+} z2nfZcF72*v&nFyTQzpbQOM$g9=x$?i&kd_*`y^lm*f=H$6^WfR00{|(rtsrjBbog( z=4cg2oRZ^H;J$6Z32DBzQMA~mGI*&p8dogH*~4X!p@qtq9`cmFCCY1c#%Pwp+(bq7y3SXSyl<`1I=t3SEPQyR#e^{?yk?j zYTLELx>XyDrXsX8rDj6qLEXdpzbJ0T19%~e`STELbI9|Rut?5DX6nhh(iTVT<|uvt zh7gY^^RlQEM+7A2$RY17YR)Ik?(MlM`4-d3?P>`G*ny{to6Nw0Rmk|+g0(pPd)gu5 zIMFz@V{empH8-kRBsm;YHvG^?m1>k(l*)>C4F@{6?=px<4Q;2Jd?eE+{*P~soHb)) z1nVG^*#P3K*cS)LP!R}SM5-El^Aor)EB(6IOA)|`sbe0OQk$3d6PYg#XkWgR)xMDt z`8`>$*j9nRVK0YKWIr zeZV4v(nJuJgx+e~{%jrtljdjz-SBF+-%?bRxwxPJ`586CA*kwtFsHVJdPaq)l4OB- zAhpYjOY5H;pEoty;6Uom(c+sZ|4;36?=Ej;3t7qr2k~|xBwB2uBAaenokg6mM)di` z;p&5|z*j`#Wx-bN40JjY7a!M$pdZlimPs)RrE@a_ri>6Jy2fw3HgU_uaGHaU%L5|s zRjxkj%t6vnd(7^}&53Xyc+65TL{`9dV@~6Ra}zaFGdI8 z*Bj>dd{ZCkc$U|MG4ZxUewzCq{F&@PCXY0#25>F;OD1QjSsOb}0|IO=VevD+Yy_De z#`i>v@6XEBzv`dPVc=hnGm%xdlab+Aw4Yqi?bQO+*#6-WENf1Y%U^}*f95=w^QTHV zCd#EoHT)K-m68B@iTK7ZKtb3*S&Sn5IjfLIobypNJ_<08#QCk{^!KnC!k7?2$2vR) zo6@WWh&C*%ir@gJf^e{bD>CFu_O@TV1cxV!##_J)&TZR0CBHC`{mxSKo%_~wAX~q( zB6T+c4JfX`5Z6sgubfP$!KtTm#`$Izt3%pqRJ5f&pwL zvu9qaG4DLBhX&(KJPC7|i^Jpq56K6emIfH85liBhAB^F6SsMpj9Q1Ze$yQ0O(-)mF z$CQrND90r;1_4}vk-=Y17&`V07A~OVzrpVWl@fQ3x6{Ln`ibxKlSo!@UH!HedOZ{` zn+-2W+1+X0>j+?6Tlb(FT`J>2#5SjDc!O4zv~tIw_Pw6qW7o=@fE+q4&swG79)dUczf1&-Ac*HOb*FnUB5&uLt* zWD#et3H5tE+#!#i{~%*@=LTQa-vX!mX?Gb51ol!+XT6hD>4zzhggHbYdUGm^F~oSS=sgpeMnfrSiH!+FCa>2zsDV>ltab4P$&QWrJd6 zi|{>eO1$6b!&0H={hgF%FL(Pr;-Szd3h&6;wJ@p2EM*%H)FNfa7t1^qd^wM5IB!#G zo#Ny9YUuAmGhJNanWVR*UwxT$asPg_9G||+KDHU8?H3w}ihO1+59W14o(us~x;R0-0g0CbPsn(mT0`7*@H01QzvJ%4SvW|!r@q3`l6?&!2xfS^NBV)^K0 zUNOKAbX^*exe&1myO>`{Ve@e1oIZxu(cR%9_0E+X+llHz5|91fQ_w2DNNuf;nl zZlS-(P;VQ!&X%T;h5UT#3 z?N+Vzoj+PM=M8<`%_oQB8dQ@T$9sD{=3KbP^{C~#EurRSqqU-tmeVFm%H*Rp*3hh{ z*T&onjx7z|&Q#FYmY+5+;_oc%EA5Q!qKC<&CAuYb%oq<@AUUR~r3#_WuE+P_c+V8+ z_soy(44JmP5u^Xl-Qs%Z!>$G*lJ;-E2c6)E>BkN3`aBe7ZTa30D1MK1NbpAB=Yh+B zycBS2k0{0l!#olb%WuGIbn8UY>OrB05uSnjW0=fepuAtiKl}=9f?V(f4Yp)p5wBmN z(S>SmKs^+%pL5X?bG>8nLSGIGpwOTsMR2XSp$?+VoAl4t#4#@~H0q5ev6@k>v4(IIDi0&a9n((i7^-09v>AG~Ni7RHi>p1Rc6qpcAsK8bslnhD8~9(!v?_oZ zK*~f(LG&;KN)A?u2?+XvBLv+gcIDpb^HB&1n;wLX`2htd8Bu6#<7b-igYubu1c8u%^&=*etO! z(KwaesW7EiGf&%U+>dZ>6Lo}~vE&-lychvi;N;U{8c9X+l`E_>oQI|Il=fL83Elm>%1<&e*nX+dgC4wr$(CZQD3w+cP`g zySr6Mr8`OGUy@GedhQE!@(+GSi4>rF+d6P)6qQ);Vc8tA_;*{0diZ|LTsXm2q#k6g zI3jnTcJyGBMM?UHGCc&owz6)o|73&*K3ysRb$W&Ntwe9oa=1QL93L|p(Q@joI5}!h zYCdWPfKyhu_)u$reHW6ENn4D6(FYvSwk5#XAV};rm)&E}7(jk}F0g7j8;FkvD%^Up z61Q)smjM7#V9(q4aVPeWBb3KBdb$9pwUk1_f^>fg@ZFNb!3I} z@Y&@bDEY7IIHviQz2KWv{fWnqk)fa)BGf>xOKEGD*vDAlgkrXVP?3gzVYI^RPT+20 zKOB8rczd{;xxihAfIIb9|F;W&8v{5CxN`?^;L zjT3eW9hI4#ot8Aks;JI7ASkOlRAMGe&Dqy|T8%n*Hd(eQ8N^*i9kt#bE7EFyf33CG zR8)J%)pG5su)5lgY(ie;TxGfBEUuiiLHR%#3f+~Fa3v$WIhEv%la?d zrIJvt4U7}rdz)QoHe?c<0)A%H;fNB6r1oNGhLu2=6SR6e8T8W3<2sxv<)`0>4vkgm zYu0q})2MQDo6kdMrqilY0Sc5yEs0IqU1RnXdqVog`aPJ4k~M85p3t(x`SCSh`N8*+ z^^U6o<;VxMTUWn1P5wCb=5{boLHB`WYJ6Do;)#0?2p4CFyerSNi8nMs+?+k6LPx`L zlQp^@t8kTrGxt?v!CARiOmoaUwVrbz=>B>`0l4CIV3N$UpJ3FBA_za{!Bo8yC$j>U z$QaYw;maIrhbMdDOM5c3m?a%#%PoN$!Ps7b&(=dXq z+IRJs&0(3w+gZz}Z}eig##gVVH;AI0ss^#XT{O)6f=_J779Q*ii!74i)TP>K`+Vmr zql~4HX6uY%4#0cRKuDcw5Y4&W)BF9hZWb6loH2)1GC@P^-0LLZ$XFGB!UF z303hhj4(RoluV#>zZ++Cp-O_0F$oCqZM`BL-B=I-Tgb9^7|g(EQOJUp04uZ?0D} zvj0-futFSzb058`_NAl)cw*Hc_i}=m4(TSPyk4fLcfuaLa4N&^e2)|37CT%yMtYQ6 zCK<&Ompz&B=A6|Qmbl6_OQ8uWHJS|tSB#;YO%V-`y^GO3Pw%)}Mxv{FtAX}xjR(H- zrN;!xp#;&5epP-FyQ1_?agaWMf~n7grdJOt#+ojUrqoAfu`emniT#2?#8-=8p=#iI zc$*m=<+?Sv0N}V`&46$jx2!$vr-f5{P=PUqAO=@+u?!*$3ndMcVOjKS3;@`Q=bw;4J|&vf7u7Ce6V*_luOe zCcO&N`idE%A{cBsgIv#DJYSF6V`MYz*5{YUIT;%|$NjdZNs9ud0SC>fqn8?_NOH=)W-Qx471ZqJ* z_Et4+!s#}0jCdG%5N#|dJWkbtFipLJeSUyBF_M+XjrNh}&xH3m1_+#)8&L`np)~or zetI}Lm^{=@iAkzahJt=&z6O3njAILmMv-17Byiq9oDB^wM#P3gae1FJim%>XPUYGn+92dhn zeVbr~kgIS3Y4$;pp9!HmzG6=?+xjD``ep`W%;znTY^#}yWpJ+I{qMCPAiS`XJg$+ zTUl}9g0qPhzkpd{RRIOjH@ioG&0IXyKlwW;J=cFcw>`!DE>7uJ9gfuBXl!lE3A?oX zm!Io-mP?|^fZN0#%CjdL&N)k-&m^GWUNO{0HN1IaN?`lWpwNtfU#cL(+25jD{DJ*9N=#ZGo^bL;9)JJIYJj_YHdiu#meE`PYVXoI?CD(RfjZVbp-Rt? zi-%{RVyH6YsmpmHBa@sYA3BqEdvji4+f@f*fsEan?^0UqyvDe_;G5aq4GP)`9bcO?g6(f5OVLa7umk zwB4h6(=OsY6DRM*VKoo#BaRG_!RJh0wSbol@;-Y=wl@V{n5B*RXv;F+?tg~lyoV;# zS@6Aj#;QoX5TN9VFP441I@0q9a%cg9qUa4(Fm||bY=P5Qk_QNr`v&cjA^C-lCHQ0PU55fE74e_BLDyyRq|3@14kTFa^wS9I0N-Z>xhNfY z!2AKb7SSu2HJFr_5i!QhLhYo&>Hq0s6mL_I>c2q@1=(>@8md!Rv?^A z^l!*KQD6(FU9%e-+=2nCSFNnhg)yWsB375EsguK4Z|=?%K0|lPQUwQNIVhiDtB_O@ zg^ENyjAh3?6Cfkc!lKTFsdHEptPfpCr$}e>q@@+O~pXoVPM7Sfb3SNQC^k zLg)y;HrE`~uyfhEco|@Q>cs}%8q@1QOgHAim6wJ{;RUtEC{Q(n{qT2}Yx;qmlIWRO z0O&~ii%Z1ow{0Us0z;`_yi#OQk`EMDdLbB|(&ho?#C3nN=jhF^=j2{gIJ^T43!v`5 zx+N1x(A|L#Gc7gu*FJ`EJuYF<*$<`GFQ$Na1;4@#sik@#+}qZr-ljlW*db-47eYuJ zrzw*c#DAPz(*&O1Uuye=_+Wh~v8V;6gaygSNj2d$nMomUz8oi@^Pz@Ghp-O53Ele$ zhX*QN&xLm@tI<{DPKkZ08sh#_VRNkMTr_g^fifLoF41x*z<8 z1D2!mv-rxV$q5|-;ZgmPNL&%XBtJ(h?iz=PvwYWt)b=nu(Y`G+%in4`e-T%_`kf=n+)3(hP;p$n@#4{#f!7`2JO$tk2jr(u6T`Y(GZ!P}8e8qO4F>P0D4Y1k) z%^rEL%BRufq^4L1g;GCYn0QpI@5gVQ3c1le-acRLe%rZbJS=&k=iwML?T3~o>`k+b42SC=+RYB<*ik}Gr3ELo z`u6mZ>-`7v9pflkW{op*I4?%o^+M~h&Zf|s-H#JQ$hIq&G==v@WSwj?7{?XOlR+;_ z(x0lGFxv@&HVyfz;T}=~xKf`?notp+?XFV(qf3OB8umTR)oUTP^zvmPnc&pzS?&b# zl+9P$su%qFd^9V7i#pRYY-&IJO2X)e{M$89XO)fic?akChHIC`I0R>}TG-$Nlf&K* zT{Kr{yNelebCH^KP@Z=mbuT?W-`fwavw^zZ9uMzN50!PMyV|{;Z^zE!-K~J0u8!`g ztN|C3u4=nr-R_U%I6kcp%}u}0?IjB z-!R`A?igYGC7&!{m0f|Bqs#lKDvF+zJDlO=c=|^y6fu=%Tu11 zKY4uJ=%zUb_RgL$pF0C|L2O^F3f+K!C=e!!!B4Bh+^*dW_-FY7r4_r!| zNcDZaHTkZAF9*xSaPzHB?+(05y7+!V+z=74%xweUsGJXufM^l)>e z*<<(FjM9M^6h_mM%V|9s-_bjHn2*bYOUOjbPIj&flpFJo)}@Ah#+oTzU|Xjyq(6t` zJZp=QjZ9)Gca)(yi-lW7dIBQ#n=aIdEtrHlZIYFQozej2v-L9dnxm8;Nz9h>tXrM%I--ia< zTlziJr3r)kccx}p$8W-0v;3; zR02cr{#rnkM8dxv00J)iD1>);Wv5nEG}b`mi3z|EYxg^kFe(5_rBFZhF7IQfcqVdS zuy14vLuQ^r&3!8&;94!x14Y(()>4y7wAcrEGy^NA;lg%$aNV#B=7pQ{qmP)4IrLS`TpG8r%1w~!v}D}94cG-$eI>7e zwxEUYCotztxm}a-2eg{jlolDu__}Li-SvN!3IZ8%D_AaPiyw=q86`b^ZAZk>yuDt3 z3hB6Ad_;b(mU}K`y{8%8-9-%fZ>Z<2~w|5~3EFnjr8cm!g%bHrL2}J+WfoK)GXA!_ib|DO( zF5Zj(f?t7?=@<<0x5ZFpu=-}E1#MMWN}CSD&Q;l07+kE{3$(2R{k$6NVGI`l#yHx6 zn{-mGQq1XsXWS?&q>qI#@JB#*m-+)qr+5Pkk2oNNRA?pj_O#u@oQaj%Y48UqljBX! zd#FwMqM_wuo@9dupI#S-k_sRo`m4=1BQj;}DeyalwAJNC#vjxMUFNuHD4z6KtpxT5 zi>lCtcMo<&*?tS6R#Xx{amA5qx|8Vj*QB$dR7OJ`=A>6gQR?o^GKd8qXxIyKvjzG2 zZ(Gaw79WgVFu)fTWY={e&=)OOSIydMHW%%6*Hv5LN&Swtp{=HNn`V4iV0~#cwai2& zjkkX|D=W;}CL23C_>BNia02ez>q=651QTxtFN&N1Tr-_e1q=i_6T@vZ-RA|_Cyks3 zVpzZ*6$p9khp_~WvPTd$^$*YyAejGpwW9>}j4rYSN@m-0HbRz4j+4WcnT-(~_-)rM5w|WW_#^}PhXU9AsBc+(VcoDPwv;dL6E>~C02 zbiXk9C^9)+e1+DdDI(ekpOFyM?fEFq0CLU)_u;%}e0!lA(H~D7ba}m;AiPod(w5x9 zot?AH$Wp7R!GC#Q$MxUGsXDvxVJGYGvNwD;Pu*I5hdXlk>4Ny;UHURUQlp1EBt~V2 z3gG}9uBjUTmzc`i3Zpd6Uz=>An~GrdtETw${XG4z3-4<8Y`@#z*$$~UtU>y+k2e$&xD{|)0?cK$Nx)X34-gV&w3RL5 zJ*>>6HqZkPxk|gnRc6LM3$1dSA47@@`VrM?pAwWJTc$iOy3d{H1mH%e>n};nQ1qKd znvlXaVR>a9Jk{pPL)sVTrn4(e}kCtQSMT%OcMOC4x<=%~~WkAbe( zL+BmFnC4xBdCECJ4tXgS#bw&!tt8j7W;0wu>B! zvr1ePOjcSSWY}r^>-`jis}C=I&0j3Pl&&#t!pEFN{HUEF+BfkoiBe{XPMTkCxVTa$ zeS-vY{IP*Fb0<2jC*`eq49z|#Qet-L&$jw%g$nfPSo(OI82-$z(R;>~?9qBuJ zqoT4C=3Tslw21%DmzLJGX(~jNzKM^85Z#n&b2j2({vW;dokG2JR*4^YT+qo5z1D#O zgY;PrQ_mppCfJWOH?3*7&5?00u>9Jor z3RKP@Fl`SAdGSm8KRSxwf$^7)D$wpeB<_LDuGBvAqvtn{Oh{gEg#fscm#!}0SQ(Ek zU1ZlJu?tH#0w1zMxR3U6h^HaA7^@V9>6p*R`_!Ix41}Zq9~8wu1O86>w01Yh@8f)Q%K=JC#1cORVQ9jj=yJ_V zu0*h6OnR+?o5l%ESuij-OSIS~f6-8maN7x5`0r*~vEY!J!9_VQtE8DmrHSa<*hv@O>})j1S9hOL^U6*6Hz*m)C-C-dPyTWyO0PKN)6q?1375S zur59>&!Gce(Nd$*g*pUIOfoY6W1$L~-2u13jZNA4xHePmHcE>O-mMTcUW0BJzUhIk z6cjVkeS!`aVx~KW@)QZp{xKRI+)(AzaZ{7886D_D{t8@R4`yd?Q*TRB$U&b85u^Pm zAcfE4sb9I!!!J#0U~W1ZLjGQ+<=GuLjqr1ViiV%|XCvg)Fk*#TzW%aMP8yHF!At1k!jro9rv?meb5;wHzl#;CSETEHpLu6RcIzI=Or640u7)QXz2*H z3XhbuG$+pV*mIDpm)7y8$7Hdnq!BN+!z8l8%S6DeQG1Ot;KKLnlR*OniJ=j1Nn6+p zuLZrbKEz*hrIKv{oe_zrdy8A9MV22$?EUxnt3j4OWkvh0318FUFxS9aVML1o#k70b zxs}FLV|NEeCJh;))%#yN-<$)j_&2IeKP9D0=khya=t-JnV>Oqi~8gsw+ zP5PVJdq9|mA2Kgw%uV&rH@iOB(85fOf?x~f$XWl5msZKCF6bIMXfdud9rerM4q@ps zd)Fe|xhB|Av!1bGtCFTh#tTQUByNY(G-zp_zbRQ$8UGd|sMowC66SP6*oW@2txW(4 z!#Jy395rePC(zV4! zH-^*$dkzta8dxpD*zM;cn5Ks@zxf5nxp5z={(2R$>#`xa6^c2Nv6dswn07D1U+8&U z&J5vbAOa7*)_sG9)CXIVj}iscu&4EdF$>Du7Fzmh`UyiT^ysXJkhgZG@vqimHB1h` zn~^%9zK|bcT-<^_i~fB^a`i&9sG}ix-8g*$;qCMqp(ZF3@|KI z;*AmY{=7MZn5^9UksfjqmYPVE&&{J+7MU{T#K`1l;&FVnH`J6fQLm$|+-a;IVBZ#} zP2r9m4X6L)b=YDsL}P{PfpTW_s+IN^bz(u$$}a<^lim9MG6g*pM+%6)Lio;~eKvHr zBFR%l|2#w53N<_!0Hm3s8IiXElXJ{lNtD)NSr*L4E=&>53)for;3Mr_xDy#JnRN3XothrYSVL5GcaDJ}Uvmum& zRE@G(UV{v4R2Rscq#9ak_oLttefbUgbXu1w!q`|zlp3i_{XP; zQP{oQUvniOazy)$t-t*#qTr!_AK7(nB~__)xTDiVVRv>{FMAp z|6rx6fbSO*s$3x6zo5~jIZFmkP|#W%1EL}f!mKSPgjR)sxjp|QpTZ(!39Q1c{{50q zSo%QzR@UWyHrfo#WvH0yVBbeeu>KQ#h7HSk`nZ)?McWxYs#<8t(*&z3mSFeK=6FJe>fe`-M9MZeY2{|cG8Ponrr&pZaJ(%zx zd=2`VS{$F9#rgQ*o6DmyUjmw zQ4Jd&;Cp1<@?LuK{`6Q2h&M{Z9WGT8kj2wW$Vh!pUgsx_e`dXc63k!&TC@&TzlG~) z4ucU`T(4y@icN_Mtuwq_4Vbs;UW-(QVseE6u%fzcc40l$pWxTj9hXRLFpHht0KG&b znuHq;qha@iydqfWMF&+UlliE-!pe~|*#s4F39@M){d*PqMi92@stZ1C_sm;arTjEk zKP4$|eLLf<>Js(fSk|m~hhtIQ^h+yI-Qw8k{*oj!mRF8_?mT;4Ha<@OZSm}M*GHot zJj$9K{{OPT7$H=h{JSjtUSZ+>_X;@Id!byf`*6BXzpba)eYhRYjzQcl%eTbdKyaio z9+R@oI|vHF-|=hvBngX#;0Q7~rXFqLQ=AS`3ia>UUAK2=3}YG1GEhQqSov(rty$vJOHBxTVX2#aI7(;H8Bs|z|pjCSd;2T^ID!}t%)x~Q%_q%^bn ziFI#19t?wKxi)Qp#`NDiC^XS)#^@A5ce}wBIONq3$!z(2;J7J!Sd6y)tml5Cg9{Tq?sNI2>(y?G5hph;I;X;!}e#+!e0T1Eq5)sM`#-(^%FRMf@X zo`btB^BOdFzW;-q_RZYq(M@S;b^ixB<>j~Nvi}cq+APjFH{GJJu?Fr7s*oExyJUk_ z^c44^@A~n`Zz560`08P>+3OT9^{e5OPq0Rn_2$2-@VO4(7)Jc^xATIlQw3M2`o)|y zarLYJ>r}p<09ZQvHAA_1$Ci!&u2dZS9t6Fq1Fk~l>eEz#`Tp-H=kGqmD*#KC2N1}9 zm-$U1hd_@rTElKo(zwW~2~`_(-e_brIW0L?i%Bck>L91)ep}V9GMx2r8Vj)OuNsZG zQnx}s`G!79M>l(I+aUK_!2C$8D2i$rFwBDoWn4?4HomXSE(H^z7yTj^EEc#3kaJnHe;iAc?BsR{Rm8!XxK7Or;JsUW=&g>o!P(M_6n}D> zAZ}@P)B==e?$%?D&7^>@tQdf~%bF+6d#u&vA0}c-wA#xAWcNO3EvL0}w|#470J{QJ zVDFu5Y0I#MmNh#>Z}^%IpujkfTXnlO+<7`zyMplfoqt52qd3>JS$%O-pnqdEA}P?& z>Dbi`FODqJb{jos=n~Q`G&nVLM#`Io{jF%zuUjq3orGS}1?|n9EH@Lo4Wnj(MlcXU zcJRD*p3sif{EsbDy8~57|HGTe!Bj)=F&e(L5HL>h0@8Tb^*`%}NL*r6YGO*gSG+vx z_`d56%wT0uK{T&8-H9zbgi!;~QVS4y#w#x(@KZ%qy%{($1&gmpD<^YvmqklaO6Kzh zZ(Q(_E#BbB6qh`oTaZ#Vr{>mkGi$5?g$?G0VIn^doskClSyp7rX{sQC z(;k*syCfl7N}GisA5OZ7Vtd1bS$ps(+rZswNH35YYSqH^y+#g|k6P07tuJ`9g0LD+ zxHA&fxK*iT$qXqL!o?qWBSQ_tYFei_BXuU!tikV+cszy{p9;lF@T%~NAdSLMmAGS3 zlOSqdYEcIPUp*CoT3Dx11&^`s4Mht*KHt&cpbU^wwP6XVU~Q2g^p%WQ2S0ulP21)( zH>|k3x=X#Q=0L6J(~fgRR@!Xn{7F)VG=teGnO$LolIMUWWwDyR-}l?Cv$im7N3IK- z=&%5z7-#R{iO`z*7$))uG84Q(%Yb;9<~9slE!UTmg^j<%L|r z!=NJB(pC?fk;10uLksZD(dvv43r3u)AZJ?TY2n4}{Bldx&->kD{uvi!WtayI= zi@DEgt-R;?iB*M?mHcqp^acH8>V7Cc@Xu;6n_O?-~&-89Q>VWm-O zwf*TqTF1J0>j1ORa-(s)Lpgu&s03`2YE&6${GD1(myZ)YE))EyBIPT0uRR7Zin|!Z ztbsgwWShis@pV760JgrRBpRYfOjk?mNN&djV`q!gM3x{$ma&G>tM4S604eqwhR%2B zQD>!D=feIONR{emNCu?GK1jMV<~T8mA4QZi1B)J4=>7r32_%Uf;*;Iq{V|Jxsn!IX zKI}MIl1LD}Z`2rBBn?h)Ig3nXv)yeE;iuw?QHpq6QsQFB4{lpW6I^TK=1pmRg0^0% zGblm0PnSdzaY4DpadkJdKot=zKl}ADMxAi1LK$JN{MKI(O?N*VR__QHSkWYZkTPA3 zuO|YbbPyVn-m9dn7$G+0jiNL?=$>&uAD*S8rwt*_TF;0BGwn0B74eL-OYYz+0q;If zTq>dCZ=o!g90}i%w?=f-5wS}6NC&H)vX2BEY5ai!3@RN_VmIRk1&Z;hto%v)PD=@N z()!Db7Tz_O3H)0T#Ll(om_>yU%2z^pqOl|F*8qloB0@5=xHBX37E|hRTR49@iXsa5 z^I-(XS^q62WXp%u{VFzh>3ezh5)D`TW1aMbAKemD+r(Dh%O0BgG0iK+!vJAbVHs94SitBY;>(9NQSrep+9-3Ytj%S9K__5oi)PpJ)=YaQo-ePwIYi4x z4zfHrAZHEA13EB&AP4$%NMCUs%7eP4LA}&tUy29eI5C;Yo`i!t_9*2y=q z(bWtHc22W)barB!E}9XL+S4+vNv<<9a+#O4CiiBCpi?6=O=ZHKhXTMy;YmJ@lH`xM z=Hbh&WtAodC1h#bRF8qHDfYyQ&;=Q0=MQrVs$QWeRw?CqnsG+ZxPzei@ni$Ubsjvz zaw1QX4k^~NYG3uqX!%haj?$+m#^kQ(AJrX3Q~8)p*6)~Pf&s}X0ZdG_S0ut2BrF-s zSrISr({KP2IDH*oP5#u**3{bMFwxjqd8`v3Yw|%N8#`3EHs&BByC_v zqd68y9?t`)V;yHw%JVdh2{ZqT)4|K=V1(EK37l5hegcCV0lEwU#*lor!SLI@`{9II zfGdKQxq}R7fgXH^mIZYV(b#0-^MT@L=sxKb+Yh<(&# z`l!}VQ}yq=spMC5n~{Y@ligNH1!ps=PDM!0x6AFjdOy-SOV?}Te)K-Q*`iw0YwLM< zak9(f`_gq(T*+3e$Jc9Nc|QHrnQE)cHuwm$)|ok3+45aOx2xlgU3a5-B;C2$Ov0PL zrYDaAWEm?=uj9I|OTr(QKsftgVyw)C6VV@GjD(~<8les}GN=v`#9yj;lk_Q3zi|Fz z&27%*F>r-#Fj1!x9GGf^ZOyKX4yM^>ztbH+Ows3UODaHlp;}?5RhYj_Ip|a?kh;7s zDsz!%4pL#3Qk&6AQ@L{FWrTSvoUXO;)L3&0-cJm%;@KkQ^?a}(pUh&=z-{7HWn3_8 zn+NHaa?CwBXtxzBOYxOz$Lu%3hXV+X_p}~wR9~38(IgWE%i|)@Vn5--UeFTrF6Lt- z#NiP4t6z@^DyKxL8>Dyp56&b2bl44h8^mDrF#68trIHw(Vp7z!l3r@>MAD zz~6-FlQ4wIi{i|yaL$sekY-LG8`y>@{&tn?b9na5tbCd`Sksz z9QJ1+oM$R@FqCMPOd^{Hp%h?tzHA9J&gAd_K|CADy6gogdA+vRh5w|_DfV8UlL4lG zDZdQxYBO@ucywfThcoGi^ZWb^9{6I66ZiYm*XM=Kmz$H<{jv7z=j-z9=V7sy?{mKt ze+EqNzW>qT_Mr5q{dIJ__gm_N6L9D?{Bwmt!aq0(&dv!=bkBqc=s`; zEwucZsq?F^PNNA`1v(JbeMnhuTx4BElmT?aJ0xpW%1C9!ps$OC%eGcmoK}kG5KQy4 za>*K>$XpzLyH3P!2FqCWiY&rX>YPKsB`&Gy@vF7Giq;B6!>Qrx@aHEG&M8QAGo zBQ*4}c$aM4=&oMdfWwcT#j)wFyT2s~owfO1&=dRIhe{ATjOnl`o!m8nhvqE@8W>j( z?ds(5Tjz;MX!;b6@y85u)T6?JDuXd#OFEoGT;5Z6vc-uVmV1c`ro7L4r3o8Gztv=9ylLS5%L46`dye35nH673K;{!)oTAu9WgX;&*93qK$R?e(L)oWM&&1vUbTYnH2)up5FhZ@0W5k5alth&c*=bd!d{k&F=n9xq#f~1G%1El=>8a9SxxKtbc+t#acZeQ{rb=4 zJ*s0#Hs9|#38#OePVTDdaVp?(aw0VzhU!=97-o{&is5-gy)+OsO1vktXdr8V@X zAN~M=_FWaZXF;}_6^#y?!*Cn7ASP)`t&)hEU4qCW+Hv@X1@%Q*yKANp(_chCYlX)W zU^Ad_=A2y+moviZv?}uGg|ryzCyaNd&&0uGWzKw$82lkb<)FFgkH!9jYDtMWZJ`fSBxA-BNIy# zDrT2OF2C|*ByJ=QDG;)Y3}jy7#SHHX)1ju1aC*Bn%;XKF=B<>BJ9crjC3#BK%M;~e zzEwI^KS>ib1!&c6`Ydy|vAbx;5#jwz%$Fy`hx2M|`I&%mC@?^*YsMqiv+ zU!BhiADyzq#2=0uzBjQ%9-c9aBGl|`osAkNqu@!(ZD9!@H+sGZn;Hhcu_RWthy3|F zi22n1Di(VDFD zO+UDh*+0+g>l%Gr=zup(sN*X)+-KYulRtHdq@`S2FxvLR5>*A#{{}#MhpyhS78~)r zo{v(g56`N2(u@KpIFIcVDYJSOGW}2zBK0U2 zp$9chju0h4uUR7~yg}l<-g{Hm_`$onUU#y}ApM1$Tvv~S7+nd>w|03tP7vkpi;IlV zLGA!iYq;aY!U9YkQp(qO(Bc2*AI<58{g3Jj%kegw4P|!4jV+Wwx?{%te>zc_CQvz% zisZ+Yk?;j!S0+nxMVrk06>|m@9ryzPeneM^-v@ntkI^vnJedGJgUUqiMK2^MI_kH9 z9S0M#g>~+UJ6bFv#gh%*1y|A0uS~Q`Wm)*2@*UE6^F+WvqqGuHHnaa|2Dm*$ouui_ zMqKUcZk&vLgnANT8?Y%IK1C)I=%eOCZx1mTOa$G@U-zVI1p$%7NPYdlNTk)(vn?`z#d2CU#;h z<36j*YTJ{ zTS6_ZnBCdZn!-75-PWOWSB;a_n(+b7k9qjai%EyKo?+xrHu4I)+;DTlLUkTQk#jDA zOanXfu=v2;33a`5HGuHHV4(Xunh-Qh_LX9tl26vczuqJue^lWf-gd8)Xb7D_}Nb!cXKymAJjJ57>m&C0VU z>Dtp7$W~5Tr)VVdlIe&-u+V=I88ie0Y+5R9OSup8h3F#z$<(IHgZ+%F#Z))#Szxk{keM`hfZY8|pVN3!emd`*^pvEBpCCVZLR zVw&-d?zp)Y3jchCUo{$gmX(K@W*NV*Y{}D!JT#l*&{ZSKQDBd}^7g$vW)5kg>I8H~ zY2A6L@Ny^32b)b~&Z}Z0s#w2xST>ia4~p*yTIAZ#@q0d-ntJ-%A%Msm7|o+0RzAL| zqh6R`=hP$&rSI~*I1nFbDG81|0JKO*M0?wSLd(8L>4NpB7j47h zRs^nF39{$0;Vznv!W4sMSWy093F>q#R>Rzf_$}Ke)?(r_PBa%2;(Oay62l|x9$Rx4?*6j$%otgg?Q3V~kL?Bs&_iaUyR6_I{ z7d|kt3~a5A%!sb2=s=A(0a7WAL?=BFxjBC8!b21Di2&r}GC;Liv0WX`JFzSA6)>SD zG0;hmuc6uX+kh%lhar_quY5wcitUCwSG+jiBC1AvANQF3}Bq zzabax>0+aT0d~uJkra~P!4EPxmOAgTo;z6Vw&AYs7d^`w zd1A0#;3k7Rt8#7t!ClE+s&C%l`fB3>ok~)FEHv_fRmj9yuT+<^=2Lfl)w5TmbR3CN zCU1OfGrgo17BU4t%}Uv(a$1}o(Xo6f?|f;kR84v`qu;eaXd7vf!R6az#ED%El`ePA z0AN_tjweaJj`oH{^nM0sXV=wQaPqjQV&imj)~8^+8;m9XbK4O6h$(JJzaJl$z?EAi z#B_fI<_LT~$5I@KwiNp;pQdSC%QvuwVGzaPuuYf#y;9DThS9TxW7|a%vQ)C@ehQp)B)sP-MHVUAwC{ zVhtDxxboIz23g4UVgCp(dAz7)kx}iAA=fc`ddO>+T~o7~Kqi5puCz&dlGj{@Y13H# zPW;!ck}}7vxjxfWgoZJk@o@njuL|HPk6#4lLSqsvKf|2@a znyKF{VXU*n&PdwZq5Zifhg;SEL_)9|00?{}5F3{mvEn_)U$uSWH3BGvlA2wc4uVpJ zE|DT$&eyBr2JdI$6Q1(p6Pk-HIxCcU;Cp~}3LO0ip3<|-=3l+}zdN3g?;+-UV!PAa zba>v*(K$Z0XfL1Gd|v~sHzK=JUq<}TGd!W61?KxBZ;X+KZFhv-GdY|@Ydek5{amdT zuHC(ETI9MZSG*zbcjQTn6YQ=P6QC5pSvGbAzPAS^8bDT&V%zsQMJS+yC}9es?=_et zO^yJ2Yzc>~tVCx*4*YYpZNNR;gmKWE-?c}HW0&tcUIF`kiK!NCx4It0AV*Wd30+$$ zEmlob3|@_EOQ8oNUr`jfQdv+gBXQNw;WY2 zp_u`=5;;>zVV+b?Qq;^Vq*II#8>g{?BDdBL5cI}W@Iu|41qH-7>Tr+yg3){CA#1Q5 z)E@6ub@yNDNxC!=v#Y9(85;KylO|jS_w647u_6!+=$ue>!es5&9_y}x-%m@#C1%(q z|F5bPa&-h9YI zNtEeZ1suME6pHgrMTXX?t90}6Vpq42Z+6t%tUB5|t*A6&2x#5$;iQm6euzJ5 z#4Lj;rPx`Sv%?)BGUMhTym{u)e;*e*f{&7Tdg^f3HDgFVv26=dDUc&gdP07x4>B)Oo)ZM4N6O`l4W#?Jf3Z%UAzi>^TimYkNm( zw?DZVs@!#|OBUIIc6q_+v)^xv{<8$9vB|<+?U|p z`IQ8J{brMOD0{pNhfz%d5EB$mpsL?CbD$=bz5J1-pCZ_w_cYs}xwoz|+>-DPz>_O9 zX6esa1jFzX+gldR7>F0c5~NhxbDj2^)Ff`8q&G+O!)K2@ z9zaQl%C?PfoARnM?zuZ^8;05asL8CxnVAd1F~Ir<2HS13$9HD@2L^*}9J8zFLj^cu zVXO7(6r;wISqBz!Ot2oG%E*L}u6W9!JFUK}Y#ExR)Tghln5`G+!NGOpneA8v@s%yB3u(V}E+eNFuLe@2>Pw=ZA>zo` zojEJI9}$!`u6#PAlEM5ek7~OW;{CfLcb=wOOD!j1G(QGX-kFG8gRiJv6|?bJ4sojH zMVM3_cP4v{3>lh<7oArX-bAww$y%%caU^e>^6GZJzVhzY`TJBpw(I-z^q}$xn;@W| zaokPa7v@8+i%$#x3@7+Qw*|%LDUhN99qsfTP43D}snvWQQA6H+&H5Mg$ifpwv?XSd zEkn8zVbz$~BbdXPBP%YL4fSE1@M37ZPS#p)C_x7u8}J9^%sX&LZjQI>h2xF9-fnMh zr~n`L>-hWn7(!ZmH|b!W@Vu=@x=Kk1hk__amw#vRZt%##hFmbh8Ed&%7B+$HB+ey} z{wAy->r|EXETlV;O(6A&0oJ{ih^Z$rCa;`){t6$s$Gp$Fh{CN9oRv1i>gK9$h#Irc ztdQwn6GOA4uY#&U!aPMRW_-;#;#hq$9kw3>IfX+W<6h!!MZ^MRIB$JyTVM@$2zk)W zYGw>=>|vkh9JTcNJ%D~B{LUWlXWQHhfEK(2^e`RGIIO|`SersOL#pupR!;?cf@O&{ zF&`eaU`eX%Q>|Qjr)JVx-^SDZzl;OcY{<6k1u7SZw_h*v%5G`Km>||oYM!xB4%1x| zdmFp#2(W;D3}U6`fuJ@o=QyhE&@s%nIyOG;Wu>g-RV=g$(Hk^7jHf+VUm(E7N|dss zH#ITc<(VRsK!+ERKu*W~{^&db+d2C)BVw1%yRn&$tX>j z5K}&^lR4`#iJ>rVf%Ot~o&$Vr@>1f7HEQMV#3d+#F}O<^&JJTxp+KtS?p7@ye!5b~v zYu*3stUJ;-26OlwylF6Q_EbL={2?a{TEUC~EGjO~pf#OcLZ>8_u<2I`U_k+Um5)h?8w?EgLS-U5cwXSy74$HHIfd^|mmK_-;7zjBJjVlK5 zbi8tSBX$u@8&q+Lu);yVnvdQqi_rGNC^Gprz>-uMUe$@K&ZymKDdK&s4&<;C{)dx$a3>6QHk@-<0(YrDZ0?()aG}|A{;LLgr;r- zsaHM0xi)b+F+bQ30lk4|;qYG-nOC*QZc@^|$#zBllTB@yR@CO*^< z`Yn~SHcwblcyQy##?aoHvSY{+4AdWQ4c4fL_sH+=V^Q&#V)AIq?ir9v(68Ox(V#YtQA&e zUM`sLC6#n!=c$KEIf6viJ|2J_?emh9pvepBlHqcMWHU}vnk9MCxduNu2fjfKhQA}S z!%0$&2f%@`061_aFe3v12X@z_g09xhCF>OEv}T+7mAh6JvdA%aNZ7Ho7RUAbMtGo% zT(k;qebA{KfEyT+)7FW>k{53hjIE)oJ`15qQ=4l%Vk&-B`DY3qlSE@XQOn$@-8+Wc z3thH3WwQ`NPs{48&LNLU>JTnD;?UQlK)+DadCIfu#-b%tH;R4tBak?;&(W|NRk8+P zC1C)OxR*9jB8+E-s4t@%+X-C-YBZL1t(QEDgCP;OJ42jMF&W((R5D@O&`LF|g34*8j4z4f$(-n%_pkylqd*3A$n`f@OWzXP!G$bL zU;0l1?i&vnQNK(UI-qlklA=&!0vNzl7$Ssv`1homh>;2^mufIaVAQx!=`$2+Nr~(d z6?P`(B5TXS)?1W5O@D37#49re@fzDz+P}c1kaMgPR$m1i25;lxxKug+ulpMOuT}aBT_Sp#?6<=hK0{;n zj!)VJ!RI6&bKx~db60Nlj91_F!8IOjEg6X9W4ZgTQ#7B5`FHd5dxRLRB!0EG{^U** zTzDYegC~4s$6#U?T~0Mv3G?tmoJ>Rkt%;I`gw#M*rau%7Pe_PLQ=K8Kk51p9xXdsa zh#Hx;218Oh)s`KgpSjOi_8d>%52GHHE8E*lUwsgd*`90HmK2te6WBoZ>~Ck*B6%5W z_(=n1)cW-`UlG0RPnRII)DP7iVHIb)8H#AZ_NLdF@NhenZ~D#phGiTe9y^Hbe+l6? zKO3;u?}u4s9P=;yzHWP62x=IQT_H;Ql4aCj6N@+vzN<~VCfOtqcI|8qBGXY`T31?& z^*Pc?XX2t=VwwA8+j7QVjWjJD=EP47o!K?;zP*3(V{nc76cn^;IIxJdqn#c;PW1Bm zYQMDqL~j0hmXp}W3B+hP1u4m%ug7i)JAFV#CgF8?lyG(1lJn(ZYwALv;Pa-E1vd1& ztxl|MU9%fW^edo_(**fJi|j*Gd19fqrsHoBMmttDX^NGFL1VHHj&YlT#&Eao=m~o7 zqVqE`S%rx73-edzp9OI*@y5N{RH$BRAgGN!`?nYW!$w6*c8$Fo;Scj|$k;Bx{_m5P68a=wkO-tk`0Nr?{)H(1T7?b-tqOa7brQSaf4Tz~MG6sha zp52_)|D?i?b^j2V?cybW3CL{w2{+MNY0&V)E(esCgG#zisf|*PS$6Zy!b+GEA$TMG zUcD%>IBI@l@NIFx2Kjj0@zktkCwcN!f-*1~DK}Mb=Ml6P9cu&v2@0h_OI)1aR)8Dn zPbGA*F;&3;MkW;cZ{HR+@lZa97NOI+(%{Mq*bomc*Gr`a_A7m~{D1vFMDqTuOP4CF z^36GY9f&zVSK;m?+&|?Kv?A-C4<~fQ*7NvA8ddIL4P^s z4~bP_wLVXLfqrtB>F?&qZs(U3&se8#uL?nYK<4`pN-p4}?(rU?-$e62Bk_578)G05 zVX|*V8k$6?!YGMG85e_FLjR-PsdtO$2=*Qw3zfhTrHqc+8r2{N=Qt7zdabIGKs~ z&~G8_X>u8rS=0mxiJFb7v7V~J;5hI7y ze^7dK&RVOXnB3hpAb^0}1XjuA-?Sjaj6ld=urJQ*4H{q6YQtFjOO6nZmPTt#2UyCA zjAxy!X(l_5LJFECqy z0ayP)SSB7eYm=R$D#gbX=bRc0q*6StpF}KftegY;&>2I->V)LVEWJ%Po~G|DV?@7f zd7CFxu@7k?E9Uxos=snD1Y%RmzxN9XLMikw`zPm5wpLL-*E@8s0ybfYcEM@okpnlR zrn-6b+*)SR$hQ11i(NHFI9d7R*f)C1kx*5mcVKu0OQbuve<4U+EU2A;Zq7wzDr^ge z*J9V+3$1;Xw>CgF!PL}o3omg;I8u_APY^^9^vB|a)g)gG*)@{1i>m){A!%7G{BjynZ>CLDY!l|vb~tM+l3zJBitRfBH5v^ zb+O@z0Gl5OxJ&>S+S-7o&a@|GE<3mh&!}VcU^0gg8J`jn0vnisg{I>qF zoQCv(Sok);gFv)NGi^X&K_L>Uy_-)NmnZ||svn>9vO4-UdtrJ{So-gP-= zGQ$MyLz#LaLeG$7lEi`FCpaqJ>{!hR631jWbD*#gfR%ib8y3xS=RFC$V0=rR@~T>7vQ8KgO_F( zvYo5USZ6Fs4PW+0CzZJB#+g*$+5KhoI2K#YIhVRfqN(Z+eqh+S?s`A*+k!={8jc9- zn6`ncQvQ5VS|qGbjk1?=*42rqsj^!e)}|L_7fFshW(0TE^Dze2?B2CStj`6AEuq}`sIK0eVng;vUOPTKnS%GiEejoBc$(8`vq^FRP@8czWjm`SK^TWh3Z$I?CO1V z$)()y7yGTi%uM)fpaYD4s!w}X86cPVt$ZZnrJ@aUqY}g|nIvr|jYho`|E5nnWrITG zSu1PS%9)Mg_dJbD;C`#v6V*=98kq1r#E2X}sHTdguov>A3c;WX1-EsSbSr@}m1nV{ zHB{_HyZAEUI9l#PQoC^e#qn_2GUa?)H^ip$Y}<37K#17_WX%d#p{GbnR{_>?ACjMZ zP!S7X$VE?K_|57EWuJxOmzYde(oJQbL}HgXWLDcyitpl~XEAV#idWZHxR+62i!o>$ z{y^w(C|v>vrFaGWmx#BP*B0{cB3^48m?Z5v>y^E`^2^7pxICQb&2=Slo zH!GT4AA9%!f!=P-CTQ6}PfCijLH+EMpfozXvoXjyOsa3>VpJYpQKxxmaZt~w_sj34 z2`b^X$dby?Jqf{Jrdf#|BZd;Me*@Z7CC+IeAxk)oqZqrr>zdy9)_GXH^A7W!GM`?# z3;g;V6*${|JgUV7Og@=GdZQw6f1rQ8jtVsF@9%FfZRu<}sk>;I-@OE!zB^ZTfgQ&Pnqg zTPHN9VLpP%bNLzPJbjOy{|8~HgGc&VBNgx;ArN%0KsQ_oi^hUS3)-wi6xf_2#~=iA z2JLSD0&_gfWV+7rr;9Wwgddj}Tl7<_OtLp%eC}X&2jf-79LedLRk+8JX%bq(xi+Z2 zM?QY~=M%l{B`|fm3*c{1-f+Dz2R#tEKaEdDVDTv`Wi)Cbf5(s;K_dk+2miVbEIl8f zgdGXYco6ZvI1cj`p7oV&y_4YmiT_$IcoiT~z!NlZ0LDS)C2vpP|_#uE$ z7%aoA#m zS=~zX1T?89uKY&)@pcqvHR;@&s^RJHob8EOSRWBj3RY6wbnpi(w~7vR;BOxtE6DpgLkwD?I~7Pk!et{68e>zajiUy$(e7oq~(bTy)vj!y^fwab80+m`{ZpB5^U0+>ODbz9+Hsh6!IkGEcdrUy_vYq4PIipnX=lAFR`waB__W0Ke zsOMi$#>x1H!_K|5n)md7~}hO$qV! z;t(D?Q0q(1JGT2j1~(MI;PR7Ap`#9>@cAszq%Y<65|KTow_CBQ*Ip{Yhik%l41Q(} zY@#^Qpdgm%dLtoQB;O{fw3x`&FVpd*Svys&Xb5^!=MdsJ^tr*kMJy^|lk9BpEk&Gi zCi)B6kffJ{g!!~65gWXO2$G)875p?>(ShtfbQmdJ5ApP2c8piwyFmzxQa zRntTz4g5}PzIS0w8B#{BE)<2EAQ5uak0kX!+@m7LsjzxE*%NWNNC-!qkSQCmky+}^ z83CIOuKuofiGc@}EokQW&2DIOn2h?kTiXrVSYA`<`63lrw1LY^J?%kn7WcFEn@w_0 ztO|!X69ig>?RWx^sJjYy4zNUTMpM%aO(gf}QnGS+FkYt{lszB0s6$AlLcEJQ#-1M} zuPz55OfoZD`D1vNZ2As_v%=e1fvQRz&A^(YJyEcDdJWlF&*&UM1Jhe00BkPW4vRcy zAWPzyQ!@0Qs-vGf>g#lYzVy<7o%n1E2uvyK#~=w(tXLKff;fNA>U~8`T--|>0fFs1l*z(!| z{Fp+|SwH5|)V?rtmo;&m^N}uM_mFiFH5uW^;CIBBw00>ZFPf9j;ft@cnKc^Y%Ix>a z1Xm!gc)5u)I>84VaCZ%EiMSFl-yjb$EfMYi(hNJGV1B(4yu$J@zg0Ataz}llpTQ}> z0aZKvvgP?E8Z)}6F{rdIRY?cg4TQ!*T_#=fB1-yTvQ}j~w==>x!{nrQfX6g<{{8oS zdUTttpKs1K4T0S{o*91$L;wTE1xe{t4N~cT?m;uF@PlJ$vEojnYq z-}VYz10?js^=wn=v`;_GR{7Uc>eF_^aI4tKawvrEaX)gJWT{i<&^dj$_v8Db``sO9 zG+yBC*H;8WR!|X$e-SB9OHYbVdy>t$D574()K>H*)}#<<+M)qOI(}T>^6S^-vy1AZ zF~t1|1hCe)(bQNt+|++;T1Cg1avkpE4Se%<5Bl&9@5I({0p{F!SFSC9n#GI{qAlzNTEVCTL5t-RK& z(ofD$r}1e*&HH4vCB0c6#X2j(a1Tm1=w`xxs+W_G@010>b6I>lkR+I5Ycn68#fx!n zhqa}tYOzKa$} z;rzZgO8Gb6$HhaVJmrel&FPJc$6BCg3p>rFM0)4^y}C#^i2#tm_>T=%IMQ6GKbAP> zRKO-+pW5aQF@R7-wzI}r_vz`JXu?c;m)oODRXRcUPi3vFaLR%oO9H*ww|j0d=l4I8 z4(EQ%06{t~DD+f)mFFfM)oAxHC!4*|Vk+mv0(X*Tw#oVUZPwymtKZF@6eB#%s$8@> z@#x~yXI#_s>6i(2J~-IQ@O4N!kZR1wER4XrHPb+*n)Qiqt6BJ6M$Q2)MPO&QI}q>p zS%0Z!tQ>7`Rw^AG{JN{)yttnJ!&a)XE>*LM4he1LryfC+=UNQ*v$e)&`}8ODS@mFI z0gr7Q_L>mNK^L@R5$mP!H~w!tDmDZZKXa!zl3QA&FAcx{H<`L@wqgP5x=aEINRrpwmmIx$|T0#;Rbi>h$M6mlD z3JHmbfRL0F5?JE*hI$k@@q+2-G1OyJ%BFeginxMrPw0E-t3$Y;E^?E=1qMZ}Jk?fD z9VI|Aq$b9Tjj9{n94EmU_J;lQ5wR@(A-%?!8k(La1A0Jq;H=$8IdlQ-M2We3JA*^h zr|yk0(CE;a{SBq_^=$0+Hnk$L79rQWTw~LC_0HthOMZNx#$1S z>Mj?wp%a^y{>SQyjB?+$I@^0>35vciz7F3$Pt)fKcpfbLV|CR_PxsTrb91BC8a9_Y z5}ddwAe){}NEO zm$WA%n*}RtuD-P=6N8Vt^wAx9(V#fTfG?H!OAh(Jhd|~{1~6D;z%uC}|5J6pv%-Gf zI_EB7C(f$3#CZDa_&)tpb=m81D=ftt+x*uonf_1J?OuX932~Vp64giVf<2 zlq6(#MtfEI`$;J*3!3yO(~&tWYJ^t9@byW|oG#~6$7So*4gwq_Owx#)9Y;AbM)0(S zP#oWi_JL8t(7fiXvyNX6YTPwZxKS+A2{EIri~F{l@nA=2=rLR~ado5}y+jJeT}R@H zFU`BoH#dmjFmg?~mC%I{Jz_mHBe~ZOx>p!&$9t=%5B;MnClvI${tzgLjNVEuonZcWiYRQK}` zmbGsW!zBJ}IM`tK8`~)vP5_p?s%B*aI-^8k>Upx#jY--Frv2UcB18xo^J@M6k z0Ig(@HJMx-mhb$P8CZ{r85KJkr!Cc08wL4IG7QVma@5!fu84>KbrVZ5s_%C+?Q*X0lieA4?yz+LE!KN-aD|Eby;|0Ya#C7mOe>P^l5iWW2p zL7-QSLG;Pz*Bj=HyrYKOeb9i_6`vR z1`gvYOTM>ntqj7TLQ`wgo3uAxU1QL%B2ES^#_bsfUFFtU4I|4J_&zhv=vvWnrK?VO zxsZLEZxTWrFOat|Q-jM4-?5Y>+H!jh;x~E&J%>bG50s$MKcP^*9qIw%V^Qy~zuFkQ&bPOXdjjq?W@G7=aSbaz|lQlATo04XYM5>ZVD8-f!eW>Ho{c_Wi z)I&Lb7O{`dK}KUFCM&t%Xl@wqGvwRKpJ>~~Qh|?-N@nv#3XNVb%+hADnX?=e{SP+r zKN`AN-nQx8m~krsk8sT7dih93H5@cAX!ZK<3l0nhbp2GOQ%6%6bP2vz(-5fJ6mWeEu^ zoZHDGj+)Eqh-s9CByhKD z=?x~`);Z6$uMEIBog5Q;9NPZ;@Xz?(olCmf1Eqo-wqfhb?M!>+Bg2OcfmO&ed;0kN z+_&n^B4R)IiL5~QGkHc9=Zkdx<+CI;OvXzF;tp?-1enC;%eYkyTK%7pOP|gvymK{8 zG>Jp&Dajq;xoD2Y9Qnf+K(LTvB?d!@mPKE>(liLQ~F!e zUQ{qx=+#uCruolh8>%1y5z+7;H16j3EBV=qX?}hp`n>B41k-N&iRPKFhv{5C?5PZX z^EY_KzxD*j{#LorN2bVP-rtU4J~w6H#Pbae^^dMo&(;nqf$5!jtTDf=NM|eSE7|WW znNMN)aMBYp*p_W4#1?Zb}r90zhpGcyznAE29uPJyHjL zWwZYiaQho@;qoXa<2Jf7PQ!B7r5otSNit_9O*MsNsY zci2|!CTt(%QkBFTcxXi4h zPpBvR9)Ms$EW3g%cke1BM-^zeC|iI%7*nQ5-)W~7mlUb5;c=TAFH$Cnass{j%Hy+L zMz7fWpZf{vquo8}R!Fr=fPj^(uzwRWL5o=ih)VgPGEHN^786^iGW9>8@WYFzP!NxX zh*75=tWl;0KVMC!#8UXq>hLB``;l!vhR(4CQta-n=Pj@*a?51?ih^liiTM09sb?zgs6$`u8R zT?Sj9s%M`Z)f)RsujWhGrP|j@GJ592!GDe&6~i234+EuLSyk1$?by2C*T*YLWrqCI zA{gJs#YN_Ng}by83COpgK6cnr|1Z(^>a<8Wt%0X_pFo*q=5Xu5pUn zLH~Tby-FU=V&mMpDTiXQQnJVK5MoX-#(F_tx*0N2$JE@Xw3=oTFgj&zjLl^-LJ+o8 zw1~L8fU;1VNDEVDsgYrUF~q`c#|bX~0&ET)VWb z1e;~F=^Z~J#T_A(6b?0mOfYSw!Vl+-7%Fh!Q63%F4#@Gp6CAt}Y_PDD2A1vXtoWP3 zGj<;boE7fVCPfbLBp462A0Dyb?e*o^WvSQ!%KuKBBZ38&n`?*T?==_f|FF=+D zM@_6eDsh>zG2zK!zE;#1oecUQC8`Z*5p+wxtjUb)8boV^c2&=V z6%{N*vWS2A!cozs(KN_6jy7$c3siDKo*Bvudd$jv>BZ23;+@Rw;xwS#@gH$%TFC*ZfHIm;2Hv@b9^rSH45%$!vog zC7wKzN_g9(T%Z1v?d;{`L?C?IV}hf6obpFx%<2{JEHRq@*;pgj=|*1-yl zh-O=Li(1+&${?B5`3K-~PLu%v+?)kk)qemk$M`u8l--@xI2w4f7DddZBvsRq1m8GG z>{{N?K&lb$G4Wl3yL*`R{N{^jOS+acFz{qCE)INUrgG_5>vd;HRJv)y3RV==j>~Jz z+bliECd2T>fTRtTyz4U#NFSXC(|WtvP-HqXDs0YuyZ>Aow=j5IA=0ucyhNjDmblb(rq+wb zHbSkL@StLJ{m%`y@>AwqI1Rby&kj}#2&kY;4!^_eR4^j`tLV!%K5QdrUdKnZ#$Cd6kFe7EhfD!4iXH@|~ zv(h=}huenT?#3uigTqfql1T*k9=WM9NU}}yCXNgS_ z;8O9V^l;)Yx01_XW0D1(DFo(XQ~RP!iC!!YCFJt8LylgA3DGgHuB>PK-vqIB8+c!% z8ZzQd3%t;snJuPT;Y6++%iLMYiom|O=lpZDqof2LA|aEhG!%JdPL+Zcs1tS{Uc0{-f0iApEfd7p?1iH%H}WmM>dYJ%Xz#1Uj{- zj}CPMkyQ4ch^G-eeF2C0@5^Xt?5KscBfBQX1a2jUv!zT8;7S}v+A46L)E(0eoR~R9 zrf9+w{ee$`H#P7bptPKJvUbY4w$_E$p)4rD{E^>r!r)B5p0G87KvK&t-dwHU5A<3$ z_y^#EUnz#w{w4nh;8y$ta4AKn%EjP7o67)Go!*`4W)1x{h`o4<+1_ZFByz7vyBvYG5nrp=H+ecvcs>8OEz6GhJh{|T z)s)*x9qV?dvymlH;0Y$mU2DC29Pzab?Z&5PQ#XzWlc8luA&owP(JvQN5Wi(XdT#G2 z6|~2zzZkQ@Qb)kW5BOyP8M_LOPBI{PN#04WplW{Y=s%f(9_joS^Uz@l?NM22NPaZ5 zCiV0sniN+SV~Q?Mi~OH|YXcffAb`Cldcq7plHRAH0reAh_Jj7He|rn?Zx8>!pJPOwbvp1X8`#vg< z5UvSQcxBjJ%U&SNv%I?feLa>(%peF1`nn4aukfTWNjXuTJh0|nr@UJKZ25@j&3rpeR6$ZzLt24p)98ok$wuBTn9L2QALP z7(ow~__uCaa*jHxC+*j5Um8eJ(qP+t35uSIQ9^^(izcm_Euv@D;hLJ(K4!O-Aay^S zrTTRun2ny4&7Kt9)79k$=NuopPCkrZqm83R+s5_R^(%b*oBzE(Yh3)Ibvp*ESzm6j z_IYZ)z|IA%jWO4su+yKI^5jR*9|!!-T4SxLc~1AY$+f`hyZlma_jl1Dps@N^TmlMy z@9&>T$UgJ599(~is+sX4o9Z;bxEqzW)6Jt8FvhI@OhHBBH@Z*L>lsvKK1AjZy2!+B zLZ>Pj)ApCg!|tY#8-%wZhucHl02MIi)Y)5ft;oZ~k2_8k&{DV%htZWp2w{~NEpknp zUMCX^c*!h3Xx*IPJAC}SLY~W3Lo@XMeb3@i?1>tE5lXK6`_;_DH670pD|mUA@>ldoD!~4N@c_m z`$?roAaW4nnYWw&|M*)kUzsV&Fn(!!QT|{hV@Io7LQWM@SO9-J6@x8OTkwy+r7bo} z<7_UP_HXs>)Jg>vDQKsQQ8bfVWLc0Q!hV?=8@sRn$@{0)3L(`L7OxjlU3nsK>yJD&|wfeK?BLqfF}dpbE8N zwxZ~z6MI0cVux}q%FI6{aX=AZQ3HY@>xs9ABf){BOB#^8H);)BiPIns5OrbWsY!TI zl-{mQErQ8`@Qwk&kkJOXvPM;Km{^h>=Y(_F5OG`bHzzfq64w!MJ26ymga{O-v;G-5^z!&_? zJw|~7&S_q{!F&aKGhsYJ>7b0LYCCzDE)qugL$r7u>9In+3aNsv8Z*-$u??CFd6~)V z_|gxa|KPI8;^De1A;XgChUF<$XkWJJWV|I_K5Lh(&)d#dWBfMx#oIcYt%oS=ob-HAEth3gEt3D{tFQbv*l%w7sJqO>*FkeR6coR$~w*he{ z({)uRy}y!RQ<42RUy5J2N~|k0JK~yhvnn19nft8kN1}X!v9v-QB-jyOonSEtI@Q#O z_hgwTj|I9J&dQok#~AU+169(;&DnlWS*KG5~L}u`~cN zd|bs)%~R4b?3%f~RU{%GE=75goziAHBHzlqPdRb8l(I~dVdbN_h;^2t%;x_5Gx@pH z>b@pYiDj#FYyVNs`c~F#^)H57*i%HUjX1HITrT=B$j1qmFrHV2`6Qjc;6S8w*xV$y z?z$PUg~(7tTxcRcO=nKUvBojh zGWRy^7MPz944um{c*t%n-_>UtqjLk4v`PF$HY$TnUdmOn%rat*nTOYVF5KSF?YJYF zwdZE&MqVl9e56JLp6cWFf-6u#uO9UaIAtDUWH+Xq^=8TKG%!J-Uj9iu>E z6H+`o%f%}eiV}Id+E(C0lMg#O)0-tX5 zfQ9T~#RMkVK1OjJ8)>IsiL?eePW^>(V{R}D%N>fTq%WYehZ%rJJ>2*;c%dp$w2>am zvPx%eM)H4Z^3&Vc;wm;Q#mA^MXg8G1a1V1XBze5{E|iXc`DWfX<*geohV*!~EWVc+ zuPeth<&dt@MJ=YH{CBTNge91izTSnBYYz_5k{Y@+`{i|-TTkhc1twJw*hXZvV$?>) z+!P}lbVEXmqdlgM3Z~sdTkfkCS2s~ef)jxal4+jLzTH95Dy%r7{AhR095wij%3X8wLOi|TG>p|^ zm9Y4;c0OP@M)bVFXp+mhc!@S84!({S%%Yt0d0(VGOJqPUVMbmF)ZL}&i(uugI89O# zl1sRfaB{Anfq0rS2dhPp-X*B%?@?fQa1<&T;BUWG3^^Utz)~U8{x`P3ZKPUf=(Ok1=)x!nnE#GMMGXa zjSw%US-#c2Ayl&dj+8{L)<4)Ss3e2HT!?R!<>D)b%a)fbaiu*JO_$h_ubU1)@0~|V zQEcjBnp$Dcd7Ov*!3G>iex(#QFVKBY%O79{?nnlZ;wkDo`Y&vu=c)Qq6}Q$H5mSaV z5ZaVNzV{*yvjIGa8&VP%r^;?d8{0d3K&c$fn}hVHQLySt6dc`RnU?Ad&WdqZR84nXXi3F2|;FxxzEp^kdys4yvZwbU2&b&)a}Q*$261`i@+2$es=oED^{=j@oG*6ncp?La z&$|2EysUy;!`11|J?(trK!Z+CVS=TwB z3$x}9{-%ejHe29~C8x0)WFErI(X>kFj70R^n1rjct0%~s3B&Taw%Apj^63yyLTPKLAGO)53(YD^PQ4DUn zf2Alj-;p7^8}r<2y7fu2_pl5DL)LEM7t>rTQ3ayOzFT(z?HI5|wXL}a=N7lY@#myx z;*uO=CU<4}&Vhm{5^S}IqD><4PvV6ZLhq<2e_i;J-JP*|(ws00bTT6iJW%>~otq|w zlz;rKDQc_N?H-z%ZkPUn6fY+WW2*6TV01DWfWOu50@q8_xUgMl8JJj5tN@lXj10!n0{0ESpRwe-;io_z(cEzz%y^ z_UGvY9KxX(4#3|s{o`*XtpWV4Bp2uO9PxAl@L$Uv87nj;&2)zqBWMg3z#cD9Ny~5j zwXR{WVu9D%!=kLaFUC>L2K< z3`SWJPeH7Z=~z6=3i#2Si{`W>l|KD8lc>3FdY0AObfx)^Zp!}op38VB`yk6X*XmG%3gH;QrMrI%)bhtmvBm1jbTtb&*7uG61I-}MKx&?a~v z^Q2vu`1e3pF2&Uc@=(OQWY5gbXn;IBsFN+i&&>sw;&~ub&-vbn_v2$Qj3KRn>QHJm zr2+iy0Ak1!*-2xYV0zWhu`yi2;fcaR%J9WdX8dM=D+idKlvC-JJZQHhO zyxZsby_(sXojqqJGueM~=X`rq+0mNh2<9p+L%ST(Bv+s;L9c|f zaEl{*?j@xlFCLy*slUY|Igt9LzZS_DYIx-u-L}b6xZWA!G8=u0A&VJjlGg`^Ny#_( zlZtsw(72fOMkm_(f_#hKXJ{jXl*c@2b~~Qn&xw1{-dmOdG_WAK%>Hh_0(!7?d~?uCrj+SPpup9zpeL9%H!7dd#x(JHu?ycXCO!QJycRHya@WH`Ed&o5wAz{ zhdQT-@%N1C@zPJfmRq=FTbBm^UdGyc$puofR40Dh*kF@R~2lgXuUud)lZ@m;LLm-R{o z85q#2N9|XW1J`#v-X!WZ7#7>)@5H%ZK59KQnH2NNUyWkeXluU_dZ(lB5ka4}EK;*` z<=yQ+M_<^EqZ-X;jR$r1$-DazO>jb)!+n@onRhV7KiVIEXwXzLPEpajB<@19`IZ1c zatC(JBVkAttO+H#1RXTtUPgQ!v2J6k0`{@LL$6D+vcYpM3Y(@e9vzV(~jpOZ@hroEaAP`To{ zdKcby@XU8dS7=8UL|)yrkIae?ltaPUikoBFC2o0xmsc(h|8#INd>@O$Up~!EHd!wD z>pLEjx7Y3p$D-bh-j|OXwTFyZx_poB_iy8;i<6V@sa_6t_dDYjS?)IA&Q5O57o2|K zwWYV0Z5sgK+HWVWWrO#%uUfgwH(eK!2dM$-{t4j3amA$!6lUb`Z*;s-A{uftP7FLv zv(x?kp`oEAX(VH$rSk-YoT@69%qY1qOt)=_-1S_<0QH+FnEDXqGny5Uaje#N76wVL z>W0Z3CO01i*OA|sVOk$)eZWpIy?!Z7)cjUEfz=O&z)(#!s+j`Xw~6#cp24x1C@%Z8 zF;Bdbp=pNC>5(0MNF6|)^DW=}qqLV&x8$LN=LXk(_$%nVzgbtaYmeB-8txx4$i&Sc zD#8%AyaujObzz5>a7U4}D9@{FlCcdqO=Tv>m1Ug^tohm`n*odSuHB8gspd)KEI2j&#^%)|D6^Vya6idQ)( z4n3Y`p@ki}77Dc+pJ0>v&reICCNb%+>BC$Zss8%HgZfi`R4QxIfkyuMgsis77u#wan+>zNcKswK@BC=wIPYSxS`&z z$3OZlfzsBsFfp+cu$GROiQDp#UKtHxGcHA9&%UlK>ANADGvA8r+W7{TtkR zIzH`{Lkd3m{KN{V4tWfh?nS=rgM3&!&!(2hEh92h#f};uO^J_L!v!&VP5vk>#t6CpI=4O;Ta1TkI0ky z1+n}dUUvRTYPmVZWn;A0fNQmWTYHHPVD-oB1U_9;Wv1wM)QP2~$KaIW#U=|isP8QjXv*BkR`oXY#UVz) z*68rU%$S0>JBm{51VLrXLHkndKo^`{l5Rf6T)qxHM$Z@~-#(hmBC%N=_?0yDw%0_G z4bftY91o#bmUSB-5mOM2%v1wdu%YvEii8D^3pc8-zf@6l`|Ip#-aoMOWWQQ~8sc}W zd3QuqMMxSLfinBq5HGRN??C*N-)W{2&r%V;3F{ z$LcUbDh$#FJ6i6y%9-@=e*{95=qP9BeSxDK4t_z-5kBJRtwVdXlmsfuFYU#4+{Hf! zJp4^US{mAeLwD-ku1Y*i)DK&17lJ!|g{7Ecr-vWkc?t3(m&9T}_@%I_GZGo~w;3j1 zf$VJ$Tik`cSXs+T3(T~3IAU?3$<)-8m-Q*Klh?6skZ<5gsAk!APmfA&Ya;xrH6Iq{ z#K^b2yG#$xHg<4}+*ea<5CiA7nXvfrx9Fp`ikxkZ$&(kbNCJ6Vm=TlSRGyb>nU2TG zxGx|V97q`7yuY>XR-0?^{8ev--TII){!wph`f)rBGAf80z6~-Gp_q0*=@Y{MAskw$ z1fE?-^DnabV>wH?ImG@U;4O(RYrfu~T*vy$3KYTuz!5@!Fpf?*tLJ!XFu>TdgGBre zjboT4i#S6#J9;y@E!j6k=1t@{nvFof2HA*+@8^HgQaS`#z_gUk@JeC#`B1CLx^q6B zrTwDUAugIPCFYt_uGydwxk38-{&p@Jq0_jo)>72_#@bl*a1oE%`tk`%D3dGmo*kf1 z&QYx{sQ=*tg=KnoP6sdkGCYhds`Xvpp>MZ}(P5iad2zD0;e; zGhz+b=!QX4<73w3Qwf6pEWTIzL0QXG6 zXj@0Q!D^BQ{=R~Rbe=N?#%ESyKR>NOUSjAuHZV&$RuW}wRcB&*^421WHS!V6=Ww+($a$fyw!v4nBi8V z1fN%y*X0*$?T8(X-HTcOz6q?XZh7E(+W6NZuR;7YhX67^GP>y*E_+5`QB|e$!I}pi)Dt(_mEG zj%KU9YN=j<4+O^Bd?(CBFituZ;R#B0&*ZHA;k22emet>^@0ky_(Y4J!YQ2ni;ahB# zj%4w^9ddn-G>BhesD+}=7z1tsvat6}DMh%G;bOeQ_1r23roH!w&tEzpQd>Ff#W zqY`@w3dc*uA-ZPN5|3j8nw9@$Zx{YyZ?XS}y?w&-3cp}7o^*w5URr#?azuI@_8YAJ?$VNbjB)#G z_sH5@P-a%8IVJKr1sN`RMRTe&{Ai7w8% z8LnN^iJhMfU#Dx3$gf|Vx9k*RLKqj>ePUuMux=x0S6dR6C}>)G`XyPnizbzs;D$PX zkGiEaFS$Z(JP%WWc_?h68c|>#3KvX}_ir95$mwQxm@Fz07Ek|W36%LX&@(p^c+fq> zV^4$XZ(T=1C7^k$l?yIi^Okr>bjWu}G4JpJWN(8hk>#L~1>Q$@(NOAbdAOb>#e2gH z6aP;T3jCs!z-m7}F>GOjkvK%T_xtjnk4&w=A2BIa%5EAbW2FI5x7?95>q3S5nVv1M zK=wARDY5~`-u6J|b{6`Kb{|{T#!)2q;ZA|GJtBte&_C(o-gXfae+W8~X}dHzujN9e z8pfz(2xq}PgTNr(+J;6jK_l-yTy>KqLo=;asP55=n_Ff zf~cudCXqB!AQIWAwGtr86+KjR+c~%IRnwQl+AXBR`Y`Z*Vj`7ctpU&x0wt8PStYbh6AShS|XNu=ArV>W?pn`j5k3GDXnBtpOp}}g?81VzmKXgQgS;LRVHOx7-bSZ)dwzi0eIWtfk*-o-BR_ zi+*@XW5P7d++m7U@nlnE#d!ds5BoO(^)k6F!nr{iy$}iAIV7aLU^5c{hbMPNRGY3H z0#HDsg*RWMx%!(m}<5!XR() zja}CmwW<}_yFe7mxtqRS!EB49LYE+u!LW3|MsK&)9?0JIJoR2UwR;M-_JLeGzOAud zjr(EMW|*S2C8t=mZE5n4d<3=cTQ+R9?X3yl zMfE7tYPgp4&SRx3>iVELS34xb5Ln0E8Dcp0bEO1#hd=bc>@6@Xe)g1l$mb;p0vr&bSFY=E92c#pu`vJOKuJ>=YppFl?U{U7XATS0J#aOU{a?l{mn(Qb&~*~$nG zOxb%?8ISkdN@*;>uSbD+RtTNV?P9z9L@f&oTPH{W)3*tV;Uwhc6ngILjo*eNFB{6y z#V5QbaYof+)lm3J4HF;z;fQ;inY^nHZN?ypoI?i!V?( zz*M-^BtfUgv?kgpue_SsBi;t#4C)$roFh$uvlqQK{IW;zHxV_CpShPx{<%oSmZSnH zdzx~Y)!&pi5ngG2puwyZ66@H{UqK%cRW2cNIP@(H-?9STTiLVMZ$|5$K=<|)&J*a~ zYVoV!^4MNt(V|_oX5F<$(V@Zx|0Ismwixs#9-t zb?y?EJ#{fAZ!G7rw*T<%MA%0f%hG4R>!j6eMz`f2wE&FgJ>zw5v0DiCF$wT)F`#zRkeN z|Hr?9r~bikr!5b7Y>U}HGzQo;jp!3&z`zr&0;Wj+kgT!&xCP@MLfPE9ub6 zoZH}=S0(@1+n@K2>K0KN`?J`l$S*KXraa6Ax_r+sqBj~uCkqxVjO%u<)y@WM?TTxQ zxo5VIct??kq{pMUlPqq1`J8cC%v&8LAsoX;^kIOPNCd%{q1Yv7Ns+Sh(>gS{-66Z@2CfWH=HYfHUfB zy5qBrFSnM}C@u=?rC?O9Y;`-SG(_CiR@N)to>`PT0$zde?U|iUYZl*x#cu7O+xl)> zg-_i-?-zDD%fXSiEtT~(|NWX_4)ZEc0KP_mKLNNtU{QW%b@k7be45#gxbX)3G%__A9pF(vcYBI&8GXWK=?MpZI49dw4%$YGl&=p-9anpLTcW( zS*Bf}=7^y6yZ;siAM_vfz4gJ49qj)koYtlSP@yI^)3^}1hEr7nydavEL|{cZ(R#Lo zvHaUTNoVX5T@nfPL)59MY$_^EdiNsyG;8m~_LQhHPzyP7lZ68jH*a`Pr3(~-XlOLj z|EArILzJX;5S|KJ})sTa*>5XE>+ttU7u5p0!?M$S~U-{Pg|H`-E*i8rN7k}kj&B}a$4*=h? zKO_Cb+myElyaQ(LZqY_iIq7nzA1u30Q5}Z=LbYm$=^TgTx-#&4!q2a;)Lsvyo^t*{ z3=XKFPhw0_D?}=6*GP1$+Vaa$U?a}>(haSGHRG&ut-IY&We;^1Zv_kiBbB6p*SC#% zd3AgnAD`!&FLqo!I*x(rgQbTy44dwzMHx_oEOMrnt8+@{5&k<13n0=(FCyu(KD9*k zuYJ(MuZytxRx3@jK|A>*ZdJ^PlBwCdd}` z!SyTud`QjWE1M@+7}>qY&&2UiD@_I7+;8uFs8X>+woqn$`sc1W@S12HUzu|6E;&T2 zs7>(D{Rz2N9}m1V5tds<$EznU0Ns^RX;8#TCcr^Kn|764 z35IZ``+K%^px8v91|qbZY^-vg{2`=v?p-(I;#2Z7QB-;*o7FVH8LA2BFVF-DqOIn*phTo(^w^Yu)% z`cDd%Gd04o=`Nq)m$7iuhCx1kW3HO{>>5h#g!J`Y6h@g%s^{`SunWyFP#@}*$g0mG zIFs`+|EeLSMDDxLB#Sh>5>cc$wIfuQL&@!=eZ4y}bb^?hOZ;QS`nJXMxsI79pDhv- z-@Em;NO`o8E2d_nwl;xjtsr=!!;*Cs5Og7uZsjwFWWWn|bO+{2XG3n_ayDzC@8G`nKapJtR_q&cr>&bL)57LxS6fz%2Wfjl;Wrh-Zp zeO89lX-18|XN75GO*r7cte|45yrEl+`cAJY-{-tm6|I)YFhjY9a zf9czSf9TuV&;+v`vAyw#t&z$^b*;VS*965g9b?b24}VHPq{zgLrFxl(iwyAZZBac) z5w9_GYA-yIk$%jeIsw)-qe`2$19?s@JD#^w@;>t=cyIr);(Ic?E+|IzZ(--4|Jb*= z4<^)k_yee&vPU<%5A*sW`UuU`hSY2izhLmuX@cO{b~){Mtd^yb)h?es2r&3e)YJUI z2&xD&lP^x2K+!Vg<|hinpqB$gSu<~8SVK~AJ;}q=IW8`q_BCGX>djJmI^GWz_h`!w zEpSaOx1Cf%DCM&j)e*b2QyI`Q1$;V(0t47sq%c-Y5T7N^J?cTQ{e|!+^eBGJZX!4& zzwbws!q;^dhoBVFjb`-BWsHq8bu|ahg?(3NQJEXK!l?Dg(UKog1z^=|-HNWpYNtG5 zb*RBa6(jswMk$P-4FB4RDT;R;U_6zIH~&i5#jJMq{p}R{zQU@DF~AxcMM?sf0_ohB;rb zC-O|i8P>w|FMg}|7r(`Dqx}cJMdLEX`-|V^{)6AD_&f5Nc+o7)o4osOoC0QCLu5uH5H_G=gW(8kk@FL2~8bk7hBL< z%V?ffw$6ml95{9y7b1d^{1RczQGz1Vo{N<)87`tKsbHRM8f|h1mIjA7U9a{-qoU}t zGLY?rKT5#{4S=DlveF_owVVc;ZsS8whChrIW*)b+?-7{YqWe@FnO!Kzh4V&T=}jj# zzg|_?#v2~E#(pu!_fxjnRY`~N7k{6OFO}I_=Gck1d+EbG^L`5YY@lKn7u6RcCgbY7 zOw`2*tk7dkCRgALYdLVnS4HX$Ctog(GH3*VYJ&q8^>`j{)-`S15c@xcC3p>r{GoTU zI3-s5)`i=`iQ&`-vuzo0dc$zOJ3<@b1}qA4v0X6=L|CdwXF(EV@eJg~wuk^BAr z^n($XHo#G1q90wPMd?ct_(JQ6Q-bVOsCoHM^p(I@E0!Uut~$&n5``}jOCL~O%|eyo zIX4;ayf)yKYByXE*|I@qk42199B)xd&_j)DkRZ;*&VmSG*=%$?eZHLSyxnjsfeq#* zMH*Dxp$U9Tl$o6c^I{}sI)l!8l35H4u2|BAC^-@xW z+DOx@>L^*==-N>G^^@yYhaqw=2*TheJbE5z-mT2_wO_++@5`+$*v-JxEzrJ2U!63# zN&ERS4lK}?@kmJT#c*)CXo{Gpp572+FaLU3+67mt<%6>r815sJgoB@XjFzl z7@uX6rR&soy?$G3f?uiC=C(RN(*LM!1Mv8`d7i(GN}AYg^L~G8D=p^4Qf1s|vkpG~ zT2(q)dt33rFi|nldAsD2VPEjNQcueNXDv$=9qcqpWJ){OvJ#HydwDyfo9^juxgVu&CQBxY#_9 z$BY!$;xgRg9_`2%mD0P}b|~V~+R#+YY%|vq)1b-~Abq>IuVn(HZxb|I?rY`mz-_*` zp7N!U^Yhx76^)!Qsb{iy)7Oe*Yzm@*(9^r>JZ(1-;wil_ZkvK6_;7(B0gh_HNA;lv zoXpa&aotV*EqCMJZ3V6H?~vC9ki1z^Qkeb_Z-l*>XpJEuBSj%2wYbE|@e~MiW@Cd8 zZE3^ta#?41a2`8LrET)|O)m-hQxX!p%@th+^K5#? z&pjXL6x|Mse@~NhmiQW@C||hJNeFKz!ov~#Z0oAK_e@n>3%(P-#jTORgIrVg6)AJB zcq+)9Q6c61#R7x}y1?THG+G}Mgi>%0RGkeaLmd8z$HT-QV1L9Zr2xX1=)(2Y;pgkC zz}xZG)lqlW>*wKd+~;ATuFuo1oIpB4$Cm%_@>W{b$KiHo)W=)!g%ea6Z5Pcey`yc| z9AM0&U8fhJwP5M=zM*>@<+ppc!v;q7mjfVuYgMbvSb_#d89qz!6cdX46KPadC6Az%_jE~!-3%EI~(6Ijuxusz!%M{9jPb#UIRl+Q<%7j zho6$Q|FLh;cf5$z8|ctEYs&B&1qIBjHgAO1Zj?d7jvp2AS#3H!Zr?{u zA#9GvpnA2D7Q3(6v~Sj;ANr-o^1oZpNl3z14Z+1=GRq+V?c0UkDEB$-l|f#wp=;TM zI3Bhu30hV{_bVmQb7oL^MDQ!L-!4Gr_Cyp~!U_*$e^HA3yE!4q{QVP@AUE!q96_*( z5Tf|kP4RDTYmDBG3i1R2Rb)?Pp>i!0o5o(x1R63bm^9qaEPqlljkG;e20rt^$bX?n zbEp2k5T$CM4^FDQKUansHuyYiJ5o3-7!!@Dyl7EODv43-*l|~ua0EA5`Z+(a+!Oos z1chFI7@p&_8(8$iWKJhvWFoyY`f#*4ZXEGzzxj+EPn6Bhbu6V0tTF|xzGMR^nS;*l zQO5T{qzOL~bKVA6V61gzd;9Rq5B#Bgav@Y_(FQtfmm3RB-s!D8=QFl7@8O|8H_`np z(EeC70?r78J7lB8I-_-9XbR-bIam|@S2`AiiA}OXwyt3S_`AJrj>uUdY0W!6_BuGI#FPe$nX=yzx3_Hzw~Xc(!ca=VjX_wKlJSz&+(0LR{neoaplBE zc=wr-k%}R;`p1Z@#2o4XusO#RNf{c6v9Hc+N6kWw_mF07CYXSnCXL;p@^iF?#YqHKF)R1M5~5O zNeaquBxI82)A5kDQ2i(NsfKioRy>kAFSu~>Mcl8n9x+Kp8V+7Ik09?DoD^rrfF_s% zUW9O~&9@LiP+MLz)WaSIoMSsX9B|}gD+uz%8RbA!4PIX*h>G-0aiQ#=ni+}2uw(A! z@3K3jLt+SlQH3MvWXc8kv>v|?!1SnA_@eryzyDcxU6dc;{u25n8m(a{FW^S|2TOXfyKu0$BvC6p{;z%8^PEAcHNG{@qP{;c zG`FH`dY)$&xVHPnnhY)xMs|ap*7JKo{bunA>g)w&PuI^vWpnZQ8cp*N14i{J!D6+V ztl6@sX18j<51RH6$*Pi|ZRuX&sLBjh9yr~}rpl;fRg=&8?hS_uj-u~_VPvCqA!q~Z z-&83R_Ym9pz0`^YyOeWpJM zyf1E_Ek0M?EH(ppUb1FCc75ufXWQGvB&U~Cr=2TsXup;khQ>nJ>Uoo?|Fv&_aHzii zK{ZVcoLbwR5kPV5pELQfc8_^bS!4*0UO3LCNOoe{>HDi&L?1(-txs6~b#fHsXTH(i zOi2g*k=_$PFDoQx$KJWki(N@k(l~ypoyy zw7XE(v)evXwiR3%0Ie+W1vt?fUa39KI}u8~#la`az{S*X?eC_kfx-RZ|5(x9G86#( z%<{e#eGM-X7f=AdyZUfeKjYWg0iOHx(MG_>jH+RhL|&Y!d$lg))Xon+ti`w3G*ne` zG?bJI@q8?M*qO?Rt#Rf6cxzK?D;w#w`labE*j8I4u62 z5WBI=rI315VS*?+BEvezLmxzTOY{JOUM-gD+8L4%i7_df1<|dhO6^neK|zL1^Y*@F zSwcCt%+DAG=n%`BTU9T!{NBsUcA{2X5=vFHLmq39;t^z=2S!U-g-MFuwu>>X9c+pV8 zjfJb&=HXQx?;A}boo2TFA#S5ow1B?X3r{ldOiAA{r; zoP8Eiu01e1LHw-KQNitMPwS((-pR`mPVMe&F?`-jMG_%3_&Uakb*V>t9nd@d80+#O7?ynv1P=(hhumg(@8bs0xTHlZy*@X^erU%`8%!(7ugnC-q|HS@2dJb;TcS z=COv4DGRb-Fc`0d;mF=BJq5#iKX247rh_2#7w6F3%PC4hQvQ^vK@TfW4%dw6gR&pQ zKhC>IHZ80dk7tP}_=6Gx41p{5s?gbIO41Ew!<$ZxJjRTc)vGnPTRtYy(lcUx2_w&s zy2#A;69q_^e?^p{8zzxG&P>sN(C|oY>Q=oDxCWkzx}l0wWTOB~d8o7fB~`7ZJ&mH% z(uZGcnMb1bX6(l69`4U?!@GNd1tCUDUKqGo`{-3cyz`&4e|%Jl30ec!* z55_@PlNUFo^hEM|0jydIQ$>CmTDRtvi@6%nGd0-NU4TNDQKJQ6bisSd3us1hb_DlN z$(6=m@Xn;!`rqOW6_dR58f)p8aaOvH6epP1R)~{i^Hdeb;(uzPbwVhV)<(RDE(y5! zp|4rwkZ8WL`F;^)cxn?npQVkLS(6tmL{l9;3K{IR9qTd2Z;BL>J(p_T1(P*DWa9|7 zYu!-rkUvbw9p9b$7>cT2UwK-*C;rvYS3}F!YLMLmvFyI?ZjLt6lSVk2ds3uXk*}EF zz9~@e!_CDNqxRW$}CjHzUu|{y>I75f8Yxn@$Kj4=2B!@3$fTA zLEA&U&m-nRgj;rpFEjnEi})A69i{;*N;HH_OoVirF+we6U=`5EJ)sh6o$J1N6EG>3 z7bz)J=;bo=DQ_3}aT}O<@;Mg-`*26i%hjYsI^X@x!-jp1kH;M6aq;YGiUs$ZLH7ec zJulcX@E;B!LG*IJ7({WZBOcFi_rg7;C4OeXu^oyIkvPvbVoX);4y9FT{;6=Y0X*f# z0d^1SI&oLrl$MX_j;i>2&E2Yli?i3A_nVC4&99k5XSvyhDUv}KWm89@8Ax?F&k;;7TKdKoKhyF}Nmo6XT!rJTEITc}Y4kp1^wb|q8W=>` zFn~NO*uIGa@mu%n^)R*>OwJ1%ws^KEF4VI-R+{|rS?1TX>SBma6z;@_gJwN|M9pf0 zEfBx0X?`g9fB3Bh5WlV2m=LVgvhoy#6~@5C8-w?gR36Qf+M6ZJqFUXZ9DC1hn5UC=zg016~S#5hFMjBUt}=6zxPB%@_Pp{INC5i}236K4jv8{i5qg>T`|v za`@sudC7Fg=t!!&7WflkHN*Wn9CSf6|MW%vuYFr5LQVRSj1VvOuYH@G9_vEPjbDO!4!VUGJ1h(! zj|+a1J@@>)qZG3$Qj+V`@NVoz3ve?xn$~Vf?eT15X+eVe)!PUqbY|b)=IRhJ;8zM| zE*o*7Sq=Y&p3x>jM|^|6YS8?9nI$^FFj%U2PoieVTF=eUp2mD-Pth2aC#(B`%E;e9 zg?;}vfhl`yU5g68v?$o`SA-p2`mT1tq?>{*S0m8`_~yy!+YN9f2x2|M32HpO&{J~s zTO71E#9l}|k;V1_apHG!+zuO@O0y&qaR_!9@OnLg(SEgZZf&AH+5vL?NIH8_fmtd1 zM`2BM>k15m;e%!Dx>*gmr&9#?oj`3J@Y~}J)^F0qW3jl7hn3o4b8Hz3)eXST4cEW= zE%W*|c1yXg9rxx!9p1Mh;TrvL%W7$K2^7$XCvnPRvj%|9?wUS@3ZkWCl9(+tn_1IW zKGwya zFm&uSE&*joA;N1MC5wSQY_M4VG5B!J>H)7*+@~c)PTqGg)OwOafkv%g3NSt7hzMBw zicPi(zaY`2n(h}Gy_iTN>(`dJ>dakkTDkCRYZoW4EO-UP5omRiMu9=8E$b}sWLXDS zMPL1@V)ilILiqCybzp{wcz{o;oFO1hN~m#II#r(f&-jJhTG|{a3HLiE)aEX|g#q&B zi5gSAWn-=KsA5J;Na;5rmjg^WIxtuaB0J2c`%Kxy3;A=z>Yq0Qm6gUMl({q2SfmWh z;J<%Gn5*hdsJ{I8o%2j!7x5DcHhSaRtaFTw{?}dE6SO;59P&}-hxCRn5Wp`@t2}Bv zw>;uJb-1?*Y};w7yoJ>e2_iq$K1(-~yj|&RvckySb-Ja+-)7ZYF{YN7dh2$hRU{VX z?cl08WIU0cbNQO_>2$8?Td<{1;kf`yNWn^F<4Ap52@`u(?zfqrXbj<{>4jg!JTY7_ zf?!5%wQaQh6DhR7d#8F(hT(1-qSln}NPH2+$+q}i{=5jmMD$NFz3j8#hXd46@!E9? zzRDHq1IW53;7fjwZsaf18ylNt6^B}J(3kXgWy708MNur(!cZ)7NcY`%^u%xQ$e%Yr zgFhSXm^s*npMICg(Pq`0ARh6JCbk@TLk#2t(L`yzwSc*wsphboPO%fG6<=1v}31A?5^`K4;I!i+CCk5nDwB=}JP(Sib9>OmCP zWTVC+Ir77ElX;2HY{^`w3|!_6F$mCw6W;%Z)%SkI6V(Bqpot2`ygR$A0#E3o?A&}t|dTE&w#kJ?q- zJ8g?nC6S0o{lg2}=+@xYoM{U^W8BEx4OG}sB9?7qUE5S@I_{67Y>Bwk!QzfwE7x4yE!s8^k<&4uaDFxa zD#Q|^F6M)}pphG{v|BE|ApJ-5Et!V~|Lh$(<&;ymrHpsc%NoCO;42KS;&{ zeZ_N`3;{JP{s8Yx+vNiokEk!Zu%~9rF=0E&o=4!TuDC-Z7=matrs{!o7-%me8Bv;sTQM_&M zg}ea`hlA0B0!TpupPK?L`}S$!*-n`h@aNPWrA5^YhxO+Z83F^CiDGGy^v|THSlBf~ zNea_@2R0fCgp;#ulZo(*MaZ!fk~LG#xE-%rRwE11?})`V^WW<1DV?9gdxb^U$rm;Ri3T+2F~gB;(koR`&Qd|sVa(10-OBFZZ)gsXR+k5MB29Pb=} z*@A*^9f&_aGho09TSdV6U0)4D#Nuu~?Y`2x0SflkwPu2U;=^V1Hg}NKCqY{lV(y=u zh~M$WUS&}*D}z!>J>;!F&|AG{-%0$du)c_6y}v`3EQe01%F}{jD|_Qn)tQME-lo?63T}&Lh93+v%j6Iv2@M>hL-~q|JGo*JRC;O&tn#rA*?}yuFcJ!DoEhR zu!=)~9vRYFW&LX9*L-YofcoY3Om3O`aYcqm(DmLnWZ{aWSm6{TB~$vmUbw4nKWv2lGL^6?F3qhv0jpF}-HAN9m0>}*IE zg&G8qgXD+aeP(NU4jhAk(Z6!R-ODX^-7mI<*sh^)<>ik#bP1!)LmokJ=p~e*Mi)Vc z7{2-l3L}Y-^11cMNs7P~XV46a3=N31lMxBpFE0(w!mW|d09Q0FHln_wOJXNrgmg`jQf36q{M=b}m%xJhHL zga#An>0;{oAocN`x4%fmbZO@kU&iE|`sOJb6&wjX{S@gIGY=HAOrb#Wp8?e~w377S zA<8i0a?)l#z}#a9VRtAg4XuY)8LsIki9=^L3-O?eUOK0X151_v6veuy02;WLJhaAL z&iFGPV;eblOx^|N{gO|7`TfMtzxFUVbSmHdgit}_ruEbk6u(2%XF=LQIul8c)m=7Kf<~ir<7_#B<*goDY=7)k_scM zam#Ni^BSSJ1>@z;ggQlpR*T2>qlBpT0VGsW=0Y(r^2TFIa8s6l zKd`H&a!L}Cv#zF0A5q8;S|$z)y@Tb$$YBgidp5CRrUNT676>93@{|pR9vb?waD|1> zB^|%wp{pb1%Ccsmo+=#A{_z;(Kysj?s#uq<<2{Lo^n2t2WsP1b;Ync;%JO%lKmAy9q=|o4Y5mFA64*}PXOySZxl&DPc_+r1^~`gW zS(U_-hwq{?)jTutm`1QLu{^WQQpD%7awt=HgqFV1Ihx*RJC}3EJcBHK5#}%l?ihp1 zOS1Dt^r*zKEHP>VPP~!h(x*;E+bBU3Zl;eYYv@TB?>qM(g4yZ*1vHl-dL3aE#j0R< zLX*yH9rR1*CG*Dl+4ENPwQO}~tHE0){)uL*S!Zrm9xa0fNZYcz>LxbW{K7-_7Y?P@ zu;!D>XA6r>j;j)}P4lp#62b}sQT3;VhmMUdkf@wZcJIJH8!%hG0>JOd>Kk^ z!i)Fttcba+MR^QBLlZ<9pV>U7@%qDP`I2bU=c)!L=-%U~HN(bWJZcd# z?Wn(Q2uPr~2xHvY?PrmQBIF|(`aO_BpvyRGM*_v^uEAN@E8ZIy6`k`{PALZPlYx7_ zXV35SN?iTwxu*VvKkyx-#{>N;Fyyz(|OGOH}Ig`)w7^U)ZaVks*s2Q~8Q`kblZK7|@J z2^Ng@@^KTjhTL*8a-a0IcYd@nR;*kL3%(5m6+J1TfPOx!Sf;B<&cel6rQ)dD$sLBM1~|}1#>v8g6$BSL30h8zuWpx?gW|_oewhbZ6R@8frLB#Q)?Yj19*+|pPK9679jf!p>UeeH zsk$pAK^VwB;$M*T2Sgy#WQ;F}+$2kt>JK((*889a#njzN?b|$43a%LotjxfuTtTjUI3n0iR*k-}8f8Pw8cM-Cgg#cH2{kJkE6u=60R-W= zF?ge{JX>yT;qa&!qgr^h`ydptU}=blyK)hZrPG%SY=`&Q4G;U%-6mRtX75Y zNs}@6Q)+<;ESh4JtQ_UhITQiHibJ&xJ|a9ihIW$M(P}k<43&p=#O!U(+6@oQ-CEzM zlIu}Mv1E5f`6@BAq!G6CZq(^j<;ptRqT)nW6nkenv_p#O`Uivt^axMihD)-Y(#)d{ zlt=4fC1*IzQ%0HlU!+}Ry~!7@@Hp#RB?rCArwfpU)_Jr-9x7@!P@?VnAnpGcnIqir zgwyAG8kR;egXr{ibN8gm+93Q?LL)zwMVrF|T$5GjsWJLu zG35SOqd`G5R&3@ubSzLM&msgQQ56a;u;7)bpr;oqC8L#Pl=vDaS3pzM6yoT+)^63tIQMAD%x&Cj z4gbxHP}b$1^oz83i}XhP5ZvOym;q4^d32v#YjbV}`>3|dluoJZGGFAc-C)Q>COOL( zGyZrB^|BpL9E>s^9?iarW_8TUlFUX7#|TkBD$!{yDg;sJ3@GRP@+a zlDSmy22;wAZlVa1KR||&>pEC45G+7?wX?wrHbgJnYEP)x87oIJ*3|b0%fcBbLMz+_ zTQ({!>E{{XJ99*};#B!nhEp4z&-$TkzW}w#)%x)oNox()tH44L&W*+nidXn43diof zR2=l$Jj7ZND_OrZs23*S{5|x;`8aQrNu3G#vnM6Z?)Z`>Z!%9m_D?yEdkANV<3RZ> zWTqKAaVV*FC|TrqK`Y$+jWp6)iJcE^pr07A)v%z->G=FoeQn8wnM0JV@sUkTT7zp= z7Iid%Je`3cv_S^<&oK~#{j7Q9v)OWmf<-yj719e7DNy+jo)By-#T({)j9s<@-9k1s zP|;d5qhjXji+)tFTrsEE1Fe3kRqQld##=&;n4u6!UE*B8e%}%42xq=KZ$#hfkE5}o zFv#sQub*mmwqMB0IE8#Tl%o}2>`~nPb#%{$^Ew=hYR^uiuo=)9Bh$N!xME~ZG0ZfL z(*mj@UurmrRN|(vMzCO1Dqb$X3ZOb|4e{$>VD5=*CCDk+DMp~4;6D9MU2Fjd$bM0O z0?8K?89`FWSy{CRMLU`W8wsO`bu4=j=XDA4?^Hi{h1f8-EXCRCoIfbUBnkTw+R2vW(#i{lx-9c47$Fr7wE5t|Zs{yy8YqO5BR| zd;c8bTFOL#Pk9n0B%^kMp%}(%02jKawPjaY;;7`4?!c}nNLD4_lA|vzJYS#5X(rNh zV7#EI(&_c0-FrUFk_w@(pfN0kCTI1wyERR-7GF!8IGj16`~5UTRAr(w1h%4v1YmYV z)TK554cflPi?ii4QJ*HI&t}GS z#Ee^&?qmss@LZ&<#(erdZn|>Xkw{~F)RqpHl!_|pVkDfpwHy>y1LDvB6qu$H&GMSZ zR>vi%j!;D@2*9Hdine$g@egy-x8&}N)HL0Ks1V1y3a(tziikH3g52g%tJjP@4et5b z1%9o7UYbv_XVh@R@1}C2*4VSTfFM;D9}uB_2*`sX)A9D zJ&uK+NqhRiR<8|qh(D9+9^U!xtK=t*)_>dX$Y4!O{S;WyNn79~Z!y{-s`QC=J*#bF zmmB}HM`rmpBy4yspXez%s1pNi{}VaRTZI1-{iW4+e(yJOEV~HzCE`h|ebQbxa?G0; zyB@*Hb1wN$lBn;RPp3HoryB&t$Twk{OT6k<{-WJ(#RzY4ic5lQ51hCS-aM2m;CK&2 zi-8Y9&ajr&zafm0*)B&mAp=qkS(ltahn_c zy?fKNimR9Wtkvpn6~8h#?QMY>`yyt1Mb0D81{J#e_fCqFiLla>nOm3MbN)#P8&57F z{-e248&9#XkL&zbZ)qmVLiN6LKl^^cP~YG$pXWF{JiHIP$%F4_++SuRqg`#jbZPN_ zjc3qT+#(<%BF5&k(418%{_t6PHr9^Jr+MBTUZYcu?nwwm{P;mHAE?g9XEv3F2W@T{ zG}NanXoi-<*HpNjB5X{^t%5dXkrOk&%2Og`n9cWVRPI!@kGk5H*O`xd=zVQ(4s>y!OU$CtSd zcO5Yk&weG$u6A)b?2^Z5r1|A=>s~vr@A~w{u|etj+J&^Li&2lz&d9$uM}M0ZGO5yL zl;c&4EqZ=##jS$Q8P@;(twNv&LF{}yK|5Zsl07`3pi$2^A*WOon53^~wZO_VNCiBj zUX;io>AGHCG6RkDB06?RJOJn8K=wi`34>;2y4q)d+pLaeN?>$>4$G>Js~UiGoNz$i zq=H|_q-UzESoE~*Q*%_|4^dU}ss=XiC$5HHF`GyO9Cvs|t{paYB>>W;cW3B(R z&V!YLtOIq#M(;QDQ~h`peDXL-;*UtX5Y8U-bNZh>_G99PuBBuLI6IK6_62;~b#2>- z@x|LS3SxB$cn+i)(X8W+v}Bz+esIThrO5BbJg{|xQ9XLK#jThmSy6I{hLtS6KXcB< zF8Lci4qvhzWoGc_T7h(G!PlAG&Oum39CKFdP!(KS_hy>$Uz{eH?QNuqb*YuZtXhy` z1a~SLhfseGsEF^(7s9*L*u^aj`#4f){w^g#zTVXtW5W9*?Z1eDh!OZTlR`p0wlKjd z$-PVwT{)g^ho(9a-uS!0Y<2vAee2iPsc2q;XU@s{!NG08@R(1+*+A=l$gFNLg={-5 zmQNFA*Kj0*_wU}l{lzf&rZBjwn1UZ=+x7b^D%E$+GKax}iw9DPO=%|Qwfeen1Ya-b zcMjh6Sq{)G!QtZwW2*_ahm8J?N&t)?i|EEQz0>+JPyb<4vMN5ANu9x?SlX>5YdB^! zCx@OYNV&FBH?%K~D1;wkmecF|k*3OOKi$$aUTBUy5|8D zAy~l#Aj~^oiw*O1q38X@)d(VmGX2abRl;Qez&l?55~Eg^c}U-Y}S+dmsjwwK(=&(B}PqsxK|R*A|w{^p+5tV-FZE1yQ;fZzAm z=Y{(D;F&Z>c4Rr|U?zEs?yu2GrEqN23<*sE2V1q(UK6=6@YC(GSrp0eBn`5g_-6@Y2zs15f~E0@0H33slf13M`{`9W1OBfupCaK@qXg zP{r(f$9V2ZCjRn80x)Dc+scWI8*S))j$x_mGs4Yc{DC8AIg{T7u9pKa#?&_lsxJO{ zY+Cr?T{5z38wbsWCFI%~{1`fmcVwxqIxYbHA(Z}0L5nIp#Tfa0HW<;=y@pMMb_Zm9 z_>4?RD8E3m${$M{OUY<-%5qJgdo799>acHWYtaZ0lm2d7)Eotw3A)vD_wzmH~44(94+ytLJ3j&aq_3dz3F&>Sh8`{g> z4%QbyiJZSZOQ`kE4$mchlCrvsh@aE|NM%htqgn!Jrb76`iAxzc;17lTzdT~~M@d!t z8zW7#zBiznyEMMQ!sJ9050}Vk4b>whf+4AQo&UI;V{nb1r4sl0-N+e6E6S)?I}s#T zVZ>pFhklHleFzdc3N~5zTpLmPt)>^vVi9kg!AoeVWdZM*N^^6+2e*;xa%YPc$k*2kT`qZkufY zJ}*ZTu6tj*`j!G#EoeWiJ~r6AV6U-x!qT9}L=AJfW?4EFB9YToz;&>i2QoH6EVOoA zMaA!`NZXr)WWDW6bVhv=u9XU(GFR|59w5c@$-f7_@y2&Vksz)WZPq2;0v2e;4e>Dc zp@&)^4zFo%S;&yIgK9N%b8K@Y$8w)p- zFB%{P>i(oddx{I}RzcM*yJ2p6ZiY@u#=stsoY*GLZO&}1ei)Le1*M50G&4b^8-_g& zF1bgmz8RmS*E5oXNCuROeH1!sH$ii6c}eA5!#ymSc2_B}lA=xdpNV^KKh)#aR_VaU z?BIMio`}0lWp-X8thO!Is&ErzWShq$0S_~c!66L%s7`q3llk^`7(C^ouXPnuutQ)5(- z-?gaB2hOX7;Yy0yx+OhWlFUe|G$;3+J50O@<8&ZwvPeZgNJ727>HT_pqPNS zGk`oA06qwz-`|0g$-YT!Ak8F4P3YVwa(eoCDO(``t&e)&(odr73+EJ+(cIxlfp^@= z+cA8CLz>GeY36Aguy$pG^bsdPJ!fkm>Ryr{DzmproWA8(u9U$MmV)KL8&mMn%wFB= zlY2V?>7;)u*)3}lz#Yzk?Q#f&o6v{5OpSUm_v2@W4Z2dLDJdyZUxRsb=bVypb$&Fe zu8q=Dc_TXPljb@TegMWt6{@D?KFR!F)VRd$Vu8-q??3Ce3>Njbr}bit9&?u3v5_v4 zZ8WtoIU^!-+848)bz1G+GZp$8<(~qmg~Em7YpW~>lDQOhJ7Hj`-l??sbVG}EruWi6 zpH~+xffUwdbeq`tOkQ-w{*1B>z-ie^sU-TRP*MFWXntQMkgzAPO;hqZQ%LTBMU3la zzjVMam*`v?uLKvdzora2Oy5#iu2h^I+XyjVv5d~(WKy`R`VohA(f-@#@o4I+J~Ds2 zHeT>%D@hNC>XA;|waF#44<=*+WqRVAyC$g!-RJMjZKT?))e7&pzHomajVFX+7yD-g zO1Y?l*Oc7U_h2x#7*~R7{_p2!xBU|Z;uVZQG3(^<+HEVFu-jFFT#ysw$o_lsRkZgP zf+zD0Q#7Z>u>)a2nZvjpsr@OKZjEcEbdB|k{*8>|h5*C|*D0Cte9}L--*Gb3Ga`Z` zYU7@SGtir22No?$uL3kSK39=|zp{D@Y34}CK@W2UunT{s`YB3eM#A5fs$K9YDWVc7 zHTOsYsu51!)&qyg1QF7KYZV6-);QA{q3=)ADrf&1yx$Id?}&WwCl|;ce@Ct(-2;Ex z6L5a5tKtSsxh(luopt^8X0f)&`;L+eP(UFJ=X9m_-r(deuN5Mzw1P6(O&}{~9el17 zLY>?@MQv9Hr~9pMKr0>JaDmV3P>c?7I!5l02jf7}ZK|buGa`c++Jcf`M7=`zPoh>4&v@*XfL>Q@LKt^D~Leq^=_be2tL^0=;yooHd-pJ zb&Ozt#<9d7IP|3g5O=#(oxr@CwQ$)C`+kvbkGCORf~=l;RkDg&u`bseS*J_@6V3!dk*)PJ-%NZzMdW)F7L;P zf%Lh2o^PQO`MyoX9@g*r#!h-Gm+LQ#f3{m+S23Z;v|SAp5Y!^mdu+vwY2>r9)Ntl1 zs+gl}q`lA=5eH$;Qq6)d(yW53k@fMi4eDwK>L}prs3~a@0)ngCSlEk<47+Cj)Zr=A z*L_-OE>D(gE@MLj$3NXcX8RGlg6PvV}ZI;Q<~62mp_QM1V&j5!xfd|fxC&ho1ZYnAzEhJO7NH-}YA zLGAa&?^U+QhD4V^Q*dBZ zE}^{sd9H^#tSjoFg{v3WCo~@0^u?sH_q>M31&|O2G+v7j7~w8t8{jX6L-75|wH}qF zL!TLNWgUud`w4#;NiiD?LJrjjRi_49$2DCIT>d0ij+|tyg5{T=YUIh52vIgaVkiJI zm-jg;4PhwJh|3M}%ds-`Q#W0zaV_TZh4|O?3TU@X+4avTder=Rv$BY8%&i>0UI_kL zlXQ9)w@FyXM3d=7NUl!&_DoaH6Y|eHQ>Gx918qjU1>)Eo2D~^H=}}Kt_`Y`$0GqO%iWKo6k8wGX`C_Z@^{iUr6o?eQ65qCWDm7-=D zuenT9bgd{YY;Q)U6qZ}t0y&vwitDlD{vf{Hyay*vlZtl3BRVv#o9-`4CPx_bUyslA zk4MuN$5wRXKnrmCOq!&WkiG2iHGbtpCftkb#7&W=>4}ozQyvK;O6a!!e6nARVaT|i zD2fX9N;mNd=-Imo;|adQ-%DbMtZB&AYw0F#bh*X#H|yRynYQI2$`^1dXOERIrg{x}h6c zPQ-?)0n7JI#57>S-r5t5qdMpXlJE~LU< z*@O4Y&U&6P_TgCN zFtZDGlg!0|l8lwM4HcS|Ql)yMmc3G*cX>y6yxrM2> zyZlK8beL?G57!y1V(-_)I9i^Jj}pqzmO!0sL=l>3KUUAA{h%Kf9g%V*L>1W@1TJ#- z_X9VDN?~&({P;QMkLg1Zs-W;h$PoeT8F7iPdYMVK31N)c?Vk9XhH%;#EkdKOL!5ov z%aybDIUnkS%2`M<8P2%&Ty~NZDy42SvA<_3j2b;qUKhyR3gtMM1=*iK!E7KZQcalL zoiWp~SU^vSBEW<3ykK(=4^Hp@kT7OMFAI|FJa21c^Fp>SL4uY7(+01Jv4$qsTusab zN8k|G(AExyh&mUt=j8Bwq7FU${?MVV2HrbIPWpg40uDk8;HxNB^vfOB=1H@xw*vO> zPUNJ2E&{_04!}b|R74PruiqDi{z6N?)K`03*Y2it8ql*=->M%aH#Ifj1Q~0YGo0R` za8T;<^|{|We%3_%9gycs7`CyRlWddT$PW1xl(vhFSrq2~NqRMnXRmcuKEX+KELM)s zDtHTr@DcIFfNDhbfs~iAO!8+tHYOC7I(y%$A*rbI#0}L3vzM-U{kjoVc1ga8Ro8;A zliN3}_=d$u*+ngG4UHWPmmP_+YpE&hQDKLxdQzm#x=|H7FF4NmDqnWeZHu9jPVh*b z7%&TZKJZ@C-MeadK)_clf6{H25>ijNoM=vz)`%3=OUyQb%cdWaZvh*=0Q-@&){ihWg^}iCeUG(6%{)A$ z(>ONeAh>ag5sDiPVsm|J1;Z|ILSvi45ueyBtbTCGU`)%N)dc#QY}`b#7f{TNg&$n{ zFZN8s>M&Bd`fa}Rv!hRPK|9`6o6e(&E1PSD$$tjVK@=Cq9_b@e#3=tvuVgek$22uU z!01+D*}XY7c;Fn`2G;&T2JEZs^}GW99VL;`dr;1L|HOwQ?PqEN5xZg#<~gDKj*?go zq*p)=HtPNWb;u>st?4(q;?jvQ3MWUVPJ{o_>tc$RFy#ZCZcrqlm{PCF@0!)PFLIf$ zZm6*HE=vdnBJZ_U3Se`~FJN~PLq_S!VLB}eM&KDK?VhWa@|GgnP~9z)2YO1NJC#Ri zf-Z0hgqz{J6M7qk(B+0~j2)l)yyblxyFI6GX`n4^c-d4V7g2@|cL{WZo<5W6E14Tu zZv8p3|=RKaK&M&n+Bb1ny20AMo>NxRCpsJu9D5| z7#o8GuK?i#ly9T-abX(LdD->ZuU87-FIrqtvyKX|a!9Y+G2%dDN^KyZk7l zJfy{tl{KX9GH0?!sl27Gaku7b5(pM6nt*AMGdPK!IFYqJAHO2(}SYB9FHh_yH7ro*i!54N0J@|LY#^V~$== zpeK(1qyOU`=ApqkEmtEf7t_L0AHuiq5HU-2$ouNQIw3^e`2U{a!wqx+E?kyT z`V}~6k+?fTTMcD@(=$xn{*dw(u74a*rJirDQ_rw|67p4tl}!#oTH`h|uOI{}bs+h0 zwnno?oUT^73BvpS;*0Xgz^9dm9RJ+2=}jpmxp)4~W>U=Ww-5;`dMYQbY!SL)%piSG z5xCx|-;V&H=f}s#?#^_vDW!$(S5bK$Pm@;*uixvgeH4@3J-%;n#fF;Z(e>LMLj-GD zaHf42;+t;eR^O`_e2!Z@Jh3}(Zy3FY&LudcNmvjrVVDZ9@5}MPTX3;KSMm!y#O_>* z77rO!Vb1QqmmewB!suDro~7TdFcLH35fIq5b5k^W)@mEOngi8#{{N5<>FFx{u=N)i z$Nfc{DRz1?V6K|l7L0^~_UfwRL%wh-TToQ;M*j+P^VJ{!(tjK zq>)Dnnq)kj4_fk31*W^$g$%qz*Pa|ZogA}x_aDKKXUEB^S3lu2*%*9hERUF}4m`bf z#4b7g52Y>v4s}VkH>HgLkb!7+Ntm{>CRi577@=BNqRK`Q0+5nq>Ao6pLdWnbxXK+> zHgr)hL_J4&lx(fQ7R+jSKXHa#sWbH!NiHc6ch!te|8{0WEUv%3?WhYpXa!Xak}(bZ z*;&UnuabQ5Is#h?)@24^$DuyIc1wHy$(j0r?#5+USt(rrC3Xeu;M>rjPPg7r%cbbz zZOYL-8Hw09XxA-d=``Sox?9%j*vl0NmQ=JYtmo1HikafhzGJ2h6P=%g!ZHE@n>3Ds zDjdAoY%^+(q4GRgt>_G5-Q#!Md!8gj1<1#(n&*V5=gZ($VMeNd99i>59RHfy3nPqj zPIdNi(~V9ON*vCGvFCfNi)7#wv6UV(6nb$4%ZVZEl4sH*kd0k20TTw9V3ifm#4HyJ z+$nWw`qwvEj^nE-E8db`Yo1eRhBEWGB+H%fI^% zWVW?_q46}c%$C013B{EFFQk3Y_?$Ly#HxSrSFna{ZyRS_9S`J|d85;y3Vk?e!5pIf zUPzJ)+xevJ5&B11o0tWI)oWmI=?VXv&u)0YAAS zocVy99=@+f>c`y&vaHF$c{An)mbQyiWxZsn`R`@7QqCY9ezOqd&H*M0kfH6L$(-S; zCVSsChPj=U+|T#FsI_I> zdc46Bg`OW9s^T}R(%P9Y*<&-D{tssh@gu-Q!&GqI^LaR$)d>hgXJOLHgAyw(hBGF&WQ#bgflK(sXC7$00pY#aSzX)5~GM*u8LE8Lw+P0tpi&=~+Rs?3nPk z4Mr*kStnh|f-?Ca1P@s#FTKVC(dEBdz zrR#)(s9(HT*BtA()FMsTAXN>iBK8;IH>a~N%7z#lP=RvVRf2Ia#)4ZRaEwR^jA%%R z=h!AW7Pxf|yr|!|@^^=@)t?4BrzLrZY-GK%gCSdv-SL{zoDU;<2gzTIG!?_h9)J0e zep6bn63UNoq*gAB)-z-&R89Q7YQnLG9r=P`%1Qac1qCzE&An76$z+C$T}I@$ls zCZ;<#vvg&t?Cs?BMJa6+1H|LRXJpLIy?{j&0o=y9hhiI zCKdS2thgFuJ76$;5QuCd&h#RQE9eK8mP{yh9K`DrCdh2C>qh}Y^>)qRGvW;a41N7= z`5W9%Tb(2E2?ptUk&WC_)7l3KeQ0b^01aEI7H8B9fX}kW%cl_;$ehF!nnJc=e9-_G z#Q(|32}aQ(=8gpoZbcI@wjXF&;fd>a7+A;^v(fq|Rf0@1qQDY)W(i#QcdBGO{vWB5 z1IxcsB`5KJr%KX|7P(y6$PoOkf((fje$;@WATbf%HqM0RfwKq%b*+(o>%rN_O_{c& z7t)<#v2gYV-n!FRauo+Ku+B;VcPG+_Urj_bj-`HGdvMtQyUeXo%1rZFZcNyAl zTM*NOV6k!~=GNiT3vxT_F2=bt!cr0`oRuKhTM(~5?7X7Zz0G%#sc9}k2iN6_Ul!|X zw*8YWISD^`gg;!<=_^&>p$DC}UuW<=x@i7VQ>z#HK8qpkm810EKK@szRD>{E-R1^$ z(D+ZN#6z;BlHnmZMHA*FC_|YrBx}MtuaL8`#u9EusZI1&U6(kmzSOAqzh_F%`NDi1 z#YRTYI;-5vR3WFDRJN=vm>?>Gp$RwIIYqcHEb)*a*Razmn)KKcvDF8eah!9=WTG

kE-%)Yks3V20kD;-!g3~35-~FVF7}Bo#Tvv0G13`7~%NfRV(?u>x$kFzZk~=4% z_lDa!%PNXbYLDZOXd`bW5TB319S7#u{=cF-a= z981W*GNrAPPTpUmCpacc3n$ZA&~`lyg7?D2)iN#q=o{r4KTu+{D6!!DH<0m2*QX#!c}tkqa`euUNcPj0uu^K*!Bvu z_NHa|pT+5+a5}c~H^xl{*GL;V=939Ukm{71!Eyb=a`YZDpv529pZH^972N13N&&d860_E>@YR8mvTw zn=U`!+uf1x%AmsGk`h{r(W|`_JrKHgYGJ!pyKo{Lz-(o~{1H!G%F2j0CPlw7L2c~P z@DrPf%VeYhdX~zoQmW{O;0Z4`uP{EM1?Gu_TJY=6-dcRAaJY#+9Co!TQ%^wUA47k8 zUmutvaT=JpObg}fBj5F0*Hp#f8M;(NaK?1u5bAh->Sv?AF%u*IL0EU|f~oIK5=*?y zjG+kwPWNVAgeJlq1G3XGBon|B5*KET(+oF`;s3-+addLmG$Us9hA&r9RzMq5r^)RD z1tt5AY?U5;4N76<2@4y$p;AtAh<4%qg`~*Pj6CSLs_-V7jY!=iTJ7#pv(-g~VKgv5ck=bzG6|6*6A?5SD3zwY6;SAU}U z;Mxt+R)6g6nTt=t{C)#W({0VHiT|C-+KO?nOEcDSuFSA&5vRTWmJ@qnTeU&x%W`b@ zs2eY1*<`J}*);(K3FP&-bk9!Dg6l0(F$Pm=kpOa<=lTf>F^qm)19#rqtbed=YVS$1L6TYTrNj1ilGM#WpT`kmY zIv&USl5u@L;=hw5KMdvndy-_0$*lRGNfHbFSg{Wi{#r1L)a?yR?(hxi6cDdv)>gzW z8?w9cXe(xgBR&fH5+)ULwOgtNA86G=;ra&IY}tEOI(neS$(% z3HbxH^RMMo>}qRD%8W5gvmu*DkeqWpc6nJ_q>$Q4)zxeNa4)10ABg`wd$M@5Jgr}`7 z#%}XKuPe(nnn}4?^i*^(nPVt_7-z@@fLUiPrh3oO(uOl!lc|<6-Cf}1syZxYzv6w~ z12x=(SRMGga5_d@t=*TBZswgRhKytW`PG+)fv|`x3MPl_wX8#%mBWIm7CKL{FIRdL z%{N{JR--NPMGbcOk2qQ8eg9jn_v*gj67IG(!>eC}$miXg3XT5x z-MB)WvgR!?Z2f4g`luUCMJUQt}WS0Q9`YI5*B<$WmL%%WL+bt6kSMEbyQmC~* zgIWTbU?#~~TSLS#2kn&jt>XJpcgqZoQOW*|CCD|L|1M1XyQIn{J9w?;e)i~c@8L3g zGh;H@AX6lt#vNxR1=HucUP$v|WN8NR9y^X;;ms1NWoyO4z(k7q7{6l5v{RgR5FE~m z#bnNq6@32@8OaVoEExXKv-tTgWsZK9Y^D_j%Q<4EItu&d-gHdfwu&+|Q);K!;swp8 zAiJZiQ^wOpAu#BfQ@TLREc+p!ZjPZ7uATYo4^vX3y#wKt>^#M#c%pzm|5nbe3+E99 z`@RX?51p$HAIkdgUmm{RKALaN$8JTCe;su!OVP+3e}C-?6+*=q@Qz?C0YQr9OH@)t z@F_vkFg71X&_qM9CdY-dgeAcW9!Vmwda-42f?Mo@#geM?v24^+sPm7z54#nP7T}KVrD2uBu;r!gUPcUyOpr9@4qFb9*EAB+A7rEft zquiwE#aN*5?1Q(LOy)dzsny-GvRTb=U}7THr>UT!y!z`PMZTn(j^V_E-a?EwX2P~V zXp)m;q@)&%Nj(CIHxk!x&iFBoi@`b+8~pyU%ZnI%}+!`4@F4Nu;E>eP%x>1 zbZlL01|Awt=2yo!nNhO`1{4KJKQk_iRCYXy)}!aB9irT->-p{>awK=Ga_8*J+dc<+ zhD(Ink*ul^W{+_@Gna`oX=jU?@dT_i1>WLE6WQh={UcdWT;3RBC8{u_)-x{3^|>=^C) zMXqZTZsJD~uT%H}6?Uu&9Z_G^_lUG(Gh~dW9Gu%9c>nFY$FF?Kx-DYz@@`~m#?&Dm z^;-E9otdQ|`@y9>=QjB#Wld2p4+<&PCLz}6PHPMeO}SNzw#-`Iqh=en z~IA*nOH3NDtsO_mMlg+LJeqzz049u?Cz$fe^t{pb>-OP$l3Bjwr5LU4( zrCnw@kGZa^_CqHjDdEIjkurhbB5;w4tS60#&Rsh?Vr=z$ZU#G^;xv3kzqQ4iPoIho!59(fxfs9-ffdx~c{-&1>DgSXPbqx9d+kmh zc)geBG+tvj(yU@+Y)E(TbVZNX`IrE0glPYB1x21hPpS6<4a%yy?>$nIT~r>$P1WX; z=6}<|ynQ-HgYet9S;p@9T82(19m2|eL2*pn*Nm?+1MvvhA&lle6bXX9H41p3JC>mn z-@B;?cF?iDkGhqcl<4C}tLW(CNs<(sO#4sS9&l{9T6_X_YH&n(@%~kuJ@ER*{jHwX zUTp*l^_3*Y`z9Og^3sM2ziPcLA;O1lVmgkf<#e(Z;y^Wf6f#lEuK$j}Z=uTng}}Ed zc1&{AL1h=qTNXsGcHja{i=W5iPI;>=y$kM(uwjx zG>z&FXF7o3s(m?MeudGY+gn!PCCo-$gMNrRmz1l~^??#g_X$6(WW*p^FA>G(-{=E? zmX!L(z|UVVov?TKhEjntM?H=oPQxRq`aO?XP-=vK;{>TUa8KH_dj2-oQEaSafdN_? z17Z)y>kxofq-bE922;UFC0l;o9{YyXGc@5Y7g9tHdtyKk;AOM7a#?vwc<#!v^wTSC zg1D4-;7U2DP#}8A)}F;AZj{rTO7?1bHn!CDvzcMKfalyH&O;e?n9@TLEqP65#lzdo zt8U*1VucZ&DVL#JCr`zFQ@#;bDjg?b=o+OY^1c+APAvyLpk$Z40KeFge?T=O=6?s( zC0G6bfa($D{{gDy{DRi{Ma)7?ZAaLcQ+sjCfnkLNl(dBCT~`h|hbvdI$o?@R{^EL0 zWHTOQIz>~41i)RUJ}6K=WyJ{jgw8O|Z^yCNG7T`na?Db!IPqnElj?uj5CxnNKe?`W z0Q(GAkf)p;BqlkVFw;6ZYR^ndI!Pguk$672Go$FrU8D$MdJLV>I7+iC)8ErH^tUYO z>)gcf#)EJ}QosCzf%daB_{ZmHU~39f{P?gTs40nf1Y?Pn2{gk)Uh@5=Sh9Z`QBeeoAAMqFb&&92ymOHjKwr!J!L{1`n{A~sgdJu}7YXkmlQasU zS7=Dj;HMyJT{#Y+0pWu#ea3&`Y0gtL#aO-M{}-Mvd8+?^@U(%*=$n6J{XclRpF#mr zJUJjiYG9RuFM(l+z99@kuDcg19*D4P+%P8PU2Gnx-pP$rR2?Jd>!NaJWn|^#`g^y= z=U%w_JYH>%P|-~1=Ve8q$3=6MY_Oc&aaQl^!|5=oD3Sx_5U>?mM3tH(B&fzfak(O% zidrp^iVscsuo>FMT6}=$H=Q=B`=-;AB~bs3PM;I?m;P8*}FzD;*m(l_Be=r{Id;Y_CfX^zBu-mYJ*jS0N(&=b8$VFhMOTjUM zcMFsF9i|ZiRbrdvSmE9}`k?mQBRm+*T5}ohnctuj#qWR56+OJ$-{(4SG?`8xeRjE0Vv{}0!J_+PFAgPLb* z%EteP>QMN9Rvm)ARR^J||56=_-W~r@9WwuKssl7b_ujYZz{m8D=^(21<4N{w*^la+ zt2&!|-|`&Vwo(k|hL$v7(K(jfQ!OHvOf!;d#WZ$V;5|F17xgC)pmq?tmoDlZA?aN% z%g1LIw85sD9PD6CD&=^e8MXLgSqv^jhYwT9l{7JT09ho;PZPS|Ol}zviYW?0jsQiS zSC5DYNbNM=&JVSp5s%$rsqABUUQTPCn_AP8WcrXA!^vM}Uv$^v!Tj4t8*2{zUbaW( zN`VwIj-%YZXR#v4)Xy(HU}ADzXr3RGGCT=NLZtAI^>A&9N&*v@uJ4Q8r*(4TCukrO z@kbTub~b8LY6_yRR0*#A*1jhcQPXO#;lA?0eQlVo*ZP{!h@9po=-27;?6nXrm5CC% zgXuDgt{1F@W%v?0UQa{9>LLu?MOV5L<(*`|bo7F~nYY0L0d8=HpP#!cZYTyb=C;@$ zN0JLzwHAiwtp3gs)F^xS@tw#dD%&6a;8V{s^GaI`o~{*Wq$-p$E-+CEZPzRPya$`4 z-~tg=jdnH`Yzx?M1vO_X!MopOw5e7Fu&lpJer&P%*WU^O*vheV_UGJCTbef0PF(W_ zkej1y`oTScy9|?+v|kF@1SP;>G>+s9K?D?);HIUPPM z5Igl!_L7q;cNly~DE67Akf!d)={p16Y96Q;CjXL;`6tNM;JNtP#xvpZP7SjslW(?? zMN-8mm$NwFvd1qNuz0%J-$7&)+km@58i%9whLJriuvV*gNVoaMHgCk^Li-Kcqr@J? z-Pn|;@vxIMxz(w{EzGg4T3HAjRt6xD?X~bozPKiklby>;9gAz5by=|RH>b$MHwl9% z4eTfHOy$!sLYC|*wEJ}oh2-t8iwjg|r=wwkxs-U@TJP{>ecUb4Ut6zzSMp8uO%-1{ z^{Vs{MgB|!WPnRK2jVREaU%1z{X?mbl#ZVF{|BX3=*I}e`Zdn@@Yg`J%(5dh6vc0H z?Jhj4Td+MnQ7vVOy!B%eVg@n1k!b@$&E<$(Gm52#HsJ+6jjA|2&>|gpX^&#n-g^#a z{E0Hxhw!O5XMatEyfrZ_S?~y^mk4XztBYxd&o=(gm>N-&mY5I-GLN^}7&k5JBK9iB z%pkdIu9Ws4hulHhy?mFMDX#crF+QPRJiwgLdN3kkV_+d8g+ zPQ3RJj^ZN*yeB%f1nwbng)DMj;Dfuc$-35UJyNn4%hE|eS*NUkC1+~R{+j!KzSDPL zj=p1$pnl1ofae)qIjN{iyK__;EYqy5k9Y4$Now`EE2YL7?vBm zw7lfSXU+#|Ej3d}2n)iWXiT%TMP?3+#54RfhaFjTjx$h52%pt%E!IPZXN&;+0>PdDG9YCel)kTrE> zRPMq{AZx&(dvkmcTxpSt)tXfd8X%*2ubQGbo%FfsV>n3)nRukrxyMKSplT~3rFOdl z3**6_WlhiitEnrf#(05p5DFvr3+X!`n>r;695BQn!Gzn9F(#WX_iRT@#y>tH7$X<_ zYN7(<>s7$P4)vQ-U)N2Uhwc{A44N3?#yI;& znn{!mK4Z&keZy2%qDNI$ux=M;A;I1yVIt-LI^zElNvN%)OF0SMp)O$qLazftLZ8Qk z23=-G235r&Ab8+!Yk(;%j9rf5X_|4^3M~A6LqLoJ#^aIAS`|BoQ|%$4wYDPqsWUL5 zH`58CH=`?}FVWROpJ!|YT?Xw0J<8twWhM92FoRek_cHJz@cvnReimN??6{uV$*K6w zoK0-fJCQ6=9SQGq9ATdL{@P8Xfm&S&!xi38L-iVC25a~~4A%IC4Ayi54AxS27|r-V zn9cY|KMN7&5_Vc-&4CW`SZ$SriTd^cW2K)X<`NeW?|GJS@S`kq{~K9`fe*q|Ez4c! z3RYXfY}men#lC|A3!*TywTw-fogmf{9VP5KFazv)Mq^NwoP570S=lS;duL#QEA`)> zjTW#GWYq>b#LTom0sfK<5yASOK-b9zbyZuwj#byd! zhkh`qzUO;C02XmkLVt(3kFD>pyiX;?Lggm$>(rRBzEW}?T)ipvO9o}`_1>P{`(`z8 zI&@v1o3hyG`3B#s^8r8Pq{QzzZbk)y*d(oFlmyYyc^dsRa2oH%L@MbfL`AyIDbV{q-+#Kqp|ovxhKy|*kWxp%EfFiu z=ywLxN<5OL7_B${q!=cnlZBd$WGc9*o_rV7CD+M>{#3Cm`uA%tuRG_$COjQl9^l;O zxalO#++bFRt)6)*706aAB|UcOq`HX7+t!ALILd5&TRhjf;!bAZG%o8JdFQv01=)J1E(jUl5<<3Ic|}kXb8M-utzGh z6ni^$6DjPXG_9gWLT+vUA7cHhn|9q^;9p`5%kx95C3|!JA=cL{*#AM+w%eB8>*@SV zj->yMtmpnmWNiWYgRIg2Mb=!|33ehS>QPt!AnWm6&U|!a(H~^Zo$)WSX2CNJk7ct- zSNj)Pi+_YQrso~S^c7_a{%xtOMwg(Zk=(SzJ9i2c4Isdz?lYsyO7!QMMoqO2LC8m8 z(z@zf_4YvJ4=(f@U(lr;ENmVu76bw+8vS)2mY`0MCYU(*dC#3-(w8u?KXcA1-BpG@ zOE^N$sK<{c*uP;L5mULq+!BdtN`B)jC~ z+>#UdkT9rVzh@_3Iw!(nQ{iOi^^on?DA{X1XmyzJ1BqU)6I3i_-REmnZKg_W9yHSV zPaN|ps~J#Vi<^`@J}d^Au$aHYK$c&reUMzhALx3p(v?llIZ{qzBZDCqt?W!zZlQ^9 zx)>}G5oxw2=*Gk+GdnXA0X=c^a7deAT+;yyRUEv3<@Pc0;pCfgJq|0{m{#g(K}GrG0oB6beRG8(lX__ecx}#R{cDVuVtmdtsOX&pZ^q?o$O)+$ zMv{g0{h*Xz1*?>nopv(35h6Ri zqx8&{GpO7aJcs3jT_}Sxy1&4v_qotd6)g!T$h2kI{R_5kNUEUnRw2EewB^a~4G9;q z)N;zGRe2YsLE>jvoeg{kiZT@Yt6QaJb8A3~@GSi=mHsqW3MQ(=F-(0q->DbyrWXyrHy zyGJ}qjQ=LTcqp7?mUVoGv z)z%bq&VHm|l@-&`4DRaLy^s8n$;i589pW1kz@I$JGBkx_||>v!TK zdTBn$7HR0pHtwkfsP?kalV6$#FDEy5Qb>rumWChY%AaoqYJFe#6C{ zpV;eP0M0)Q=Gx`>n}64OX7)|rwMw!cPlp5yK{q)jU!g6!Ne1~dj+d)YiC)72dP4$Hs}7?(=wpKt6^$nC>K3`^&i8co*-umylFx|~Q@)kXn^vZVOaZO>2N zA|e3XB>-lWNVw7gTMsm{6}=sL0i5 zyUQQSuuV*uWN?6ZkV4q%oD=pa>3}uP!yu8ffz5$p7IzAr{>s3fgJr9+Qo-i;g<5U4 z^obLf(5tcHE27Thy;g=0n*C2>fJkjG}nj!D zMCbjq`F>LU+)~Q>ov=SA{>iD3MiX|_d2{hgsbQP{k7nWLZ zNbsnMT<0P?9vOo|9IqoumbVeLXRo-sqC);A`>+d5>ARrV;2YO*WYc@xt-20!k1s+* z^Z7MX&up&4mCDX`p3T$-X66paGdr#qC(CVws`c!kO`h7SIPT41*YpjDro!sqC-QI} zl+1SEW{cD%hR2ih4!~4J3Xw z)9Bz|ytD~>cu%{%sZkK!&(x0@v1h*TG~evpIj6E9l1HTNJrw5*s0fUa75d zd982c9^wc)Ta)*CkzZ58k`P@kP!+sArXhQ2Grbv_(ITZKZL_8A9lrQ#X!6x}Zf?>m zP;({ZEJQZ|D{@bsMol7)p9Rf}IvDChx2_~dxe&a4G@6JC6j10QM6f3f34BRf&Y0z} z>B%!)*q&+<%bH*3Kf?rjl>J*}wH{&K7zknkj?#Bo(cHk`$@hpTDf^WW$Y>?y_YihLqdVa+t(^E&u&j60bpF+Bip{3P^mD&ZU`K%AIEo**fJENY~ zfJGriZyR^~FoO0UkCS_0Mi@~WLM`{|-63#JW`X(wr^v0KU)$KpWcb!NnYVcv+SWBJ zK)#-B@>+m%%I>b)1cvpQ_shXjj~IZBM-a2Slo$b)%4RZnxuOlXAx0}(4qT4aMUX(w zCE0&`lFhby!2;dpJ`AX73)Ei!lwiObrb~<}PyM=|NHgae&y*pw?YQ(!F?LcQNwuj? z5lpDdi#JEsbCj+u7(wyVF7cHHK%NYi-B*Ze46{WjZJJ?-8vJdgh#d-S3oKq(%n8XK z;Z3FJnu3l`aT3l1Ijc801ZS`DqOo$ruR-IJbhdFiNd_V>Ffh25ZZ0NlZQ9YCh?ZpE z2=CuBH7)|NQo~BdOVRx(R)894YU4c*>#)xWPLkf%2n%DIB1K}T%*lx&yZ^iC@>4{n z;W;EZvR*G$q7j&*qpF1F)B4opSF5WQZTcb;UZrb2{@JumeoGtY;CSbXI5p=o{&E?= zOBxp`@L)qh6l|hwvN)&wCVvV-qbuuWB;tZFWk%d@^S|_BrFO@Q*fTp2i#F567ymgm z@mCD#4BHIehJsp{%9f)stC%616vgq*2Bp3vS9t^DH+DiZNrDC$)N4^q7(Zz`I;q$g zi<-<|_}R6}uW@A<=G(%WqCM5ZuU{^XkjE@D!qCjyYbyRzg1P==v;pZG*SbA#IcSF) z&RcUa%@fzJXUz`uIOm-O6`>G6S$K~z6*YI2CntO$-!$YwN6(taO|J%HBtol$!Yxta z?BbrV-K6~HW#jBnEgYu}LrwpkkF(p-Jm>f1I$2h_K0g@&GU)CF@m-9BoW$Qhr_h1f zR3~s<{g4{gl)C!@S8mTqtX7d&;8y0Rvp##Ikkqk9qI0bpw{1_(%%~n&Z%K<5N0|k3 zYci;0z`sa8-?$PrICFy0Lgg+!(ngVff6-Wji4?czmycQVguZi_SVG@7%Cwe87!=!L zV~86+hc=mUWWWZFJ+O>#sQIi-X`>h(NLVo-rR~p@qMal>Egpj6is@PckdJM|e`95n zE^ag00k~E2OX|Mc?ww7VV!L{iKV5ZgDt(+mY5odOZJ0@sj6aSp(IgqV4{vd^My#T5 z0O<<;7QN(9_?3(8tUQ6NaAU}52NXssTZi^JB`|oOF=tN#Uo?-YTe`=XjIN{r zvk`{Bpu`VG%O6Y!kBWaxO2S}pd`gr;x?iU03{0#cy=)1JZ2)qc)~2@Bi|MFT6#Z$G zR$dVQCq@@$)qgZ|6EfoSgomh$#k@#lE!jcsFN-R1(}19aChA`;?)aQ~x0d`?zhP4k z-o*oZe>mrq5!S#5sqtl6UZP2#`9BP$Ih$d^1+r-klt{#CVVU4W+%iYjgd`Y?kTGgL zTmr^Y`c3m~dZH>edWBy__3ie^5S2^)M&$#+{Jr^kDDXl}+VV(##MWqx;KDri<1 z`wmI&8sXNKfKs1-`!9&HqL&+8)9PwjFm5~67{4W*4Lz`U*VhVZPmRgdeOOOr`VB~nP)=pC40$K) zzv4+^0B7spATPJED^L=GiiX@T2^>I|11DL<{vv{`T`e5wm?-N#z-)6)OWzVK*-Ep} zS~Pu@Rz+Rv;GKX0J;FfpBga=A6%{S2O_}}4EirIy62Lq{Sma#n60!i^?z8RMk>XoP zlGB4L9Y1o_Qj29{Sa;MqYc3S91$Gn1Mrlp(HiU!n`3~a<^)ZBd8^C!8<2XTfnyEoP zxj}Z4ug%Iy4di72|IfAqk1@Fkfyd*Y?UqVEYgw{?ZvNjp{MVh&BL4Tv@aucH=(Yds z=DRrjLVlF{??a%Q!j&T~47gw9WGrhHKxWA&qcNLq(jl9h-*#H_=Y1C}<&MZ}5#B|R z&zORwgSKdpVGNV~*&X&C#i}L#aRb$}WyQ0S$@k9ip8t1&ZIO~NWM}_RU&Jo=K#O=i*7aKSI;=aXcuD|VILZO=+L@k$QgmUty;*aJTLP5py^>8i6qGdZ0De_RJ#DIrW#`D zfnD;KrqTi+aLlb;yN}SeZqR*9LgD_>ygLV%rCL5`dnKno!kMT4Eu68@*u8QplKLka zY~h#xpJ=f1F=PwC{|N^(ycx?BaN~c0<9|Iog?{ZDzYKQtCA7q3`nj^NCP zvv<6Z5p;_m5!W5iO=>5Iz+C6}aYAOqZoW`Z=y$M8o>6%l8bYX?-Y~ zjgdz{Bl`$C+jyUp?l>J1-VTEnp#b~(hrbdBW^STlXqh6T-mGYZX~s}5j9yGOcxtM5 zWF1gLofv{^x*F#*FO)amAb9To9D*mQn$oteL<-lVZ~Oerq-Np5z^{$Cudrj*=l;~N z063fO3nh$neXr0!Ggq+k`4n$>Uc@jNp7$miPT&UC+Wl|Y3<@>ux> zb9C}DFD7iC_E)m;`J(-BqPISuul=6sel(uZ_@4$hhx6oi-?fB}(irAJ;7p^$FO6)& zY8ojF>m>6$CzapGX0BOG>noiiuVIv4R>ju&oz<{sbdt_hI)77y^GBWuh85E4829r zjc3iP#<~$yR%_y;*EKMc0f8<&UZWzwb|e1&avE+MVIt!-+M}CU;--=XkI&)juDwv24BAgW0-^iJx=6t>xjU-WgPq*3kyWeMzAKNY8H%7nT_rBkE&G&Q+W-<%E0D*ec6c<n6eHudefr(OE1z1+?v4qtj27Y`^gauZG*L7J|^#4e1mw zphNT<8cSs&p3O3s=TE0{erar;HY!bZ;0&qkURM9qTB?N3Iom5P=5vikV;>SvsG_KN zbZN3>O7+*@&IM++5X|n9_KY6iD3hV=F7oy|evJ@;5 zaw{fYBudQo;xsZ%5+wiyD)P>y>1c&V)k1rX$u>YyEXI-=%8FIU>teva5~OhJk4elL zZ~ga$%5{5{J+hPUJJSI>q060vPjj}FXd`w%#N^q;dvWxiOtN=-w8qtnN~h5~QOf4# z$cfre4=RJhMK82eq;%5H?R%CSOY%_$1(mV_3m4%;y*Q=+Rbl`KY{&FU!mgMPjYoAI z)sKdYaQHos`=7&%7X$+F(XaY6&4W}INA)Ua1)xPb8d;XBN-AdYvH$okF|)lHxL={U zID8x(pAHTf2uk!xGMU<6ZRqp+Y=$|TK5q$_>FMlJTTusjOjDp;x=G^0zRTmavatr3 zE7Rywe)ofd6WS!idM)zkSy1AneFBTV8x0?CO7NPq>T{S0e zprsBZB>mx7pllMX*u<3GWkq#-X9hr%cIZnY1ZNMib2PX)L5BqvwO>#aT>N zNGfGydKhU|m)qw{iI4V+@~3ltn02`6ah?#*;FPFyxy%#kA@PBDh!Eg`v>ILY-{#EY76IzMQ{%`XTib7X^%I#v&{h^ighjxOfU?(TnRY?7A`+q!P%rwq8*M z9@qH0D4A`5T2T$%VNhhUO=*CSp8vtkv!(alaDP8>sk%n=^r;c_pn!$Sx3oXOZUU!f z@F2mt=6=hpb;vf=qKW97AooaZjIML4M61o|1rmB`TEne)TjbR5agFl?@#4NWW9-2~W{(D0cgeo3~rp)`t~QhzH@1VeCl`3T=|g zqPG0__Z|x!Y041bzTmhR;MXXeXX$?QScc9Y=G&Ao)H?uc%IMtoGl*LBs(fJvR+b zVX6#VX*yk>0W@0lpJW16pMF)vOr=jGcb9`IpLul+UKeI%Zr1`YPSQ`a!Y*S`)9M}? zvxDjRXrqaPVBd-um1lr1gcT|J(zK(o@`?(_g4F?tv9DZg^z;s1emq9d)*5&dT|sWi zid5=(Pt}ENEh#bke}Se{%HsSbrPs&7wC!C_W?-???!j3FIZz|SRnFyO1k)DeJFi6Z z<_&#cQN!LZUo(qWSZpohGf$Clj+-(Rh!oJX7kY0PO5*49)MdSJeQIncxYt9G6+qoVNVL^E)?sN zqbe2I%kR=*FeKlFrPf=30t4nrccL_)mAiZcGk~9caik5`B(s39JX(JqqPoFa^V*!! zbWWhh?IXF7FHOr|K8~6Q@_TB5cxG@WPZT2*Jr2uIGN zD+8k8NL%`;k@H*(`PGujL2(!!BdBMFuh}^pIE05)x@tVHot`K&Q&gZayEFkB=#?w2 zlvaS_4}1!+Jw^Cx2e{lYa@Bh0u=E+B;L8ug@3aKkEdC6xdcdk#O1}F|XQbvRjG9$r zUYln#zt^4Th^1SwUPwWmoo=~+B#_hIo{5nICMpNwB0okW_LpE{_AamcenB-j0eUfv zGMlGr(2Gv4-RIzM+R>^(nOe*x68j^t0=)Y%w02u3pj#-XRq&!VF0SCx1D+tj#S4>(pR~`KtLB`{n#jWRNqVVNgW?%!@aE?Vz7?!tz-`(PAay zodJh=jeXQ)vEp>2u8@VtA;e^2C50{@W8;DwB=|0&tY&T!oLM)9l5SfC&oQFcF}sr( z;*Jn=iHnmmcZkc`NLiiCh4sC`ra>?7VzkA*Ug7*OLM(r|d*~LITzdu!K0al#W4L>C z)JR*4w>$i{^!}dC#>DvI;PRc12CS5kUG2r%8s%8L7*yIfJDhNGmo;5zh6|cOBMjr( zQEvIWb*r{=@#_8(wJkb&?1ED{ZrZU{zmby3pXsKnx1gD7#eR5DOL^?PJ%g^J9H{PQ zMGHcFR~1WILvV#a6EVG80_y9}m&Bmgz&u-B6DT9Ljc2C3W+1At`5ee)79(VK%V%;c zkg(_?wj7~Lj}wR@WR+|_s(>TEI_gH!cmz_1(vlp#3#8@3nN%rRd7uxpD8k9kcU@ z2in;iaMi$S_H7b9;?5Z3_?~H}G1{P(J+&K{oZ1u3S&nc~I4=ZHj{g`kp{901Zx}SO zgI6^Q58~N}L)i&MAEgm9)O0=`9WtllNrh+)T!hfLJ7M1#@#h*^q|(E(WQ+?A z1s{;l(pSX#J*r=4XL%mZ#muCE4V;GPzTM;dxOhmqg&UaU@6psJp;p3R&vEAuNjZ59 zal0926A13R#&$pcmh*t-1cV2ak|f^xK!*c;i6IkS-FJx~UKedv%FBIQKXy*4k2rpfhvARNi& zS*q{sM#F@PnA&@FE`WICmhPCl-Y+)0yC+a+>_QZ}7b>~- zrzwV|4ah`ENZRQvNZyfI)`$=%pKx{&xzt7!YFV!Nt{n!Xo3-pDgG%5qa34&4q z&spvdvYEE_9b}$t0V-^Bc!K84+C$q08`d4qpvljM60h@ks zHT!XM@!hKpgqsBO+oWp|u~5;igxgRNz7`M>dMAh8Brih|Cui-%jVZ(pwdF`r&x&IC z!i!vno%bBN#C+@~42gsyvuk5l7y?hhSWHKcr{?HBcZ7>wDlogh^w_HFUvBd+?Wr5o?_s<`F zoAhZ;z$q^jA#4Vs{f7I@GJxk8t$i#GB>~RhRDjwHpje4w1erC7rMhT5@@i<0V@pS-$4ZFHB^iIP6JrT6HBh^>1LdJ zidxxKDsf#CD=u-{5(?thXo6>>R5UDETypnmgC-C)2&7w)Rgn#n`4lsFKH&UQr;6?~ z0L8#O4AxZ1hd2qwS=Xz^Qz}}c1~qFw)KDLBBNAtB@@N*unjue2sx>(`$G1o7&3$z* zADxTz(2dY2wR>Mx~(J8N&#KQqnHCDKmx!GWqv1p(FG0BdOV zPw2B{jyQgCtpVm+#3o?j59`7@sEFc_E|GcZY6V`JqByI0um4uN<~_%& z6_9JzZcg){^3{eN5HydQcDe|@t3pSqfZ8Z zjj=NrR@cgW;*O-79gY^eWs;;bs3m9tl<%gbldOHP;eJ%V@l`o@NM`NERvE;^od1A63o=kFg4kPgj3s|i&d4*T;)A?~tbo#+7vXeJ6K=S6Ts zc?xwDL_MC5Iv%YGQ9lvgTx;epapZ^wVxy~;SLKD9w4bpHnjL?lD^>gwQ`5)%jl;Yy z`0^~P30B3+?hkdQl0hm#HsKDJ8PuVRr&GI*Schbk(vRHIenI!4ugOckR^!f>-jgqs z{#n;g5l$LVtGjRb-!{Gjam|+vG$uE0qo$t5s6I| zIX8*39pt9+5+SbL=>@0o{%ysqMu>?dbhP^IMSev=%!mEUkT3hdp318{;7176)eVi;QPssi0=7AYv@s)1z2OSz z%2kD?gU2VvitcD&V2>~dA9hDhKy1iv9&TfJe8%;5qo>GSzrV@%u3+7~+{#)b-EH+8 z`<#~bJ$uEd#ZDb%RQi@j7*2A*kFYx-T zN!NGMI7Mc_$=T7)=W|Ri)BB54?66+hbk&RAabS^cyQaMhU2VJq#fw{rjGBrB7M>>I zvfzzevSQ_LMzIsw)qPxMFVQVeA@G<<0-GVsV7PwfKM(;gmadS7$h z(TY&#%o0MF{qnc_b)|@N`A#LqZ(abW4Rv63j}0mn06<1r5hPH=Ab!<3`D;#Be-@Rq z?mnos7@d?o=&~gc&81Cc_&J67K{2bJ=P&f&{7@APNUn^l37uK6NsiqYqcLU5VG#Ywr=f z%`3G7yxnN_qxgNH-dlZvaDQOPLVtK|uO7NEENLm&=?L^51tLI82-hi`)!8}wPP^W5 zey!rYh~LubdRlz;V@qj`WctT#qR5z5aCHGt5A2oIo+|4;ETcVC(RUWD`pVrIeb=QX{dw6?jK;YpW!h8_we>u)hBk*OB=L^t|??<6)^yl zCli;e4{ba@l1NmGlAuTju1T@AzbH;--;|}-X>11sW2;k_kPW+*A2+~>qbk*?4OuUo z?*s+1h-|!trgY%1Nc@`%bvB1EwrevQHk*8W&%&My2h2xn{YNE`mYQz~9+4CaEI`07 zu5={NA?PI&X4%S+7ak6{3AY5_Bdf&}$qcoTm||Ee34>J%+>K9z)RIYj2@yQ<=FtS8 zj>rpo9P~7K&y9ja9@=pN2ljg0^DfQ0ES??nw9<9&2 zdj(O8W|p*BUWidMG+xeQRE+68`cQ%G{5qN#8^JJGWqbyq{M-zv-h~M4SKF;xyf_X0 zoR_O-v6CqX_AVaQs?cu8KSBIzl7EBvOmSFR)>wCZ{QB;M^4<#0ci~8&h=&U?5QPIv z-m<{ISB?ZP!30Q94aN`si(2K4r8r65)1<8pg?4R;JOB2DaH@{LJm-Qxt=Z^JV~D*~U*6PO1R3E#YC5@wR6~D1sNNb5jSU=G)a)by6eO>XWjWO}`2jPPd`p#^(p06t+vMIv9hTqS2L*n+1q8gSCLR&pN&E7H{x9r2FXsj4@luvu;5jXX{V?*&=%e7i|@s+8z zY)x}!byu|aUwyQ1B@e#4LutP6dKjPp08T*)_AaH%U2!5L+x zEbf*+J6HNhbov@(z)9R@&IwlqB2>(+t#5M63Bj3r|1;C?v&}(E1EZ7gyr$Q)9+k^# zG~4WMa_Q9)cYW0TI#SGvtBoV03$>4gWH%MW9bl#z$>jT~=4LMgNn8PMy}w#{h$swf zCQ7WJV>U}WNR@*C36SPgf{fAo?Xo&NIaf|I*RhTnMPe9SjF1G#YeSSibuN{pf!nVy zaP0yGX8xzK7f2S=&Y-(TvW;EjlRI&gPtU3BMTZrFsJ+`UT_M^Ir(6bZ>YJY4z#0`c zq8n2!LZ>$5ys8`_-~Oq^GwnsMqE>M@vp6b^@^!JJE#!M}tQsnx7O60zU?0({OCO$8 zWLArM-b;sr3hL;Du8G%X;f+hcTcR8#mLNfj3uiy56NeyBtwUS0$Pg%iKm5VZBn2rU znbmg>JxL~TxtuegS~kj}Og+0qsZwS8WA$q)_OiO_X;HmgGz4)eF$D+B0c)Y2yBg~b z&#rcn{00i=gN@PsEa_8$EbW_x^^Ovh7h>Y&4Rw?kf=11=D9Ff{4lS#EqR40)@(^tW>_JBX1-jYV21G=s( zum*-dmrQ}o!0;&hraW^|NsF2q#J@E%Hl?^YiBWY<#br787oR9OWfSMZA7w{XCUZ)ti1%_9ocZxTS?t z;#y7UW{GEmVTTkD%9Ks)z^}JXP?D-L=*_fpu}!7f6#55$(N${d`sE|jq426rO$l`| zPsR|0-!wHR%5!;N<WUvRI)ZREPE0gS}KmX~-7$#Y}eK5}Y& z2#KdwOQQ)doREk%h+2McJzsc*k^tC*dOD4BdgW!dN@5}c6Z-nTrW5@B15{CEl~}Jm zXa4w4w|aiCfJD46@7H~P4>zd(Vqv)qTnH4AK$Pe>1ddYZ;C}kQ2k}Lb!!hu~D9p8n zcYiJ&Y<3GhAt51ye%pB69{2ck+ufd@pA~F1TirY#G5u;GKP$fA?N@BnDhQ8&>c81H zTB{9@vmrhnm;2lTjj(7ivL``b;uKE2m^Z-92CxGP2msLUK*7<;)F;jDIe1@fUJ$)P z?U}iyocFH#W?xQT`cH2bPwa0t`?mey!JuA2kr;^IB86%($c!W-x|S26XfYz$*^`KC z5UxU%{0CdKF^AEP3`@kqx{p1&=uKP&Lr3An<z9hN9T_1Qd;yn8w`MC7aUsjOy#XdW8 zl`s6`!pVwZc*;f2P*>7GAF#kqtvN4?;oh6z@_$t7)p@H#LbR*zAJjX8iuro5wV?4+4tS7lAa1a+`{0cez23nwQic ziij4sStNZC9i}HbV%=BF#JW_*+4w)<6p*NM92KDqm~QaOBqQCw^UJAq6-0fREcOV| z<7~ZqL-^znPJJsdge?}`%re6Py)MIHoT?U@6t%v`giDOL95|rf1jbzXWYeTRc$^qL z!LPR;Slngl+HtcF0=^9ggrx3(b7n}~A`cAEzb8Ss51O%=E4-b7S$MS5AKCDo&=>*+ zeUXdrz|?(oF1KEi_akh+xjnwGnC{X3 zaPWONeQ@-4_O?7QG*SHsn~hwQNP~dxlUQhANGzEgAj#2w*AoGCro-SSZRrtAZbVU* zg+l~g)3j7=HFhj5ITYaw;n2zNE=vVpj6gA=cEIz~d|e|6Y+jI+IN=Z7mpi4nvEKN^ z8DyFNdV>z7P+uP#ljUR~S%-9aQ0!T68rUhfmAM+Gf!#y!$!9?1=95ff(3G`N@}cON z?Y|;G#F;>p;|o?G8O*a#q#$<~8PyDuoZ1cG2@w2df<#NZFOagz#Wz%3#CQ}$t@puu zBJVSUbvfq4&yPil9xw;&Un1v&t(f++)9v>8^!fUDzT14Z+kQIk2?5}kZt(ye8SV6T=PA{}WX#Nu&I+^K{5>)gikOk|GXsu|=zPXuKPPL1qZ$ z`sG#~l!sf}p}LZgQLE2z+uN~xCWoUtG*8(L&Lu=lT|yXNKIM;PbQhI~pR%*ffJ(6` z-_4Nc%JpEWr+1_-mBH5==_5Clo9@n$%-P{3`H?npDnt^P$)KGMdkS1 ze*;W;t#+L#vZ*jy?s&M_VZOOA{gGE`EHmai9D&5nP;j{}!DvOCW(d~NY8)+PO1c8h z*qR=asn*%CfLGz)p^Rny>!9yq7AN2}zZM{f_J+RC=EL(v~lFm*D)uSey) zacV{uj=74#C>2$~5FC$L(7tv*l>at7+~eTr@4~e&|9wcu*vTZ8*_ zEHrbGTFWe4pW~x!TFsJ*X{1t?In9XK&&}k)Jd#wy3g7m$mrtS;u?{; z{uPYL(!fMNEmn3_fk=mqDY^9MG>oTtBu4QU=^e$b$Dn7+-TTL1ziOR9s#xQ#ViE7Z z)Yeu*sRr9sS`#WtXO||H%f9Rx8f_dl>WS?Dh0yjU*RR}Yyj{dBWWf3;LzrB$PjyYl zB!cpW%Mv}3COHpjRW2B3me4gJLPZS}t5)S1nGY_N6Kqa|`PTQF9lk%GZ9^tq4bK8d zH9eJ0$FK5oL=H6In;o!A?WQW2bru*6n|43~Bb~F~lrk3_BC^VNc~1AT#p@nYX~egR zPI81?@q&l$Rz!JQf`~%&-<)lPbic4ue`94gn#Xo!Z!I zgT~{_I6IVgXuAHq@}5fST=8x?BeFr^>CPl>{9|mt*ffcPX+dc`Rtw&hU19|fx2(y9 zJVIo*lb%i9ha4Sni66W*>r%L2kA9O!gQCY|dMd+Zmfj7NiKy?oE6vYD;n*)NY)>jv z$|$-lbfU!mOx0uZ)WIm?zAuizJdpRB*Jx^vS>;`*j9=9~Di&GntjKZ^LYTy$+U~E+ zj^G4$wEqp%TFS>)bs-HJzITOO#gS7rfUknT#0-H$gcXrodS4XLDl<`5!6EeXPp*gZ z$?%ovi*i6YUdnT_zC=EPg{$Wwub^d5H-o|~?{a0`}7 zr+x91`4H1yy)LRL%i(p%)?nPF}V;Cu5r1g~t91@8??*X5eEQuGl1xTq`vt2&+9S74#r$dIIQ+ zMtV{ZmgcC~v8`J17a0~$h$*`{z@l6@cfZ-hpA?%)2uY6+G%;(XQ5+&B4@B3 z)1+lta^;fo!lHuNxvQeMD)-pyP_F*Dt zk5}O&NIrY+Z1tY@qWG^k$QG?IL3`41Vr+a8Nr_Gb{7DgA=;T9uh zDz#V!$|SvJ777*B`< z5HeVCOa&O@c|vl*AKBsBO@4DBGMnnsJN<|G7RV%`(o`JzV*L)f{Dh4dVhhb+#u87d zI(8CgTk`&z4Eb^wT(we`)-q@Fm5XJ@`HUqFQM0+;>RIU7#>!lgLy?h@lbu5P&)+TDFMJl`U~AQK3+G~fZyxaVaE0Q3mrV5AJ5VY-RKK7xPO^^vKRgDF@g|8 ze3Kzt&52)ZWaiR$BKR!DF<43(k81dW!87^(a7F@c;K0(RugD-m3jRFmRV+$1(JFV_ zhEeqgG|4bu{%yI|w}>IFl9bAi8sU?aTd>#cb26c$pufMME|qp8Cah0^4;}y=-vBs# z{4;s^W${ys;ic!ni!G2-kLrY@_qK3e9sJe1VcUjPqMzFgY0lA@^8x=CQ|}xYXA`xJ z$F|j=vCVF5G`1VFVPo4iHclGbZp@9*CXH>o`|b0--w*#R?zv}ncFsLBXU@6Kb@Ex+ zs3Qskm7?)(os}C+-sJh`olZ~dCxqs_Ue1OvA9f;NuO&fr?{lFfV;kd3kxZwO_zy)f zud31}T$;%xk)3;|daXP{HSNrRVEcM1{u_}CN%qDjNJdu8JEcL|wyNGVX954RUpyb= zRsM*t&T{?&r6OeN0g$OzW=?@oi5a;RDS0|X5LU*4@ZP@!g>o$N0|U1G2?g5Ch@Io;tEDJO5r2ImMSU)b_eh2Eh814M z+mETXHe?>r^_*z8j}ANCP7c1gzJ93YA9+rUbb5PE#DocS6#YjXN<+#jkHPXOP_0g6 zXvcZm>H@@`>P_`{)&GWH`)O$g>ZBTkD64bQbdqMcfZ;~c@fjTo$tBQh|5|i7E$lZBLhzp6PV$a}Y>3`)$ud%ee&En!7Thy9&Gm#iFHO#S(qO+Lf>(8Hh%v@u*C>Xvzk z9f1C)fxa;P#VeL5uV{LTSD2Nz)!ESF{EQw?z0GEQQx!j8jr@o-@5G&*H}F7}9*p~` zh)vzD1YHHjejj{g((kVW00)9^8#2KZFyxuPzV9^GN7$KmYrB6xV8ahwE<@389H=O(=zMD$x+U)j|Mo}jc>>dP3?akNGR1-S!HgPW zDkvf}@i=Cgfs|W>n&)5j{zo+q0Z(U0P9p?S)2i^`5SRV)Z?Na0zZBq$oOOxfe zVd_Xi%45`(gB(&f$j?1$sEp(h2iBq7 z#%S^OIdecDJv5US{R3t~vcRir&iJ1Jbn7ie2^EeTo*Mz84L9sI$;;Jpccv5S?bgoD zpVi*?C#>u1N6``~k}~RZiG&8bP}7@ARtF$qSYr|n3q$H{jx2Gp-KQ@d{}G} zF{c%DY_ml1)Mc5Ze85Sl@lW3ujhC(^ii}yu{Pb>0zk~VPKZH7A8MV9;5B46hj9UTs!$r<{c}Cx$$6;aq-7)!>ezxx3RNNMr^3 z0yGK>1$cY%byh|usc8Vzqp@L+tU@2&xiPU}-4n|8fv}ET?+96B%1GgvH5@#v=55O7 zr=C&KnD=N_vhFT?u(b^Cs*9QIz&ANasRSmkY8dwQUf%BwGXFw_!iGE^MC(oZ*iHg5 ze8E?U!R!a%{6so4bhp-&Q6{Q^ZQT-(3#!Tj=`eZOcq4wO?!;dWqEur1F(JpOV&})V z*;%~W-;yg{Ejak9{@Ba?Y+RL63 z*?nKY;-+V};6cxAg2*dqSr{dkpyAIFU?ke*UO^ws1rWlRJ|e>*l1(;qAzX0Hs4{i> z*T;FhRFdkwxg0NwY|V{dDcN}xLZY>JS3Sr{OcYgki3!QC-n+p-s!W8c5SuQ7(uFGcjDduYkglR7<|j56hf*{Dl~Dte z-Hq^~NL5Sje!QSaZGiyJ&qr3^Q7b@<>QBTEHzJgShA*VBKQB6OVTs@bdpre@(AbEi zk+>)sI##OVQ$CQ;nhw5F%WUIJmn&9a z*^34Be{eU}!YHI*pr8=lLM&tmxqjlrz;EkW>g_D7{}lP6{Fs+gs*tD*#6!;fv8c+E z))?TMcDi&+23^p5Nu}Pu*91OdEf7%I6D|j zn(7{-xx%j+vO=B6>%-<|w<;ABZ0HztT~9Ci2}yk#i~f7rNsdLID2At~XHi=pm1Quc zxo}ToJng&Ej{Es$5KCz1np>+v)m(x{L&wsxYA{#eEa#s^o~Qkv6u;)ae|B(WE}i}qUn{aq8yl?3HiqyY zbO@Y`x|P9N>j)oJv84gkXC59P7cwVnb0CGK^`2HGpgP8BF6NxctrCJSA2)|$uUA=b z$GE7L?h!Y4xyMCwX&9fKfs6=jW0mt>Rb!dbYxg9dn!!rt-9x5!law$9 zQ#UviRDmxtXlx{5?Nd9vq}oz~uW9{%ZnK;w0Efxna@KtuG(GO1Wg_29vC*o^`2b;p zt?Z5)m)}@*!HM%^@KiwTN!6ntH8)@pKhNi;ZSYN3 zBKTSC8YZqN$(jd$&kz&JnO_#pa7^HuGdmc`hktUElVj3|T-MGB&MzSZY8u9;wil8u zhjlIZV+51vk?&>Betn6LXbZAI}B;^B2jFZV*PbSYeWmvDYF9nFL*i zJ~Pk|WpZvCUO=0f>iOXr=Q-BcFe71x8F)B%L(eWXT1xsZ?8GND)hz=NpQ%obUrWO?~{w}T93_a@`Gq1cbufVnNs z*ZRTZ3}495^J7?>D!@`SLStB0wRHmY5Zw6${yDqJi6%;b6}R*o@4&nF$NP&X z4EOD-W0No7!-uog$dPA?dgI>9y+C249w-V`EEvb|JavSGuW0`UlLPi>oj7)25GKXG ziIAWp*on_=nPL>aUn9&_e*7Y^=FudG*a{pD8NfO_dhhpKKH2#g97K!t_N%RPF+5Yj zxTp6Wm~QiT<{$e@Hcf>{hKm_&ABJ?znQ2axO7v1PXnMU1FF+llCaO)BXNX$Qh;PV2 zG?DS|drnr{pr%DCn`xJIYR=C~4idO1OD-rT+fO*xZ|>naeByleLe!wB64QxWkusK4(h34L}a7H#j|%`hmR-g)9y2cm6XJSoUooh zaB(=EpUr=ls)``hl@WDX6Q#tFt;6!JA%rs9MW*qIFcMVGK9qGX zSi?W`=_BF>+>7nMvrfff>eNE;Uj`D>2Upw`b-0P%RjxNZbp&27yPvkH4<(4jzIt{N zyW>h@=qLA;t|RE0Ob%4xre^ zLajrxM+l#!7=)IU7)NNtA6d%c)i%uU3YkJMrLaWMqg$q*I}b%8{*vrO%-y(rjXYQM z=qV^cYc_NSbrC;cxxlwbGY!2pa`8e-46I|hwkMTG-ni;QNj!f|-UA|!r=p2ymJ@TsQ(xyf2~*oQvi ziNtwS6k-?+P*jEt)r&kC=o+Y_nLC%8gvR(=d+gO z+;lKAM0nbEvuTi24tM72Q7MASOE@et)U5qmJCsoRD&?!@&Ds-#Kiiv(0Pv~!KCOXr z4ynRoEu{sv5h6rHuH_$O!6h_I-x}634Yg`Hs%bMz;1T4f=vUIFF5p=E=aCK}i9SLo z1raF?EH=&J+GW03ROj;cmFoU>o{1o%SQ?#JdfpBl%*JtE(1%<8A<0`6%Uq2Y%=MFD z>fhu={Yt8Zm9~;NzQiA3^K|v+DOTXQIwN8X)hSINx(Cd0>jqjU_TkFj%!8b32uuNt z@>4u2GS}Iz#Y4KWu&&H@+I1FHuP`HKW(*1am_no_e*|u6Tu#$#w0_Cg*afZMm*q{Z zR!U!~Fw_Oj6b=rlUP6gVloT;xHe;cSUfpAOq}^eH0W%&JyrbM`=S!PHf9FGje$W3T za0}>#v;Ia@y$OvZpooA)7?+~gpvngL78O;md@+9OW37ocey@iXCCGS_V--WY`zXOXXhniD>hxC)65 z+M@%>>L;Nx^v(y^SY=N}v3MjlKi}fapq%?)Cgn5NfIZ?xdn3Q$QC@?G*SeF(l%bi< zR3+V^hfE7^@{*x&(`8@7@o{UsqA#iUk(;L*v#^@6C?aw%|JH1M@2Enb+TJs%~6 zb#h3=gEto3)9nzGsBQ3Pg|!4&@5#yJln_J6862CaB-LjcC!H;&X(*>RWj3FYTx=Q*e*HNS;CP28QUbeytk^tQcN1CH}TufQJX#z6yMFer0Sz``dUCVeuto787l&}7LJI7fG? z-Mg8cnxFb~m#-g&%?>m#-40Abplyf|fjU4llgrYY@liRw)$ryB`-^^!g=;s9TJl{9 z&U%LLqUvYTWC+64!HeGKa%ORgjaf#*-#YWVjv!7c`~D(Aru z)L;2=xTT*B$rZS)1%PN7P~sGvg)D-nd9=yLk&oGq*)jybY<~Xv*-ughViK)%JcuRS zrp}+SK&@0@7;0|*r4R{AS>`$HEoLprN>xDzBy>$&{loX%&n{XJIzTy0^MzIM06e0V z;j`y#&!kDcP9}Q+q`Hys1X3|~DvG1Q-+#BLUe#uqp4pKBet8<~H}mFu@b6^hz*{hY z!@@?R7Ew5Tpe&NQAe_X;bW1v14$8@hZi{|hB30v?I?cbuYmIz|Jv*$1-RnuRc#(fl z`j#e4aSGH=z!;nb(^`uVa>RKoL~;zgpvd+6qZwOUwkD zC0%*cy5D*nMyAsUU(#~*UN^rqyFeE*YIuF{@i<9(iB3~C!a8V4^C_P> z(`A2&!x~x&#Qb}!nYEI$64$prULj>fD*%4pGrivXg<~Q5BF9F;LH8GcZSw>AfG9%v zq99OuMmCzEtY>w(5=&v@O(QBk zR45JB!={ORGV&0LHdD_(*ZRtziL?sw3Nbpdj{s4@Q-b96+MZezx$Y0%A%Mt^|4Ty& zL(3w9;)TtI_s8XR1HQsK2P1wDVp8(cbwYonaTfUIkJHdrKq}Z5oE!c`EWSG+LZ5tZD_U01V?+-5a&bx0ThYo-@Ml`1~EdO4E1!fmN4RG{P zzG%$J4c<58d8Wu|8fowL4RAwzQ2H5XMaZR^+IczCOG=CFuIzJYZi57=4;y^A_hCN# zQMSCqrsdB=aUDmPiX7|fYCQ}tc4UZyWkSPu%hOD*OgqVH>OXOLgM1Rz_$PgBFcdjn zAZ$T-Tq!SQg=n)$IQ=>t%sXkqI~G%wGkz?XYKD}b2kLpEBwMDQ$Qx2YFjYr*p5|&H zd;9KwEGRvN$|v$cOQBsX?rug$0KYy&n@L=SgEg%7L{QTpfnb2x)Ta~W))PZI6%hi6Mn z+%niCi=Ds*hf}xJgWt2~1=O1!dG0(-htC*-B!H4NfW&N(Yf4c))LG?cq&UW-s!zY2 zc6yuagN=x!E48L%VI~M@BVva)BPv+8{$!p-M-F@s%c{~N(4yh7F51Rmd;S|>#t79d zqV*bJK>6XN;;PVQ@ma8})N@bwl%dy2Ma&adp`G57z>>9dJ)loI?iR zT-|lX%9jN@o0KHliLxl8GHnbh?a0fNKWoOeIC^L!G8UwTy-KId?a4SsdP(+T#RKdu zrk1c(pDTEXU^@}U&AX7x&CwOQ^}7r6CAb+cFY=ueqz=9t+5~kG zl<@k7BOC{bxT7r5N4JL*t`rsRlO8Jt*Epy21{F|*9k#{I^@ZIQ3`@el$ou9D;VAuk z?OqE~N{g~UBRde*5we#qf)WkEeRLy+;h2f_pz&jPV%keSbnd=kt#7`pA)VDTjZB2A{r`?w~x= z@MoFVO;56nNTcro1e0M}{LaL@Wy$!{=sBy}ZqZDorV^yx+6k8$yI25Xt7rT7GWIfG zv6#o9D?J$H%JP#MJr<9K^x`}b7Y}}{fE`pPLQ0}P^;jAcA_Amh%d2or4(aMhAGq9x zxfb+$c--_wk}a7>ikq2G>Aw30jM09(jr*0nw))HV^B+c0QGq{f$t(9RAId33rg(_K z31~~sXh24k$z95YLwm8Q74*BM zJWLv;a)XS(_@XR+EaWrBtd12C;S~GxfjN?!u| z9ULX&6>J*W!KiNsW7TMem(5-dG0-Z+qb;OqeYb@*luLo97Va5V9sIHZWR!;r!toy) z$2c^d-vhQO#bG@vv#KdaPhWGJh=t`B8@S=&&8XLy#2TI@=WNDNL!jzwO1+sfi3^Fgx&nb?wZqUB+z2%LJX zglvQ9j0o<6NsL)OWL1@$Vqe~WLjKM4m+pkiGel#IH(H$SzpFao7rjmAKYd>t;8H0t zFsu1fweXZK1?mUc7;PlagjJaAP{`{lwyWN^Tip#qRBowrwP3R(#D3Q7W&vPfx~4+i zCP&nQsAQGt&0;^spPIEfqT$8j%cs8ki8~u3K3tqA4i<`Wd!kpfntrADHCm9I^3Y6K z+?@e7=J2wpZJ1qCNiTu2;Qm1sY<-DEzf+O&lR^bIZ_Jc2C5H4-k%sAW$+ce)p+XH| zOs{RD{YP^RJwXxN1uP8mCL+}%(Iz4wOuPY8Vt-Fy0}3_+175 z=nfhfqF$l752xpJkn6w@?pK=Mi><26AJ&x@o65oe^;x6T^oLY2PqD;rSA5|!uXof! zv@ixpz_!O~B%05&dHfyAO6FZ6yK+vFGqOmf+3$0E2lqG11S_;xx%qin=q7Qklpth6 z`uB-rhrFj<2iFw0v(wgutXIRD-e1!@0tFb-KgH~sRKv)$_{u*Kst#|+?E7pCyNfL2 zGalQ}GYawOSn&JqZYzm@3ff)@V{AzFTAAaj&u!GP^A!C&K5xuP7Si^M(SCD}{D-%5 z`|=60N9Eyaa-Y?ubJ@6`t&^8o%CzRiy*1rA(y^R`G-1~5c&5GeNu#lPAKGR| z1?a??ZC|ynQ1Dp3AlHx8foSMJ=5&RZZgW@m&KZcX0O`NKQ0EX8oD3&A;9kt+mGU*m z36^Adn1xV`OBgNXF!%-VqoDCEm;>BLg{@I?;xPV0yS!x0+am^BA)g?g7J)v?N9t3 zfE4)4&XgvEzMuGuA~!x>kN6o+Ej&sUEAd8Qc;8=!o)?l^VfeMM5Fg!|HVIJnd;Y-`HzIAAw8F(AFrwB2WTCd!@vqD?&X)$(<`qxq3;ysVw{^n59

^%4NV7%x1wKb3EmK_up?x4GBemn;GOuzr?+3UtVSvjb#B9io0glAWIK?8_Chvs zloB-YN>NDaN+?a7Rcd(hY*7AE%BUuVY0aLak%TJ$;c&#cJj52q^=^^UIdc9e_%ZoH9o8oZ~q)mpm*Yob5G39k0pM=N5s|fp1ZRliYHD-HT;WT>ReE2cb*N|(GDmeB;pV? zgw5=;bJX-Y^Oum@f1$+v{Ht=#k4mnlsjM-AFcbxu;M_aql!`)yGSpC9yn&GzIcUYg zzJ}Q}_$_gkM0(wWWWQf-dXu5`RrQ4R#isi>mf~h$u`8&2luz1Jq!#bqXkuRng<$H6 z3*`@66T%d)P28lo@HCL|q2miO=6Y~4Om9~h|0)4PG@?SYiv9<*7TN{xf-I6<(?G7Z zZmw1Cp&{^4#kZvOrR5##EsDy-Khh6^l8Li~2_jr1}esN|92$;$9k=$H2wl$>8@ z@-`xQqvF80oR-9}h*{1=-PzFJF5Gn+u?5-mKSDbU1W~#iN5gwN> z`(yQ;w?3uRTR&i z+?DYBs)lo`tj|?+A26g^c)?f29TBDO{=Wid1_tnm#<_T~$Sz~b?nIT|yBilFH@p@c z7Jj}DA@24N{FW~doGqFwdw>o#NK?H*P3n(GiX%KcGLC23rp@Zd55#?kw$^Sz^>6!B z0-$23|ICXzu5me)D)FVH>Z;z|c{%(3T0mL)G(Tp|bH(YD4+&Y+q^V+Aa z!9_hz$_@3%(*|2g%^+%88dy1kph^Q;_bN$$$=%$z2E!~ks6>EANd!8h7p_T3$<2Bh zi2;-TD^23254kj-yujxGDJ|Uq@n9B_Fl;_^H=S^+basNt)v0|X6}IA^QQ59_cRWt7 zgdqAI^2%bLPd$WaIZ+|Y3vpMuiZpaVRHiP4o9+7p)9leII9-LN-jC&Lz9@A?g;Y~7 z2lNa*-i$rQeDLiFb0v!=Q)S8jIh0H%ZIIlXGHD23Q-5obC@%5hk!kdYL@EBrmQA%1Ckk$69AFY+E`q@#OIs6Uq*VpO z^kT5>HhT4kN0txh({4Yz?U!0 zL1{2Z0xU};wkw#_s5F>}_d1XfNZ`H^6_Uxs2ZpC<&JjyEW3X{c23R_aq-v_E9$Xvp zqOGc_QmtvPk|U8Mid$&v>AV6Og=oFAL)yGt$-Qr>G}OJFXKFbV#oJ9~ksqnI#%|4t zpgtuE5<;_)s(==rE5#Srob*XGR^V2?t-8FV3s5tNJz*apsow6NWJv7&NTQzQq?J_` zmp-Ue_6H`?y%yZ?n!zCtv%)_GBSr(ZFY`1)JfJL1j|2vyqMC1JJ$(M+vkXeLts51y zsjAYO)tex4Hw&ooR%kzxRb6|U^1h5` zXkMb&_|(?b^~1UKzq<@_wAC5{{zvL7s?PEMTX99L;rIVm%+8C}C8G~+CUg9%=u885 ze+X3`(khjPJed9!;e&>|p|jw$ArWw_^d;7)E|mC|m<1k%z;K~}06(AcXIrR=EmkCY ziWvJKwz(=Te#k_IYjv{wS~NR~Bg4;k^-s0=_;{M+4P@sylM+O_*0u+m1(u71g!g1c z#PBK;7xiDQn#u~ZTe7Cn@Uc7L+mqI@4CkJH`1pAGJES}QG$mt zc5w*MW-8*pr#p7QwRm=SvY2-m%0?^#iGu>Bv9)o)PsU?LbF)ccg zAGj9$ylEi-`N49{a2edYrGe}ak*);$)|ZF1A9>+%zS}*a+ zu`5EN5$mhpBY^RQYe#+=I%jyC5%|mZ;Rx)t-(nadZ|1`| z!^qXEzwfGrQX)gKffpqF0_7qCgLxxNg9y)@kJdi1*}HnvK$+u95@(S6fk~o- zQo?sC3>vk(gjMiF?7r}&eIqX zAO1g35MN9b;f9VlDU?oXVZBZ%;kR5UY-Mv3*o~n)w{P$mU43DK8Jm~XeW8tQAZH{$Y1O}5= zU!fP@KR<7ehjr%*u^U_U!|X)sDE$2!LV z=V`G&_f`xt_{}GR_~sD;pUX-`q=B~f-?*L9yJ8dpdn7N19R-3*q|4lZSfX;KKrJXi zQBNMLx>_%X1`=5MeKJrK9~$ZEDbPQCyM<5x2lQE#NufnS-%BvP0y2U}YiMznq?u!w z$_Vcf)j+g$hzw65glT9P>pqcjCq(@GSW3&_CVdcvM?Yz>I*tJQVP+q7elhCwMGVp! z6J{ng-5%I#-4O_* zfOTy{qz?00OK?pqlPL-F`!_7=f8a*li*MbZwKS2IxI(jpOdZ;Z*XTU#rRRjqL;1Q}jYU++QLOj@S zJE18Tvbjunh1Z9_o^cZcCwAcESA9M}+JhEG|CD%*R&H4azapGyTkzm#deK#%bYxf~ zD+BiKbf51Ncw9sE4P0;nX%dAyqn0Jn1=c|dfV1tMwo^Z=v$I5-^f^1=4=P!a@12cp zWAK8m2cCaYnDh5Xe`h%IfP6X|X$2oM<*3|bb18WEv7nxH0syl{Y z*>sgR6d=4;OiwsrA!gd&mOKZ=q_LE+QUzi<2337-2Gv3P6`G;aX&N_f;sf&LE#Jt7 zbwD@Iyj>|$)TK0T@PZHDn-3zReBz1!q*HJ$LY7Y#gzq3k+tr*EB=8y~?*|strb%|a*pPH2o@-E7#nuNNzrvDAp}3P4tkc4mg{X+K;C#f_d> zro4X)J{YR&wo8T4BN%M23(^v%)qQDo#$h+$YSk~De#|mFBp}O?X5jrFx!l?cnL3e zwuU25E-bKKneSb`q+qVNq;WYY_UR`R^@U(fycVFkdhgru15u#?(3>M2ytr z@(Q8Y*pg+VHGGoQaO3G zzMYN2EergIUMtF*Yg6$TMd=$^dwO4fn6vY@MQXd2D0hH4t7jZt*vsAdSF0l5&>eYO z?mn~u-Q)QSIa9B+zy}gD{)4FmUBGDu(jC&KfNpT5F?^GG|miu0aS=PEXC7m06W_GK5y< zk|TT)n!JX7nxRP;Zi%r)tkbVKYzzOL=-7jGxQ?4@>O!?in zeDOLu9T}{XBAh%2PRM5YLp?eEji&kVkEKC0@YO&eO-)jYxax{n!nz?Jm?a6_1A zwku!0R)Q?YyI${85!HJ*hKx!~2fY&Q6{g80ItN9saX~C1$kq-Q&^j%T<1V) z=Zw+A+_g+x+z2PQ1e8H2`aIe+VW z1Z_|FPfidn2o61|jn5-{?}%yS_gxKg$3a9|lSomqV%ve`2b?!OWE1ZIR*F{f)+~~V z3eig}@2F= zTNBUZ@w6_#OJfbz%9c!qaK~ds`UA(g1YWK+XPV)khUp|GaL70j2q%{nb`;Fc=>xt9 zYlbcY&OSRyckcR;$BH7nX#)@Nm@DF0%00gXqjEN(8t}Y3~pDg)5{jSt7 zh#SU?s)G{yq}LUx@2pSi|Laed!HQNMU6n&F}+$f@w81+Eezs@8Tu-iu~9KQ-3rt1 z&J&6)kP9PGCiYoVKX3*RB$#yZ7g2R@fNUB|T#1wKFl)NyD;oyPgK;4T%J!W=dV97t zlTGA1v&sRpPpF}?RogC@t9dF6dcIBBnFm6Ge1nZmL~=xqq=Z@;RNVJkHOSiL7;J6y zJi{tJ`l0MnK9Gqm&>JpZLx-^sMWl(|#EAeA^!;= z6e0kSDWNw!Wa08gFbL7ufQStx10qtiHn<8vsL?(?3*^}#c0g8cOzj$H)~)LRaj)Uz zS$vo!bg_kf(2kFxUxoWyJEuH!kHhOhO3~MG@^<+>l2MxsT?+OpXax?)Pd*b`bnc3b zsVLe|hq`}0e-aGPm(2BEiEh|BdbUOXE*K#6|JL0&x9;o-$^ZGF<@bSS&wj!WMX%Q% z`<@T!tRIkdkhQ=X@#PDovrPet&QnM0;{Rq{M|x|va5iqeJ(BvH4PDsJ+Tq&$fS>lS zARV82WgV1Xx%wPv4f*{7Yena7*scGm;x7WqmcC;x)32ysLR?zlBq7Jjuo&3jO{Y_2Qot!k70l-TchkLX*@$Tzz`{O zU5x$SQXzb|4G(E>^UX!B{|ngD*Q!ABm4id&J`wcC*OZq>pY#jzVTz_<+==V&f|-rN z`4=TN3qKx0vrqu1?MSBFb(l1cZM}gz?1Ah?p0&|*GY-fL#6u4eK`wv#U)NRuYO?9t zpACZ4y=?K{ZZpsu?+>;4zmF}tbty6@w_#|6_=OwNC`QQKUXoO~q`uMg&8k+#?~ejN ze7Uwc)|tYKIg*M%$379ZLHcI0M?-t0uRn&-Jj~0LZx5@4)yezj{G|k8y2F~V5ctIQ zJ`uS6V9Rwrr^alGR=xq_SJ&m_g9LWTG+dXYnF1L@85~~7{(*^2sAZDGqP?0h0dfPp zFkg<+3O|VvuL)vseBO2FX_iL?vOtVkDZjoVFkYW$r7!|p+cYR%L^9~@h@cX}1}rlE z)-Wu!xbPR?^9X629h_-+Hub4C0#kpe2~Jps2PieYR?RT^L9(GRTdOPCEIV5_I#!#t z7FgS#O1A2RYV=eCKxx@$OIhjs9Y@|06YVe@wM{y1$ej6;CalTiv~b?~pVlP__zu=j z;)=9AT4)8-k>i(p#j2JbM^}(1U^vpzfyxg!jFx^xa09Z2S#Lz|%-ZMe+u144AUOjo zT6~I^KKXwMyj%mjVik)iantOn!lm0ZXFAt45AO=hm)UY+&UN6?$H1%3SfKD@m(bk-@6bw3< z%tB3G+QZ#B(_is%Y59ylC1M5$oEH`!Au1m=e+G3qgN;YHC+hi~jGc@p?!ra^XQR6( zLLdwiM|}`?7#-kjSVgq9BgQ&k`^FH`rU!!iK|ieeR><`E>82Oi;6x-nsQEh^x7J;a zCz1;kJq0k$+UUYc3vl+orLtE%Ms;!CzzHLz+PIH=ZbH@0mOhG42^g~Bx|Y0vv*R3V z+W#IzLYv{{OYKoE(D~$=nj3B?GNMTdi#xeux&>cwk`NNS6>6^p|X4=|f=!HU+x4BklUiUgywyV5VQK zJJf@gD<>w=PjreyLq6ErEWxJ_A7bQ~%z0-<-))E`1-9){k8b~paGyswGcb~s)dJ|) zOg5|V&>3|E=-jbrt}%b~H}4&;U+Gp4=37_nKdxe|%1&`Nw|Szmf!be(JQK|7$(V@4ne-?39%w zGp6>yqB^AdT=+;K!pZqmU*s7YRZr{B8Tm`-=KnLI)la5xc>}|*{}IA;@BPN{3waU- z{f20vO2yI5c|yZ>vgKYGOzmvRgxvnTUkiO3cQN9PNc|hAvC$vQI$+N+HKy7Jis2BB zV6hI8Ll=Lq0j;x83hc_94ScBEyiQODc$!GQoHAt#qSAjcmb6 zApb^$!|B45IOpub^g;?Xr3f1zbLqf@8Mm^b*vJhuIT3x7*`Ab=7~+=5&b!u_OT%mG zu+z>BL7V8K+NCzxJdYuIFvs^YccSs8`_j4-kg;@B7wIt295@z*nhK8|se6p2X#2aR zr5(CYeEa_gZNNT?LP86bI2wc~#1KxPRBqq;g;2Er45$GSFq?z$0we{&|Bn?lW4nhg zcMm6z@{*IRmA8atu->&i%Z0lJLG^7ETOH2FYt~&han!m53t~AQBc%5$c3;2ER9+rU z!byG7zR!p*vN|plX-{um8Q|5U|+vo8dPy2q-JxWi z@~iQBQQ*8i{@pkAWvU7Cx8RKd^MsTJUwr?y7Su9~K?agdnq*?xEb?Q#o@$}6Xt8sG z6;BApP)2=eX-mEin+b})2;{e{m|G9HC}Z@rih+MaSr_mxC>3DeJ(@&!Sn?P@86%V% zSskz_Couj~6jws8*q0PrE4{+1qCi&Vf}+1pm2nX>V)2DX60XtEiJarN))dAJV-X95 zAnk?fp=DPs?fTooO;i+xno`#?VT&Q2dup9?l#PQjf}%68tk|(El(HrL<>6ZH(IFn9 z{=ZFMI#}x3bA0ipTHAc%ihq8bX(#D*hGo zgZ*LX>AL2Ei|?sp4Ko;mGer`SOwt8+QY?&4B~`eDhjH*8Gae~kXC{SE;tA?_wTT*a zZa?RW+^gj?x(rQ?Nx`-l;pq7_8wG-_9$d-M98brrDUlCn(itN&UzV)KD^;DPr*zBl zt7@5i1p>COvzec$eyG0I{IaPPrSmVkoBM5kN+`67huL;c;sdXv(0zI=|Fk#HY04w! zBb-jJ^QjV-nbj?l6ILTs_IJZOlu^iD7Ai@O%(_4Xnd9nkQiAj{2ln-%?=(Ce_Zgdm z4EgeyV4AOe+O>M=D4d}Nrw$W633nO!oDaJ*AH41{3j)Ng7!>_tvrh%_{wn>S0QLY0 z|FUa_+9I{^b^&mx0BJ}KYHk)haP%p2LCGn0RR6&xstB{j2!^fo7%Pj literal 0 HcmV?d00001 diff --git a/helm-templates/contour/templates/NOTES.txt b/helm-templates/contour/templates/NOTES.txt deleted file mode 100644 index f021504..0000000 --- a/helm-templates/contour/templates/NOTES.txt +++ /dev/null @@ -1,40 +0,0 @@ -CHART NAME: {{ .Chart.Name }} -CHART VERSION: {{ .Chart.Version }} -APP VERSION: {{ .Chart.AppVersion }} - -** Please be patient while the chart is being deployed ** - -{{- if eq .Values.envoy.service.type "LoadBalancer" }} -1. Get Contours's load balancer IP/hostname: - - NOTE: It may take a few minutes for this to become available. - - You can watch the status by running: - - $ kubectl get svc {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} --namespace {{ include "common.names.namespace" . }} -w - - Once 'EXTERNAL-IP' is no longer '': - - $ kubectl describe svc {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} --namespace {{ include "common.names.namespace" . }} | grep Ingress | awk '{print $3}' - -2. Configure DNS records corresponding to Kubernetes ingress resources to point to the load balancer IP/hostname found in step 1 -{{- end }} -{{- if eq .Values.envoy.service.type "NodePort" }} -{{- if (and (not (empty .Values.envoy.service.nodePorts.https)) (not (empty .Values.envoy.service.nodePorts.http))) }} -1. Contour is listening on the following ports on the host machine: - - http - {{ .Values.envoy.service.nodePorts.http }} - https - {{ .Values.envoy.service.nodePorts.https }} -{{- else }} -1. Contour has been started. You can find out the port numbers being used by Contour by running: - - $ kubectl describe svc {{ include "common.names.fullname" . }} --namespace {{ include "common.names.namespace" . }} - -{{- end }} - -2. Configure DNS records corresponding to Kubernetes ingress resources to point to the NODE_IP/NODE_HOST -{{- end }} - -{{- include "contour.validateValues" . }} -{{- include "common.warnings.rollingTag" .Values.contour.image }} -{{- include "common.warnings.rollingTag" .Values.envoy.image }} diff --git a/helm-templates/contour/templates/_helpers.tpl b/helm-templates/contour/templates/_helpers.tpl deleted file mode 100644 index 86a1077..0000000 --- a/helm-templates/contour/templates/_helpers.tpl +++ /dev/null @@ -1,122 +0,0 @@ -{{/* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} - -{{/* -Create the name of the envoy service account to use -*/}} -{{- define "envoy.envoyServiceAccountName" -}} -{{- if .Values.contour.serviceAccount.create -}} - {{ default (printf "%s-envoy" (include "common.names.fullname" .)) .Values.envoy.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.envoy.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the contour service account to use -*/}} -{{- define "contour.contourServiceAccountName" -}} -{{- if .Values.contour.serviceAccount.create -}} - {{ default (printf "%s-contour" (include "common.names.fullname" .)) .Values.contour.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.contour.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the contour-certgen service account to use -*/}} -{{- define "contour.contourCertGenServiceAccountName" -}} -{{- if .Values.contour.certgen.serviceAccount.create -}} - {{ default (printf "%s-contour-certgen" (include "common.names.fullname" .)) .Values.contour.certgen.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.contour.certgen.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Whether to enabled contour-certgen or not -*/}} -{{- define "contour.contour-certgen.enabled" -}} -{{- if and (not .Values.tlsExistingSecret) (or (not .Values.contour.tlsExistingSecret) (not .Values.envoy.tlsExistingSecret)) -}} - true -{{- else -}}{{- end -}} -{{- end -}} - -{{/* -Contour certs secret name -*/}} -{{- define "contour.contour.certs-secret.name" -}} -{{- $existingSecret := default .Values.tlsExistingSecret .Values.contour.tlsExistingSecret -}} -{{- $name := default "contourcert" $existingSecret -}} -{{- printf "%s" $name -}} -{{- end -}} - -{{/* -Envoy certs secret name -*/}} -{{- define "contour.envoy.certs-secret.name" -}} -{{- $existingSecret := default .Values.tlsExistingSecret .Values.envoy.tlsExistingSecret -}} -{{- $name := default "envoycert" $existingSecret -}} -{{- printf "%s" $name -}} -{{- end -}} - -{{/* -Create the name of the settings ConfigMap to use. -*/}} -{{- define "contour.configMapName" -}} -{{- if .Values.configInline -}} - {{ include "common.names.fullname" . }} -{{- else -}} - {{ .Values.existingConfigMap }} -{{- end -}} -{{- end -}} - -{{/* -Compile all warnings into a single message, and call fail. -*/}} -{{- define "contour.validateValues" -}} -{{- $messages := list -}} -{{- $messages := append $messages (include "contour.validateValues.envoy.kind" .) -}} -{{- $messages := without $messages "" -}} -{{- $message := join "\n" $messages -}} - -{{- if $message -}} -{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}} -{{- end -}} -{{- end -}} - -{{/* Validate values of Contour - must provide a valid Envoy kind */}} -{{- define "contour.validateValues.envoy.kind" -}} -{{- if and .Values.envoy.enabled (ne .Values.envoy.kind "deployment") (ne .Values.envoy.kind "daemonset") -}} -contour: envoy.kind - Invalid envoy.kind selected. Valid values are "daemonset" and - "deployment". Please set a valid kind (--set envoy.kind="xxxx") -{{- end -}} -{{- end -}} - -{{/* Create the name of the IngressClass to use. */}} -{{- define "contour.ingressClassName" -}} -{{- $ingressClass := .Values.contour.ingressClass }} -{{- if kindIs "string" $ingressClass -}} - {{ default "contour" $ingressClass }} -{{- else if kindIs "map" $ingressClass -}} - {{ default "contour" $ingressClass.name }} -{{- else -}} - contour -{{- end -}} -{{- end -}} - -{{/* Whether the name of the ingress class is defined or not */}} -{{- define "contour.isIngressClassNameDefined" -}} -{{- $ingressClass := .Values.contour.ingressClass -}} -{{- if kindIs "string" $ingressClass -}} - true -{{- else if and (kindIs "map" $ingressClass) ($ingressClass.name) -}} - true -{{- end -}} -{{- end -}} diff --git a/helm-templates/contour/templates/certgen/job.yaml b/helm-templates/contour/templates/certgen/job.yaml deleted file mode 100644 index 60cd524..0000000 --- a/helm-templates/contour/templates/certgen/job.yaml +++ /dev/null @@ -1,84 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if and .Values.contour.enabled (include "contour.contour-certgen.enabled" .) }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ printf "%s-contour-certgen" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ include "common.names.namespace" . | quote }} - annotations: - "helm.sh/hook": "pre-install,pre-upgrade" - "helm.sh/hook-weight": "1" - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: contour-certgen -spec: - template: - metadata: - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 8 }} - app.kubernetes.io/component: contour-certgen - spec: - {{- include "common.images.pullSecrets" ( dict "images" (list .Values.contour.image) "global" .Values.global) | nindent 6 }} - {{- if .Values.contour.nodeSelector }} - nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.contour.nodeSelector "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.contour.affinity }} - affinity: {{- include "common.tplvalues.render" (dict "value" .Values.contour.affinity "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.contour.tolerations }} - tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.contour.tolerations "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.contour.podSecurityContext.enabled }} - securityContext: {{- omit .Values.contour.podSecurityContext "enabled" | toYaml | nindent 8 }} - {{- end }} - containers: - - name: contour - image: {{ include "common.images.image" ( dict "imageRoot" .Values.contour.image "global" .Values.global) }} - imagePullPolicy: {{ .Values.contour.image.pullPolicy }} - command: - - contour - args: - - certgen - - --kube - - --incluster - - --overwrite - - --secrets-format=compact - - --namespace=$(CONTOUR_NAMESPACE) - - --certificate-lifetime={{ .Values.contour.certgen.certificateLifetime }} - env: - - name: CONTOUR_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - {{- if .Values.contour.extraEnvVars }} - {{- include "common.tplvalues.render" (dict "value" .Values.contour.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - {{- if or .Values.contour.extraEnvVarsCM .Values.contour.extraEnvVarsSecret }} - envFrom: - {{- if .Values.contour.extraEnvVarsCM }} - - configMapRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsCM "context" $ ) }} - {{- end }} - {{- if .Values.contour.extraEnvVarsSecret }} - - secretRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsSecret "context" $ ) }} - {{- end }} - {{- end }} - {{- if .Values.contour.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.contour.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - resources: {{ toYaml .Values.contour.resources | nindent 12 }} - restartPolicy: Never - serviceAccountName: {{ include "contour.contourCertGenServiceAccountName" . }} - parallelism: 1 - completions: 1 - backoffLimit: 1 -{{- end }} diff --git a/helm-templates/contour/templates/certgen/rbac.yaml b/helm-templates/contour/templates/certgen/rbac.yaml deleted file mode 100644 index 872aaf2..0000000 --- a/helm-templates/contour/templates/certgen/rbac.yaml +++ /dev/null @@ -1,48 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if and .Values.rbac.create .Values.contour.enabled (include "contour.contour-certgen.enabled" .) }} -{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }} -{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} -apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} -kind: Role -metadata: - name: {{ printf "%s-contour-certgen" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ include "common.names.namespace" . | quote }} - annotations: - "helm.sh/hook": "pre-install,pre-upgrade" - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: contour-certgen -rules: - - apiGroups: - - "" - resources: - - secrets - verbs: - - create - - update ---- -apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} -kind: RoleBinding -metadata: - name: {{ printf "%s-contour-certgen" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ include "common.names.namespace" . | quote }} - annotations: - "helm.sh/hook": "pre-install,pre-upgrade" - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: contour-certgen -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ printf "%s-contour-certgen" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} -subjects: - - kind: ServiceAccount - name: {{ include "contour.contourCertGenServiceAccountName" . }} -{{- end }} diff --git a/helm-templates/contour/templates/certgen/serviceaccount.yaml b/helm-templates/contour/templates/certgen/serviceaccount.yaml deleted file mode 100644 index aa15e4d..0000000 --- a/helm-templates/contour/templates/certgen/serviceaccount.yaml +++ /dev/null @@ -1,24 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if and .Values.contour.certgen.serviceAccount.create (include "contour.contour-certgen.enabled" .) }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "contour.contourCertGenServiceAccountName" . }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: contour-certgen - annotations: - "helm.sh/hook": "pre-install,pre-upgrade" - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - {{- if or .Values.contour.certgen.serviceAccount.annotations .Values.commonAnnotations }} - {{- $mergedAnnotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.contour.certgen.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }} - {{- include "common.tplvalues.render" ( dict "value" $mergedAnnotations "context" $ ) | nindent 4 }} - {{- end }} -automountServiceAccountToken: {{ .Values.contour.certgen.serviceAccount.automountServiceAccountToken }} -{{- end }} diff --git a/helm-templates/contour/templates/contour/configmap.yaml b/helm-templates/contour/templates/contour/configmap.yaml deleted file mode 100644 index 911b589..0000000 --- a/helm-templates/contour/templates/contour/configmap.yaml +++ /dev/null @@ -1,22 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if .Values.configInline }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "common.names.fullname" . }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: contour - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -data: - contour.yaml: |- - {{- include "common.tplvalues.render" ( dict "value" .Values.configInline "context" $) | nindent 4 }} -{{- end }} diff --git a/helm-templates/contour/templates/contour/deployment.yaml b/helm-templates/contour/templates/contour/deployment.yaml deleted file mode 100644 index 137ce67..0000000 --- a/helm-templates/contour/templates/contour/deployment.yaml +++ /dev/null @@ -1,247 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if .Values.contour.enabled }} -apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} -kind: Deployment -metadata: - name: {{ printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: contour - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.contour.podLabels .Values.commonLabels $versionLabel ) "context" . ) }} - replicas: {{ .Values.contour.replicaCount }} - {{- if .Values.contour.updateStrategy }} - strategy: {{- toYaml .Values.contour.updateStrategy | nindent 4 }} - {{- end }} - selector: - matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} - app.kubernetes.io/component: contour - template: - metadata: - {{- if or .Values.configInline .Values.contour.podAnnotations .Values.commonAnnotations }} - annotations: - {{- if .Values.contour.podAnnotations }} - {{- include "common.tplvalues.render" (dict "value" .Values.contour.podAnnotations "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.configInline }} - checksum/config: {{ include (print $.Template.BasePath "/contour/configmap.yaml") . | sha256sum }} - {{- end }} - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 8 }} - {{- end }} - {{- end }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} - app.kubernetes.io/component: contour - spec: - {{- include "common.images.pullSecrets" ( dict "images" (list .Values.contour.image) "global" .Values.global) | nindent 6 }} - {{- if .Values.contour.priorityClassName }} - priorityClassName: {{ .Values.contour.priorityClassName | quote }} - {{- end }} - {{- if .Values.contour.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.contour.hostAliases "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.contour.affinity }} - affinity: {{- include "common.tplvalues.render" (dict "value" .Values.contour.affinity "context" $) | nindent 8 }} - {{- else }} - affinity: - podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.contour.podAffinityPreset "component" "contour" "customLabels" $podLabels "context" $) | nindent 10 }} - podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.contour.podAntiAffinityPreset "component" "contour" "customLabels" $podLabels "context" $) | nindent 10 }} - nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.contour.nodeAffinityPreset.type "key" .Values.contour.nodeAffinityPreset.key "values" .Values.contour.nodeAffinityPreset.values) | nindent 10 }} - {{- end }} - {{- if .Values.contour.nodeSelector }} - nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.contour.nodeSelector "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.contour.tolerations }} - tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.contour.tolerations "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.contour.schedulerName }} - schedulerName: {{ .Values.contour.schedulerName | quote }} - {{- end }} - {{- if .Values.contour.topologySpreadConstraints }} - topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.contour.topologySpreadConstraints "context" .) | nindent 8 }} - {{- end }} - {{- if .Values.contour.terminationGracePeriodSeconds }} - terminationGracePeriodSeconds: {{ .Values.contour.terminationGracePeriodSeconds }} - {{- end }} - {{- if .Values.contour.initContainers }} - initContainers: {{- include "common.tplvalues.render" ( dict "value" .Values.contour.initContainers "context" $ ) | nindent 6 }} - {{- end }} - containers: - - name: contour - {{- if .Values.diagnosticMode.enabled }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} - {{- else if .Values.contour.command }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.contour.command "context" $) | nindent 12 }} - {{- else }} - command: - - contour - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} - {{- else if .Values.contour.args }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.contour.args "context" $) | nindent 12 }} - {{- else }} - args: - - serve - - --incluster - - --xds-address=0.0.0.0 - - --xds-port={{ .Values.contour.containerPorts.xds }} - - --http-port={{ .Values.contour.containerPorts.metrics }} - - --envoy-service-http-port={{ .Values.envoy.containerPorts.http }} - - --envoy-service-https-port={{ .Values.envoy.containerPorts.https }} - - --contour-cafile=/certs/ca.crt - - --contour-cert-file=/certs/tls.crt - - --contour-key-file=/certs/tls.key - {{- if .Values.contour.configPath }} - - --config-path=/config/contour.yaml - {{- else }} - - --contour-config-name={{ .Values.contour.contourConfigName }} - {{- end }} - {{- if .Values.contour.ingressStatusAddress }} - - --ingress-status-address={{ .Values.contour.ingressStatusAddress }} - {{- else }} - - --envoy-service-namespace={{ default .Release.Namespace .Values.contour.envoyServiceNamespace }} - - --envoy-service-name={{ default (printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-") .Values.contour.envoyServiceName }} - {{- end }} - - --leader-election-resource-name={{ default (printf "%s-%s" (include "common.names.namespace" .) (printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-")) .Values.contour.leaderElectionResourceName }} - {{- if .Values.contour.debug }} - - --debug - {{- end }} - - --log-format={{ .Values.contour.logFormat }} - - --kubernetes-debug={{ .Values.contour.kubernetesDebug }} - {{- if (include "contour.isIngressClassNameDefined" .) }} - - --ingress-class-name={{ include "contour.ingressClassName" . }} - {{- end }} - {{- if .Values.contour.rootNamespaces }} - - --root-namespaces={{ .Values.contour.rootNamespaces }} - {{- end }} - {{- if .Values.contour.extraArgs }} - {{- include "common.tplvalues.render" (dict "value" .Values.contour.extraArgs "context" $) | nindent 12 }} - {{- end }} - {{- end }} - image: {{ include "common.images.image" ( dict "imageRoot" .Values.contour.image "global" .Values.global) }} - imagePullPolicy: {{ .Values.contour.image.pullPolicy }} - ports: - - containerPort: {{ .Values.contour.containerPorts.xds }} - name: xds - protocol: TCP - - containerPort: {{ .Values.contour.containerPorts.metrics }} - name: metrics - protocol: TCP - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.contour.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.contour.lifecycleHooks "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.contour.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.contour.customLivenessProbe "context" $) | nindent 12 }} - {{- else if .Values.contour.livenessProbe.enabled }} - livenessProbe: - httpGet: - path: /healthz - port: {{ .Values.contour.containerPorts.metrics }} - initialDelaySeconds: {{ .Values.contour.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.contour.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.contour.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.contour.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.contour.livenessProbe.failureThreshold }} - {{- end }} - {{- if .Values.contour.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.contour.customReadinessProbe "context" $) | nindent 12 }} - {{- else if .Values.contour.readinessProbe.enabled }} - readinessProbe: - httpGet: - path: /healthz - port: {{ .Values.contour.containerPorts.metrics }} - initialDelaySeconds: {{ .Values.contour.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.contour.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.contour.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.contour.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.contour.readinessProbe.failureThreshold }} - {{- end }} - {{- if .Values.contour.customStartupProbe }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.contour.customStartupProbe "context" $) | nindent 12 }} - {{- else if .Values.contour.startupProbe.enabled }} - startupProbe: - httpGet: - path: /healthz - port: {{ .Values.contour.containerPorts.metrics }} - initialDelaySeconds: {{ .Values.contour.startupProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.contour.startupProbe.periodSeconds }} - timeoutSeconds: {{ .Values.contour.startupProbe.timeoutSeconds }} - successThreshold: {{ .Values.contour.startupProbe.successThreshold }} - failureThreshold: {{ .Values.contour.startupProbe.failureThreshold }} - {{- end }} - {{- end }} - resources: {{ toYaml .Values.contour.resources | nindent 12 }} - volumeMounts: - - name: contourcert - mountPath: /certs - readOnly: true - - name: contour-config - mountPath: /config - readOnly: true - {{- if .Values.contour.extraVolumeMounts }} - {{- include "common.tplvalues.render" ( dict "value" .Values.contour.extraVolumeMounts "context" $ ) | nindent 12 }} - {{- end }} - env: - - name: CONTOUR_NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" (or .Values.contour.image.debug .Values.diagnosticMode.enabled) | quote }} - {{- if .Values.contour.extraEnvVars }} - {{- include "common.tplvalues.render" (dict "value" .Values.contour.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - {{- if or .Values.contour.extraEnvVarsCM .Values.contour.extraEnvVarsSecret }} - envFrom: - {{- if .Values.contour.extraEnvVarsCM }} - - configMapRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsCM "context" $ ) }} - {{- end }} - {{- if .Values.contour.extraEnvVarsSecret }} - - secretRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsSecret "context" $ ) }} - {{- end }} - {{- end }} - {{- if .Values.contour.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.contour.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.contour.sidecars }} - {{- include "common.tplvalues.render" ( dict "value" .Values.contour.sidecars "context" $) | nindent 8 }} - {{- end }} - dnsPolicy: ClusterFirst - serviceAccountName: {{ include "contour.contourServiceAccountName" . }} - {{- if .Values.contour.podSecurityContext.enabled }} - securityContext: {{- omit .Values.contour.podSecurityContext "enabled" | toYaml | nindent 8 }} - {{- end }} - volumes: - - name: contourcert - secret: - secretName: {{ include "contour.contour.certs-secret.name" . }} - - name: contour-config - configMap: - name: {{ include "contour.configMapName" . }} - defaultMode: 0644 - items: - - key: contour.yaml - path: contour.yaml - {{- if .Values.contour.extraVolumes }} - {{- include "common.tplvalues.render" ( dict "value" .Values.contour.extraVolumes "context" $ ) | nindent 8 }} - {{- end }} -{{- end }} diff --git a/helm-templates/contour/templates/contour/ingressclass.yaml b/helm-templates/contour/templates/contour/ingressclass.yaml deleted file mode 100644 index a356f08..0000000 --- a/helm-templates/contour/templates/contour/ingressclass.yaml +++ /dev/null @@ -1,25 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{ $ingressClass := .Values.contour.ingressClass }} -{{- if kindIs "map" $ingressClass }} -{{- if $ingressClass.create }} ---- -apiVersion: networking.k8s.io/v1 -kind: IngressClass -metadata: - name: {{ include "contour.ingressClassName" . }} - annotations: -{{- if $ingressClass.default }} - ingressclass.kubernetes.io/is-default-class: "true" -{{- end }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: contour -spec: - controller: {{ printf "projectcontour.io/%s/%s-contour" (include "common.names.namespace" .) (include "common.names.fullname" .) }} -{{- end }} -{{- end }} diff --git a/helm-templates/contour/templates/contour/rbac.yaml b/helm-templates/contour/templates/contour/rbac.yaml deleted file mode 100644 index e1ac49a..0000000 --- a/helm-templates/contour/templates/contour/rbac.yaml +++ /dev/null @@ -1,234 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if and .Values.rbac.create .Values.contour.enabled }} -apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} -kind: ClusterRole -metadata: - name: {{ printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -rules: - - apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - get - - update - - apiGroups: - - "" - resources: - - endpoints - verbs: - - get - - list - - watch - - apiGroups: - - "" - resources: - - namespaces - verbs: - - get - - list - - watch - - apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch - - apiGroups: - - "" - resources: - - services - verbs: - - get - - list - - watch - - apiGroups: - - networking.k8s.io - resources: - - ingressclasses - verbs: - - get - - list - - watch - - apiGroups: - - networking.k8s.io - resources: - - ingresses - verbs: - - get - - list - - watch - - apiGroups: - - networking.k8s.io - resources: - - ingresses/status - verbs: - - create - - get - - update - - apiGroups: - - networking.x-k8s.io - - gateway.networking.k8s.io - resources: - - gatewayclasses - - gateways - - grpcroutes - - httproutes - - tcproutes - - tlsroutes - - udproutes - - referencepolicies - - referencegrants - verbs: - - get - - list - - watch - - apiGroups: - - networking.x-k8s.io - - gateway.networking.k8s.io - resources: - - gatewayclasses/status - - gateways/status - - grpcroutes/status - - httproutes/status - - tcproutes/status - - tlsroutes/status - - udproutes/status - verbs: - - update - - apiGroups: - - projectcontour.io - resources: - - contourconfigurations - verbs: - - get - - list - - watch - - apiGroups: - - projectcontour.io - resources: - - contourconfigurations/status - verbs: - - create - - get - - update - - apiGroups: - - projectcontour.io - resources: - - extensionservices - verbs: - - get - - list - - watch - - apiGroups: - - projectcontour.io - resources: - - extensionservices/status - verbs: - - create - - get - - update - - apiGroups: - - projectcontour.io - resources: - - httpproxies - - tlscertificatedelegations - verbs: - - get - - list - - watch - - apiGroups: - - projectcontour.io - resources: - - httpproxies/status - verbs: - - create - - get - - update - - apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch - {{- if .Values.rbac.rules }} - {{- include "common.tplvalues.render" ( dict "value" .Values.rbac.rules "context" $ ) | nindent 2 }} - {{- end }} ---- -apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} -kind: ClusterRoleBinding -metadata: - name: {{ printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} -subjects: - - kind: ServiceAccount - name: {{ include "contour.contourServiceAccountName" . }} - namespace: {{ include "common.names.namespace" . | quote }} ---- -apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} -kind: Role -metadata: - name: {{ printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -rules: - - apiGroups: - - "" - resources: - - events - verbs: - - create - - get - - update - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - get - - update ---- -apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} -kind: RoleBinding -metadata: - name: {{ printf "%s-contour-role" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} -subjects: - - kind: ServiceAccount - name: {{ include "contour.contourServiceAccountName" . }} - namespace: {{ include "common.names.namespace" . | quote }} -{{- end }} diff --git a/helm-templates/contour/templates/contour/service-loadbalancer.yaml b/helm-templates/contour/templates/contour/service-loadbalancer.yaml deleted file mode 100644 index ee4202c..0000000 --- a/helm-templates/contour/templates/contour/service-loadbalancer.yaml +++ /dev/null @@ -1,28 +0,0 @@ -{{- if .Values.contour.enabled }} -{{- if .Values.contour.service.tcpLB }} -apiVersion: v1 -kind: Service -metadata: - name: {{ printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}-tcp-lb - namespace: {{ include "common.names.namespace" . | quote }} - annotations: - cloud.google.com/load-balancer-type: "Internal" - labels: {{- include "common.labels.standard" . | nindent 4 }} - app.kubernetes.io/component: contour - {{- if .Values.contour.service.labels }} - {{- include "common.tplvalues.render" (dict "value" .Values.contour.service.labels "context" $) | nindent 4 }} - {{- end }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} -spec: - type: LoadBalancer - ports: - - port: {{ .Values.contour.service.ports.xds }} - name: tcp-xds - protocol: TCP - targetPort: xds - selector: {{- include "common.labels.matchLabels" . | nindent 4 }} - app.kubernetes.io/component: contour -{{- end }} -{{- end }} diff --git a/helm-templates/contour/templates/contour/service.yaml b/helm-templates/contour/templates/contour/service.yaml deleted file mode 100644 index 6fc87c6..0000000 --- a/helm-templates/contour/templates/contour/service.yaml +++ /dev/null @@ -1,80 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if .Values.contour.enabled }} -apiVersion: v1 -kind: Service -metadata: - name: {{ include "common.names.fullname" . }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: contour - {{- if or .Values.contour.service.annotations .Values.commonAnnotations }} - {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.contour.service.annotations .Values.commonAnnotations ) "context" . ) }} - annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} - {{- end }} -spec: - type: {{ .Values.contour.service.type }} - {{- if or (eq .Values.contour.service.type "LoadBalancer") (eq .Values.contour.service.type "NodePort") }} - externalTrafficPolicy: {{ .Values.contour.service.externalTrafficPolicy | quote }} - {{- end }} - {{- if and .Values.contour.service.clusterIP (eq .Values.contour.service.type "ClusterIP") }} - clusterIP: {{ .Values.contour.service.clusterIP }} - {{- end }} - {{- if and (eq .Values.contour.service.type "LoadBalancer") (not (empty .Values.contour.service.loadBalancerSourceRanges)) }} - loadBalancerSourceRanges: {{ .Values.contour.service.loadBalancerSourceRanges }} - {{- end }} - {{- if and (eq .Values.contour.service.type "LoadBalancer") (not (empty .Values.contour.service.loadBalancerIP)) }} - loadBalancerIP: {{ .Values.contour.service.loadBalancerIP }} - {{- end }} - {{- if .Values.contour.service.sessionAffinity }} - sessionAffinity: {{ .Values.contour.service.sessionAffinity }} - {{- end }} - {{- if .Values.contour.service.sessionAffinityConfig }} - sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.contour.service.sessionAffinityConfig "context" $) | nindent 4 }} - {{- end }} - {{- if and .Values.contour.service.loadBalancerClass (eq .Values.contour.service.type "LoadBalancer") }} - loadBalancerClass: {{ .Values.contour.service.loadBalancerClass }} - {{- end }} - ports: - - port: {{ .Values.contour.service.ports.xds }} - name: tcp-xds - protocol: TCP - targetPort: xds - {{- if (and (or (eq .Values.contour.service.type "NodePort") (eq .Values.contour.service.type "LoadBalancer")) (not (empty .Values.contour.service.nodePorts.xds))) }} - nodePort: {{ .Values.contour.service.nodePorts.xds }} - {{- else if eq .Values.contour.service.type "ClusterIP" }} - nodePort: null - {{- end }} - {{- if .Values.contour.service.extraPorts }} - {{- include "common.tplvalues.render" (dict "value" .Values.contour.service.extraPorts "context" $) | nindent 4 }} - {{- end }} - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.contour.podLabels .Values.commonLabels ) "context" . ) }} - selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: contour -{{- if .Values.metrics.serviceMonitor.enabled }} ---- -apiVersion: v1 -kind: Service -metadata: - name: {{ printf "%s-contour-metrics" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ include "common.names.namespace" . | quote }} - labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: contour -spec: - type: ClusterIP - clusterIP: None - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.contour.podLabels .Values.commonLabels ) "context" . ) }} - selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: contour - ports: - - name: metrics - port: {{ .Values.contour.service.ports.metrics }} - protocol: TCP - targetPort: metrics -{{- end }} -{{- end }} diff --git a/helm-templates/contour/templates/contour/serviceaccount.yaml b/helm-templates/contour/templates/contour/serviceaccount.yaml deleted file mode 100644 index b5e7200..0000000 --- a/helm-templates/contour/templates/contour/serviceaccount.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if and .Values.contour.serviceAccount.create .Values.contour.enabled }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "contour.contourServiceAccountName" . }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: contour - {{- $mergedAnnotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.contour.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }} - {{- if $mergedAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" $mergedAnnotations "context" $ ) | nindent 4 }} - {{- end }} -automountServiceAccountToken: {{ .Values.contour.serviceAccount.automountServiceAccountToken }} -{{- end }} diff --git a/helm-templates/contour/templates/contour/servicemonitor.yaml b/helm-templates/contour/templates/contour/servicemonitor.yaml deleted file mode 100644 index 1468a7d..0000000 --- a/helm-templates/contour/templates/contour/servicemonitor.yaml +++ /dev/null @@ -1,47 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if and .Values.metrics.serviceMonitor.enabled .Values.contour.enabled }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ default (include "common.names.namespace" .) .Values.metrics.serviceMonitor.namespace }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: contour - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel | quote }} - selector: - matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 6 }} - app.kubernetes.io/component: contour - {{- if .Values.metrics.serviceMonitor.selector }} - {{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }} - {{- end }} - namespaceSelector: - matchNames: - - {{ include "common.names.namespace" . | quote }} - endpoints: - - port: metrics - {{- if .Values.metrics.serviceMonitor.interval }} - interval: {{ .Values.metrics.serviceMonitor.interval }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} - scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.honorLabels }} - honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.metricRelabelings }} - metricRelabelings: {{ toYaml .Values.metrics.serviceMonitor.metricRelabelings | nindent 6 }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.relabelings }} - relabelings: {{ toYaml .Values.metrics.serviceMonitor.relabelings | nindent 6 }} - {{- end }} -{{- end }} diff --git a/helm-templates/contour/templates/crds/contourconfiguration.yaml b/helm-templates/contour/templates/crds/contourconfiguration.yaml deleted file mode 100644 index a202482..0000000 --- a/helm-templates/contour/templates/crds/contourconfiguration.yaml +++ /dev/null @@ -1,1238 +0,0 @@ -{{- if .Values.contour.manageCRDs }} -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.13.0 - name: contourconfigurations.projectcontour.io -spec: - preserveUnknownFields: false - group: projectcontour.io - names: - kind: ContourConfiguration - listKind: ContourConfigurationList - plural: contourconfigurations - shortNames: - - contourconfig - singular: contourconfiguration - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: ContourConfiguration is the schema for a Contour instance. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: ContourConfigurationSpec represents a configuration of a - Contour controller. It contains most of all the options that can be - customized, the other remaining options being command line flags. - properties: - debug: - description: Debug contains parameters to enable debug logging and - debug interfaces inside Contour. - properties: - address: - description: "Defines the Contour debug address interface. \n - Contour's default is \"127.0.0.1\"." - type: string - port: - description: "Defines the Contour debug address port. \n Contour's - default is 6060." - type: integer - type: object - enableExternalNameService: - description: "EnableExternalNameService allows processing of ExternalNameServices - \n Contour's default is false for security reasons." - type: boolean - envoy: - description: Envoy contains parameters for Envoy as well as how to - optionally configure a managed Envoy fleet. - properties: - clientCertificate: - description: ClientCertificate defines the namespace/name of the - Kubernetes secret containing the client certificate and private - key to be used when establishing TLS connection to upstream - cluster. - properties: - name: - type: string - namespace: - type: string - required: - - name - - namespace - type: object - cluster: - description: Cluster holds various configurable Envoy cluster - values that can be set in the config file. - properties: - dnsLookupFamily: - description: "DNSLookupFamily defines how external names are - looked up When configured as V4, the DNS resolver will only - perform a lookup for addresses in the IPv4 family. If V6 - is configured, the DNS resolver will only perform a lookup - for addresses in the IPv6 family. If AUTO is configured, - the DNS resolver will first perform a lookup for addresses - in the IPv6 family and fallback to a lookup for addresses - in the IPv4 family. If ALL is specified, the DNS resolver - will perform a lookup for both IPv4 and IPv6 families, and - return all resolved addresses. When this is used, Happy - Eyeballs will be enabled for upstream connections. Refer - to Happy Eyeballs Support for more information. Note: This - only applies to externalName clusters. \n See https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto.html#envoy-v3-api-enum-config-cluster-v3-cluster-dnslookupfamily - for more information. \n Values: `auto` (default), `v4`, - `v6`, `all`. \n Other values will produce an error." - type: string - maxRequestsPerConnection: - description: Defines the maximum requests for upstream connections. - If not specified, there is no limit. see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#envoy-v3-api-msg-config-core-v3-httpprotocoloptions - for more information. - format: int32 - minimum: 1 - type: integer - per-connection-buffer-limit-bytes: - description: Defines the soft limit on size of the cluster’s - new connection read and write buffers in bytes. If unspecified, - an implementation defined default is applied (1MiB). see - https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-field-config-cluster-v3-cluster-per-connection-buffer-limit-bytes - for more information. - format: int32 - minimum: 1 - type: integer - type: object - defaultHTTPVersions: - description: "DefaultHTTPVersions defines the default set of HTTPS - versions the proxy should accept. HTTP versions are strings - of the form \"HTTP/xx\". Supported versions are \"HTTP/1.1\" - and \"HTTP/2\". \n Values: `HTTP/1.1`, `HTTP/2` (default: both). - \n Other values will produce an error." - items: - description: HTTPVersionType is the name of a supported HTTP - version. - type: string - type: array - health: - description: "Health defines the endpoint Envoy uses to serve - health checks. \n Contour's default is { address: \"0.0.0.0\", - port: 8002 }." - properties: - address: - description: Defines the health address interface. - minLength: 1 - type: string - port: - description: Defines the health port. - type: integer - type: object - http: - description: "Defines the HTTP Listener for Envoy. \n Contour's - default is { address: \"0.0.0.0\", port: 8080, accessLog: \"/dev/stdout\" - }." - properties: - accessLog: - description: AccessLog defines where Envoy logs are outputted - for this listener. - type: string - address: - description: Defines an Envoy Listener Address. - minLength: 1 - type: string - port: - description: Defines an Envoy listener Port. - type: integer - type: object - https: - description: "Defines the HTTPS Listener for Envoy. \n Contour's - default is { address: \"0.0.0.0\", port: 8443, accessLog: \"/dev/stdout\" - }." - properties: - accessLog: - description: AccessLog defines where Envoy logs are outputted - for this listener. - type: string - address: - description: Defines an Envoy Listener Address. - minLength: 1 - type: string - port: - description: Defines an Envoy listener Port. - type: integer - type: object - listener: - description: Listener hold various configurable Envoy listener - values. - properties: - connectionBalancer: - description: "ConnectionBalancer. If the value is exact, the - listener will use the exact connection balancer See https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/listener.proto#envoy-api-msg-listener-connectionbalanceconfig - for more information. \n Values: (empty string): use the - default ConnectionBalancer, `exact`: use the Exact ConnectionBalancer. - \n Other values will produce an error." - type: string - disableAllowChunkedLength: - description: "DisableAllowChunkedLength disables the RFC-compliant - Envoy behavior to strip the \"Content-Length\" header if - \"Transfer-Encoding: chunked\" is also set. This is an emergency - off-switch to revert back to Envoy's default behavior in - case of failures. Please file an issue if failures are encountered. - See: https://github.com/projectcontour/contour/issues/3221 - \n Contour's default is false." - type: boolean - disableMergeSlashes: - description: "DisableMergeSlashes disables Envoy's non-standard - merge_slashes path transformation option which strips duplicate - slashes from request URL paths. \n Contour's default is - false." - type: boolean - httpMaxConcurrentStreams: - description: Defines the value for SETTINGS_MAX_CONCURRENT_STREAMS - Envoy will advertise in the SETTINGS frame in HTTP/2 connections - and the limit for concurrent streams allowed for a peer - on a single HTTP/2 connection. It is recommended to not - set this lower than 100 but this field can be used to bound - resource usage by HTTP/2 connections and mitigate attacks - like CVE-2023-44487. The default value when this is not - set is unlimited. - format: int32 - minimum: 1 - type: integer - maxRequestsPerConnection: - description: Defines the maximum requests for downstream connections. - If not specified, there is no limit. see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#envoy-v3-api-msg-config-core-v3-httpprotocoloptions - for more information. - format: int32 - minimum: 1 - type: integer - maxRequestsPerIOCycle: - description: Defines the limit on number of HTTP requests - that Envoy will process from a single connection in a single - I/O cycle. Requests over this limit are processed in subsequent - I/O cycles. Can be used as a mitigation for CVE-2023-44487 - when abusive traffic is detected. Configures the http.max_requests_per_io_cycle - Envoy runtime setting. The default value when this is not - set is no limit. - format: int32 - minimum: 1 - type: integer - per-connection-buffer-limit-bytes: - description: Defines the soft limit on size of the listener’s - new connection read and write buffers in bytes. If unspecified, - an implementation defined default is applied (1MiB). see - https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener.proto#envoy-v3-api-field-config-listener-v3-listener-per-connection-buffer-limit-bytes - for more information. - format: int32 - minimum: 1 - type: integer - serverHeaderTransformation: - description: "Defines the action to be applied to the Server - header on the response path. When configured as overwrite, - overwrites any Server header with \"envoy\". When configured - as append_if_absent, if a Server header is present, pass - it through, otherwise set it to \"envoy\". When configured - as pass_through, pass through the value of the Server header, - and do not append a header if none is present. \n Values: - `overwrite` (default), `append_if_absent`, `pass_through` - \n Other values will produce an error. Contour's default - is overwrite." - type: string - socketOptions: - description: SocketOptions defines configurable socket options - for the listeners. Single set of options are applied to - all listeners. - properties: - tos: - description: Defines the value for IPv4 TOS field (including - 6 bit DSCP field) for IP packets originating from Envoy - listeners. Single value is applied to all listeners. - If listeners are bound to IPv6-only addresses, setting - this option will cause an error. - format: int32 - maximum: 255 - minimum: 0 - type: integer - trafficClass: - description: Defines the value for IPv6 Traffic Class - field (including 6 bit DSCP field) for IP packets originating - from the Envoy listeners. Single value is applied to - all listeners. If listeners are bound to IPv4-only addresses, - setting this option will cause an error. - format: int32 - maximum: 255 - minimum: 0 - type: integer - type: object - tls: - description: TLS holds various configurable Envoy TLS listener - values. - properties: - cipherSuites: - description: "CipherSuites defines the TLS ciphers to - be supported by Envoy TLS listeners when negotiating - TLS 1.2. Ciphers are validated against the set that - Envoy supports by default. This parameter should only - be used by advanced users. Note that these will be ignored - when TLS 1.3 is in use. \n This field is optional; when - it is undefined, a Contour-managed ciphersuite list - will be used, which may be updated to keep it secure. - \n Contour's default list is: - \"[ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]\" - - \"[ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]\" - - \"ECDHE-ECDSA-AES256-GCM-SHA384\" - \"ECDHE-RSA-AES256-GCM-SHA384\" - \n Ciphers provided are validated against the following - list: - \"[ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]\" - - \"[ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]\" - - \"ECDHE-ECDSA-AES128-GCM-SHA256\" - \"ECDHE-RSA-AES128-GCM-SHA256\" - - \"ECDHE-ECDSA-AES128-SHA\" - \"ECDHE-RSA-AES128-SHA\" - - \"AES128-GCM-SHA256\" - \"AES128-SHA\" - \"ECDHE-ECDSA-AES256-GCM-SHA384\" - - \"ECDHE-RSA-AES256-GCM-SHA384\" - \"ECDHE-ECDSA-AES256-SHA\" - - \"ECDHE-RSA-AES256-SHA\" - \"AES256-GCM-SHA384\" - - \"AES256-SHA\" \n Contour recommends leaving this undefined - unless you are sure you must. \n See: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#extensions-transport-sockets-tls-v3-tlsparameters - Note: This list is a superset of what is valid for stock - Envoy builds and those using BoringSSL FIPS." - items: - type: string - type: array - maximumProtocolVersion: - description: "MaximumProtocolVersion is the maximum TLS - version this vhost should negotiate. \n Values: `1.2`, - `1.3`(default). \n Other values will produce an error." - type: string - minimumProtocolVersion: - description: "MinimumProtocolVersion is the minimum TLS - version this vhost should negotiate. \n Values: `1.2` - (default), `1.3`. \n Other values will produce an error." - type: string - type: object - useProxyProtocol: - description: "Use PROXY protocol for all listeners. \n Contour's - default is false." - type: boolean - type: object - logging: - description: Logging defines how Envoy's logs can be configured. - properties: - accessLogFormat: - description: "AccessLogFormat sets the global access log format. - \n Values: `envoy` (default), `json`. \n Other values will - produce an error." - type: string - accessLogFormatString: - description: AccessLogFormatString sets the access log format - when format is set to `envoy`. When empty, Envoy's default - format is used. - type: string - accessLogJSONFields: - description: AccessLogJSONFields sets the fields that JSON - logging will output when AccessLogFormat is json. - items: - type: string - type: array - accessLogLevel: - description: "AccessLogLevel sets the verbosity level of the - access log. \n Values: `info` (default, all requests are - logged), `error` (all non-success requests, i.e. 300+ response - code, are logged), `critical` (all 5xx requests are logged) - and `disabled`. \n Other values will produce an error." - type: string - type: object - metrics: - description: "Metrics defines the endpoint Envoy uses to serve - metrics. \n Contour's default is { address: \"0.0.0.0\", port: - 8002 }." - properties: - address: - description: Defines the metrics address interface. - maxLength: 253 - minLength: 1 - type: string - port: - description: Defines the metrics port. - type: integer - tls: - description: TLS holds TLS file config details. Metrics and - health endpoints cannot have same port number when metrics - is served over HTTPS. - properties: - caFile: - description: CA filename. - type: string - certFile: - description: Client certificate filename. - type: string - keyFile: - description: Client key filename. - type: string - type: object - type: object - network: - description: Network holds various configurable Envoy network - values. - properties: - adminPort: - description: "Configure the port used to access the Envoy - Admin interface. If configured to port \"0\" then the admin - interface is disabled. \n Contour's default is 9001." - type: integer - numTrustedHops: - description: "XffNumTrustedHops defines the number of additional - ingress proxy hops from the right side of the x-forwarded-for - HTTP header to trust when determining the origin client’s - IP address. \n See https://www.envoyproxy.io/docs/envoy/v1.17.0/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto?highlight=xff_num_trusted_hops - for more information. \n Contour's default is 0." - format: int32 - type: integer - type: object - service: - description: "Service holds Envoy service parameters for setting - Ingress status. \n Contour's default is { namespace: \"projectcontour\", - name: \"envoy\" }." - properties: - name: - type: string - namespace: - type: string - required: - - name - - namespace - type: object - timeouts: - description: Timeouts holds various configurable timeouts that - can be set in the config file. - properties: - connectTimeout: - description: "ConnectTimeout defines how long the proxy should - wait when establishing connection to upstream service. If - not set, a default value of 2 seconds will be used. \n See - https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-field-config-cluster-v3-cluster-connect-timeout - for more information." - type: string - connectionIdleTimeout: - description: "ConnectionIdleTimeout defines how long the proxy - should wait while there are no active requests (for HTTP/1.1) - or streams (for HTTP/2) before terminating an HTTP connection. - Set to \"infinity\" to disable the timeout entirely. \n - See https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#envoy-v3-api-field-config-core-v3-httpprotocoloptions-idle-timeout - for more information." - type: string - connectionShutdownGracePeriod: - description: "ConnectionShutdownGracePeriod defines how long - the proxy will wait between sending an initial GOAWAY frame - and a second, final GOAWAY frame when terminating an HTTP/2 - connection. During this grace period, the proxy will continue - to respond to new streams. After the final GOAWAY frame - has been sent, the proxy will refuse new streams. \n See - https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-drain-timeout - for more information." - type: string - delayedCloseTimeout: - description: "DelayedCloseTimeout defines how long envoy will - wait, once connection close processing has been initiated, - for the downstream peer to close the connection before Envoy - closes the socket associated with the connection. \n Setting - this timeout to 'infinity' will disable it, equivalent to - setting it to '0' in Envoy. Leaving it unset will result - in the Envoy default value being used. \n See https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-delayed-close-timeout - for more information." - type: string - maxConnectionDuration: - description: "MaxConnectionDuration defines the maximum period - of time after an HTTP connection has been established from - the client to the proxy before it is closed by the proxy, - regardless of whether there has been activity or not. Omit - or set to \"infinity\" for no max duration. \n See https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#envoy-v3-api-field-config-core-v3-httpprotocoloptions-max-connection-duration - for more information." - type: string - requestTimeout: - description: "RequestTimeout sets the client request timeout - globally for Contour. Note that this is a timeout for the - entire request, not an idle timeout. Omit or set to \"infinity\" - to disable the timeout entirely. \n See https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-request-timeout - for more information." - type: string - streamIdleTimeout: - description: "StreamIdleTimeout defines how long the proxy - should wait while there is no request activity (for HTTP/1.1) - or stream activity (for HTTP/2) before terminating the HTTP - request or stream. Set to \"infinity\" to disable the timeout - entirely. \n See https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-stream-idle-timeout - for more information." - type: string - type: object - type: object - featureFlags: - description: 'FeatureFlags defines toggle to enable new contour features. - Available toggles are: useEndpointSlices - configures contour to - fetch endpoint data from k8s endpoint slices. defaults to false - and reading endpoint data from the k8s endpoints.' - items: - type: string - type: array - gateway: - description: Gateway contains parameters for the gateway-api Gateway - that Contour is configured to serve traffic. - properties: - controllerName: - description: ControllerName is used to determine whether Contour - should reconcile a GatewayClass. The string takes the form of - "projectcontour.io//contour". If unset, the gatewayclass - controller will not be started. Exactly one of ControllerName - or GatewayRef must be set. - type: string - gatewayRef: - description: GatewayRef defines a specific Gateway that this Contour - instance corresponds to. If set, Contour will reconcile only - this gateway, and will not reconcile any gateway classes. Exactly - one of ControllerName or GatewayRef must be set. - properties: - name: - type: string - namespace: - type: string - required: - - name - - namespace - type: object - type: object - globalExtAuth: - description: GlobalExternalAuthorization allows envoys external authorization - filter to be enabled for all virtual hosts. - properties: - authPolicy: - description: AuthPolicy sets a default authorization policy for - client requests. This policy will be used unless overridden - by individual routes. - properties: - context: - additionalProperties: - type: string - description: Context is a set of key/value pairs that are - sent to the authentication server in the check request. - If a context is provided at an enclosing scope, the entries - are merged such that the inner scope overrides matching - keys from the outer scope. - type: object - disabled: - description: When true, this field disables client request - authentication for the scope of the policy. - type: boolean - type: object - extensionRef: - description: ExtensionServiceRef specifies the extension resource - that will authorize client requests. - properties: - apiVersion: - description: API version of the referent. If this field is - not specified, the default "projectcontour.io/v1alpha1" - will be used - minLength: 1 - type: string - name: - description: "Name of the referent. \n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names" - minLength: 1 - type: string - namespace: - description: "Namespace of the referent. If this field is - not specifies, the namespace of the resource that targets - the referent will be used. \n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/" - minLength: 1 - type: string - type: object - failOpen: - description: If FailOpen is true, the client request is forwarded - to the upstream service even if the authorization server fails - to respond. This field should not be set in most cases. It is - intended for use only while migrating applications from internal - authorization to Contour external authorization. - type: boolean - responseTimeout: - description: ResponseTimeout configures maximum time to wait for - a check response from the authorization server. Timeout durations - are expressed in the Go [Duration format](https://godoc.org/time#ParseDuration). - Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". - The string "infinity" is also a valid input and specifies no - timeout. - pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+|infinity|infinite)$ - type: string - withRequestBody: - description: WithRequestBody specifies configuration for sending - the client request's body to authorization server. - properties: - allowPartialMessage: - description: If AllowPartialMessage is true, then Envoy will - buffer the body until MaxRequestBytes are reached. - type: boolean - maxRequestBytes: - default: 1024 - description: MaxRequestBytes sets the maximum size of message - body ExtAuthz filter will hold in-memory. - format: int32 - minimum: 1 - type: integer - packAsBytes: - description: If PackAsBytes is true, the body sent to Authorization - Server is in raw bytes. - type: boolean - type: object - type: object - health: - description: "Health defines the endpoints Contour uses to serve health - checks. \n Contour's default is { address: \"0.0.0.0\", port: 8000 - }." - properties: - address: - description: Defines the health address interface. - minLength: 1 - type: string - port: - description: Defines the health port. - type: integer - type: object - httpproxy: - description: HTTPProxy defines parameters on HTTPProxy. - properties: - disablePermitInsecure: - description: "DisablePermitInsecure disables the use of the permitInsecure - field in HTTPProxy. \n Contour's default is false." - type: boolean - fallbackCertificate: - description: FallbackCertificate defines the namespace/name of - the Kubernetes secret to use as fallback when a non-SNI request - is received. - properties: - name: - type: string - namespace: - type: string - required: - - name - - namespace - type: object - rootNamespaces: - description: Restrict Contour to searching these namespaces for - root ingress routes. - items: - type: string - type: array - type: object - ingress: - description: Ingress contains parameters for ingress options. - properties: - classNames: - description: Ingress Class Names Contour should use. - items: - type: string - type: array - statusAddress: - description: Address to set in Ingress object status. - type: string - type: object - metrics: - description: "Metrics defines the endpoint Contour uses to serve metrics. - \n Contour's default is { address: \"0.0.0.0\", port: 8000 }." - properties: - address: - description: Defines the metrics address interface. - maxLength: 253 - minLength: 1 - type: string - port: - description: Defines the metrics port. - type: integer - tls: - description: TLS holds TLS file config details. Metrics and health - endpoints cannot have same port number when metrics is served - over HTTPS. - properties: - caFile: - description: CA filename. - type: string - certFile: - description: Client certificate filename. - type: string - keyFile: - description: Client key filename. - type: string - type: object - type: object - policy: - description: Policy specifies default policy applied if not overridden - by the user - properties: - applyToIngress: - description: "ApplyToIngress determines if the Policies will apply - to ingress objects \n Contour's default is false." - type: boolean - requestHeaders: - description: RequestHeadersPolicy defines the request headers - set/removed on all routes - properties: - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - responseHeaders: - description: ResponseHeadersPolicy defines the response headers - set/removed on all routes - properties: - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - type: object - rateLimitService: - description: RateLimitService optionally holds properties of the Rate - Limit Service to be used for global rate limiting. - properties: - defaultGlobalRateLimitPolicy: - description: DefaultGlobalRateLimitPolicy allows setting a default - global rate limit policy for every HTTPProxy. HTTPProxy can - overwrite this configuration. - properties: - descriptors: - description: Descriptors defines the list of descriptors that - will be generated and sent to the rate limit service. Each - descriptor contains 1+ key-value pair entries. - items: - description: RateLimitDescriptor defines a list of key-value - pair generators. - properties: - entries: - description: Entries is the list of key-value pair generators. - items: - description: RateLimitDescriptorEntry is a key-value - pair generator. Exactly one field on this struct - must be non-nil. - properties: - genericKey: - description: GenericKey defines a descriptor entry - with a static key and value. - properties: - key: - description: Key defines the key of the descriptor - entry. If not set, the key is set to "generic_key". - type: string - value: - description: Value defines the value of the - descriptor entry. - minLength: 1 - type: string - type: object - remoteAddress: - description: RemoteAddress defines a descriptor - entry with a key of "remote_address" and a value - equal to the client's IP address (from x-forwarded-for). - type: object - requestHeader: - description: RequestHeader defines a descriptor - entry that's populated only if a given header - is present on the request. The descriptor key - is static, and the descriptor value is equal - to the value of the header. - properties: - descriptorKey: - description: DescriptorKey defines the key - to use on the descriptor entry. - minLength: 1 - type: string - headerName: - description: HeaderName defines the name of - the header to look for on the request. - minLength: 1 - type: string - type: object - requestHeaderValueMatch: - description: RequestHeaderValueMatch defines a - descriptor entry that's populated if the request's - headers match a set of 1+ match criteria. The - descriptor key is "header_match", and the descriptor - value is static. - properties: - expectMatch: - default: true - description: ExpectMatch defines whether the - request must positively match the match - criteria in order to generate a descriptor - entry (i.e. true), or not match the match - criteria in order to generate a descriptor - entry (i.e. false). The default is true. - type: boolean - headers: - description: Headers is a list of 1+ match - criteria to apply against the request to - determine whether to populate the descriptor - entry or not. - items: - description: HeaderMatchCondition specifies - how to conditionally match against HTTP - headers. The Name field is required, only - one of Present, NotPresent, Contains, - NotContains, Exact, NotExact and Regex - can be set. For negative matching rules - only (e.g. NotContains or NotExact) you - can set TreatMissingAsEmpty. IgnoreCase - has no effect for Regex. - properties: - contains: - description: Contains specifies a substring - that must be present in the header - value. - type: string - exact: - description: Exact specifies a string - that the header value must be equal - to. - type: string - ignoreCase: - description: IgnoreCase specifies that - string matching should be case insensitive. - Note that this has no effect on the - Regex parameter. - type: boolean - name: - description: Name is the name of the - header to match against. Name is required. - Header names are case insensitive. - type: string - notcontains: - description: NotContains specifies a - substring that must not be present - in the header value. - type: string - notexact: - description: NoExact specifies a string - that the header value must not be - equal to. The condition is true if - the header has any other value. - type: string - notpresent: - description: NotPresent specifies that - condition is true when the named header - is not present. Note that setting - NotPresent to false does not make - the condition true if the named header - is present. - type: boolean - present: - description: Present specifies that - condition is true when the named header - is present, regardless of its value. - Note that setting Present to false - does not make the condition true if - the named header is absent. - type: boolean - regex: - description: Regex specifies a regular - expression pattern that must match - the header value. - type: string - treatMissingAsEmpty: - description: TreatMissingAsEmpty specifies - if the header match rule specified - header does not exist, this header - value will be treated as empty. Defaults - to false. Unlike the underlying Envoy - implementation this is **only** supported - for negative matches (e.g. NotContains, - NotExact). - type: boolean - required: - - name - type: object - minItems: 1 - type: array - value: - description: Value defines the value of the - descriptor entry. - minLength: 1 - type: string - type: object - type: object - minItems: 1 - type: array - type: object - minItems: 1 - type: array - disabled: - description: Disabled configures the HTTPProxy to not use - the default global rate limit policy defined by the Contour - configuration. - type: boolean - type: object - domain: - description: Domain is passed to the Rate Limit Service. - type: string - enableResourceExhaustedCode: - description: EnableResourceExhaustedCode enables translating error - code 429 to grpc code RESOURCE_EXHAUSTED. When disabled it's - translated to UNAVAILABLE - type: boolean - enableXRateLimitHeaders: - description: "EnableXRateLimitHeaders defines whether to include - the X-RateLimit headers X-RateLimit-Limit, X-RateLimit-Remaining, - and X-RateLimit-Reset (as defined by the IETF Internet-Draft - linked below), on responses to clients when the Rate Limit Service - is consulted for a request. \n ref. https://tools.ietf.org/id/draft-polli-ratelimit-headers-03.html" - type: boolean - extensionService: - description: ExtensionService identifies the extension service - defining the RLS. - properties: - name: - type: string - namespace: - type: string - required: - - name - - namespace - type: object - failOpen: - description: FailOpen defines whether to allow requests to proceed - when the Rate Limit Service fails to respond with a valid rate - limit decision within the timeout defined on the extension service. - type: boolean - required: - - extensionService - type: object - tracing: - description: Tracing defines properties for exporting trace data to - OpenTelemetry. - properties: - customTags: - description: CustomTags defines a list of custom tags with unique - tag name. - items: - description: CustomTag defines custom tags with unique tag name - to create tags for the active span. - properties: - literal: - description: Literal is a static custom tag value. Precisely - one of Literal, RequestHeaderName must be set. - type: string - requestHeaderName: - description: RequestHeaderName indicates which request header - the label value is obtained from. Precisely one of Literal, - RequestHeaderName must be set. - type: string - tagName: - description: TagName is the unique name of the custom tag. - type: string - required: - - tagName - type: object - type: array - extensionService: - description: ExtensionService identifies the extension service - defining the otel-collector. - properties: - name: - type: string - namespace: - type: string - required: - - name - - namespace - type: object - includePodDetail: - description: 'IncludePodDetail defines a flag. If it is true, - contour will add the pod name and namespace to the span of the - trace. the default is true. Note: The Envoy pods MUST have the - HOSTNAME and CONTOUR_NAMESPACE environment variables set for - this to work properly.' - type: boolean - maxPathTagLength: - description: MaxPathTagLength defines maximum length of the request - path to extract and include in the HttpUrl tag. contour's default - is 256. - format: int32 - type: integer - overallSampling: - description: OverallSampling defines the sampling rate of trace - data. contour's default is 100. - type: string - serviceName: - description: ServiceName defines the name for the service. contour's - default is contour. - type: string - required: - - extensionService - type: object - xdsServer: - description: XDSServer contains parameters for the xDS server. - properties: - address: - description: "Defines the xDS gRPC API address which Contour will - serve. \n Contour's default is \"0.0.0.0\"." - minLength: 1 - type: string - port: - description: "Defines the xDS gRPC API port which Contour will - serve. \n Contour's default is 8001." - type: integer - tls: - description: "TLS holds TLS file config details. \n Contour's - default is { caFile: \"/certs/ca.crt\", certFile: \"/certs/tls.cert\", - keyFile: \"/certs/tls.key\", insecure: false }." - properties: - caFile: - description: CA filename. - type: string - certFile: - description: Client certificate filename. - type: string - insecure: - description: Allow serving the xDS gRPC API without TLS. - type: boolean - keyFile: - description: Client key filename. - type: string - type: object - type: - description: "Defines the XDSServer to use for `contour serve`. - \n Values: `contour` (default), `envoy`. \n Other values will - produce an error." - type: string - type: object - type: object - status: - description: ContourConfigurationStatus defines the observed state of - a ContourConfiguration resource. - properties: - conditions: - description: "Conditions contains the current status of the Contour - resource. \n Contour will update a single condition, `Valid`, that - is in normal-true polarity. \n Contour will not modify any other - Conditions set in this block, in case some other controller wants - to add a Condition." - items: - description: "DetailedCondition is an extension of the normal Kubernetes - conditions, with two extra fields to hold sub-conditions, which - provide more detailed reasons for the state (True or False) of - the condition. \n `errors` holds information about sub-conditions - which are fatal to that condition and render its state False. - \n `warnings` holds information about sub-conditions which are - not fatal to that condition and do not force the state to be False. - \n Remember that Conditions have a type, a status, and a reason. - \n The type is the type of the condition, the most important one - in this CRD set is `Valid`. `Valid` is a positive-polarity condition: - when it is `status: true` there are no problems. \n In more detail, - `status: true` means that the object is has been ingested into - Contour with no errors. `warnings` may still be present, and will - be indicated in the Reason field. There must be zero entries in - the `errors` slice in this case. \n `Valid`, `status: false` means - that the object has had one or more fatal errors during processing - into Contour. The details of the errors will be present under - the `errors` field. There must be at least one error in the `errors` - slice if `status` is `false`. \n For DetailedConditions of types - other than `Valid`, the Condition must be in the negative polarity. - When they have `status` `true`, there is an error. There must - be at least one entry in the `errors` Subcondition slice. When - they have `status` `false`, there are no serious errors, and there - must be zero entries in the `errors` slice. In either case, there - may be entries in the `warnings` slice. \n Regardless of the polarity, - the `reason` and `message` fields must be updated with either - the detail of the reason (if there is one and only one entry in - total across both the `errors` and `warnings` slices), or `MultipleReasons` - if there is more than one entry." - properties: - errors: - description: "Errors contains a slice of relevant error subconditions - for this object. \n Subconditions are expected to appear when - relevant (when there is a error), and disappear when not relevant. - An empty slice here indicates no errors." - items: - description: "SubCondition is a Condition-like type intended - for use as a subcondition inside a DetailedCondition. \n - It contains a subset of the Condition fields. \n It is intended - for warnings and errors, so `type` names should use abnormal-true - polarity, that is, they should be of the form \"ErrorPresent: - true\". \n The expected lifecycle for these errors is that - they should only be present when the error or warning is, - and should be removed when they are not relevant." - properties: - message: - description: "Message is a human readable message indicating - details about the transition. \n This may be an empty - string." - maxLength: 32768 - type: string - reason: - description: "Reason contains a programmatic identifier - indicating the reason for the condition's last transition. - Producers of specific condition types may define expected - values and meanings for this field, and whether the - values are considered a guaranteed API. \n The value - should be a CamelCase string. \n This field may not - be empty." - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: Status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: "Type of condition in `CamelCase` or in `foo.example.com/CamelCase`. - \n This must be in abnormal-true polarity, that is, - `ErrorFound` or `controller.io/ErrorFound`. \n The regex - it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)" - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - message - - reason - - status - - type - type: object - type: array - lastTransitionTime: - description: lastTransitionTime is the last time the condition - transitioned from one status to another. This should be when - the underlying condition changed. If that is not known, then - using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: message is a human readable message indicating - details about the transition. This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: observedGeneration represents the .metadata.generation - that the condition was set based upon. For instance, if .metadata.generation - is currently 12, but the .status.conditions[x].observedGeneration - is 9, the condition is out of date with respect to the current - state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: reason contains a programmatic identifier indicating - the reason for the condition's last transition. Producers - of specific condition types may define expected values and - meanings for this field, and whether the values are considered - a guaranteed API. The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - --- Many .condition.type values are consistent across resources - like Available, but because arbitrary conditions can be useful - (see .node.status.conditions), the ability to deconflict is - important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - warnings: - description: "Warnings contains a slice of relevant warning - subconditions for this object. \n Subconditions are expected - to appear when relevant (when there is a warning), and disappear - when not relevant. An empty slice here indicates no warnings." - items: - description: "SubCondition is a Condition-like type intended - for use as a subcondition inside a DetailedCondition. \n - It contains a subset of the Condition fields. \n It is intended - for warnings and errors, so `type` names should use abnormal-true - polarity, that is, they should be of the form \"ErrorPresent: - true\". \n The expected lifecycle for these errors is that - they should only be present when the error or warning is, - and should be removed when they are not relevant." - properties: - message: - description: "Message is a human readable message indicating - details about the transition. \n This may be an empty - string." - maxLength: 32768 - type: string - reason: - description: "Reason contains a programmatic identifier - indicating the reason for the condition's last transition. - Producers of specific condition types may define expected - values and meanings for this field, and whether the - values are considered a guaranteed API. \n The value - should be a CamelCase string. \n This field may not - be empty." - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: Status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: "Type of condition in `CamelCase` or in `foo.example.com/CamelCase`. - \n This must be in abnormal-true polarity, that is, - `ErrorFound` or `controller.io/ErrorFound`. \n The regex - it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)" - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - message - - reason - - status - - type - type: object - type: array - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} -{{- end }} diff --git a/helm-templates/contour/templates/crds/contourdeployments.yaml b/helm-templates/contour/templates/crds/contourdeployments.yaml deleted file mode 100644 index d89fa7b..0000000 --- a/helm-templates/contour/templates/crds/contourdeployments.yaml +++ /dev/null @@ -1,3359 +0,0 @@ -{{- if .Values.contour.manageCRDs }} -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.13.0 - name: contourdeployments.projectcontour.io -spec: - preserveUnknownFields: false - group: projectcontour.io - names: - kind: ContourDeployment - listKind: ContourDeploymentList - plural: contourdeployments - shortNames: - - contourdeploy - singular: contourdeployment - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: ContourDeployment is the schema for a Contour Deployment. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: ContourDeploymentSpec specifies options for how a Contour - instance should be provisioned. - properties: - contour: - description: Contour specifies deployment-time settings for the Contour - part of the installation, i.e. the xDS server/control plane and - associated resources, including things like replica count for the - Deployment, and node placement constraints for the pods. - properties: - deployment: - description: Deployment describes the settings for running contour - as a `Deployment`. - properties: - replicas: - description: Replicas is the desired number of replicas. - format: int32 - minimum: 0 - type: integer - strategy: - description: Strategy describes the deployment strategy to - use to replace existing pods with new pods. - properties: - rollingUpdate: - description: 'Rolling update config params. Present only - if DeploymentStrategyType = RollingUpdate. --- TODO: - Update this to follow our convention for oneOf, whatever - we decide it to be.' - properties: - maxSurge: - anyOf: - - type: integer - - type: string - description: 'The maximum number of pods that can - be scheduled above the desired number of pods. Value - can be an absolute number (ex: 5) or a percentage - of desired pods (ex: 10%). This can not be 0 if - MaxUnavailable is 0. Absolute number is calculated - from percentage by rounding up. Defaults to 25%. - Example: when this is set to 30%, the new ReplicaSet - can be scaled up immediately when the rolling update - starts, such that the total number of old and new - pods do not exceed 130% of desired pods. Once old - pods have been killed, new ReplicaSet can be scaled - up further, ensuring that total number of pods running - at any time during the update is at most 130% of - desired pods.' - x-kubernetes-int-or-string: true - maxUnavailable: - anyOf: - - type: integer - - type: string - description: 'The maximum number of pods that can - be unavailable during the update. Value can be an - absolute number (ex: 5) or a percentage of desired - pods (ex: 10%). Absolute number is calculated from - percentage by rounding down. This can not be 0 if - MaxSurge is 0. Defaults to 25%. Example: when this - is set to 30%, the old ReplicaSet can be scaled - down to 70% of desired pods immediately when the - rolling update starts. Once new pods are ready, - old ReplicaSet can be scaled down further, followed - by scaling up the new ReplicaSet, ensuring that - the total number of pods available at all times - during the update is at least 70% of desired pods.' - x-kubernetes-int-or-string: true - type: object - type: - description: Type of deployment. Can be "Recreate" or - "RollingUpdate". Default is RollingUpdate. - type: string - type: object - type: object - kubernetesLogLevel: - description: KubernetesLogLevel Enable Kubernetes client debug - logging with log level. If unset, defaults to 0. - maximum: 9 - minimum: 0 - type: integer - logLevel: - description: LogLevel sets the log level for Contour Allowed values - are "info", "debug". - type: string - nodePlacement: - description: NodePlacement describes node scheduling configuration - of Contour pods. - properties: - nodeSelector: - additionalProperties: - type: string - description: "NodeSelector is the simplest recommended form - of node selection constraint and specifies a map of key-value - pairs. For the pod to be eligible to run on a node, the - node must have each of the indicated key-value pairs as - labels (it can have additional labels as well). \n If unset, - the pod(s) will be scheduled to any available node." - type: object - tolerations: - description: "Tolerations work with taints to ensure that - pods are not scheduled onto inappropriate nodes. One or - more taints are applied to a node; this marks that the node - should not accept any pods that do not tolerate the taints. - \n The default is an empty list. \n See https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - for additional details." - items: - description: The pod this Toleration is attached to tolerates - any taint that matches the triple using - the matching operator . - properties: - effect: - description: Effect indicates the taint effect to match. - Empty means match all taint effects. When specified, - allowed values are NoSchedule, PreferNoSchedule and - NoExecute. - type: string - key: - description: Key is the taint key that the toleration - applies to. Empty means match all taint keys. If the - key is empty, operator must be Exists; this combination - means to match all values and all keys. - type: string - operator: - description: Operator represents a key's relationship - to the value. Valid operators are Exists and Equal. - Defaults to Equal. Exists is equivalent to wildcard - for value, so that a pod can tolerate all taints of - a particular category. - type: string - tolerationSeconds: - description: TolerationSeconds represents the period - of time the toleration (which must be of effect NoExecute, - otherwise this field is ignored) tolerates the taint. - By default, it is not set, which means tolerate the - taint forever (do not evict). Zero and negative values - will be treated as 0 (evict immediately) by the system. - format: int64 - type: integer - value: - description: Value is the taint value the toleration - matches to. If the operator is Exists, the value should - be empty, otherwise just a regular string. - type: string - type: object - type: array - type: object - podAnnotations: - additionalProperties: - type: string - description: PodAnnotations defines annotations to add to the - Contour pods. the annotations for Prometheus will be appended - or overwritten with predefined value. - type: object - replicas: - description: "Deprecated: Use `DeploymentSettings.Replicas` instead. - \n Replicas is the desired number of Contour replicas. If if - unset, defaults to 2. \n if both `DeploymentSettings.Replicas` - and this one is set, use `DeploymentSettings.Replicas`." - format: int32 - minimum: 0 - type: integer - resources: - description: 'Compute Resources required by contour container. - Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - properties: - claims: - description: "Claims lists the names of resources, defined - in spec.resourceClaims, that are used by this container. - \n This is an alpha field and requires enabling the DynamicResourceAllocation - feature gate. \n This field is immutable. It can only be - set for containers." - items: - description: ResourceClaim references one entry in PodSpec.ResourceClaims. - properties: - name: - description: Name must match the name of one entry in - pod.spec.resourceClaims of the Pod where this field - is used. It makes that resource available inside a - container. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum amount of compute - resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum amount of compute - resources required. If Requests is omitted for a container, - it defaults to Limits if that is explicitly specified, otherwise - to an implementation-defined value. Requests cannot exceed - Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - type: object - envoy: - description: Envoy specifies deployment-time settings for the Envoy - part of the installation, i.e. the xDS client/data plane and associated - resources, including things like the workload type to use (DaemonSet - or Deployment), node placement constraints for the pods, and various - options for the Envoy service. - properties: - baseID: - description: The base ID to use when allocating shared memory - regions. if Envoy needs to be run multiple times on the same - machine, each running Envoy will need a unique base ID so that - the shared memory regions do not conflict. defaults to 0. - format: int32 - minimum: 0 - type: integer - daemonSet: - description: DaemonSet describes the settings for running envoy - as a `DaemonSet`. if `WorkloadType` is `Deployment`,it's must - be nil - properties: - updateStrategy: - description: Strategy describes the deployment strategy to - use to replace existing DaemonSet pods with new pods. - properties: - rollingUpdate: - description: 'Rolling update config params. Present only - if type = "RollingUpdate". --- TODO: Update this to - follow our convention for oneOf, whatever we decide - it to be. Same as Deployment `strategy.rollingUpdate`. - See https://github.com/kubernetes/kubernetes/issues/35345' - properties: - maxSurge: - anyOf: - - type: integer - - type: string - description: 'The maximum number of nodes with an - existing available DaemonSet pod that can have an - updated DaemonSet pod during during an update. Value - can be an absolute number (ex: 5) or a percentage - of desired pods (ex: 10%). This can not be 0 if - MaxUnavailable is 0. Absolute number is calculated - from percentage by rounding up to a minimum of 1. - Default value is 0. Example: when this is set to - 30%, at most 30% of the total number of nodes that - should be running the daemon pod (i.e. status.desiredNumberScheduled) - can have their a new pod created before the old - pod is marked as deleted. The update starts by launching - new pods on 30% of nodes. Once an updated pod is - available (Ready for at least minReadySeconds) the - old DaemonSet pod on that node is marked deleted. - If the old pod becomes unavailable for any reason - (Ready transitions to false, is evicted, or is drained) - an updated pod is immediatedly created on that node - without considering surge limits. Allowing surge - implies the possibility that the resources consumed - by the daemonset on any given node can double if - the readiness check fails, and so resource intensive - daemonsets should take into account that they may - cause evictions during disruption.' - x-kubernetes-int-or-string: true - maxUnavailable: - anyOf: - - type: integer - - type: string - description: 'The maximum number of DaemonSet pods - that can be unavailable during the update. Value - can be an absolute number (ex: 5) or a percentage - of total number of DaemonSet pods at the start of - the update (ex: 10%). Absolute number is calculated - from percentage by rounding up. This cannot be 0 - if MaxSurge is 0 Default value is 1. Example: when - this is set to 30%, at most 30% of the total number - of nodes that should be running the daemon pod (i.e. - status.desiredNumberScheduled) can have their pods - stopped for an update at any given time. The update - starts by stopping at most 30% of those DaemonSet - pods and then brings up new DaemonSet pods in their - place. Once the new pods are available, it then - proceeds onto other DaemonSet pods, thus ensuring - that at least 70% of original number of DaemonSet - pods are available at all times during the update.' - x-kubernetes-int-or-string: true - type: object - type: - description: Type of daemon set update. Can be "RollingUpdate" - or "OnDelete". Default is RollingUpdate. - type: string - type: object - type: object - deployment: - description: Deployment describes the settings for running envoy - as a `Deployment`. if `WorkloadType` is `DaemonSet`,it's must - be nil - properties: - replicas: - description: Replicas is the desired number of replicas. - format: int32 - minimum: 0 - type: integer - strategy: - description: Strategy describes the deployment strategy to - use to replace existing pods with new pods. - properties: - rollingUpdate: - description: 'Rolling update config params. Present only - if DeploymentStrategyType = RollingUpdate. --- TODO: - Update this to follow our convention for oneOf, whatever - we decide it to be.' - properties: - maxSurge: - anyOf: - - type: integer - - type: string - description: 'The maximum number of pods that can - be scheduled above the desired number of pods. Value - can be an absolute number (ex: 5) or a percentage - of desired pods (ex: 10%). This can not be 0 if - MaxUnavailable is 0. Absolute number is calculated - from percentage by rounding up. Defaults to 25%. - Example: when this is set to 30%, the new ReplicaSet - can be scaled up immediately when the rolling update - starts, such that the total number of old and new - pods do not exceed 130% of desired pods. Once old - pods have been killed, new ReplicaSet can be scaled - up further, ensuring that total number of pods running - at any time during the update is at most 130% of - desired pods.' - x-kubernetes-int-or-string: true - maxUnavailable: - anyOf: - - type: integer - - type: string - description: 'The maximum number of pods that can - be unavailable during the update. Value can be an - absolute number (ex: 5) or a percentage of desired - pods (ex: 10%). Absolute number is calculated from - percentage by rounding down. This can not be 0 if - MaxSurge is 0. Defaults to 25%. Example: when this - is set to 30%, the old ReplicaSet can be scaled - down to 70% of desired pods immediately when the - rolling update starts. Once new pods are ready, - old ReplicaSet can be scaled down further, followed - by scaling up the new ReplicaSet, ensuring that - the total number of pods available at all times - during the update is at least 70% of desired pods.' - x-kubernetes-int-or-string: true - type: object - type: - description: Type of deployment. Can be "Recreate" or - "RollingUpdate". Default is RollingUpdate. - type: string - type: object - type: object - extraVolumeMounts: - description: ExtraVolumeMounts holds the extra volume mounts to - add (normally used with extraVolumes). - items: - description: VolumeMount describes a mounting of a Volume within - a container. - properties: - mountPath: - description: Path within the container at which the volume - should be mounted. Must not contain ':'. - type: string - mountPropagation: - description: mountPropagation determines how mounts are - propagated from the host to container and the other way - around. When not set, MountPropagationNone is used. This - field is beta in 1.10. - type: string - name: - description: This must match the Name of a Volume. - type: string - readOnly: - description: Mounted read-only if true, read-write otherwise - (false or unspecified). Defaults to false. - type: boolean - subPath: - description: Path within the volume from which the container's - volume should be mounted. Defaults to "" (volume's root). - type: string - subPathExpr: - description: Expanded path within the volume from which - the container's volume should be mounted. Behaves similarly - to SubPath but environment variable references $(VAR_NAME) - are expanded using the container's environment. Defaults - to "" (volume's root). SubPathExpr and SubPath are mutually - exclusive. - type: string - required: - - mountPath - - name - type: object - type: array - extraVolumes: - description: ExtraVolumes holds the extra volumes to add. - items: - description: Volume represents a named volume in a pod that - may be accessed by any container in the pod. - properties: - awsElasticBlockStore: - description: 'awsElasticBlockStore represents an AWS Disk - resource that is attached to a kubelet''s host machine - and then exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - properties: - fsType: - description: 'fsType is the filesystem type of the volume - that you want to mount. Tip: Ensure that the filesystem - type is supported by the host operating system. Examples: - "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore - TODO: how do we prevent errors in the filesystem from - compromising the machine' - type: string - partition: - description: 'partition is the partition in the volume - that you want to mount. If omitted, the default is - to mount by volume name. Examples: For volume /dev/sda1, - you specify the partition as "1". Similarly, the volume - partition for /dev/sda is "0" (or you can leave the - property empty).' - format: int32 - type: integer - readOnly: - description: 'readOnly value true will force the readOnly - setting in VolumeMounts. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: boolean - volumeID: - description: 'volumeID is unique ID of the persistent - disk resource in AWS (Amazon EBS volume). More info: - https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: string - required: - - volumeID - type: object - azureDisk: - description: azureDisk represents an Azure Data Disk mount - on the host and bind mount to the pod. - properties: - cachingMode: - description: 'cachingMode is the Host Caching mode: - None, Read Only, Read Write.' - type: string - diskName: - description: diskName is the Name of the data disk in - the blob storage - type: string - diskURI: - description: diskURI is the URI of data disk in the - blob storage - type: string - fsType: - description: fsType is Filesystem type to mount. Must - be a filesystem type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred - to be "ext4" if unspecified. - type: string - kind: - description: 'kind expected values are Shared: multiple - blob disks per storage account Dedicated: single - blob disk per storage account Managed: azure managed - data disk (only in managed availability set). defaults - to shared' - type: string - readOnly: - description: readOnly Defaults to false (read/write). - ReadOnly here will force the ReadOnly setting in VolumeMounts. - type: boolean - required: - - diskName - - diskURI - type: object - azureFile: - description: azureFile represents an Azure File Service - mount on the host and bind mount to the pod. - properties: - readOnly: - description: readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting in VolumeMounts. - type: boolean - secretName: - description: secretName is the name of secret that - contains Azure Storage Account Name and Key - type: string - shareName: - description: shareName is the azure share Name - type: string - required: - - secretName - - shareName - type: object - cephfs: - description: cephFS represents a Ceph FS mount on the host - that shares a pod's lifetime - properties: - monitors: - description: 'monitors is Required: Monitors is a collection - of Ceph monitors More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - items: - type: string - type: array - path: - description: 'path is Optional: Used as the mounted - root, rather than the full Ceph tree, default is /' - type: string - readOnly: - description: 'readOnly is Optional: Defaults to false - (read/write). ReadOnly here will force the ReadOnly - setting in VolumeMounts. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: boolean - secretFile: - description: 'secretFile is Optional: SecretFile is - the path to key ring for User, default is /etc/ceph/user.secret - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - secretRef: - description: 'secretRef is Optional: SecretRef is reference - to the authentication secret for User, default is - empty. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - type: object - x-kubernetes-map-type: atomic - user: - description: 'user is optional: User is the rados user - name, default is admin More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - required: - - monitors - type: object - cinder: - description: 'cinder represents a cinder volume attached - and mounted on kubelets host machine. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - properties: - fsType: - description: 'fsType is the filesystem type to mount. - Must be a filesystem type supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - readOnly: - description: 'readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting in VolumeMounts. - More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: boolean - secretRef: - description: 'secretRef is optional: points to a secret - object containing parameters used to connect to OpenStack.' - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - type: object - x-kubernetes-map-type: atomic - volumeID: - description: 'volumeID used to identify the volume in - cinder. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - required: - - volumeID - type: object - configMap: - description: configMap represents a configMap that should - populate this volume - properties: - defaultMode: - description: 'defaultMode is optional: mode bits used - to set permissions on created files by default. Must - be an octal value between 0000 and 0777 or a decimal - value between 0 and 511. YAML accepts both octal and - decimal values, JSON requires decimal values for mode - bits. Defaults to 0644. Directories within the path - are not affected by this setting. This might be in - conflict with other options that affect the file mode, - like fsGroup, and the result can be other mode bits - set.' - format: int32 - type: integer - items: - description: items if unspecified, each key-value pair - in the Data field of the referenced ConfigMap will - be projected into the volume as a file whose name - is the key and content is the value. If specified, - the listed keys will be projected into the specified - paths, and unlisted keys will not be present. If a - key is specified which is not present in the ConfigMap, - the volume setup will error unless it is marked optional. - Paths must be relative and may not contain the '..' - path or start with '..'. - items: - description: Maps a string key to a path within a - volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode bits used - to set permissions on this file. Must be an - octal value between 0000 and 0777 or a decimal - value between 0 and 511. YAML accepts both octal - and decimal values, JSON requires decimal values - for mode bits. If not specified, the volume - defaultMode will be used. This might be in conflict - with other options that affect the file mode, - like fsGroup, and the result can be other mode - bits set.' - format: int32 - type: integer - path: - description: path is the relative path of the - file to map the key to. May not be an absolute - path. May not contain the path element '..'. - May not start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - optional: - description: optional specify whether the ConfigMap - or its keys must be defined - type: boolean - type: object - x-kubernetes-map-type: atomic - csi: - description: csi (Container Storage Interface) represents - ephemeral storage that is handled by certain external - CSI drivers (Beta feature). - properties: - driver: - description: driver is the name of the CSI driver that - handles this volume. Consult with your admin for the - correct name as registered in the cluster. - type: string - fsType: - description: fsType to mount. Ex. "ext4", "xfs", "ntfs". - If not provided, the empty value is passed to the - associated CSI driver which will determine the default - filesystem to apply. - type: string - nodePublishSecretRef: - description: nodePublishSecretRef is a reference to - the secret object containing sensitive information - to pass to the CSI driver to complete the CSI NodePublishVolume - and NodeUnpublishVolume calls. This field is optional, - and may be empty if no secret is required. If the - secret object contains more than one secret, all secret - references are passed. - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - type: object - x-kubernetes-map-type: atomic - readOnly: - description: readOnly specifies a read-only configuration - for the volume. Defaults to false (read/write). - type: boolean - volumeAttributes: - additionalProperties: - type: string - description: volumeAttributes stores driver-specific - properties that are passed to the CSI driver. Consult - your driver's documentation for supported values. - type: object - required: - - driver - type: object - downwardAPI: - description: downwardAPI represents downward API about the - pod that should populate this volume - properties: - defaultMode: - description: 'Optional: mode bits to use on created - files by default. Must be a Optional: mode bits used - to set permissions on created files by default. Must - be an octal value between 0000 and 0777 or a decimal - value between 0 and 511. YAML accepts both octal and - decimal values, JSON requires decimal values for mode - bits. Defaults to 0644. Directories within the path - are not affected by this setting. This might be in - conflict with other options that affect the file mode, - like fsGroup, and the result can be other mode bits - set.' - format: int32 - type: integer - items: - description: Items is a list of downward API volume - file - items: - description: DownwardAPIVolumeFile represents information - to create the file containing the pod field - properties: - fieldRef: - description: 'Required: Selects a field of the - pod: only annotations, labels, name and namespace - are supported.' - properties: - apiVersion: - description: Version of the schema the FieldPath - is written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select in - the specified API version. - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - mode: - description: 'Optional: mode bits used to set - permissions on this file, must be an octal value - between 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal and decimal - values, JSON requires decimal values for mode - bits. If not specified, the volume defaultMode - will be used. This might be in conflict with - other options that affect the file mode, like - fsGroup, and the result can be other mode bits - set.' - format: int32 - type: integer - path: - description: 'Required: Path is the relative - path name of the file to be created. Must not - be absolute or contain the ''..'' path. Must - be utf-8 encoded. The first item of the relative - path must not start with ''..''' - type: string - resourceFieldRef: - description: 'Selects a resource of the container: - only resources limits and requests (limits.cpu, - limits.memory, requests.cpu and requests.memory) - are currently supported.' - properties: - containerName: - description: 'Container name: required for - volumes, optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output format of - the exposed resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - required: - - path - type: object - type: array - type: object - emptyDir: - description: 'emptyDir represents a temporary directory - that shares a pod''s lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - properties: - medium: - description: 'medium represents what type of storage - medium should back this directory. The default is - "" which means to use the node''s default medium. - Must be an empty string (default) or Memory. More - info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - description: 'sizeLimit is the total amount of local - storage required for this EmptyDir volume. The size - limit is also applicable for memory medium. The maximum - usage on memory medium EmptyDir would be the minimum - value between the SizeLimit specified here and the - sum of memory limits of all containers in a pod. The - default is nil which means that the limit is undefined. - More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - ephemeral: - description: "ephemeral represents a volume that is handled - by a cluster storage driver. The volume's lifecycle is - tied to the pod that defines it - it will be created before - the pod starts, and deleted when the pod is removed. \n - Use this if: a) the volume is only needed while the pod - runs, b) features of normal volumes like restoring from - snapshot or capacity tracking are needed, c) the storage - driver is specified through a storage class, and d) the - storage driver supports dynamic volume provisioning through - a PersistentVolumeClaim (see EphemeralVolumeSource for - more information on the connection between this volume - type and PersistentVolumeClaim). \n Use PersistentVolumeClaim - or one of the vendor-specific APIs for volumes that persist - for longer than the lifecycle of an individual pod. \n - Use CSI for light-weight local ephemeral volumes if the - CSI driver is meant to be used that way - see the documentation - of the driver for more information. \n A pod can use both - types of ephemeral volumes and persistent volumes at the - same time." - properties: - volumeClaimTemplate: - description: "Will be used to create a stand-alone PVC - to provision the volume. The pod in which this EphemeralVolumeSource - is embedded will be the owner of the PVC, i.e. the - PVC will be deleted together with the pod. The name - of the PVC will be `-` where - `` is the name from the `PodSpec.Volumes` - array entry. Pod validation will reject the pod if - the concatenated name is not valid for a PVC (for - example, too long). \n An existing PVC with that name - that is not owned by the pod will *not* be used for - the pod to avoid using an unrelated volume by mistake. - Starting the pod is then blocked until the unrelated - PVC is removed. If such a pre-created PVC is meant - to be used by the pod, the PVC has to updated with - an owner reference to the pod once the pod exists. - Normally this should not be necessary, but it may - be useful when manually reconstructing a broken cluster. - \n This field is read-only and no changes will be - made by Kubernetes to the PVC after it has been created. - \n Required, must not be nil." - properties: - metadata: - description: May contain labels and annotations - that will be copied into the PVC when creating - it. No other fields are allowed and will be rejected - during validation. - type: object - spec: - description: The specification for the PersistentVolumeClaim. - The entire content is copied unchanged into the - PVC that gets created from this template. The - same fields as in a PersistentVolumeClaim are - also valid here. - properties: - accessModes: - description: 'accessModes contains the desired - access modes the volume should have. More - info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' - items: - type: string - type: array - dataSource: - description: 'dataSource field can be used to - specify either: * An existing VolumeSnapshot - object (snapshot.storage.k8s.io/VolumeSnapshot) - * An existing PVC (PersistentVolumeClaim) - If the provisioner or an external controller - can support the specified data source, it - will create a new volume based on the contents - of the specified data source. When the AnyVolumeDataSource - feature gate is enabled, dataSource contents - will be copied to dataSourceRef, and dataSourceRef - contents will be copied to dataSource when - dataSourceRef.namespace is not specified. - If the namespace is specified, then dataSourceRef - will not be copied to dataSource.' - properties: - apiGroup: - description: APIGroup is the group for the - resource being referenced. If APIGroup - is not specified, the specified Kind must - be in the core API group. For any other - third-party types, APIGroup is required. - type: string - kind: - description: Kind is the type of resource - being referenced - type: string - name: - description: Name is the name of resource - being referenced - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - dataSourceRef: - description: 'dataSourceRef specifies the object - from which to populate the volume with data, - if a non-empty volume is desired. This may - be any object from a non-empty API group (non - core object) or a PersistentVolumeClaim object. - When this field is specified, volume binding - will only succeed if the type of the specified - object matches some installed volume populator - or dynamic provisioner. This field will replace - the functionality of the dataSource field - and as such if both fields are non-empty, - they must have the same value. For backwards - compatibility, when namespace isn''t specified - in dataSourceRef, both fields (dataSource - and dataSourceRef) will be set to the same - value automatically if one of them is empty - and the other is non-empty. When namespace - is specified in dataSourceRef, dataSource - isn''t set to the same value and must be empty. - There are three important differences between - dataSource and dataSourceRef: * While dataSource - only allows two specific types of objects, - dataSourceRef allows any non-core object, - as well as PersistentVolumeClaim objects. - * While dataSource ignores disallowed values - (dropping them), dataSourceRef preserves all - values, and generates an error if a disallowed - value is specified. * While dataSource only - allows local objects, dataSourceRef allows - objects in any namespaces. (Beta) Using this - field requires the AnyVolumeDataSource feature - gate to be enabled. (Alpha) Using the namespace - field of dataSourceRef requires the CrossNamespaceVolumeDataSource - feature gate to be enabled.' - properties: - apiGroup: - description: APIGroup is the group for the - resource being referenced. If APIGroup - is not specified, the specified Kind must - be in the core API group. For any other - third-party types, APIGroup is required. - type: string - kind: - description: Kind is the type of resource - being referenced - type: string - name: - description: Name is the name of resource - being referenced - type: string - namespace: - description: Namespace is the namespace - of resource being referenced Note that - when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant - object is required in the referent namespace - to allow that namespace's owner to accept - the reference. See the ReferenceGrant - documentation for details. (Alpha) This - field requires the CrossNamespaceVolumeDataSource - feature gate to be enabled. - type: string - required: - - kind - - name - type: object - resources: - description: 'resources represents the minimum - resources the volume should have. If RecoverVolumeExpansionFailure - feature is enabled users are allowed to specify - resource requirements that are lower than - previous value but must still be higher than - capacity recorded in the status field of the - claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' - properties: - claims: - description: "Claims lists the names of - resources, defined in spec.resourceClaims, - that are used by this container. \n This - is an alpha field and requires enabling - the DynamicResourceAllocation feature - gate. \n This field is immutable. It can - only be set for containers." - items: - description: ResourceClaim references - one entry in PodSpec.ResourceClaims. - properties: - name: - description: Name must match the name - of one entry in pod.spec.resourceClaims - of the Pod where this field is used. - It makes that resource available - inside a container. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum - amount of compute resources allowed. More - info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum - amount of compute resources required. - If Requests is omitted for a container, - it defaults to Limits if that is explicitly - specified, otherwise to an implementation-defined - value. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - selector: - description: selector is a label query over - volumes to consider for binding. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The requirements - are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: operator represents a - key's relationship to a set of values. - Valid operators are In, NotIn, Exists - and DoesNotExist. - type: string - values: - description: values is an array of - string values. If the operator is - In or NotIn, the values array must - be non-empty. If the operator is - Exists or DoesNotExist, the values - array must be empty. This array - is replaced during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - storageClassName: - description: 'storageClassName is the name of - the StorageClass required by the claim. More - info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' - type: string - volumeMode: - description: volumeMode defines what type of - volume is required by the claim. Value of - Filesystem is implied when not included in - claim spec. - type: string - volumeName: - description: volumeName is the binding reference - to the PersistentVolume backing this claim. - type: string - type: object - required: - - spec - type: object - type: object - fc: - description: fc represents a Fibre Channel resource that - is attached to a kubelet's host machine and then exposed - to the pod. - properties: - fsType: - description: 'fsType is the filesystem type to mount. - Must be a filesystem type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred - to be "ext4" if unspecified. TODO: how do we prevent - errors in the filesystem from compromising the machine' - type: string - lun: - description: 'lun is Optional: FC target lun number' - format: int32 - type: integer - readOnly: - description: 'readOnly is Optional: Defaults to false - (read/write). ReadOnly here will force the ReadOnly - setting in VolumeMounts.' - type: boolean - targetWWNs: - description: 'targetWWNs is Optional: FC target worldwide - names (WWNs)' - items: - type: string - type: array - wwids: - description: 'wwids Optional: FC volume world wide identifiers - (wwids) Either wwids or combination of targetWWNs - and lun must be set, but not both simultaneously.' - items: - type: string - type: array - type: object - flexVolume: - description: flexVolume represents a generic volume resource - that is provisioned/attached using an exec based plugin. - properties: - driver: - description: driver is the name of the driver to use - for this volume. - type: string - fsType: - description: fsType is the filesystem type to mount. - Must be a filesystem type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". The default filesystem - depends on FlexVolume script. - type: string - options: - additionalProperties: - type: string - description: 'options is Optional: this field holds - extra command options if any.' - type: object - readOnly: - description: 'readOnly is Optional: defaults to false - (read/write). ReadOnly here will force the ReadOnly - setting in VolumeMounts.' - type: boolean - secretRef: - description: 'secretRef is Optional: secretRef is reference - to the secret object containing sensitive information - to pass to the plugin scripts. This may be empty if - no secret object is specified. If the secret object - contains more than one secret, all secrets are passed - to the plugin scripts.' - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - type: object - x-kubernetes-map-type: atomic - required: - - driver - type: object - flocker: - description: flocker represents a Flocker volume attached - to a kubelet's host machine. This depends on the Flocker - control service being running - properties: - datasetName: - description: datasetName is Name of the dataset stored - as metadata -> name on the dataset for Flocker should - be considered as deprecated - type: string - datasetUUID: - description: datasetUUID is the UUID of the dataset. - This is unique identifier of a Flocker dataset - type: string - type: object - gcePersistentDisk: - description: 'gcePersistentDisk represents a GCE Disk resource - that is attached to a kubelet''s host machine and then - exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - properties: - fsType: - description: 'fsType is filesystem type of the volume - that you want to mount. Tip: Ensure that the filesystem - type is supported by the host operating system. Examples: - "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk - TODO: how do we prevent errors in the filesystem from - compromising the machine' - type: string - partition: - description: 'partition is the partition in the volume - that you want to mount. If omitted, the default is - to mount by volume name. Examples: For volume /dev/sda1, - you specify the partition as "1". Similarly, the volume - partition for /dev/sda is "0" (or you can leave the - property empty). More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - format: int32 - type: integer - pdName: - description: 'pdName is unique name of the PD resource - in GCE. Used to identify the disk in GCE. More info: - https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: string - readOnly: - description: 'readOnly here will force the ReadOnly - setting in VolumeMounts. Defaults to false. More info: - https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: boolean - required: - - pdName - type: object - gitRepo: - description: 'gitRepo represents a git repository at a particular - revision. DEPRECATED: GitRepo is deprecated. To provision - a container with a git repo, mount an EmptyDir into an - InitContainer that clones the repo using git, then mount - the EmptyDir into the Pod''s container.' - properties: - directory: - description: directory is the target directory name. - Must not contain or start with '..'. If '.' is supplied, - the volume directory will be the git repository. Otherwise, - if specified, the volume will contain the git repository - in the subdirectory with the given name. - type: string - repository: - description: repository is the URL - type: string - revision: - description: revision is the commit hash for the specified - revision. - type: string - required: - - repository - type: object - glusterfs: - description: 'glusterfs represents a Glusterfs mount on - the host that shares a pod''s lifetime. More info: https://examples.k8s.io/volumes/glusterfs/README.md' - properties: - endpoints: - description: 'endpoints is the endpoint name that details - Glusterfs topology. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - path: - description: 'path is the Glusterfs volume path. More - info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - readOnly: - description: 'readOnly here will force the Glusterfs - volume to be mounted with read-only permissions. Defaults - to false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: boolean - required: - - endpoints - - path - type: object - hostPath: - description: 'hostPath represents a pre-existing file or - directory on the host machine that is directly exposed - to the container. This is generally used for system agents - or other privileged things that are allowed to see the - host machine. Most containers will NOT need this. More - info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath - --- TODO(jonesdl) We need to restrict who can use host - directory mounts and who can/can not mount host directories - as read/write.' - properties: - path: - description: 'path of the directory on the host. If - the path is a symlink, it will follow the link to - the real path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - type: - description: 'type for HostPath Volume Defaults to "" - More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - required: - - path - type: object - iscsi: - description: 'iscsi represents an ISCSI Disk resource that - is attached to a kubelet''s host machine and then exposed - to the pod. More info: https://examples.k8s.io/volumes/iscsi/README.md' - properties: - chapAuthDiscovery: - description: chapAuthDiscovery defines whether support - iSCSI Discovery CHAP authentication - type: boolean - chapAuthSession: - description: chapAuthSession defines whether support - iSCSI Session CHAP authentication - type: boolean - fsType: - description: 'fsType is the filesystem type of the volume - that you want to mount. Tip: Ensure that the filesystem - type is supported by the host operating system. Examples: - "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi - TODO: how do we prevent errors in the filesystem from - compromising the machine' - type: string - initiatorName: - description: initiatorName is the custom iSCSI Initiator - Name. If initiatorName is specified with iscsiInterface - simultaneously, new iSCSI interface : will be created for the connection. - type: string - iqn: - description: iqn is the target iSCSI Qualified Name. - type: string - iscsiInterface: - description: iscsiInterface is the interface Name that - uses an iSCSI transport. Defaults to 'default' (tcp). - type: string - lun: - description: lun represents iSCSI Target Lun number. - format: int32 - type: integer - portals: - description: portals is the iSCSI Target Portal List. - The portal is either an IP or ip_addr:port if the - port is other than default (typically TCP ports 860 - and 3260). - items: - type: string - type: array - readOnly: - description: readOnly here will force the ReadOnly setting - in VolumeMounts. Defaults to false. - type: boolean - secretRef: - description: secretRef is the CHAP Secret for iSCSI - target and initiator authentication - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - type: object - x-kubernetes-map-type: atomic - targetPortal: - description: targetPortal is iSCSI Target Portal. The - Portal is either an IP or ip_addr:port if the port - is other than default (typically TCP ports 860 and - 3260). - type: string - required: - - iqn - - lun - - targetPortal - type: object - name: - description: 'name of the volume. Must be a DNS_LABEL and - unique within the pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - nfs: - description: 'nfs represents an NFS mount on the host that - shares a pod''s lifetime More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - properties: - path: - description: 'path that is exported by the NFS server. - More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - readOnly: - description: 'readOnly here will force the NFS export - to be mounted with read-only permissions. Defaults - to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: boolean - server: - description: 'server is the hostname or IP address of - the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - required: - - path - - server - type: object - persistentVolumeClaim: - description: 'persistentVolumeClaimVolumeSource represents - a reference to a PersistentVolumeClaim in the same namespace. - More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - properties: - claimName: - description: 'claimName is the name of a PersistentVolumeClaim - in the same namespace as the pod using this volume. - More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - type: string - readOnly: - description: readOnly Will force the ReadOnly setting - in VolumeMounts. Default false. - type: boolean - required: - - claimName - type: object - photonPersistentDisk: - description: photonPersistentDisk represents a PhotonController - persistent disk attached and mounted on kubelets host - machine - properties: - fsType: - description: fsType is the filesystem type to mount. - Must be a filesystem type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred - to be "ext4" if unspecified. - type: string - pdID: - description: pdID is the ID that identifies Photon Controller - persistent disk - type: string - required: - - pdID - type: object - portworxVolume: - description: portworxVolume represents a portworx volume - attached and mounted on kubelets host machine - properties: - fsType: - description: fSType represents the filesystem type to - mount Must be a filesystem type supported by the host - operating system. Ex. "ext4", "xfs". Implicitly inferred - to be "ext4" if unspecified. - type: string - readOnly: - description: readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting in VolumeMounts. - type: boolean - volumeID: - description: volumeID uniquely identifies a Portworx - volume - type: string - required: - - volumeID - type: object - projected: - description: projected items for all in one resources secrets, - configmaps, and downward API - properties: - defaultMode: - description: defaultMode are the mode bits used to set - permissions on created files by default. Must be an - octal value between 0000 and 0777 or a decimal value - between 0 and 511. YAML accepts both octal and decimal - values, JSON requires decimal values for mode bits. - Directories within the path are not affected by this - setting. This might be in conflict with other options - that affect the file mode, like fsGroup, and the result - can be other mode bits set. - format: int32 - type: integer - sources: - description: sources is the list of volume projections - items: - description: Projection that may be projected along - with other supported volume types - properties: - configMap: - description: configMap information about the configMap - data to project - properties: - items: - description: items if unspecified, each key-value - pair in the Data field of the referenced - ConfigMap will be projected into the volume - as a file whose name is the key and content - is the value. If specified, the listed keys - will be projected into the specified paths, - and unlisted keys will not be present. If - a key is specified which is not present - in the ConfigMap, the volume setup will - error unless it is marked optional. Paths - must be relative and may not contain the - '..' path or start with '..'. - items: - description: Maps a string key to a path - within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode - bits used to set permissions on this - file. Must be an octal value between - 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal - and decimal values, JSON requires - decimal values for mode bits. If not - specified, the volume defaultMode - will be used. This might be in conflict - with other options that affect the - file mode, like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: path is the relative path - of the file to map the key to. May - not be an absolute path. May not contain - the path element '..'. May not start - with the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: optional specify whether the - ConfigMap or its keys must be defined - type: boolean - type: object - x-kubernetes-map-type: atomic - downwardAPI: - description: downwardAPI information about the - downwardAPI data to project - properties: - items: - description: Items is a list of DownwardAPIVolume - file - items: - description: DownwardAPIVolumeFile represents - information to create the file containing - the pod field - properties: - fieldRef: - description: 'Required: Selects a field - of the pod: only annotations, labels, - name and namespace are supported.' - properties: - apiVersion: - description: Version of the schema - the FieldPath is written in terms - of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to - select in the specified API version. - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - mode: - description: 'Optional: mode bits used - to set permissions on this file, must - be an octal value between 0000 and - 0777 or a decimal value between 0 - and 511. YAML accepts both octal and - decimal values, JSON requires decimal - values for mode bits. If not specified, - the volume defaultMode will be used. - This might be in conflict with other - options that affect the file mode, - like fsGroup, and the result can be - other mode bits set.' - format: int32 - type: integer - path: - description: 'Required: Path is the - relative path name of the file to - be created. Must not be absolute or - contain the ''..'' path. Must be utf-8 - encoded. The first item of the relative - path must not start with ''..''' - type: string - resourceFieldRef: - description: 'Selects a resource of - the container: only resources limits - and requests (limits.cpu, limits.memory, - requests.cpu and requests.memory) - are currently supported.' - properties: - containerName: - description: 'Container name: required - for volumes, optional for env - vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output - format of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource - to select' - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - required: - - path - type: object - type: array - type: object - secret: - description: secret information about the secret - data to project - properties: - items: - description: items if unspecified, each key-value - pair in the Data field of the referenced - Secret will be projected into the volume - as a file whose name is the key and content - is the value. If specified, the listed keys - will be projected into the specified paths, - and unlisted keys will not be present. If - a key is specified which is not present - in the Secret, the volume setup will error - unless it is marked optional. Paths must - be relative and may not contain the '..' - path or start with '..'. - items: - description: Maps a string key to a path - within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode - bits used to set permissions on this - file. Must be an octal value between - 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal - and decimal values, JSON requires - decimal values for mode bits. If not - specified, the volume defaultMode - will be used. This might be in conflict - with other options that affect the - file mode, like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: path is the relative path - of the file to map the key to. May - not be an absolute path. May not contain - the path element '..'. May not start - with the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: optional field specify whether - the Secret or its key must be defined - type: boolean - type: object - x-kubernetes-map-type: atomic - serviceAccountToken: - description: serviceAccountToken is information - about the serviceAccountToken data to project - properties: - audience: - description: audience is the intended audience - of the token. A recipient of a token must - identify itself with an identifier specified - in the audience of the token, and otherwise - should reject the token. The audience defaults - to the identifier of the apiserver. - type: string - expirationSeconds: - description: expirationSeconds is the requested - duration of validity of the service account - token. As the token approaches expiration, - the kubelet volume plugin will proactively - rotate the service account token. The kubelet - will start trying to rotate the token if - the token is older than 80 percent of its - time to live or if the token is older than - 24 hours.Defaults to 1 hour and must be - at least 10 minutes. - format: int64 - type: integer - path: - description: path is the path relative to - the mount point of the file to project the - token into. - type: string - required: - - path - type: object - type: object - type: array - type: object - quobyte: - description: quobyte represents a Quobyte mount on the host - that shares a pod's lifetime - properties: - group: - description: group to map volume access to Default is - no group - type: string - readOnly: - description: readOnly here will force the Quobyte volume - to be mounted with read-only permissions. Defaults - to false. - type: boolean - registry: - description: registry represents a single or multiple - Quobyte Registry services specified as a string as - host:port pair (multiple entries are separated with - commas) which acts as the central registry for volumes - type: string - tenant: - description: tenant owning the given Quobyte volume - in the Backend Used with dynamically provisioned Quobyte - volumes, value is set by the plugin - type: string - user: - description: user to map volume access to Defaults to - serivceaccount user - type: string - volume: - description: volume is a string that references an already - created Quobyte volume by name. - type: string - required: - - registry - - volume - type: object - rbd: - description: 'rbd represents a Rados Block Device mount - on the host that shares a pod''s lifetime. More info: - https://examples.k8s.io/volumes/rbd/README.md' - properties: - fsType: - description: 'fsType is the filesystem type of the volume - that you want to mount. Tip: Ensure that the filesystem - type is supported by the host operating system. Examples: - "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd - TODO: how do we prevent errors in the filesystem from - compromising the machine' - type: string - image: - description: 'image is the rados image name. More info: - https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - keyring: - description: 'keyring is the path to key ring for RBDUser. - Default is /etc/ceph/keyring. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - monitors: - description: 'monitors is a collection of Ceph monitors. - More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - items: - type: string - type: array - pool: - description: 'pool is the rados pool name. Default is - rbd. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - readOnly: - description: 'readOnly here will force the ReadOnly - setting in VolumeMounts. Defaults to false. More info: - https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: boolean - secretRef: - description: 'secretRef is name of the authentication - secret for RBDUser. If provided overrides keyring. - Default is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - type: object - x-kubernetes-map-type: atomic - user: - description: 'user is the rados user name. Default is - admin. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - required: - - image - - monitors - type: object - scaleIO: - description: scaleIO represents a ScaleIO persistent volume - attached and mounted on Kubernetes nodes. - properties: - fsType: - description: fsType is the filesystem type to mount. - Must be a filesystem type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Default is "xfs". - type: string - gateway: - description: gateway is the host address of the ScaleIO - API Gateway. - type: string - protectionDomain: - description: protectionDomain is the name of the ScaleIO - Protection Domain for the configured storage. - type: string - readOnly: - description: readOnly Defaults to false (read/write). - ReadOnly here will force the ReadOnly setting in VolumeMounts. - type: boolean - secretRef: - description: secretRef references to the secret for - ScaleIO user and other sensitive information. If this - is not provided, Login operation will fail. - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - type: object - x-kubernetes-map-type: atomic - sslEnabled: - description: sslEnabled Flag enable/disable SSL communication - with Gateway, default false - type: boolean - storageMode: - description: storageMode indicates whether the storage - for a volume should be ThickProvisioned or ThinProvisioned. - Default is ThinProvisioned. - type: string - storagePool: - description: storagePool is the ScaleIO Storage Pool - associated with the protection domain. - type: string - system: - description: system is the name of the storage system - as configured in ScaleIO. - type: string - volumeName: - description: volumeName is the name of a volume already - created in the ScaleIO system that is associated with - this volume source. - type: string - required: - - gateway - - secretRef - - system - type: object - secret: - description: 'secret represents a secret that should populate - this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' - properties: - defaultMode: - description: 'defaultMode is Optional: mode bits used - to set permissions on created files by default. Must - be an octal value between 0000 and 0777 or a decimal - value between 0 and 511. YAML accepts both octal and - decimal values, JSON requires decimal values for mode - bits. Defaults to 0644. Directories within the path - are not affected by this setting. This might be in - conflict with other options that affect the file mode, - like fsGroup, and the result can be other mode bits - set.' - format: int32 - type: integer - items: - description: items If unspecified, each key-value pair - in the Data field of the referenced Secret will be - projected into the volume as a file whose name is - the key and content is the value. If specified, the - listed keys will be projected into the specified paths, - and unlisted keys will not be present. If a key is - specified which is not present in the Secret, the - volume setup will error unless it is marked optional. - Paths must be relative and may not contain the '..' - path or start with '..'. - items: - description: Maps a string key to a path within a - volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode bits used - to set permissions on this file. Must be an - octal value between 0000 and 0777 or a decimal - value between 0 and 511. YAML accepts both octal - and decimal values, JSON requires decimal values - for mode bits. If not specified, the volume - defaultMode will be used. This might be in conflict - with other options that affect the file mode, - like fsGroup, and the result can be other mode - bits set.' - format: int32 - type: integer - path: - description: path is the relative path of the - file to map the key to. May not be an absolute - path. May not contain the path element '..'. - May not start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - optional: - description: optional field specify whether the Secret - or its keys must be defined - type: boolean - secretName: - description: 'secretName is the name of the secret in - the pod''s namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' - type: string - type: object - storageos: - description: storageOS represents a StorageOS volume attached - and mounted on Kubernetes nodes. - properties: - fsType: - description: fsType is the filesystem type to mount. - Must be a filesystem type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred - to be "ext4" if unspecified. - type: string - readOnly: - description: readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting in VolumeMounts. - type: boolean - secretRef: - description: secretRef specifies the secret to use for - obtaining the StorageOS API credentials. If not specified, - default values will be attempted. - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - type: object - x-kubernetes-map-type: atomic - volumeName: - description: volumeName is the human-readable name of - the StorageOS volume. Volume names are only unique - within a namespace. - type: string - volumeNamespace: - description: volumeNamespace specifies the scope of - the volume within StorageOS. If no namespace is specified - then the Pod's namespace will be used. This allows - the Kubernetes name scoping to be mirrored within - StorageOS for tighter integration. Set VolumeName - to any name to override the default behaviour. Set - to "default" if you are not using namespaces within - StorageOS. Namespaces that do not pre-exist within - StorageOS will be created. - type: string - type: object - vsphereVolume: - description: vsphereVolume represents a vSphere volume attached - and mounted on kubelets host machine - properties: - fsType: - description: fsType is filesystem type to mount. Must - be a filesystem type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred - to be "ext4" if unspecified. - type: string - storagePolicyID: - description: storagePolicyID is the storage Policy Based - Management (SPBM) profile ID associated with the StoragePolicyName. - type: string - storagePolicyName: - description: storagePolicyName is the storage Policy - Based Management (SPBM) profile name. - type: string - volumePath: - description: volumePath is the path that identifies - vSphere volume vmdk - type: string - required: - - volumePath - type: object - required: - - name - type: object - type: array - logLevel: - description: LogLevel sets the log level for Envoy. Allowed values - are "trace", "debug", "info", "warn", "error", "critical", "off". - type: string - networkPublishing: - description: NetworkPublishing defines how to expose Envoy to - a network. - properties: - externalTrafficPolicy: - description: "ExternalTrafficPolicy describes how nodes distribute - service traffic they receive on one of the Service's \"externally-facing\" - addresses (NodePorts, ExternalIPs, and LoadBalancer IPs). - \n If unset, defaults to \"Local\"." - type: string - ipFamilyPolicy: - description: IPFamilyPolicy represents the dual-stack-ness - requested or required by this Service. If there is no value - provided, then this field will be set to SingleStack. Services - can be "SingleStack" (a single IP family), "PreferDualStack" - (two IP families on dual-stack configured clusters or a - single IP family on single-stack clusters), or "RequireDualStack" - (two IP families on dual-stack configured clusters, otherwise - fail). - type: string - serviceAnnotations: - additionalProperties: - type: string - description: ServiceAnnotations is the annotations to add - to the provisioned Envoy service. - type: object - type: - description: "NetworkPublishingType is the type of publishing - strategy to use. Valid values are: \n * LoadBalancerService - \n In this configuration, network endpoints for Envoy use - container networking. A Kubernetes LoadBalancer Service - is created to publish Envoy network endpoints. \n See: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer - \n * NodePortService \n Publishes Envoy network endpoints - using a Kubernetes NodePort Service. \n In this configuration, - Envoy network endpoints use container networking. A Kubernetes - NodePort Service is created to publish the network endpoints. - \n See: https://kubernetes.io/docs/concepts/services-networking/service/#nodeport - \n NOTE: When provisioning an Envoy `NodePortService`, use - Gateway Listeners' port numbers to populate the Service's - node port values, there's no way to auto-allocate them. - \n See: https://github.com/projectcontour/contour/issues/4499 - \n * ClusterIPService \n Publishes Envoy network endpoints - using a Kubernetes ClusterIP Service. \n In this configuration, - Envoy network endpoints use container networking. A Kubernetes - ClusterIP Service is created to publish the network endpoints. - \n See: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types - \n If unset, defaults to LoadBalancerService." - type: string - type: object - nodePlacement: - description: NodePlacement describes node scheduling configuration - of Envoy pods. - properties: - nodeSelector: - additionalProperties: - type: string - description: "NodeSelector is the simplest recommended form - of node selection constraint and specifies a map of key-value - pairs. For the pod to be eligible to run on a node, the - node must have each of the indicated key-value pairs as - labels (it can have additional labels as well). \n If unset, - the pod(s) will be scheduled to any available node." - type: object - tolerations: - description: "Tolerations work with taints to ensure that - pods are not scheduled onto inappropriate nodes. One or - more taints are applied to a node; this marks that the node - should not accept any pods that do not tolerate the taints. - \n The default is an empty list. \n See https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - for additional details." - items: - description: The pod this Toleration is attached to tolerates - any taint that matches the triple using - the matching operator . - properties: - effect: - description: Effect indicates the taint effect to match. - Empty means match all taint effects. When specified, - allowed values are NoSchedule, PreferNoSchedule and - NoExecute. - type: string - key: - description: Key is the taint key that the toleration - applies to. Empty means match all taint keys. If the - key is empty, operator must be Exists; this combination - means to match all values and all keys. - type: string - operator: - description: Operator represents a key's relationship - to the value. Valid operators are Exists and Equal. - Defaults to Equal. Exists is equivalent to wildcard - for value, so that a pod can tolerate all taints of - a particular category. - type: string - tolerationSeconds: - description: TolerationSeconds represents the period - of time the toleration (which must be of effect NoExecute, - otherwise this field is ignored) tolerates the taint. - By default, it is not set, which means tolerate the - taint forever (do not evict). Zero and negative values - will be treated as 0 (evict immediately) by the system. - format: int64 - type: integer - value: - description: Value is the taint value the toleration - matches to. If the operator is Exists, the value should - be empty, otherwise just a regular string. - type: string - type: object - type: array - type: object - overloadMaxHeapSize: - description: 'OverloadMaxHeapSize defines the maximum heap memory - of the envoy controlled by the overload manager. When the value - is greater than 0, the overload manager is enabled, and when - envoy reaches 95% of the maximum heap size, it performs a shrink - heap operation, When it reaches 98% of the maximum heap size, - Envoy Will stop accepting requests. More info: https://projectcontour.io/docs/main/config/overload-manager/' - format: int64 - type: integer - podAnnotations: - additionalProperties: - type: string - description: PodAnnotations defines annotations to add to the - Envoy pods. the annotations for Prometheus will be appended - or overwritten with predefined value. - type: object - replicas: - description: "Deprecated: Use `DeploymentSettings.Replicas` instead. - \n Replicas is the desired number of Envoy replicas. If WorkloadType - is not \"Deployment\", this field is ignored. Otherwise, if - unset, defaults to 2. \n if both `DeploymentSettings.Replicas` - and this one is set, use `DeploymentSettings.Replicas`." - format: int32 - minimum: 0 - type: integer - resources: - description: 'Compute Resources required by envoy container. Cannot - be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - properties: - claims: - description: "Claims lists the names of resources, defined - in spec.resourceClaims, that are used by this container. - \n This is an alpha field and requires enabling the DynamicResourceAllocation - feature gate. \n This field is immutable. It can only be - set for containers." - items: - description: ResourceClaim references one entry in PodSpec.ResourceClaims. - properties: - name: - description: Name must match the name of one entry in - pod.spec.resourceClaims of the Pod where this field - is used. It makes that resource available inside a - container. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum amount of compute - resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum amount of compute - resources required. If Requests is omitted for a container, - it defaults to Limits if that is explicitly specified, otherwise - to an implementation-defined value. Requests cannot exceed - Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - workloadType: - description: WorkloadType is the type of workload to install Envoy - as. Choices are DaemonSet and Deployment. If unset, defaults - to DaemonSet. - type: string - type: object - resourceLabels: - additionalProperties: - type: string - description: ResourceLabels is a set of labels to add to the provisioned - Contour resources. - type: object - runtimeSettings: - description: RuntimeSettings is a ContourConfiguration spec to be - used when provisioning a Contour instance that will influence aspects - of the Contour instance's runtime behavior. - properties: - debug: - description: Debug contains parameters to enable debug logging - and debug interfaces inside Contour. - properties: - address: - description: "Defines the Contour debug address interface. - \n Contour's default is \"127.0.0.1\"." - type: string - port: - description: "Defines the Contour debug address port. \n Contour's - default is 6060." - type: integer - type: object - enableExternalNameService: - description: "EnableExternalNameService allows processing of ExternalNameServices - \n Contour's default is false for security reasons." - type: boolean - envoy: - description: Envoy contains parameters for Envoy as well as how - to optionally configure a managed Envoy fleet. - properties: - clientCertificate: - description: ClientCertificate defines the namespace/name - of the Kubernetes secret containing the client certificate - and private key to be used when establishing TLS connection - to upstream cluster. - properties: - name: - type: string - namespace: - type: string - required: - - name - - namespace - type: object - cluster: - description: Cluster holds various configurable Envoy cluster - values that can be set in the config file. - properties: - dnsLookupFamily: - description: "DNSLookupFamily defines how external names - are looked up When configured as V4, the DNS resolver - will only perform a lookup for addresses in the IPv4 - family. If V6 is configured, the DNS resolver will only - perform a lookup for addresses in the IPv6 family. If - AUTO is configured, the DNS resolver will first perform - a lookup for addresses in the IPv6 family and fallback - to a lookup for addresses in the IPv4 family. If ALL - is specified, the DNS resolver will perform a lookup - for both IPv4 and IPv6 families, and return all resolved - addresses. When this is used, Happy Eyeballs will be - enabled for upstream connections. Refer to Happy Eyeballs - Support for more information. Note: This only applies - to externalName clusters. \n See https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto.html#envoy-v3-api-enum-config-cluster-v3-cluster-dnslookupfamily - for more information. \n Values: `auto` (default), `v4`, - `v6`, `all`. \n Other values will produce an error." - type: string - maxRequestsPerConnection: - description: Defines the maximum requests for upstream - connections. If not specified, there is no limit. see - https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#envoy-v3-api-msg-config-core-v3-httpprotocoloptions - for more information. - format: int32 - minimum: 1 - type: integer - per-connection-buffer-limit-bytes: - description: Defines the soft limit on size of the cluster’s - new connection read and write buffers in bytes. If unspecified, - an implementation defined default is applied (1MiB). - see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-field-config-cluster-v3-cluster-per-connection-buffer-limit-bytes - for more information. - format: int32 - minimum: 1 - type: integer - type: object - defaultHTTPVersions: - description: "DefaultHTTPVersions defines the default set - of HTTPS versions the proxy should accept. HTTP versions - are strings of the form \"HTTP/xx\". Supported versions - are \"HTTP/1.1\" and \"HTTP/2\". \n Values: `HTTP/1.1`, - `HTTP/2` (default: both). \n Other values will produce an - error." - items: - description: HTTPVersionType is the name of a supported - HTTP version. - type: string - type: array - health: - description: "Health defines the endpoint Envoy uses to serve - health checks. \n Contour's default is { address: \"0.0.0.0\", - port: 8002 }." - properties: - address: - description: Defines the health address interface. - minLength: 1 - type: string - port: - description: Defines the health port. - type: integer - type: object - http: - description: "Defines the HTTP Listener for Envoy. \n Contour's - default is { address: \"0.0.0.0\", port: 8080, accessLog: - \"/dev/stdout\" }." - properties: - accessLog: - description: AccessLog defines where Envoy logs are outputted - for this listener. - type: string - address: - description: Defines an Envoy Listener Address. - minLength: 1 - type: string - port: - description: Defines an Envoy listener Port. - type: integer - type: object - https: - description: "Defines the HTTPS Listener for Envoy. \n Contour's - default is { address: \"0.0.0.0\", port: 8443, accessLog: - \"/dev/stdout\" }." - properties: - accessLog: - description: AccessLog defines where Envoy logs are outputted - for this listener. - type: string - address: - description: Defines an Envoy Listener Address. - minLength: 1 - type: string - port: - description: Defines an Envoy listener Port. - type: integer - type: object - listener: - description: Listener hold various configurable Envoy listener - values. - properties: - connectionBalancer: - description: "ConnectionBalancer. If the value is exact, - the listener will use the exact connection balancer - See https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/listener.proto#envoy-api-msg-listener-connectionbalanceconfig - for more information. \n Values: (empty string): use - the default ConnectionBalancer, `exact`: use the Exact - ConnectionBalancer. \n Other values will produce an - error." - type: string - disableAllowChunkedLength: - description: "DisableAllowChunkedLength disables the RFC-compliant - Envoy behavior to strip the \"Content-Length\" header - if \"Transfer-Encoding: chunked\" is also set. This - is an emergency off-switch to revert back to Envoy's - default behavior in case of failures. Please file an - issue if failures are encountered. See: https://github.com/projectcontour/contour/issues/3221 - \n Contour's default is false." - type: boolean - disableMergeSlashes: - description: "DisableMergeSlashes disables Envoy's non-standard - merge_slashes path transformation option which strips - duplicate slashes from request URL paths. \n Contour's - default is false." - type: boolean - httpMaxConcurrentStreams: - description: Defines the value for SETTINGS_MAX_CONCURRENT_STREAMS - Envoy will advertise in the SETTINGS frame in HTTP/2 - connections and the limit for concurrent streams allowed - for a peer on a single HTTP/2 connection. It is recommended - to not set this lower than 100 but this field can be - used to bound resource usage by HTTP/2 connections and - mitigate attacks like CVE-2023-44487. The default value - when this is not set is unlimited. - format: int32 - minimum: 1 - type: integer - maxRequestsPerConnection: - description: Defines the maximum requests for downstream - connections. If not specified, there is no limit. see - https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#envoy-v3-api-msg-config-core-v3-httpprotocoloptions - for more information. - format: int32 - minimum: 1 - type: integer - maxRequestsPerIOCycle: - description: Defines the limit on number of HTTP requests - that Envoy will process from a single connection in - a single I/O cycle. Requests over this limit are processed - in subsequent I/O cycles. Can be used as a mitigation - for CVE-2023-44487 when abusive traffic is detected. - Configures the http.max_requests_per_io_cycle Envoy - runtime setting. The default value when this is not - set is no limit. - format: int32 - minimum: 1 - type: integer - per-connection-buffer-limit-bytes: - description: Defines the soft limit on size of the listener’s - new connection read and write buffers in bytes. If unspecified, - an implementation defined default is applied (1MiB). - see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener.proto#envoy-v3-api-field-config-listener-v3-listener-per-connection-buffer-limit-bytes - for more information. - format: int32 - minimum: 1 - type: integer - serverHeaderTransformation: - description: "Defines the action to be applied to the - Server header on the response path. When configured - as overwrite, overwrites any Server header with \"envoy\". - When configured as append_if_absent, if a Server header - is present, pass it through, otherwise set it to \"envoy\". - When configured as pass_through, pass through the value - of the Server header, and do not append a header if - none is present. \n Values: `overwrite` (default), `append_if_absent`, - `pass_through` \n Other values will produce an error. - Contour's default is overwrite." - type: string - socketOptions: - description: SocketOptions defines configurable socket - options for the listeners. Single set of options are - applied to all listeners. - properties: - tos: - description: Defines the value for IPv4 TOS field - (including 6 bit DSCP field) for IP packets originating - from Envoy listeners. Single value is applied to - all listeners. If listeners are bound to IPv6-only - addresses, setting this option will cause an error. - format: int32 - maximum: 255 - minimum: 0 - type: integer - trafficClass: - description: Defines the value for IPv6 Traffic Class - field (including 6 bit DSCP field) for IP packets - originating from the Envoy listeners. Single value - is applied to all listeners. If listeners are bound - to IPv4-only addresses, setting this option will - cause an error. - format: int32 - maximum: 255 - minimum: 0 - type: integer - type: object - tls: - description: TLS holds various configurable Envoy TLS - listener values. - properties: - cipherSuites: - description: "CipherSuites defines the TLS ciphers - to be supported by Envoy TLS listeners when negotiating - TLS 1.2. Ciphers are validated against the set that - Envoy supports by default. This parameter should - only be used by advanced users. Note that these - will be ignored when TLS 1.3 is in use. \n This - field is optional; when it is undefined, a Contour-managed - ciphersuite list will be used, which may be updated - to keep it secure. \n Contour's default list is: - - \"[ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]\" - - \"[ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]\" - - \"ECDHE-ECDSA-AES256-GCM-SHA384\" - \"ECDHE-RSA-AES256-GCM-SHA384\" - \n Ciphers provided are validated against the following - list: - \"[ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]\" - - \"[ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]\" - - \"ECDHE-ECDSA-AES128-GCM-SHA256\" - \"ECDHE-RSA-AES128-GCM-SHA256\" - - \"ECDHE-ECDSA-AES128-SHA\" - \"ECDHE-RSA-AES128-SHA\" - - \"AES128-GCM-SHA256\" - \"AES128-SHA\" - \"ECDHE-ECDSA-AES256-GCM-SHA384\" - - \"ECDHE-RSA-AES256-GCM-SHA384\" - \"ECDHE-ECDSA-AES256-SHA\" - - \"ECDHE-RSA-AES256-SHA\" - \"AES256-GCM-SHA384\" - - \"AES256-SHA\" \n Contour recommends leaving this - undefined unless you are sure you must. \n See: - https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#extensions-transport-sockets-tls-v3-tlsparameters - Note: This list is a superset of what is valid for - stock Envoy builds and those using BoringSSL FIPS." - items: - type: string - type: array - maximumProtocolVersion: - description: "MaximumProtocolVersion is the maximum - TLS version this vhost should negotiate. \n Values: - `1.2`, `1.3`(default). \n Other values will produce - an error." - type: string - minimumProtocolVersion: - description: "MinimumProtocolVersion is the minimum - TLS version this vhost should negotiate. \n Values: - `1.2` (default), `1.3`. \n Other values will produce - an error." - type: string - type: object - useProxyProtocol: - description: "Use PROXY protocol for all listeners. \n - Contour's default is false." - type: boolean - type: object - logging: - description: Logging defines how Envoy's logs can be configured. - properties: - accessLogFormat: - description: "AccessLogFormat sets the global access log - format. \n Values: `envoy` (default), `json`. \n Other - values will produce an error." - type: string - accessLogFormatString: - description: AccessLogFormatString sets the access log - format when format is set to `envoy`. When empty, Envoy's - default format is used. - type: string - accessLogJSONFields: - description: AccessLogJSONFields sets the fields that - JSON logging will output when AccessLogFormat is json. - items: - type: string - type: array - accessLogLevel: - description: "AccessLogLevel sets the verbosity level - of the access log. \n Values: `info` (default, all requests - are logged), `error` (all non-success requests, i.e. - 300+ response code, are logged), `critical` (all 5xx - requests are logged) and `disabled`. \n Other values - will produce an error." - type: string - type: object - metrics: - description: "Metrics defines the endpoint Envoy uses to serve - metrics. \n Contour's default is { address: \"0.0.0.0\", - port: 8002 }." - properties: - address: - description: Defines the metrics address interface. - maxLength: 253 - minLength: 1 - type: string - port: - description: Defines the metrics port. - type: integer - tls: - description: TLS holds TLS file config details. Metrics - and health endpoints cannot have same port number when - metrics is served over HTTPS. - properties: - caFile: - description: CA filename. - type: string - certFile: - description: Client certificate filename. - type: string - keyFile: - description: Client key filename. - type: string - type: object - type: object - network: - description: Network holds various configurable Envoy network - values. - properties: - adminPort: - description: "Configure the port used to access the Envoy - Admin interface. If configured to port \"0\" then the - admin interface is disabled. \n Contour's default is - 9001." - type: integer - numTrustedHops: - description: "XffNumTrustedHops defines the number of - additional ingress proxy hops from the right side of - the x-forwarded-for HTTP header to trust when determining - the origin client’s IP address. \n See https://www.envoyproxy.io/docs/envoy/v1.17.0/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto?highlight=xff_num_trusted_hops - for more information. \n Contour's default is 0." - format: int32 - type: integer - type: object - service: - description: "Service holds Envoy service parameters for setting - Ingress status. \n Contour's default is { namespace: \"projectcontour\", - name: \"envoy\" }." - properties: - name: - type: string - namespace: - type: string - required: - - name - - namespace - type: object - timeouts: - description: Timeouts holds various configurable timeouts - that can be set in the config file. - properties: - connectTimeout: - description: "ConnectTimeout defines how long the proxy - should wait when establishing connection to upstream - service. If not set, a default value of 2 seconds will - be used. \n See https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-field-config-cluster-v3-cluster-connect-timeout - for more information." - type: string - connectionIdleTimeout: - description: "ConnectionIdleTimeout defines how long the - proxy should wait while there are no active requests - (for HTTP/1.1) or streams (for HTTP/2) before terminating - an HTTP connection. Set to \"infinity\" to disable the - timeout entirely. \n See https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#envoy-v3-api-field-config-core-v3-httpprotocoloptions-idle-timeout - for more information." - type: string - connectionShutdownGracePeriod: - description: "ConnectionShutdownGracePeriod defines how - long the proxy will wait between sending an initial - GOAWAY frame and a second, final GOAWAY frame when terminating - an HTTP/2 connection. During this grace period, the - proxy will continue to respond to new streams. After - the final GOAWAY frame has been sent, the proxy will - refuse new streams. \n See https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-drain-timeout - for more information." - type: string - delayedCloseTimeout: - description: "DelayedCloseTimeout defines how long envoy - will wait, once connection close processing has been - initiated, for the downstream peer to close the connection - before Envoy closes the socket associated with the connection. - \n Setting this timeout to 'infinity' will disable it, - equivalent to setting it to '0' in Envoy. Leaving it - unset will result in the Envoy default value being used. - \n See https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-delayed-close-timeout - for more information." - type: string - maxConnectionDuration: - description: "MaxConnectionDuration defines the maximum - period of time after an HTTP connection has been established - from the client to the proxy before it is closed by - the proxy, regardless of whether there has been activity - or not. Omit or set to \"infinity\" for no max duration. - \n See https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#envoy-v3-api-field-config-core-v3-httpprotocoloptions-max-connection-duration - for more information." - type: string - requestTimeout: - description: "RequestTimeout sets the client request timeout - globally for Contour. Note that this is a timeout for - the entire request, not an idle timeout. Omit or set - to \"infinity\" to disable the timeout entirely. \n - See https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-request-timeout - for more information." - type: string - streamIdleTimeout: - description: "StreamIdleTimeout defines how long the proxy - should wait while there is no request activity (for - HTTP/1.1) or stream activity (for HTTP/2) before terminating - the HTTP request or stream. Set to \"infinity\" to disable - the timeout entirely. \n See https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-stream-idle-timeout - for more information." - type: string - type: object - type: object - featureFlags: - description: 'FeatureFlags defines toggle to enable new contour - features. Available toggles are: useEndpointSlices - configures - contour to fetch endpoint data from k8s endpoint slices. defaults - to false and reading endpoint data from the k8s endpoints.' - items: - type: string - type: array - gateway: - description: Gateway contains parameters for the gateway-api Gateway - that Contour is configured to serve traffic. - properties: - controllerName: - description: ControllerName is used to determine whether Contour - should reconcile a GatewayClass. The string takes the form - of "projectcontour.io//contour". If unset, the - gatewayclass controller will not be started. Exactly one - of ControllerName or GatewayRef must be set. - type: string - gatewayRef: - description: GatewayRef defines a specific Gateway that this - Contour instance corresponds to. If set, Contour will reconcile - only this gateway, and will not reconcile any gateway classes. - Exactly one of ControllerName or GatewayRef must be set. - properties: - name: - type: string - namespace: - type: string - required: - - name - - namespace - type: object - type: object - globalExtAuth: - description: GlobalExternalAuthorization allows envoys external - authorization filter to be enabled for all virtual hosts. - properties: - authPolicy: - description: AuthPolicy sets a default authorization policy - for client requests. This policy will be used unless overridden - by individual routes. - properties: - context: - additionalProperties: - type: string - description: Context is a set of key/value pairs that - are sent to the authentication server in the check request. - If a context is provided at an enclosing scope, the - entries are merged such that the inner scope overrides - matching keys from the outer scope. - type: object - disabled: - description: When true, this field disables client request - authentication for the scope of the policy. - type: boolean - type: object - extensionRef: - description: ExtensionServiceRef specifies the extension resource - that will authorize client requests. - properties: - apiVersion: - description: API version of the referent. If this field - is not specified, the default "projectcontour.io/v1alpha1" - will be used - minLength: 1 - type: string - name: - description: "Name of the referent. \n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names" - minLength: 1 - type: string - namespace: - description: "Namespace of the referent. If this field - is not specifies, the namespace of the resource that - targets the referent will be used. \n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/" - minLength: 1 - type: string - type: object - failOpen: - description: If FailOpen is true, the client request is forwarded - to the upstream service even if the authorization server - fails to respond. This field should not be set in most cases. - It is intended for use only while migrating applications - from internal authorization to Contour external authorization. - type: boolean - responseTimeout: - description: ResponseTimeout configures maximum time to wait - for a check response from the authorization server. Timeout - durations are expressed in the Go [Duration format](https://godoc.org/time#ParseDuration). - Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", - "h". The string "infinity" is also a valid input and specifies - no timeout. - pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+|infinity|infinite)$ - type: string - withRequestBody: - description: WithRequestBody specifies configuration for sending - the client request's body to authorization server. - properties: - allowPartialMessage: - description: If AllowPartialMessage is true, then Envoy - will buffer the body until MaxRequestBytes are reached. - type: boolean - maxRequestBytes: - default: 1024 - description: MaxRequestBytes sets the maximum size of - message body ExtAuthz filter will hold in-memory. - format: int32 - minimum: 1 - type: integer - packAsBytes: - description: If PackAsBytes is true, the body sent to - Authorization Server is in raw bytes. - type: boolean - type: object - type: object - health: - description: "Health defines the endpoints Contour uses to serve - health checks. \n Contour's default is { address: \"0.0.0.0\", - port: 8000 }." - properties: - address: - description: Defines the health address interface. - minLength: 1 - type: string - port: - description: Defines the health port. - type: integer - type: object - httpproxy: - description: HTTPProxy defines parameters on HTTPProxy. - properties: - disablePermitInsecure: - description: "DisablePermitInsecure disables the use of the - permitInsecure field in HTTPProxy. \n Contour's default - is false." - type: boolean - fallbackCertificate: - description: FallbackCertificate defines the namespace/name - of the Kubernetes secret to use as fallback when a non-SNI - request is received. - properties: - name: - type: string - namespace: - type: string - required: - - name - - namespace - type: object - rootNamespaces: - description: Restrict Contour to searching these namespaces - for root ingress routes. - items: - type: string - type: array - type: object - ingress: - description: Ingress contains parameters for ingress options. - properties: - classNames: - description: Ingress Class Names Contour should use. - items: - type: string - type: array - statusAddress: - description: Address to set in Ingress object status. - type: string - type: object - metrics: - description: "Metrics defines the endpoint Contour uses to serve - metrics. \n Contour's default is { address: \"0.0.0.0\", port: - 8000 }." - properties: - address: - description: Defines the metrics address interface. - maxLength: 253 - minLength: 1 - type: string - port: - description: Defines the metrics port. - type: integer - tls: - description: TLS holds TLS file config details. Metrics and - health endpoints cannot have same port number when metrics - is served over HTTPS. - properties: - caFile: - description: CA filename. - type: string - certFile: - description: Client certificate filename. - type: string - keyFile: - description: Client key filename. - type: string - type: object - type: object - policy: - description: Policy specifies default policy applied if not overridden - by the user - properties: - applyToIngress: - description: "ApplyToIngress determines if the Policies will - apply to ingress objects \n Contour's default is false." - type: boolean - requestHeaders: - description: RequestHeadersPolicy defines the request headers - set/removed on all routes - properties: - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - responseHeaders: - description: ResponseHeadersPolicy defines the response headers - set/removed on all routes - properties: - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - type: object - rateLimitService: - description: RateLimitService optionally holds properties of the - Rate Limit Service to be used for global rate limiting. - properties: - defaultGlobalRateLimitPolicy: - description: DefaultGlobalRateLimitPolicy allows setting a - default global rate limit policy for every HTTPProxy. HTTPProxy - can overwrite this configuration. - properties: - descriptors: - description: Descriptors defines the list of descriptors - that will be generated and sent to the rate limit service. - Each descriptor contains 1+ key-value pair entries. - items: - description: RateLimitDescriptor defines a list of key-value - pair generators. - properties: - entries: - description: Entries is the list of key-value pair - generators. - items: - description: RateLimitDescriptorEntry is a key-value - pair generator. Exactly one field on this struct - must be non-nil. - properties: - genericKey: - description: GenericKey defines a descriptor - entry with a static key and value. - properties: - key: - description: Key defines the key of the - descriptor entry. If not set, the key - is set to "generic_key". - type: string - value: - description: Value defines the value of - the descriptor entry. - minLength: 1 - type: string - type: object - remoteAddress: - description: RemoteAddress defines a descriptor - entry with a key of "remote_address" and - a value equal to the client's IP address - (from x-forwarded-for). - type: object - requestHeader: - description: RequestHeader defines a descriptor - entry that's populated only if a given header - is present on the request. The descriptor - key is static, and the descriptor value - is equal to the value of the header. - properties: - descriptorKey: - description: DescriptorKey defines the - key to use on the descriptor entry. - minLength: 1 - type: string - headerName: - description: HeaderName defines the name - of the header to look for on the request. - minLength: 1 - type: string - type: object - requestHeaderValueMatch: - description: RequestHeaderValueMatch defines - a descriptor entry that's populated if the - request's headers match a set of 1+ match - criteria. The descriptor key is "header_match", - and the descriptor value is static. - properties: - expectMatch: - default: true - description: ExpectMatch defines whether - the request must positively match the - match criteria in order to generate - a descriptor entry (i.e. true), or not - match the match criteria in order to - generate a descriptor entry (i.e. false). - The default is true. - type: boolean - headers: - description: Headers is a list of 1+ match - criteria to apply against the request - to determine whether to populate the - descriptor entry or not. - items: - description: HeaderMatchCondition specifies - how to conditionally match against - HTTP headers. The Name field is required, - only one of Present, NotPresent, Contains, - NotContains, Exact, NotExact and Regex - can be set. For negative matching - rules only (e.g. NotContains or NotExact) - you can set TreatMissingAsEmpty. IgnoreCase - has no effect for Regex. - properties: - contains: - description: Contains specifies - a substring that must be present - in the header value. - type: string - exact: - description: Exact specifies a string - that the header value must be - equal to. - type: string - ignoreCase: - description: IgnoreCase specifies - that string matching should be - case insensitive. Note that this - has no effect on the Regex parameter. - type: boolean - name: - description: Name is the name of - the header to match against. Name - is required. Header names are - case insensitive. - type: string - notcontains: - description: NotContains specifies - a substring that must not be present - in the header value. - type: string - notexact: - description: NoExact specifies a - string that the header value must - not be equal to. The condition - is true if the header has any - other value. - type: string - notpresent: - description: NotPresent specifies - that condition is true when the - named header is not present. Note - that setting NotPresent to false - does not make the condition true - if the named header is present. - type: boolean - present: - description: Present specifies that - condition is true when the named - header is present, regardless - of its value. Note that setting - Present to false does not make - the condition true if the named - header is absent. - type: boolean - regex: - description: Regex specifies a regular - expression pattern that must match - the header value. - type: string - treatMissingAsEmpty: - description: TreatMissingAsEmpty - specifies if the header match - rule specified header does not - exist, this header value will - be treated as empty. Defaults - to false. Unlike the underlying - Envoy implementation this is **only** - supported for negative matches - (e.g. NotContains, NotExact). - type: boolean - required: - - name - type: object - minItems: 1 - type: array - value: - description: Value defines the value of - the descriptor entry. - minLength: 1 - type: string - type: object - type: object - minItems: 1 - type: array - type: object - minItems: 1 - type: array - disabled: - description: Disabled configures the HTTPProxy to not - use the default global rate limit policy defined by - the Contour configuration. - type: boolean - type: object - domain: - description: Domain is passed to the Rate Limit Service. - type: string - enableResourceExhaustedCode: - description: EnableResourceExhaustedCode enables translating - error code 429 to grpc code RESOURCE_EXHAUSTED. When disabled - it's translated to UNAVAILABLE - type: boolean - enableXRateLimitHeaders: - description: "EnableXRateLimitHeaders defines whether to include - the X-RateLimit headers X-RateLimit-Limit, X-RateLimit-Remaining, - and X-RateLimit-Reset (as defined by the IETF Internet-Draft - linked below), on responses to clients when the Rate Limit - Service is consulted for a request. \n ref. https://tools.ietf.org/id/draft-polli-ratelimit-headers-03.html" - type: boolean - extensionService: - description: ExtensionService identifies the extension service - defining the RLS. - properties: - name: - type: string - namespace: - type: string - required: - - name - - namespace - type: object - failOpen: - description: FailOpen defines whether to allow requests to - proceed when the Rate Limit Service fails to respond with - a valid rate limit decision within the timeout defined on - the extension service. - type: boolean - required: - - extensionService - type: object - tracing: - description: Tracing defines properties for exporting trace data - to OpenTelemetry. - properties: - customTags: - description: CustomTags defines a list of custom tags with - unique tag name. - items: - description: CustomTag defines custom tags with unique tag - name to create tags for the active span. - properties: - literal: - description: Literal is a static custom tag value. Precisely - one of Literal, RequestHeaderName must be set. - type: string - requestHeaderName: - description: RequestHeaderName indicates which request - header the label value is obtained from. Precisely - one of Literal, RequestHeaderName must be set. - type: string - tagName: - description: TagName is the unique name of the custom - tag. - type: string - required: - - tagName - type: object - type: array - extensionService: - description: ExtensionService identifies the extension service - defining the otel-collector. - properties: - name: - type: string - namespace: - type: string - required: - - name - - namespace - type: object - includePodDetail: - description: 'IncludePodDetail defines a flag. If it is true, - contour will add the pod name and namespace to the span - of the trace. the default is true. Note: The Envoy pods - MUST have the HOSTNAME and CONTOUR_NAMESPACE environment - variables set for this to work properly.' - type: boolean - maxPathTagLength: - description: MaxPathTagLength defines maximum length of the - request path to extract and include in the HttpUrl tag. - contour's default is 256. - format: int32 - type: integer - overallSampling: - description: OverallSampling defines the sampling rate of - trace data. contour's default is 100. - type: string - serviceName: - description: ServiceName defines the name for the service. - contour's default is contour. - type: string - required: - - extensionService - type: object - xdsServer: - description: XDSServer contains parameters for the xDS server. - properties: - address: - description: "Defines the xDS gRPC API address which Contour - will serve. \n Contour's default is \"0.0.0.0\"." - minLength: 1 - type: string - port: - description: "Defines the xDS gRPC API port which Contour - will serve. \n Contour's default is 8001." - type: integer - tls: - description: "TLS holds TLS file config details. \n Contour's - default is { caFile: \"/certs/ca.crt\", certFile: \"/certs/tls.cert\", - keyFile: \"/certs/tls.key\", insecure: false }." - properties: - caFile: - description: CA filename. - type: string - certFile: - description: Client certificate filename. - type: string - insecure: - description: Allow serving the xDS gRPC API without TLS. - type: boolean - keyFile: - description: Client key filename. - type: string - type: object - type: - description: "Defines the XDSServer to use for `contour serve`. - \n Values: `contour` (default), `envoy`. \n Other values - will produce an error." - type: string - type: object - type: object - type: object - status: - description: ContourDeploymentStatus defines the observed state of a ContourDeployment - resource. - properties: - conditions: - description: Conditions describe the current conditions of the ContourDeployment - resource. - items: - description: "Condition contains details for one aspect of the current - state of this API Resource. --- This struct is intended for direct - use as an array at the field path .status.conditions. For example, - \n type FooStatus struct{ // Represents the observations of a - foo's current state. // Known .status.conditions.type are: \"Available\", - \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge - // +listType=map // +listMapKey=type Conditions []metav1.Condition - `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" - protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }" - properties: - lastTransitionTime: - description: lastTransitionTime is the last time the condition - transitioned from one status to another. This should be when - the underlying condition changed. If that is not known, then - using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: message is a human readable message indicating - details about the transition. This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: observedGeneration represents the .metadata.generation - that the condition was set based upon. For instance, if .metadata.generation - is currently 12, but the .status.conditions[x].observedGeneration - is 9, the condition is out of date with respect to the current - state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: reason contains a programmatic identifier indicating - the reason for the condition's last transition. Producers - of specific condition types may define expected values and - meanings for this field, and whether the values are considered - a guaranteed API. The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - --- Many .condition.type values are consistent across resources - like Available, but because arbitrary conditions can be useful - (see .node.status.conditions), the ability to deconflict is - important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - type: object - type: object - served: true - storage: true - subresources: - status: {} -{{- end }} diff --git a/helm-templates/contour/templates/crds/extensionservices.yaml b/helm-templates/contour/templates/crds/extensionservices.yaml deleted file mode 100644 index b184405..0000000 --- a/helm-templates/contour/templates/crds/extensionservices.yaml +++ /dev/null @@ -1,425 +0,0 @@ -{{- if .Values.contour.manageCRDs }} -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.13.0 - name: extensionservices.projectcontour.io -spec: - preserveUnknownFields: false - group: projectcontour.io - names: - kind: ExtensionService - listKind: ExtensionServiceList - plural: extensionservices - shortNames: - - extensionservice - - extensionservices - singular: extensionservice - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: ExtensionService is the schema for the Contour extension services - API. An ExtensionService resource binds a network service to the Contour - API so that Contour API features can be implemented by collaborating components. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: ExtensionServiceSpec defines the desired state of an ExtensionService - resource. - properties: - loadBalancerPolicy: - description: The policy for load balancing GRPC service requests. - Note that the `Cookie` and `RequestHash` load balancing strategies - cannot be used here. - properties: - requestHashPolicies: - description: RequestHashPolicies contains a list of hash policies - to apply when the `RequestHash` load balancing strategy is chosen. - If an element of the supplied list of hash policies is invalid, - it will be ignored. If the list of hash policies is empty after - validation, the load balancing strategy will fall back to the - default `RoundRobin`. - items: - description: RequestHashPolicy contains configuration for an - individual hash policy on a request attribute. - properties: - hashSourceIP: - description: HashSourceIP should be set to true when request - source IP hash based load balancing is desired. It must - be the only hash option field set, otherwise this request - hash policy object will be ignored. - type: boolean - headerHashOptions: - description: HeaderHashOptions should be set when request - header hash based load balancing is desired. It must be - the only hash option field set, otherwise this request - hash policy object will be ignored. - properties: - headerName: - description: HeaderName is the name of the HTTP request - header that will be used to calculate the hash key. - If the header specified is not present on a request, - no hash will be produced. - minLength: 1 - type: string - type: object - queryParameterHashOptions: - description: QueryParameterHashOptions should be set when - request query parameter hash based load balancing is desired. - It must be the only hash option field set, otherwise this - request hash policy object will be ignored. - properties: - parameterName: - description: ParameterName is the name of the HTTP request - query parameter that will be used to calculate the - hash key. If the query parameter specified is not - present on a request, no hash will be produced. - minLength: 1 - type: string - type: object - terminal: - description: Terminal is a flag that allows for short-circuiting - computing of a hash for a given request. If set to true, - and the request attribute specified in the attribute hash - options is present, no further hash policies will be used - to calculate a hash for the request. - type: boolean - type: object - type: array - strategy: - description: Strategy specifies the policy used to balance requests - across the pool of backend pods. Valid policy names are `Random`, - `RoundRobin`, `WeightedLeastRequest`, `Cookie`, and `RequestHash`. - If an unknown strategy name is specified or no policy is supplied, - the default `RoundRobin` policy is used. - type: string - type: object - protocol: - description: Protocol may be used to specify (or override) the protocol - used to reach this Service. Values may be h2 or h2c. If omitted, - protocol-selection falls back on Service annotations. - enum: - - h2 - - h2c - type: string - protocolVersion: - description: This field sets the version of the GRPC protocol that - Envoy uses to send requests to the extension service. Since Contour - always uses the v3 Envoy API, this is currently fixed at "v3". However, - other protocol options will be available in future. - enum: - - v3 - type: string - services: - description: Services specifies the set of Kubernetes Service resources - that receive GRPC extension API requests. If no weights are specified - for any of the entries in this array, traffic will be spread evenly - across all the services. Otherwise, traffic is balanced proportionally - to the Weight field in each entry. - items: - description: ExtensionServiceTarget defines an Kubernetes Service - to target with extension service traffic. - properties: - name: - description: Name is the name of Kubernetes service that will - accept service traffic. - type: string - port: - description: Port (defined as Integer) to proxy traffic to since - a service can have multiple defined. - exclusiveMaximum: true - maximum: 65536 - minimum: 1 - type: integer - weight: - description: Weight defines proportion of traffic to balance - to the Kubernetes Service. - format: int32 - type: integer - required: - - name - - port - type: object - minItems: 1 - type: array - timeoutPolicy: - description: The timeout policy for requests to the services. - properties: - idle: - description: Timeout for how long the proxy should wait while - there is no activity during single request/response (for HTTP/1.1) - or stream (for HTTP/2). Timeout will not trigger while HTTP/1.1 - connection is idle between two consecutive requests. If not - specified, there is no per-route idle timeout, though a connection - manager-wide stream_idle_timeout default of 5m still applies. - pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+|infinity|infinite)$ - type: string - idleConnection: - description: Timeout for how long connection from the proxy to - the upstream service is kept when there are no active requests. - If not supplied, Envoy's default value of 1h applies. - pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+|infinity|infinite)$ - type: string - response: - description: Timeout for receiving a response from the server - after processing a request from client. If not supplied, Envoy's - default value of 15s applies. - pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+|infinity|infinite)$ - type: string - type: object - validation: - description: UpstreamValidation defines how to verify the backend - service's certificate - properties: - caSecret: - description: Name or namespaced name of the Kubernetes secret - used to validate the certificate presented by the backend. The - secret must contain key named ca.crt. The name can be optionally - prefixed with namespace "namespace/name". When cross-namespace - reference is used, TLSCertificateDelegation resource must exist - in the namespace to grant access to the secret. - type: string - subjectName: - description: Key which is expected to be present in the 'subjectAltName' - of the presented certificate. - type: string - required: - - caSecret - - subjectName - type: object - required: - - services - type: object - status: - description: ExtensionServiceStatus defines the observed state of an ExtensionService - resource. - properties: - conditions: - description: "Conditions contains the current status of the ExtensionService - resource. \n Contour will update a single condition, `Valid`, that - is in normal-true polarity. \n Contour will not modify any other - Conditions set in this block, in case some other controller wants - to add a Condition." - items: - description: "DetailedCondition is an extension of the normal Kubernetes - conditions, with two extra fields to hold sub-conditions, which - provide more detailed reasons for the state (True or False) of - the condition. \n `errors` holds information about sub-conditions - which are fatal to that condition and render its state False. - \n `warnings` holds information about sub-conditions which are - not fatal to that condition and do not force the state to be False. - \n Remember that Conditions have a type, a status, and a reason. - \n The type is the type of the condition, the most important one - in this CRD set is `Valid`. `Valid` is a positive-polarity condition: - when it is `status: true` there are no problems. \n In more detail, - `status: true` means that the object is has been ingested into - Contour with no errors. `warnings` may still be present, and will - be indicated in the Reason field. There must be zero entries in - the `errors` slice in this case. \n `Valid`, `status: false` means - that the object has had one or more fatal errors during processing - into Contour. The details of the errors will be present under - the `errors` field. There must be at least one error in the `errors` - slice if `status` is `false`. \n For DetailedConditions of types - other than `Valid`, the Condition must be in the negative polarity. - When they have `status` `true`, there is an error. There must - be at least one entry in the `errors` Subcondition slice. When - they have `status` `false`, there are no serious errors, and there - must be zero entries in the `errors` slice. In either case, there - may be entries in the `warnings` slice. \n Regardless of the polarity, - the `reason` and `message` fields must be updated with either - the detail of the reason (if there is one and only one entry in - total across both the `errors` and `warnings` slices), or `MultipleReasons` - if there is more than one entry." - properties: - errors: - description: "Errors contains a slice of relevant error subconditions - for this object. \n Subconditions are expected to appear when - relevant (when there is a error), and disappear when not relevant. - An empty slice here indicates no errors." - items: - description: "SubCondition is a Condition-like type intended - for use as a subcondition inside a DetailedCondition. \n - It contains a subset of the Condition fields. \n It is intended - for warnings and errors, so `type` names should use abnormal-true - polarity, that is, they should be of the form \"ErrorPresent: - true\". \n The expected lifecycle for these errors is that - they should only be present when the error or warning is, - and should be removed when they are not relevant." - properties: - message: - description: "Message is a human readable message indicating - details about the transition. \n This may be an empty - string." - maxLength: 32768 - type: string - reason: - description: "Reason contains a programmatic identifier - indicating the reason for the condition's last transition. - Producers of specific condition types may define expected - values and meanings for this field, and whether the - values are considered a guaranteed API. \n The value - should be a CamelCase string. \n This field may not - be empty." - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: Status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: "Type of condition in `CamelCase` or in `foo.example.com/CamelCase`. - \n This must be in abnormal-true polarity, that is, - `ErrorFound` or `controller.io/ErrorFound`. \n The regex - it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)" - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - message - - reason - - status - - type - type: object - type: array - lastTransitionTime: - description: lastTransitionTime is the last time the condition - transitioned from one status to another. This should be when - the underlying condition changed. If that is not known, then - using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: message is a human readable message indicating - details about the transition. This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: observedGeneration represents the .metadata.generation - that the condition was set based upon. For instance, if .metadata.generation - is currently 12, but the .status.conditions[x].observedGeneration - is 9, the condition is out of date with respect to the current - state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: reason contains a programmatic identifier indicating - the reason for the condition's last transition. Producers - of specific condition types may define expected values and - meanings for this field, and whether the values are considered - a guaranteed API. The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - --- Many .condition.type values are consistent across resources - like Available, but because arbitrary conditions can be useful - (see .node.status.conditions), the ability to deconflict is - important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - warnings: - description: "Warnings contains a slice of relevant warning - subconditions for this object. \n Subconditions are expected - to appear when relevant (when there is a warning), and disappear - when not relevant. An empty slice here indicates no warnings." - items: - description: "SubCondition is a Condition-like type intended - for use as a subcondition inside a DetailedCondition. \n - It contains a subset of the Condition fields. \n It is intended - for warnings and errors, so `type` names should use abnormal-true - polarity, that is, they should be of the form \"ErrorPresent: - true\". \n The expected lifecycle for these errors is that - they should only be present when the error or warning is, - and should be removed when they are not relevant." - properties: - message: - description: "Message is a human readable message indicating - details about the transition. \n This may be an empty - string." - maxLength: 32768 - type: string - reason: - description: "Reason contains a programmatic identifier - indicating the reason for the condition's last transition. - Producers of specific condition types may define expected - values and meanings for this field, and whether the - values are considered a guaranteed API. \n The value - should be a CamelCase string. \n This field may not - be empty." - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: Status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: "Type of condition in `CamelCase` or in `foo.example.com/CamelCase`. - \n This must be in abnormal-true polarity, that is, - `ErrorFound` or `controller.io/ErrorFound`. \n The regex - it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)" - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - message - - reason - - status - - type - type: object - type: array - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - type: object - type: object - served: true - storage: true - subresources: - status: {} -{{- end }} diff --git a/helm-templates/contour/templates/crds/httpproxies.yaml b/helm-templates/contour/templates/crds/httpproxies.yaml deleted file mode 100644 index 655e692..0000000 --- a/helm-templates/contour/templates/crds/httpproxies.yaml +++ /dev/null @@ -1,2803 +0,0 @@ -{{- if .Values.contour.manageCRDs }} -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.13.0 - name: httpproxies.projectcontour.io -spec: - preserveUnknownFields: false - group: projectcontour.io - names: - kind: HTTPProxy - listKind: HTTPProxyList - plural: httpproxies - shortNames: - - proxy - - proxies - singular: httpproxy - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: Fully qualified domain name - jsonPath: .spec.virtualhost.fqdn - name: FQDN - type: string - - description: Secret with TLS credentials - jsonPath: .spec.virtualhost.tls.secretName - name: TLS Secret - type: string - - description: The current status of the HTTPProxy - jsonPath: .status.currentStatus - name: Status - type: string - - description: Description of the current status - jsonPath: .status.description - name: Status Description - type: string - name: v1 - schema: - openAPIV3Schema: - description: HTTPProxy is an Ingress CRD specification. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: HTTPProxySpec defines the spec of the CRD. - properties: - includes: - description: Includes allow for specific routing configuration to - be included from another HTTPProxy, possibly in another namespace. - items: - description: Include describes a set of policies that can be applied - to an HTTPProxy in a namespace. - properties: - conditions: - description: 'Conditions are a set of rules that are applied - to included HTTPProxies. In effect, they are added onto the - Conditions of included HTTPProxy Route structs. When applied, - they are merged using AND, with one exception: There can be - only one Prefix MatchCondition per Conditions slice. More - than one Prefix, or contradictory Conditions, will make the - include invalid. Exact and Regex match conditions are not - allowed on includes.' - items: - description: MatchCondition are a general holder for matching - rules for HTTPProxies. One of Prefix, Exact, Regex, Header - or QueryParameter must be provided. - properties: - exact: - description: Exact defines a exact match for a request. - This field is not allowed in include match conditions. - type: string - header: - description: Header specifies the header condition to - match. - properties: - contains: - description: Contains specifies a substring that must - be present in the header value. - type: string - exact: - description: Exact specifies a string that the header - value must be equal to. - type: string - ignoreCase: - description: IgnoreCase specifies that string matching - should be case insensitive. Note that this has no - effect on the Regex parameter. - type: boolean - name: - description: Name is the name of the header to match - against. Name is required. Header names are case - insensitive. - type: string - notcontains: - description: NotContains specifies a substring that - must not be present in the header value. - type: string - notexact: - description: NoExact specifies a string that the header - value must not be equal to. The condition is true - if the header has any other value. - type: string - notpresent: - description: NotPresent specifies that condition is - true when the named header is not present. Note - that setting NotPresent to false does not make the - condition true if the named header is present. - type: boolean - present: - description: Present specifies that condition is true - when the named header is present, regardless of - its value. Note that setting Present to false does - not make the condition true if the named header - is absent. - type: boolean - regex: - description: Regex specifies a regular expression - pattern that must match the header value. - type: string - treatMissingAsEmpty: - description: TreatMissingAsEmpty specifies if the - header match rule specified header does not exist, - this header value will be treated as empty. Defaults - to false. Unlike the underlying Envoy implementation - this is **only** supported for negative matches - (e.g. NotContains, NotExact). - type: boolean - required: - - name - type: object - prefix: - description: Prefix defines a prefix match for a request. - type: string - queryParameter: - description: QueryParameter specifies the query parameter - condition to match. - properties: - contains: - description: Contains specifies a substring that must - be present in the query parameter value. - type: string - exact: - description: Exact specifies a string that the query - parameter value must be equal to. - type: string - ignoreCase: - description: IgnoreCase specifies that string matching - should be case insensitive. Note that this has no - effect on the Regex parameter. - type: boolean - name: - description: Name is the name of the query parameter - to match against. Name is required. Query parameter - names are case insensitive. - type: string - prefix: - description: Prefix defines a prefix match for the - query parameter value. - type: string - present: - description: Present specifies that condition is true - when the named query parameter is present, regardless - of its value. Note that setting Present to false - does not make the condition true if the named query - parameter is absent. - type: boolean - regex: - description: Regex specifies a regular expression - pattern that must match the query parameter value. - type: string - suffix: - description: Suffix defines a suffix match for a query - parameter value. - type: string - required: - - name - type: object - regex: - description: Regex defines a regex match for a request. - This field is not allowed in include match conditions. - type: string - type: object - type: array - name: - description: Name of the HTTPProxy - type: string - namespace: - description: Namespace of the HTTPProxy to include. Defaults - to the current namespace if not supplied. - type: string - required: - - name - type: object - type: array - ingressClassName: - description: IngressClassName optionally specifies the ingress class - to use for this HTTPProxy. This replaces the deprecated `kubernetes.io/ingress.class` - annotation. For backwards compatibility, when that annotation is - set, it is given precedence over this field. - type: string - routes: - description: Routes are the ingress routes. If TCPProxy is present, - Routes is ignored. - items: - description: Route contains the set of routes for a virtual host. - properties: - authPolicy: - description: AuthPolicy updates the authorization policy that - was set on the root HTTPProxy object for client requests that - match this route. - properties: - context: - additionalProperties: - type: string - description: Context is a set of key/value pairs that are - sent to the authentication server in the check request. - If a context is provided at an enclosing scope, the entries - are merged such that the inner scope overrides matching - keys from the outer scope. - type: object - disabled: - description: When true, this field disables client request - authentication for the scope of the policy. - type: boolean - type: object - conditions: - description: 'Conditions are a set of rules that are applied - to a Route. When applied, they are merged using AND, with - one exception: There can be only one Prefix, Exact or Regex - MatchCondition per Conditions slice. More than one of these - condition types, or contradictory Conditions, will make the - route invalid.' - items: - description: MatchCondition are a general holder for matching - rules for HTTPProxies. One of Prefix, Exact, Regex, Header - or QueryParameter must be provided. - properties: - exact: - description: Exact defines a exact match for a request. - This field is not allowed in include match conditions. - type: string - header: - description: Header specifies the header condition to - match. - properties: - contains: - description: Contains specifies a substring that must - be present in the header value. - type: string - exact: - description: Exact specifies a string that the header - value must be equal to. - type: string - ignoreCase: - description: IgnoreCase specifies that string matching - should be case insensitive. Note that this has no - effect on the Regex parameter. - type: boolean - name: - description: Name is the name of the header to match - against. Name is required. Header names are case - insensitive. - type: string - notcontains: - description: NotContains specifies a substring that - must not be present in the header value. - type: string - notexact: - description: NoExact specifies a string that the header - value must not be equal to. The condition is true - if the header has any other value. - type: string - notpresent: - description: NotPresent specifies that condition is - true when the named header is not present. Note - that setting NotPresent to false does not make the - condition true if the named header is present. - type: boolean - present: - description: Present specifies that condition is true - when the named header is present, regardless of - its value. Note that setting Present to false does - not make the condition true if the named header - is absent. - type: boolean - regex: - description: Regex specifies a regular expression - pattern that must match the header value. - type: string - treatMissingAsEmpty: - description: TreatMissingAsEmpty specifies if the - header match rule specified header does not exist, - this header value will be treated as empty. Defaults - to false. Unlike the underlying Envoy implementation - this is **only** supported for negative matches - (e.g. NotContains, NotExact). - type: boolean - required: - - name - type: object - prefix: - description: Prefix defines a prefix match for a request. - type: string - queryParameter: - description: QueryParameter specifies the query parameter - condition to match. - properties: - contains: - description: Contains specifies a substring that must - be present in the query parameter value. - type: string - exact: - description: Exact specifies a string that the query - parameter value must be equal to. - type: string - ignoreCase: - description: IgnoreCase specifies that string matching - should be case insensitive. Note that this has no - effect on the Regex parameter. - type: boolean - name: - description: Name is the name of the query parameter - to match against. Name is required. Query parameter - names are case insensitive. - type: string - prefix: - description: Prefix defines a prefix match for the - query parameter value. - type: string - present: - description: Present specifies that condition is true - when the named query parameter is present, regardless - of its value. Note that setting Present to false - does not make the condition true if the named query - parameter is absent. - type: boolean - regex: - description: Regex specifies a regular expression - pattern that must match the query parameter value. - type: string - suffix: - description: Suffix defines a suffix match for a query - parameter value. - type: string - required: - - name - type: object - regex: - description: Regex defines a regex match for a request. - This field is not allowed in include match conditions. - type: string - type: object - type: array - cookieRewritePolicies: - description: The policies for rewriting Set-Cookie header attributes. - Note that rewritten cookie names must be unique in this list. - Order rewrite policies are specified in does not matter. - items: - properties: - domainRewrite: - description: DomainRewrite enables rewriting the Set-Cookie - Domain element. If not set, Domain will not be rewritten. - properties: - value: - description: Value is the value to rewrite the Domain - attribute to. For now this is required. - maxLength: 4096 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - value - type: object - name: - description: Name is the name of the cookie for which - attributes will be rewritten. - maxLength: 4096 - minLength: 1 - pattern: ^[^()<>@,;:\\"\/[\]?={} \t\x7f\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f]+$ - type: string - pathRewrite: - description: PathRewrite enables rewriting the Set-Cookie - Path element. If not set, Path will not be rewritten. - properties: - value: - description: Value is the value to rewrite the Path - attribute to. For now this is required. - maxLength: 4096 - minLength: 1 - pattern: ^[^;\x7f\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f]+$ - type: string - required: - - value - type: object - sameSite: - description: SameSite enables rewriting the Set-Cookie - SameSite element. If not set, SameSite attribute will - not be rewritten. - enum: - - Strict - - Lax - - None - type: string - secure: - description: Secure enables rewriting the Set-Cookie Secure - element. If not set, Secure attribute will not be rewritten. - type: boolean - required: - - name - type: object - type: array - directResponsePolicy: - description: DirectResponsePolicy returns an arbitrary HTTP - response directly. - properties: - body: - description: "Body is the content of the response body. - If this setting is omitted, no body is included in the - generated response. \n Note: Body is not recommended to - set too long otherwise it can have significant resource - usage impacts." - type: string - statusCode: - description: StatusCode is the HTTP response status to be - returned. - maximum: 599 - minimum: 200 - type: integer - required: - - statusCode - type: object - enableWebsockets: - description: Enables websocket support for the route. - type: boolean - healthCheckPolicy: - description: The health check policy for this route. - properties: - expectedStatuses: - description: The ranges of HTTP response statuses considered - healthy. Follow half-open semantics, i.e. for each range - the start is inclusive and the end is exclusive. Must - be within the range [100,600). If not specified, only - a 200 response status is considered healthy. - items: - properties: - end: - description: The end (exclusive) of a range of HTTP - status codes. - format: int64 - maximum: 600 - minimum: 101 - type: integer - start: - description: The start (inclusive) of a range of HTTP - status codes. - format: int64 - maximum: 599 - minimum: 100 - type: integer - required: - - end - - start - type: object - type: array - healthyThresholdCount: - description: The number of healthy health checks required - before a host is marked healthy - format: int64 - minimum: 0 - type: integer - host: - description: The value of the host header in the HTTP health - check request. If left empty (default value), the name - "contour-envoy-healthcheck" will be used. - type: string - intervalSeconds: - description: The interval (seconds) between health checks - format: int64 - type: integer - path: - description: HTTP endpoint used to perform health checks - on upstream service - type: string - timeoutSeconds: - description: The time to wait (seconds) for a health check - response - format: int64 - type: integer - unhealthyThresholdCount: - description: The number of unhealthy health checks required - before a host is marked unhealthy - format: int64 - minimum: 0 - type: integer - required: - - path - type: object - internalRedirectPolicy: - description: The policy to define when to handle redirects responses - internally. - properties: - allowCrossSchemeRedirect: - default: Never - description: AllowCrossSchemeRedirect Allow internal redirect - to follow a target URI with a different scheme than the - value of x-forwarded-proto. SafeOnly allows same scheme - redirect and safe cross scheme redirect, which means if - the downstream scheme is HTTPS, both HTTPS and HTTP redirect - targets are allowed, but if the downstream scheme is HTTP, - only HTTP redirect targets are allowed. - enum: - - Always - - Never - - SafeOnly - type: string - denyRepeatedRouteRedirect: - description: If DenyRepeatedRouteRedirect is true, rejects - redirect targets that are pointing to a route that has - been followed by a previous redirect from the current - route. - type: boolean - maxInternalRedirects: - description: MaxInternalRedirects An internal redirect is - not handled, unless the number of previous internal redirects - that a downstream request has encountered is lower than - this value. - format: int32 - type: integer - redirectResponseCodes: - description: RedirectResponseCodes If unspecified, only - 302 will be treated as internal redirect. Only 301, 302, - 303, 307 and 308 are valid values. - items: - description: RedirectResponseCode is a uint32 type alias - with validation to ensure that the value is valid. - enum: - - 301 - - 302 - - 303 - - 307 - - 308 - format: int32 - type: integer - type: array - type: object - ipAllowPolicy: - description: IPAllowFilterPolicy is a list of ipv4/6 filter - rules for which matching requests should be allowed. All other - requests will be denied. Only one of IPAllowFilterPolicy and - IPDenyFilterPolicy can be defined. The rules defined here - override any rules set on the root HTTPProxy. - items: - properties: - cidr: - description: CIDR is a CIDR block of ipv4 or ipv6 addresses - to filter on. This can also be a bare IP address (without - a mask) to filter on exactly one address. - type: string - source: - description: 'Source indicates how to determine the ip - address to filter on, and can be one of two values: - - `Remote` filters on the ip address of the client, - accounting for PROXY and X-Forwarded-For as needed. - - `Peer` filters on the ip of the network request, ignoring - PROXY and X-Forwarded-For.' - enum: - - Peer - - Remote - type: string - required: - - cidr - - source - type: object - type: array - ipDenyPolicy: - description: IPDenyFilterPolicy is a list of ipv4/6 filter rules - for which matching requests should be denied. All other requests - will be allowed. Only one of IPAllowFilterPolicy and IPDenyFilterPolicy - can be defined. The rules defined here override any rules - set on the root HTTPProxy. - items: - properties: - cidr: - description: CIDR is a CIDR block of ipv4 or ipv6 addresses - to filter on. This can also be a bare IP address (without - a mask) to filter on exactly one address. - type: string - source: - description: 'Source indicates how to determine the ip - address to filter on, and can be one of two values: - - `Remote` filters on the ip address of the client, - accounting for PROXY and X-Forwarded-For as needed. - - `Peer` filters on the ip of the network request, ignoring - PROXY and X-Forwarded-For.' - enum: - - Peer - - Remote - type: string - required: - - cidr - - source - type: object - type: array - jwtVerificationPolicy: - description: The policy for verifying JWTs for requests to this - route. - properties: - disabled: - description: Disabled defines whether to disable all JWT - verification for this route. This can be used to opt specific - routes out of the default JWT provider for the HTTPProxy. - At most one of this field or the "require" field can be - specified. - type: boolean - require: - description: Require names a specific JWT provider (defined - in the virtual host) to require for the route. If specified, - this field overrides the default provider if one exists. - If this field is not specified, the default provider will - be required if one exists. At most one of this field or - the "disabled" field can be specified. - type: string - type: object - loadBalancerPolicy: - description: The load balancing policy for this route. - properties: - requestHashPolicies: - description: RequestHashPolicies contains a list of hash - policies to apply when the `RequestHash` load balancing - strategy is chosen. If an element of the supplied list - of hash policies is invalid, it will be ignored. If the - list of hash policies is empty after validation, the load - balancing strategy will fall back to the default `RoundRobin`. - items: - description: RequestHashPolicy contains configuration - for an individual hash policy on a request attribute. - properties: - hashSourceIP: - description: HashSourceIP should be set to true when - request source IP hash based load balancing is desired. - It must be the only hash option field set, otherwise - this request hash policy object will be ignored. - type: boolean - headerHashOptions: - description: HeaderHashOptions should be set when - request header hash based load balancing is desired. - It must be the only hash option field set, otherwise - this request hash policy object will be ignored. - properties: - headerName: - description: HeaderName is the name of the HTTP - request header that will be used to calculate - the hash key. If the header specified is not - present on a request, no hash will be produced. - minLength: 1 - type: string - type: object - queryParameterHashOptions: - description: QueryParameterHashOptions should be set - when request query parameter hash based load balancing - is desired. It must be the only hash option field - set, otherwise this request hash policy object will - be ignored. - properties: - parameterName: - description: ParameterName is the name of the - HTTP request query parameter that will be used - to calculate the hash key. If the query parameter - specified is not present on a request, no hash - will be produced. - minLength: 1 - type: string - type: object - terminal: - description: Terminal is a flag that allows for short-circuiting - computing of a hash for a given request. If set - to true, and the request attribute specified in - the attribute hash options is present, no further - hash policies will be used to calculate a hash for - the request. - type: boolean - type: object - type: array - strategy: - description: Strategy specifies the policy used to balance - requests across the pool of backend pods. Valid policy - names are `Random`, `RoundRobin`, `WeightedLeastRequest`, - `Cookie`, and `RequestHash`. If an unknown strategy name - is specified or no policy is supplied, the default `RoundRobin` - policy is used. - type: string - type: object - pathRewritePolicy: - description: The policy for rewriting the path of the request - URL after the request has been routed to a Service. - properties: - replacePrefix: - description: ReplacePrefix describes how the path prefix - should be replaced. - items: - description: ReplacePrefix describes a path prefix replacement. - properties: - prefix: - description: "Prefix specifies the URL path prefix - to be replaced. \n If Prefix is specified, it must - exactly match the MatchCondition prefix that is - rendered by the chain of including HTTPProxies and - only that path prefix will be replaced by Replacement. - This allows HTTPProxies that are included through - multiple roots to only replace specific path prefixes, - leaving others unmodified. \n If Prefix is not specified, - all routing prefixes rendered by the include chain - will be replaced." - minLength: 1 - type: string - replacement: - description: Replacement is the string that the routing - path prefix will be replaced with. This must not - be empty. - minLength: 1 - type: string - required: - - replacement - type: object - type: array - type: object - permitInsecure: - description: Allow this path to respond to insecure requests - over HTTP which are normally not permitted when a `virtualhost.tls` - block is present. - type: boolean - rateLimitPolicy: - description: The policy for rate limiting on the route. - properties: - global: - description: Global defines global rate limiting parameters, - i.e. parameters defining descriptors that are sent to - an external rate limit service (RLS) for a rate limit - decision on each request. - properties: - descriptors: - description: Descriptors defines the list of descriptors - that will be generated and sent to the rate limit - service. Each descriptor contains 1+ key-value pair - entries. - items: - description: RateLimitDescriptor defines a list of - key-value pair generators. - properties: - entries: - description: Entries is the list of key-value - pair generators. - items: - description: RateLimitDescriptorEntry is a key-value - pair generator. Exactly one field on this - struct must be non-nil. - properties: - genericKey: - description: GenericKey defines a descriptor - entry with a static key and value. - properties: - key: - description: Key defines the key of - the descriptor entry. If not set, - the key is set to "generic_key". - type: string - value: - description: Value defines the value - of the descriptor entry. - minLength: 1 - type: string - type: object - remoteAddress: - description: RemoteAddress defines a descriptor - entry with a key of "remote_address" and - a value equal to the client's IP address - (from x-forwarded-for). - type: object - requestHeader: - description: RequestHeader defines a descriptor - entry that's populated only if a given - header is present on the request. The - descriptor key is static, and the descriptor - value is equal to the value of the header. - properties: - descriptorKey: - description: DescriptorKey defines the - key to use on the descriptor entry. - minLength: 1 - type: string - headerName: - description: HeaderName defines the - name of the header to look for on - the request. - minLength: 1 - type: string - type: object - requestHeaderValueMatch: - description: RequestHeaderValueMatch defines - a descriptor entry that's populated if - the request's headers match a set of 1+ - match criteria. The descriptor key is - "header_match", and the descriptor value - is static. - properties: - expectMatch: - default: true - description: ExpectMatch defines whether - the request must positively match - the match criteria in order to generate - a descriptor entry (i.e. true), or - not match the match criteria in order - to generate a descriptor entry (i.e. - false). The default is true. - type: boolean - headers: - description: Headers is a list of 1+ - match criteria to apply against the - request to determine whether to populate - the descriptor entry or not. - items: - description: HeaderMatchCondition - specifies how to conditionally match - against HTTP headers. The Name field - is required, only one of Present, - NotPresent, Contains, NotContains, - Exact, NotExact and Regex can be - set. For negative matching rules - only (e.g. NotContains or NotExact) - you can set TreatMissingAsEmpty. - IgnoreCase has no effect for Regex. - properties: - contains: - description: Contains specifies - a substring that must be present - in the header value. - type: string - exact: - description: Exact specifies a - string that the header value - must be equal to. - type: string - ignoreCase: - description: IgnoreCase specifies - that string matching should - be case insensitive. Note that - this has no effect on the Regex - parameter. - type: boolean - name: - description: Name is the name - of the header to match against. - Name is required. Header names - are case insensitive. - type: string - notcontains: - description: NotContains specifies - a substring that must not be - present in the header value. - type: string - notexact: - description: NoExact specifies - a string that the header value - must not be equal to. The condition - is true if the header has any - other value. - type: string - notpresent: - description: NotPresent specifies - that condition is true when - the named header is not present. - Note that setting NotPresent - to false does not make the condition - true if the named header is - present. - type: boolean - present: - description: Present specifies - that condition is true when - the named header is present, - regardless of its value. Note - that setting Present to false - does not make the condition - true if the named header is - absent. - type: boolean - regex: - description: Regex specifies a - regular expression pattern that - must match the header value. - type: string - treatMissingAsEmpty: - description: TreatMissingAsEmpty - specifies if the header match - rule specified header does not - exist, this header value will - be treated as empty. Defaults - to false. Unlike the underlying - Envoy implementation this is - **only** supported for negative - matches (e.g. NotContains, NotExact). - type: boolean - required: - - name - type: object - minItems: 1 - type: array - value: - description: Value defines the value - of the descriptor entry. - minLength: 1 - type: string - type: object - type: object - minItems: 1 - type: array - type: object - minItems: 1 - type: array - disabled: - description: Disabled configures the HTTPProxy to not - use the default global rate limit policy defined by - the Contour configuration. - type: boolean - type: object - local: - description: Local defines local rate limiting parameters, - i.e. parameters for rate limiting that occurs within each - Envoy pod as requests are handled. - properties: - burst: - description: Burst defines the number of requests above - the requests per unit that should be allowed within - a short period of time. - format: int32 - type: integer - requests: - description: Requests defines how many requests per - unit of time should be allowed before rate limiting - occurs. - format: int32 - minimum: 1 - type: integer - responseHeadersToAdd: - description: ResponseHeadersToAdd is an optional list - of response headers to set when a request is rate-limited. - items: - description: HeaderValue represents a header name/value - pair - properties: - name: - description: Name represents a key of a header - minLength: 1 - type: string - value: - description: Value represents the value of a header - specified by a key - minLength: 1 - type: string - required: - - name - - value - type: object - type: array - responseStatusCode: - description: ResponseStatusCode is the HTTP status code - to use for responses to rate-limited requests. Codes - must be in the 400-599 range (inclusive). If not specified, - the Envoy default of 429 (Too Many Requests) is used. - format: int32 - maximum: 599 - minimum: 400 - type: integer - unit: - description: Unit defines the period of time within - which requests over the limit will be rate limited. - Valid values are "second", "minute" and "hour". - enum: - - second - - minute - - hour - type: string - required: - - requests - - unit - type: object - type: object - requestHeadersPolicy: - description: "The policy for managing request headers during - proxying. \n You may dynamically rewrite the Host header to - be forwarded upstream to the content of a request header using - the below format \"%REQ(X-Header-Name)%\". If the value of - the header is empty, it is ignored. \n *NOTE: Pay attention - to the potential security implications of using this option. - Provided header must come from trusted source. \n **NOTE: - The header rewrite is only done while forwarding and has no - bearing on the routing decision." - properties: - remove: - description: Remove specifies a list of HTTP header names - to remove. - items: - type: string - type: array - set: - description: Set specifies a list of HTTP header values - that will be set in the HTTP header. If the header does - not exist it will be added, otherwise it will be overwritten - with the new value. - items: - description: HeaderValue represents a header name/value - pair - properties: - name: - description: Name represents a key of a header - minLength: 1 - type: string - value: - description: Value represents the value of a header - specified by a key - minLength: 1 - type: string - required: - - name - - value - type: object - type: array - type: object - requestRedirectPolicy: - description: RequestRedirectPolicy defines an HTTP redirection. - properties: - hostname: - description: Hostname is the precise hostname to be used - in the value of the `Location` header in the response. - When empty, the hostname of the request is used. No wildcards - are allowed. - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - path: - description: "Path allows for redirection to a different - path from the original on the request. The path must start - with a leading slash. \n Note: Only one of Path or Prefix - can be defined." - pattern: ^\/.*$ - type: string - port: - description: Port is the port to be used in the value of - the `Location` header in the response. When empty, port - (if specified) of the request is used. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - prefix: - description: "Prefix defines the value to swap the matched - prefix or path with. The prefix must start with a leading - slash. \n Note: Only one of Path or Prefix can be defined." - pattern: ^\/.*$ - type: string - scheme: - description: Scheme is the scheme to be used in the value - of the `Location` header in the response. When empty, - the scheme of the request is used. - enum: - - http - - https - type: string - statusCode: - default: 302 - description: StatusCode is the HTTP status code to be used - in response. - enum: - - 301 - - 302 - type: integer - type: object - responseHeadersPolicy: - description: The policy for managing response headers during - proxying. Rewriting the 'Host' header is not supported. - properties: - remove: - description: Remove specifies a list of HTTP header names - to remove. - items: - type: string - type: array - set: - description: Set specifies a list of HTTP header values - that will be set in the HTTP header. If the header does - not exist it will be added, otherwise it will be overwritten - with the new value. - items: - description: HeaderValue represents a header name/value - pair - properties: - name: - description: Name represents a key of a header - minLength: 1 - type: string - value: - description: Value represents the value of a header - specified by a key - minLength: 1 - type: string - required: - - name - - value - type: object - type: array - type: object - retryPolicy: - description: The retry policy for this route. - properties: - count: - default: 1 - description: NumRetries is maximum allowed number of retries. - If set to -1, then retries are disabled. If set to 0 or - not supplied, the value is set to the Envoy default of - 1. - format: int64 - minimum: -1 - type: integer - perTryTimeout: - description: PerTryTimeout specifies the timeout per retry - attempt. Ignored if NumRetries is not supplied. - pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+|infinity|infinite)$ - type: string - retriableStatusCodes: - description: "RetriableStatusCodes specifies the HTTP status - codes that should be retried. \n This field is only respected - when you include `retriable-status-codes` in the `RetryOn` - field." - items: - format: int32 - type: integer - type: array - retryOn: - description: "RetryOn specifies the conditions on which - to retry a request. \n Supported [HTTP conditions](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#x-envoy-retry-on): - \n - `5xx` - `gateway-error` - `reset` - `connect-failure` - - `retriable-4xx` - `refused-stream` - `retriable-status-codes` - - `retriable-headers` \n Supported [gRPC conditions](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#x-envoy-retry-grpc-on): - \n - `cancelled` - `deadline-exceeded` - `internal` - - `resource-exhausted` - `unavailable`" - items: - description: RetryOn is a string type alias with validation - to ensure that the value is valid. - enum: - - 5xx - - gateway-error - - reset - - connect-failure - - retriable-4xx - - refused-stream - - retriable-status-codes - - retriable-headers - - cancelled - - deadline-exceeded - - internal - - resource-exhausted - - unavailable - type: string - type: array - type: object - services: - description: Services are the services to proxy traffic. - items: - description: Service defines an Kubernetes Service to proxy - traffic. - properties: - cookieRewritePolicies: - description: The policies for rewriting Set-Cookie header - attributes. - items: - properties: - domainRewrite: - description: DomainRewrite enables rewriting the - Set-Cookie Domain element. If not set, Domain - will not be rewritten. - properties: - value: - description: Value is the value to rewrite the - Domain attribute to. For now this is required. - maxLength: 4096 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - value - type: object - name: - description: Name is the name of the cookie for - which attributes will be rewritten. - maxLength: 4096 - minLength: 1 - pattern: ^[^()<>@,;:\\"\/[\]?={} \t\x7f\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f]+$ - type: string - pathRewrite: - description: PathRewrite enables rewriting the Set-Cookie - Path element. If not set, Path will not be rewritten. - properties: - value: - description: Value is the value to rewrite the - Path attribute to. For now this is required. - maxLength: 4096 - minLength: 1 - pattern: ^[^;\x7f\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f]+$ - type: string - required: - - value - type: object - sameSite: - description: SameSite enables rewriting the Set-Cookie - SameSite element. If not set, SameSite attribute - will not be rewritten. - enum: - - Strict - - Lax - - None - type: string - secure: - description: Secure enables rewriting the Set-Cookie - Secure element. If not set, Secure attribute will - not be rewritten. - type: boolean - required: - - name - type: object - type: array - healthPort: - description: HealthPort is the port for this service healthcheck. - If not specified, Port is used for service healthchecks. - maximum: 65535 - minimum: 1 - type: integer - mirror: - description: 'If Mirror is true the Service will receive - a read only mirror of the traffic for this route. If - Mirror is true, then fractional mirroring can be enabled - by optionally setting the Weight field. Legal values - for Weight are 1-100. Omitting the Weight field will - result in 100% mirroring. NOTE: Setting Weight explicitly - to 0 will unexpectedly result in 100% traffic mirroring. - This occurs since we cannot distinguish omitted fields - from those explicitly set to their default values' - type: boolean - name: - description: Name is the name of Kubernetes service to - proxy traffic. Names defined here will be used to look - up corresponding endpoints which contain the ips to - route. - type: string - port: - description: Port (defined as Integer) to proxy traffic - to since a service can have multiple defined. - exclusiveMaximum: true - maximum: 65536 - minimum: 1 - type: integer - protocol: - description: Protocol may be used to specify (or override) - the protocol used to reach this Service. Values may - be tls, h2, h2c. If omitted, protocol-selection falls - back on Service annotations. - enum: - - h2 - - h2c - - tls - type: string - requestHeadersPolicy: - description: The policy for managing request headers during - proxying. - properties: - remove: - description: Remove specifies a list of HTTP header - names to remove. - items: - type: string - type: array - set: - description: Set specifies a list of HTTP header values - that will be set in the HTTP header. If the header - does not exist it will be added, otherwise it will - be overwritten with the new value. - items: - description: HeaderValue represents a header name/value - pair - properties: - name: - description: Name represents a key of a header - minLength: 1 - type: string - value: - description: Value represents the value of a - header specified by a key - minLength: 1 - type: string - required: - - name - - value - type: object - type: array - type: object - responseHeadersPolicy: - description: The policy for managing response headers - during proxying. Rewriting the 'Host' header is not - supported. - properties: - remove: - description: Remove specifies a list of HTTP header - names to remove. - items: - type: string - type: array - set: - description: Set specifies a list of HTTP header values - that will be set in the HTTP header. If the header - does not exist it will be added, otherwise it will - be overwritten with the new value. - items: - description: HeaderValue represents a header name/value - pair - properties: - name: - description: Name represents a key of a header - minLength: 1 - type: string - value: - description: Value represents the value of a - header specified by a key - minLength: 1 - type: string - required: - - name - - value - type: object - type: array - type: object - slowStartPolicy: - description: Slow start will gradually increase amount - of traffic to a newly added endpoint. - properties: - aggression: - default: "1.0" - description: "The speed of traffic increase over the - slow start window. Defaults to 1.0, so that endpoint - would get linearly increasing amount of traffic. - When increasing the value for this parameter, the - speed of traffic ramp-up increases non-linearly. - The value of aggression parameter should be greater - than 0.0. \n More info: https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/slow_start" - pattern: ^([0-9]+([.][0-9]+)?|[.][0-9]+)$ - type: string - minWeightPercent: - default: 10 - description: The minimum or starting percentage of - traffic to send to new endpoints. A non-zero value - helps avoid a too small initial weight, which may - cause endpoints in slow start mode to receive no - traffic in the beginning of the slow start window. - If not specified, the default is 10%. - format: int32 - maximum: 100 - minimum: 0 - type: integer - window: - description: The duration of slow start window. Duration - is expressed in the Go [Duration format](https://godoc.org/time#ParseDuration). - Valid time units are "ns", "us" (or "µs"), "ms", - "s", "m", "h". - pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+)$ - type: string - required: - - window - type: object - validation: - description: UpstreamValidation defines how to verify - the backend service's certificate - properties: - caSecret: - description: Name or namespaced name of the Kubernetes - secret used to validate the certificate presented - by the backend. The secret must contain key named - ca.crt. The name can be optionally prefixed with - namespace "namespace/name". When cross-namespace - reference is used, TLSCertificateDelegation resource - must exist in the namespace to grant access to the - secret. - type: string - subjectName: - description: Key which is expected to be present in - the 'subjectAltName' of the presented certificate. - type: string - required: - - caSecret - - subjectName - type: object - weight: - description: Weight defines percentage of traffic to balance - traffic - format: int64 - minimum: 0 - type: integer - required: - - name - - port - type: object - type: array - timeoutPolicy: - description: The timeout policy for this route. - properties: - idle: - description: Timeout for how long the proxy should wait - while there is no activity during single request/response - (for HTTP/1.1) or stream (for HTTP/2). Timeout will not - trigger while HTTP/1.1 connection is idle between two - consecutive requests. If not specified, there is no per-route - idle timeout, though a connection manager-wide stream_idle_timeout - default of 5m still applies. - pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+|infinity|infinite)$ - type: string - idleConnection: - description: Timeout for how long connection from the proxy - to the upstream service is kept when there are no active - requests. If not supplied, Envoy's default value of 1h - applies. - pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+|infinity|infinite)$ - type: string - response: - description: Timeout for receiving a response from the server - after processing a request from client. If not supplied, - Envoy's default value of 15s applies. - pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+|infinity|infinite)$ - type: string - type: object - type: object - type: array - tcpproxy: - description: TCPProxy holds TCP proxy information. - properties: - healthCheckPolicy: - description: The health check policy for this tcp proxy - properties: - healthyThresholdCount: - description: The number of healthy health checks required - before a host is marked healthy - format: int32 - type: integer - intervalSeconds: - description: The interval (seconds) between health checks - format: int64 - type: integer - timeoutSeconds: - description: The time to wait (seconds) for a health check - response - format: int64 - type: integer - unhealthyThresholdCount: - description: The number of unhealthy health checks required - before a host is marked unhealthy - format: int32 - type: integer - type: object - include: - description: Include specifies that this tcpproxy should be delegated - to another HTTPProxy. - properties: - name: - description: Name of the child HTTPProxy - type: string - namespace: - description: Namespace of the HTTPProxy to include. Defaults - to the current namespace if not supplied. - type: string - required: - - name - type: object - includes: - description: "IncludesDeprecated allow for specific routing configuration - to be appended to another HTTPProxy in another namespace. \n - Exists due to a mistake when developing HTTPProxy and the field - was marked plural when it should have been singular. This field - should stay to not break backwards compatibility to v1 users." - properties: - name: - description: Name of the child HTTPProxy - type: string - namespace: - description: Namespace of the HTTPProxy to include. Defaults - to the current namespace if not supplied. - type: string - required: - - name - type: object - loadBalancerPolicy: - description: The load balancing policy for the backend services. - Note that the `Cookie` and `RequestHash` load balancing strategies - cannot be used here. - properties: - requestHashPolicies: - description: RequestHashPolicies contains a list of hash policies - to apply when the `RequestHash` load balancing strategy - is chosen. If an element of the supplied list of hash policies - is invalid, it will be ignored. If the list of hash policies - is empty after validation, the load balancing strategy will - fall back to the default `RoundRobin`. - items: - description: RequestHashPolicy contains configuration for - an individual hash policy on a request attribute. - properties: - hashSourceIP: - description: HashSourceIP should be set to true when - request source IP hash based load balancing is desired. - It must be the only hash option field set, otherwise - this request hash policy object will be ignored. - type: boolean - headerHashOptions: - description: HeaderHashOptions should be set when request - header hash based load balancing is desired. It must - be the only hash option field set, otherwise this - request hash policy object will be ignored. - properties: - headerName: - description: HeaderName is the name of the HTTP - request header that will be used to calculate - the hash key. If the header specified is not present - on a request, no hash will be produced. - minLength: 1 - type: string - type: object - queryParameterHashOptions: - description: QueryParameterHashOptions should be set - when request query parameter hash based load balancing - is desired. It must be the only hash option field - set, otherwise this request hash policy object will - be ignored. - properties: - parameterName: - description: ParameterName is the name of the HTTP - request query parameter that will be used to calculate - the hash key. If the query parameter specified - is not present on a request, no hash will be produced. - minLength: 1 - type: string - type: object - terminal: - description: Terminal is a flag that allows for short-circuiting - computing of a hash for a given request. If set to - true, and the request attribute specified in the attribute - hash options is present, no further hash policies - will be used to calculate a hash for the request. - type: boolean - type: object - type: array - strategy: - description: Strategy specifies the policy used to balance - requests across the pool of backend pods. Valid policy names - are `Random`, `RoundRobin`, `WeightedLeastRequest`, `Cookie`, - and `RequestHash`. If an unknown strategy name is specified - or no policy is supplied, the default `RoundRobin` policy - is used. - type: string - type: object - services: - description: Services are the services to proxy traffic - items: - description: Service defines an Kubernetes Service to proxy - traffic. - properties: - cookieRewritePolicies: - description: The policies for rewriting Set-Cookie header - attributes. - items: - properties: - domainRewrite: - description: DomainRewrite enables rewriting the Set-Cookie - Domain element. If not set, Domain will not be rewritten. - properties: - value: - description: Value is the value to rewrite the - Domain attribute to. For now this is required. - maxLength: 4096 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - value - type: object - name: - description: Name is the name of the cookie for which - attributes will be rewritten. - maxLength: 4096 - minLength: 1 - pattern: ^[^()<>@,;:\\"\/[\]?={} \t\x7f\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f]+$ - type: string - pathRewrite: - description: PathRewrite enables rewriting the Set-Cookie - Path element. If not set, Path will not be rewritten. - properties: - value: - description: Value is the value to rewrite the - Path attribute to. For now this is required. - maxLength: 4096 - minLength: 1 - pattern: ^[^;\x7f\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f]+$ - type: string - required: - - value - type: object - sameSite: - description: SameSite enables rewriting the Set-Cookie - SameSite element. If not set, SameSite attribute - will not be rewritten. - enum: - - Strict - - Lax - - None - type: string - secure: - description: Secure enables rewriting the Set-Cookie - Secure element. If not set, Secure attribute will - not be rewritten. - type: boolean - required: - - name - type: object - type: array - healthPort: - description: HealthPort is the port for this service healthcheck. - If not specified, Port is used for service healthchecks. - maximum: 65535 - minimum: 1 - type: integer - mirror: - description: 'If Mirror is true the Service will receive - a read only mirror of the traffic for this route. If Mirror - is true, then fractional mirroring can be enabled by optionally - setting the Weight field. Legal values for Weight are - 1-100. Omitting the Weight field will result in 100% mirroring. - NOTE: Setting Weight explicitly to 0 will unexpectedly - result in 100% traffic mirroring. This occurs since we - cannot distinguish omitted fields from those explicitly - set to their default values' - type: boolean - name: - description: Name is the name of Kubernetes service to proxy - traffic. Names defined here will be used to look up corresponding - endpoints which contain the ips to route. - type: string - port: - description: Port (defined as Integer) to proxy traffic - to since a service can have multiple defined. - exclusiveMaximum: true - maximum: 65536 - minimum: 1 - type: integer - protocol: - description: Protocol may be used to specify (or override) - the protocol used to reach this Service. Values may be - tls, h2, h2c. If omitted, protocol-selection falls back - on Service annotations. - enum: - - h2 - - h2c - - tls - type: string - requestHeadersPolicy: - description: The policy for managing request headers during - proxying. - properties: - remove: - description: Remove specifies a list of HTTP header - names to remove. - items: - type: string - type: array - set: - description: Set specifies a list of HTTP header values - that will be set in the HTTP header. If the header - does not exist it will be added, otherwise it will - be overwritten with the new value. - items: - description: HeaderValue represents a header name/value - pair - properties: - name: - description: Name represents a key of a header - minLength: 1 - type: string - value: - description: Value represents the value of a header - specified by a key - minLength: 1 - type: string - required: - - name - - value - type: object - type: array - type: object - responseHeadersPolicy: - description: The policy for managing response headers during - proxying. Rewriting the 'Host' header is not supported. - properties: - remove: - description: Remove specifies a list of HTTP header - names to remove. - items: - type: string - type: array - set: - description: Set specifies a list of HTTP header values - that will be set in the HTTP header. If the header - does not exist it will be added, otherwise it will - be overwritten with the new value. - items: - description: HeaderValue represents a header name/value - pair - properties: - name: - description: Name represents a key of a header - minLength: 1 - type: string - value: - description: Value represents the value of a header - specified by a key - minLength: 1 - type: string - required: - - name - - value - type: object - type: array - type: object - slowStartPolicy: - description: Slow start will gradually increase amount of - traffic to a newly added endpoint. - properties: - aggression: - default: "1.0" - description: "The speed of traffic increase over the - slow start window. Defaults to 1.0, so that endpoint - would get linearly increasing amount of traffic. When - increasing the value for this parameter, the speed - of traffic ramp-up increases non-linearly. The value - of aggression parameter should be greater than 0.0. - \n More info: https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/slow_start" - pattern: ^([0-9]+([.][0-9]+)?|[.][0-9]+)$ - type: string - minWeightPercent: - default: 10 - description: The minimum or starting percentage of traffic - to send to new endpoints. A non-zero value helps avoid - a too small initial weight, which may cause endpoints - in slow start mode to receive no traffic in the beginning - of the slow start window. If not specified, the default - is 10%. - format: int32 - maximum: 100 - minimum: 0 - type: integer - window: - description: The duration of slow start window. Duration - is expressed in the Go [Duration format](https://godoc.org/time#ParseDuration). - Valid time units are "ns", "us" (or "µs"), "ms", "s", - "m", "h". - pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+)$ - type: string - required: - - window - type: object - validation: - description: UpstreamValidation defines how to verify the - backend service's certificate - properties: - caSecret: - description: Name or namespaced name of the Kubernetes - secret used to validate the certificate presented - by the backend. The secret must contain key named - ca.crt. The name can be optionally prefixed with namespace - "namespace/name". When cross-namespace reference is - used, TLSCertificateDelegation resource must exist - in the namespace to grant access to the secret. - type: string - subjectName: - description: Key which is expected to be present in - the 'subjectAltName' of the presented certificate. - type: string - required: - - caSecret - - subjectName - type: object - weight: - description: Weight defines percentage of traffic to balance - traffic - format: int64 - minimum: 0 - type: integer - required: - - name - - port - type: object - type: array - type: object - virtualhost: - description: Virtualhost appears at most once. If it is present, the - object is considered to be a "root" HTTPProxy. - properties: - authorization: - description: This field configures an extension service to perform - authorization for this virtual host. Authorization can only - be configured on virtual hosts that have TLS enabled. If the - TLS configuration requires client certificate validation, the - client certificate is always included in the authentication - check request. - properties: - authPolicy: - description: AuthPolicy sets a default authorization policy - for client requests. This policy will be used unless overridden - by individual routes. - properties: - context: - additionalProperties: - type: string - description: Context is a set of key/value pairs that - are sent to the authentication server in the check request. - If a context is provided at an enclosing scope, the - entries are merged such that the inner scope overrides - matching keys from the outer scope. - type: object - disabled: - description: When true, this field disables client request - authentication for the scope of the policy. - type: boolean - type: object - extensionRef: - description: ExtensionServiceRef specifies the extension resource - that will authorize client requests. - properties: - apiVersion: - description: API version of the referent. If this field - is not specified, the default "projectcontour.io/v1alpha1" - will be used - minLength: 1 - type: string - name: - description: "Name of the referent. \n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names" - minLength: 1 - type: string - namespace: - description: "Namespace of the referent. If this field - is not specifies, the namespace of the resource that - targets the referent will be used. \n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/" - minLength: 1 - type: string - type: object - failOpen: - description: If FailOpen is true, the client request is forwarded - to the upstream service even if the authorization server - fails to respond. This field should not be set in most cases. - It is intended for use only while migrating applications - from internal authorization to Contour external authorization. - type: boolean - responseTimeout: - description: ResponseTimeout configures maximum time to wait - for a check response from the authorization server. Timeout - durations are expressed in the Go [Duration format](https://godoc.org/time#ParseDuration). - Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", - "h". The string "infinity" is also a valid input and specifies - no timeout. - pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+|infinity|infinite)$ - type: string - withRequestBody: - description: WithRequestBody specifies configuration for sending - the client request's body to authorization server. - properties: - allowPartialMessage: - description: If AllowPartialMessage is true, then Envoy - will buffer the body until MaxRequestBytes are reached. - type: boolean - maxRequestBytes: - default: 1024 - description: MaxRequestBytes sets the maximum size of - message body ExtAuthz filter will hold in-memory. - format: int32 - minimum: 1 - type: integer - packAsBytes: - description: If PackAsBytes is true, the body sent to - Authorization Server is in raw bytes. - type: boolean - type: object - type: object - corsPolicy: - description: Specifies the cross-origin policy to apply to the - VirtualHost. - properties: - allowCredentials: - description: Specifies whether the resource allows credentials. - type: boolean - allowHeaders: - description: AllowHeaders specifies the content for the *access-control-allow-headers* - header. - items: - description: CORSHeaderValue specifies the value of the - string headers returned by a cross-domain request. - pattern: ^[a-zA-Z0-9!#$%&'*+.^_`|~-]+$ - type: string - minItems: 1 - type: array - allowMethods: - description: AllowMethods specifies the content for the *access-control-allow-methods* - header. - items: - description: CORSHeaderValue specifies the value of the - string headers returned by a cross-domain request. - pattern: ^[a-zA-Z0-9!#$%&'*+.^_`|~-]+$ - type: string - minItems: 1 - type: array - allowOrigin: - description: AllowOrigin specifies the origins that will be - allowed to do CORS requests. Allowed values include "*" - which signifies any origin is allowed, an exact origin of - the form "scheme://host[:port]" (where port is optional), - or a valid regex pattern. Note that regex patterns are validated - and a simple "glob" pattern (e.g. *.foo.com) will be rejected - or produce unexpected matches when applied as a regex. - items: - type: string - minItems: 1 - type: array - allowPrivateNetwork: - description: AllowPrivateNetwork specifies whether to allow - private network requests. See https://developer.chrome.com/blog/private-network-access-preflight. - type: boolean - exposeHeaders: - description: ExposeHeaders Specifies the content for the *access-control-expose-headers* - header. - items: - description: CORSHeaderValue specifies the value of the - string headers returned by a cross-domain request. - pattern: ^[a-zA-Z0-9!#$%&'*+.^_`|~-]+$ - type: string - minItems: 1 - type: array - maxAge: - description: MaxAge indicates for how long the results of - a preflight request can be cached. MaxAge durations are - expressed in the Go [Duration format](https://godoc.org/time#ParseDuration). - Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", - "h". Only positive values are allowed while 0 disables the - cache requiring a preflight OPTIONS check for all cross-origin - requests. - pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+|0)$ - type: string - required: - - allowMethods - - allowOrigin - type: object - fqdn: - description: The fully qualified domain name of the root of the - ingress tree all leaves of the DAG rooted at this object relate - to the fqdn. - pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - ipAllowPolicy: - description: IPAllowFilterPolicy is a list of ipv4/6 filter rules - for which matching requests should be allowed. All other requests - will be denied. Only one of IPAllowFilterPolicy and IPDenyFilterPolicy - can be defined. The rules defined here may be overridden in - a Route. - items: - properties: - cidr: - description: CIDR is a CIDR block of ipv4 or ipv6 addresses - to filter on. This can also be a bare IP address (without - a mask) to filter on exactly one address. - type: string - source: - description: 'Source indicates how to determine the ip address - to filter on, and can be one of two values: - `Remote` - filters on the ip address of the client, accounting for - PROXY and X-Forwarded-For as needed. - `Peer` filters - on the ip of the network request, ignoring PROXY and X-Forwarded-For.' - enum: - - Peer - - Remote - type: string - required: - - cidr - - source - type: object - type: array - ipDenyPolicy: - description: IPDenyFilterPolicy is a list of ipv4/6 filter rules - for which matching requests should be denied. All other requests - will be allowed. Only one of IPAllowFilterPolicy and IPDenyFilterPolicy - can be defined. The rules defined here may be overridden in - a Route. - items: - properties: - cidr: - description: CIDR is a CIDR block of ipv4 or ipv6 addresses - to filter on. This can also be a bare IP address (without - a mask) to filter on exactly one address. - type: string - source: - description: 'Source indicates how to determine the ip address - to filter on, and can be one of two values: - `Remote` - filters on the ip address of the client, accounting for - PROXY and X-Forwarded-For as needed. - `Peer` filters - on the ip of the network request, ignoring PROXY and X-Forwarded-For.' - enum: - - Peer - - Remote - type: string - required: - - cidr - - source - type: object - type: array - jwtProviders: - description: Providers to use for verifying JSON Web Tokens (JWTs) - on the virtual host. - items: - description: JWTProvider defines how to verify JWTs on requests. - properties: - audiences: - description: Audiences that JWTs are allowed to have in - the "aud" field. If not provided, JWT audiences are not - checked. - items: - type: string - type: array - default: - description: Whether the provider should apply to all routes - in the HTTPProxy/its includes by default. At most one - provider can be marked as the default. If no provider - is marked as the default, individual routes must explicitly - identify the provider they require. - type: boolean - forwardJWT: - description: Whether the JWT should be forwarded to the - backend service after successful verification. By default, - the JWT is not forwarded. - type: boolean - issuer: - description: Issuer that JWTs are required to have in the - "iss" field. If not provided, JWT issuers are not checked. - type: string - name: - description: Unique name for the provider. - minLength: 1 - type: string - remoteJWKS: - description: Remote JWKS to use for verifying JWT signatures. - properties: - cacheDuration: - description: How long to cache the JWKS locally. If - not specified, Envoy's default of 5m applies. - pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+)$ - type: string - dnsLookupFamily: - description: "The DNS IP address resolution policy for - the JWKS URI. When configured as \"v4\", the DNS resolver - will only perform a lookup for addresses in the IPv4 - family. If \"v6\" is configured, the DNS resolver - will only perform a lookup for addresses in the IPv6 - family. If \"all\" is configured, the DNS resolver - will perform a lookup for addresses in both the IPv4 - and IPv6 family. If \"auto\" is configured, the DNS - resolver will first perform a lookup for addresses - in the IPv6 family and fallback to a lookup for addresses - in the IPv4 family. If not specified, the Contour-wide - setting defined in the config file or ContourConfiguration - applies (defaults to \"auto\"). \n See https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto.html#envoy-v3-api-enum-config-cluster-v3-cluster-dnslookupfamily - for more information." - enum: - - auto - - v4 - - v6 - type: string - timeout: - description: How long to wait for a response from the - URI. If not specified, a default of 1s applies. - pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+)$ - type: string - uri: - description: The URI for the JWKS. - minLength: 1 - type: string - validation: - description: UpstreamValidation defines how to verify - the JWKS's TLS certificate. - properties: - caSecret: - description: Name or namespaced name of the Kubernetes - secret used to validate the certificate presented - by the backend. The secret must contain key named - ca.crt. The name can be optionally prefixed with - namespace "namespace/name". When cross-namespace - reference is used, TLSCertificateDelegation resource - must exist in the namespace to grant access to - the secret. - type: string - subjectName: - description: Key which is expected to be present - in the 'subjectAltName' of the presented certificate. - type: string - required: - - caSecret - - subjectName - type: object - required: - - uri - type: object - required: - - name - - remoteJWKS - type: object - type: array - rateLimitPolicy: - description: The policy for rate limiting on the virtual host. - properties: - global: - description: Global defines global rate limiting parameters, - i.e. parameters defining descriptors that are sent to an - external rate limit service (RLS) for a rate limit decision - on each request. - properties: - descriptors: - description: Descriptors defines the list of descriptors - that will be generated and sent to the rate limit service. - Each descriptor contains 1+ key-value pair entries. - items: - description: RateLimitDescriptor defines a list of key-value - pair generators. - properties: - entries: - description: Entries is the list of key-value pair - generators. - items: - description: RateLimitDescriptorEntry is a key-value - pair generator. Exactly one field on this struct - must be non-nil. - properties: - genericKey: - description: GenericKey defines a descriptor - entry with a static key and value. - properties: - key: - description: Key defines the key of the - descriptor entry. If not set, the key - is set to "generic_key". - type: string - value: - description: Value defines the value of - the descriptor entry. - minLength: 1 - type: string - type: object - remoteAddress: - description: RemoteAddress defines a descriptor - entry with a key of "remote_address" and - a value equal to the client's IP address - (from x-forwarded-for). - type: object - requestHeader: - description: RequestHeader defines a descriptor - entry that's populated only if a given header - is present on the request. The descriptor - key is static, and the descriptor value - is equal to the value of the header. - properties: - descriptorKey: - description: DescriptorKey defines the - key to use on the descriptor entry. - minLength: 1 - type: string - headerName: - description: HeaderName defines the name - of the header to look for on the request. - minLength: 1 - type: string - type: object - requestHeaderValueMatch: - description: RequestHeaderValueMatch defines - a descriptor entry that's populated if the - request's headers match a set of 1+ match - criteria. The descriptor key is "header_match", - and the descriptor value is static. - properties: - expectMatch: - default: true - description: ExpectMatch defines whether - the request must positively match the - match criteria in order to generate - a descriptor entry (i.e. true), or not - match the match criteria in order to - generate a descriptor entry (i.e. false). - The default is true. - type: boolean - headers: - description: Headers is a list of 1+ match - criteria to apply against the request - to determine whether to populate the - descriptor entry or not. - items: - description: HeaderMatchCondition specifies - how to conditionally match against - HTTP headers. The Name field is required, - only one of Present, NotPresent, Contains, - NotContains, Exact, NotExact and Regex - can be set. For negative matching - rules only (e.g. NotContains or NotExact) - you can set TreatMissingAsEmpty. IgnoreCase - has no effect for Regex. - properties: - contains: - description: Contains specifies - a substring that must be present - in the header value. - type: string - exact: - description: Exact specifies a string - that the header value must be - equal to. - type: string - ignoreCase: - description: IgnoreCase specifies - that string matching should be - case insensitive. Note that this - has no effect on the Regex parameter. - type: boolean - name: - description: Name is the name of - the header to match against. Name - is required. Header names are - case insensitive. - type: string - notcontains: - description: NotContains specifies - a substring that must not be present - in the header value. - type: string - notexact: - description: NoExact specifies a - string that the header value must - not be equal to. The condition - is true if the header has any - other value. - type: string - notpresent: - description: NotPresent specifies - that condition is true when the - named header is not present. Note - that setting NotPresent to false - does not make the condition true - if the named header is present. - type: boolean - present: - description: Present specifies that - condition is true when the named - header is present, regardless - of its value. Note that setting - Present to false does not make - the condition true if the named - header is absent. - type: boolean - regex: - description: Regex specifies a regular - expression pattern that must match - the header value. - type: string - treatMissingAsEmpty: - description: TreatMissingAsEmpty - specifies if the header match - rule specified header does not - exist, this header value will - be treated as empty. Defaults - to false. Unlike the underlying - Envoy implementation this is **only** - supported for negative matches - (e.g. NotContains, NotExact). - type: boolean - required: - - name - type: object - minItems: 1 - type: array - value: - description: Value defines the value of - the descriptor entry. - minLength: 1 - type: string - type: object - type: object - minItems: 1 - type: array - type: object - minItems: 1 - type: array - disabled: - description: Disabled configures the HTTPProxy to not - use the default global rate limit policy defined by - the Contour configuration. - type: boolean - type: object - local: - description: Local defines local rate limiting parameters, - i.e. parameters for rate limiting that occurs within each - Envoy pod as requests are handled. - properties: - burst: - description: Burst defines the number of requests above - the requests per unit that should be allowed within - a short period of time. - format: int32 - type: integer - requests: - description: Requests defines how many requests per unit - of time should be allowed before rate limiting occurs. - format: int32 - minimum: 1 - type: integer - responseHeadersToAdd: - description: ResponseHeadersToAdd is an optional list - of response headers to set when a request is rate-limited. - items: - description: HeaderValue represents a header name/value - pair - properties: - name: - description: Name represents a key of a header - minLength: 1 - type: string - value: - description: Value represents the value of a header - specified by a key - minLength: 1 - type: string - required: - - name - - value - type: object - type: array - responseStatusCode: - description: ResponseStatusCode is the HTTP status code - to use for responses to rate-limited requests. Codes - must be in the 400-599 range (inclusive). If not specified, - the Envoy default of 429 (Too Many Requests) is used. - format: int32 - maximum: 599 - minimum: 400 - type: integer - unit: - description: Unit defines the period of time within which - requests over the limit will be rate limited. Valid - values are "second", "minute" and "hour". - enum: - - second - - minute - - hour - type: string - required: - - requests - - unit - type: object - type: object - tls: - description: If present the fields describes TLS properties of - the virtual host. The SNI names that will be matched on are - described in fqdn, the tls.secretName secret must contain a - certificate that itself contains a name that matches the FQDN. - properties: - clientValidation: - description: "ClientValidation defines how to verify the client - certificate when an external client establishes a TLS connection - to Envoy. \n This setting: \n 1. Enables TLS client certificate - validation. 2. Specifies how the client certificate will - be validated (i.e. validation required or skipped). \n Note: - Setting client certificate validation to be skipped should - be only used in conjunction with an external authorization - server that performs client validation as Contour will ensure - client certificates are passed along." - properties: - caSecret: - description: Name of a Kubernetes secret that contains - a CA certificate bundle. The secret must contain key - named ca.crt. The client certificate must validate against - the certificates in the bundle. If specified and SkipClientCertValidation - is true, client certificates will be required on requests. - The name can be optionally prefixed with namespace "namespace/name". - When cross-namespace reference is used, TLSCertificateDelegation - resource must exist in the namespace to grant access - to the secret. - minLength: 1 - type: string - crlOnlyVerifyLeafCert: - description: If this option is set to true, only the certificate - at the end of the certificate chain will be subject - to validation by CRL. - type: boolean - crlSecret: - description: Name of a Kubernetes opaque secret that contains - a concatenated list of PEM encoded CRLs. The secret - must contain key named crl.pem. This field will be used - to verify that a client certificate has not been revoked. - CRLs must be available from all CAs, unless crlOnlyVerifyLeafCert - is true. Large CRL lists are not supported since individual - secrets are limited to 1MiB in size. The name can be - optionally prefixed with namespace "namespace/name". - When cross-namespace reference is used, TLSCertificateDelegation - resource must exist in the namespace to grant access - to the secret. - minLength: 1 - type: string - forwardClientCertificate: - description: ForwardClientCertificate adds the selected - data from the passed client TLS certificate to the x-forwarded-client-cert - header. - properties: - cert: - description: Client cert in URL encoded PEM format. - type: boolean - chain: - description: Client cert chain (including the leaf - cert) in URL encoded PEM format. - type: boolean - dns: - description: DNS type Subject Alternative Names of - the client cert. - type: boolean - subject: - description: Subject of the client cert. - type: boolean - uri: - description: URI type Subject Alternative Name of - the client cert. - type: boolean - type: object - optionalClientCertificate: - description: OptionalClientCertificate when set to true - will request a client certificate but allow the connection - to continue if the client does not provide one. If a - client certificate is sent, it will be verified according - to the other properties, which includes disabling validation - if SkipClientCertValidation is set. Defaults to false. - type: boolean - skipClientCertValidation: - description: SkipClientCertValidation disables downstream - client certificate validation. Defaults to false. This - field is intended to be used in conjunction with external - authorization in order to enable the external authorization - server to validate client certificates. When this field - is set to true, client certificates are requested but - not verified by Envoy. If CACertificate is specified, - client certificates are required on requests, but not - verified. If external authorization is in use, they - are presented to the external authorization server. - type: boolean - type: object - enableFallbackCertificate: - description: EnableFallbackCertificate defines if the vhost - should allow a default certificate to be applied which handles - all requests which don't match the SNI defined in this vhost. - type: boolean - maximumProtocolVersion: - description: MaximumProtocolVersion is the maximum TLS version - this vhost should negotiate. Valid options are `1.2` and - `1.3` (default). Any other value defaults to TLS 1.3. - type: string - minimumProtocolVersion: - description: MinimumProtocolVersion is the minimum TLS version - this vhost should negotiate. Valid options are `1.2` (default) - and `1.3`. Any other value defaults to TLS 1.2. - type: string - passthrough: - description: Passthrough defines whether the encrypted TLS - handshake will be passed through to the backing cluster. - Either Passthrough or SecretName must be specified, but - not both. - type: boolean - secretName: - description: SecretName is the name of a TLS secret. Either - SecretName or Passthrough must be specified, but not both. - If specified, the named secret must contain a matching certificate - for the virtual host's FQDN. The name can be optionally - prefixed with namespace "namespace/name". When cross-namespace - reference is used, TLSCertificateDelegation resource must - exist in the namespace to grant access to the secret. - type: string - type: object - required: - - fqdn - type: object - type: object - status: - default: - currentStatus: NotReconciled - description: Waiting for controller - description: Status is a container for computed information about the - HTTPProxy. - properties: - conditions: - description: "Conditions contains information about the current status - of the HTTPProxy, in an upstream-friendly container. \n Contour - will update a single condition, `Valid`, that is in normal-true - polarity. That is, when `currentStatus` is `valid`, the `Valid` - condition will be `status: true`, and vice versa. \n Contour will - leave untouched any other Conditions set in this block, in case - some other controller wants to add a Condition. \n If you are another - controller owner and wish to add a condition, you *should* namespace - your condition with a label, like `controller.domain.com/ConditionName`." - items: - description: "DetailedCondition is an extension of the normal Kubernetes - conditions, with two extra fields to hold sub-conditions, which - provide more detailed reasons for the state (True or False) of - the condition. \n `errors` holds information about sub-conditions - which are fatal to that condition and render its state False. - \n `warnings` holds information about sub-conditions which are - not fatal to that condition and do not force the state to be False. - \n Remember that Conditions have a type, a status, and a reason. - \n The type is the type of the condition, the most important one - in this CRD set is `Valid`. `Valid` is a positive-polarity condition: - when it is `status: true` there are no problems. \n In more detail, - `status: true` means that the object is has been ingested into - Contour with no errors. `warnings` may still be present, and will - be indicated in the Reason field. There must be zero entries in - the `errors` slice in this case. \n `Valid`, `status: false` means - that the object has had one or more fatal errors during processing - into Contour. The details of the errors will be present under - the `errors` field. There must be at least one error in the `errors` - slice if `status` is `false`. \n For DetailedConditions of types - other than `Valid`, the Condition must be in the negative polarity. - When they have `status` `true`, there is an error. There must - be at least one entry in the `errors` Subcondition slice. When - they have `status` `false`, there are no serious errors, and there - must be zero entries in the `errors` slice. In either case, there - may be entries in the `warnings` slice. \n Regardless of the polarity, - the `reason` and `message` fields must be updated with either - the detail of the reason (if there is one and only one entry in - total across both the `errors` and `warnings` slices), or `MultipleReasons` - if there is more than one entry." - properties: - errors: - description: "Errors contains a slice of relevant error subconditions - for this object. \n Subconditions are expected to appear when - relevant (when there is a error), and disappear when not relevant. - An empty slice here indicates no errors." - items: - description: "SubCondition is a Condition-like type intended - for use as a subcondition inside a DetailedCondition. \n - It contains a subset of the Condition fields. \n It is intended - for warnings and errors, so `type` names should use abnormal-true - polarity, that is, they should be of the form \"ErrorPresent: - true\". \n The expected lifecycle for these errors is that - they should only be present when the error or warning is, - and should be removed when they are not relevant." - properties: - message: - description: "Message is a human readable message indicating - details about the transition. \n This may be an empty - string." - maxLength: 32768 - type: string - reason: - description: "Reason contains a programmatic identifier - indicating the reason for the condition's last transition. - Producers of specific condition types may define expected - values and meanings for this field, and whether the - values are considered a guaranteed API. \n The value - should be a CamelCase string. \n This field may not - be empty." - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: Status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: "Type of condition in `CamelCase` or in `foo.example.com/CamelCase`. - \n This must be in abnormal-true polarity, that is, - `ErrorFound` or `controller.io/ErrorFound`. \n The regex - it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)" - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - message - - reason - - status - - type - type: object - type: array - lastTransitionTime: - description: lastTransitionTime is the last time the condition - transitioned from one status to another. This should be when - the underlying condition changed. If that is not known, then - using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: message is a human readable message indicating - details about the transition. This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: observedGeneration represents the .metadata.generation - that the condition was set based upon. For instance, if .metadata.generation - is currently 12, but the .status.conditions[x].observedGeneration - is 9, the condition is out of date with respect to the current - state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: reason contains a programmatic identifier indicating - the reason for the condition's last transition. Producers - of specific condition types may define expected values and - meanings for this field, and whether the values are considered - a guaranteed API. The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - --- Many .condition.type values are consistent across resources - like Available, but because arbitrary conditions can be useful - (see .node.status.conditions), the ability to deconflict is - important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - warnings: - description: "Warnings contains a slice of relevant warning - subconditions for this object. \n Subconditions are expected - to appear when relevant (when there is a warning), and disappear - when not relevant. An empty slice here indicates no warnings." - items: - description: "SubCondition is a Condition-like type intended - for use as a subcondition inside a DetailedCondition. \n - It contains a subset of the Condition fields. \n It is intended - for warnings and errors, so `type` names should use abnormal-true - polarity, that is, they should be of the form \"ErrorPresent: - true\". \n The expected lifecycle for these errors is that - they should only be present when the error or warning is, - and should be removed when they are not relevant." - properties: - message: - description: "Message is a human readable message indicating - details about the transition. \n This may be an empty - string." - maxLength: 32768 - type: string - reason: - description: "Reason contains a programmatic identifier - indicating the reason for the condition's last transition. - Producers of specific condition types may define expected - values and meanings for this field, and whether the - values are considered a guaranteed API. \n The value - should be a CamelCase string. \n This field may not - be empty." - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: Status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: "Type of condition in `CamelCase` or in `foo.example.com/CamelCase`. - \n This must be in abnormal-true polarity, that is, - `ErrorFound` or `controller.io/ErrorFound`. \n The regex - it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)" - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - message - - reason - - status - - type - type: object - type: array - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - currentStatus: - type: string - description: - type: string - loadBalancer: - description: LoadBalancer contains the current status of the load - balancer. - properties: - ingress: - description: Ingress is a list containing ingress points for the - load-balancer. Traffic intended for the service should be sent - to these ingress points. - items: - description: 'LoadBalancerIngress represents the status of a - load-balancer ingress point: traffic intended for the service - should be sent to an ingress point.' - properties: - hostname: - description: Hostname is set for load-balancer ingress points - that are DNS based (typically AWS load-balancers) - type: string - ip: - description: IP is set for load-balancer ingress points - that are IP based (typically GCE or OpenStack load-balancers) - type: string - ports: - description: Ports is a list of records of service ports - If used, every port defined in the service should have - an entry in it - items: - properties: - error: - description: 'Error is to record the problem with - the service port The format of the error shall comply - with the following rules: - built-in error values - shall be specified in this file and those shall - use CamelCase names - cloud provider specific error - values must have names that comply with the format - foo.example.com/CamelCase. --- The regex it matches - is (dns1123SubdomainFmt/)?(qualifiedNameFmt)' - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - port: - description: Port is the port number of the service - port of which status is recorded here - format: int32 - type: integer - protocol: - default: TCP - description: 'Protocol is the protocol of the service - port of which status is recorded here The supported - values are: "TCP", "UDP", "SCTP"' - type: string - required: - - port - - protocol - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: array - type: object - type: object - required: - - metadata - - spec - type: object - served: true - storage: true - subresources: - status: {} -{{- end }} diff --git a/helm-templates/contour/templates/crds/tlscertificatedeligations.yaml b/helm-templates/contour/templates/crds/tlscertificatedeligations.yaml deleted file mode 100644 index 7c4b980..0000000 --- a/helm-templates/contour/templates/crds/tlscertificatedeligations.yaml +++ /dev/null @@ -1,291 +0,0 @@ -{{- if .Values.contour.manageCRDs }} -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.13.0 - name: tlscertificatedelegations.projectcontour.io -spec: - preserveUnknownFields: false - group: projectcontour.io - names: - kind: TLSCertificateDelegation - listKind: TLSCertificateDelegationList - plural: tlscertificatedelegations - shortNames: - - tlscerts - singular: tlscertificatedelegation - scope: Namespaced - versions: - - name: v1 - schema: - openAPIV3Schema: - description: TLSCertificateDelegation is an TLS Certificate Delegation CRD - specification. See design/tls-certificate-delegation.md for details. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: TLSCertificateDelegationSpec defines the spec of the CRD - properties: - delegations: - items: - description: CertificateDelegation maps the authority to reference - a secret in the current namespace to a set of namespaces. - properties: - secretName: - description: required, the name of a secret in the current namespace. - type: string - targetNamespaces: - description: required, the namespaces the authority to reference - the secret will be delegated to. If TargetNamespaces is nil - or empty, the CertificateDelegation' is ignored. If the TargetNamespace - list contains the character, "*" the secret will be delegated - to all namespaces. - items: - type: string - type: array - required: - - secretName - - targetNamespaces - type: object - type: array - required: - - delegations - type: object - status: - description: TLSCertificateDelegationStatus allows for the status of the - delegation to be presented to the user. - properties: - conditions: - description: "Conditions contains information about the current status - of the HTTPProxy, in an upstream-friendly container. \n Contour - will update a single condition, `Valid`, that is in normal-true - polarity. That is, when `currentStatus` is `valid`, the `Valid` - condition will be `status: true`, and vice versa. \n Contour will - leave untouched any other Conditions set in this block, in case - some other controller wants to add a Condition. \n If you are another - controller owner and wish to add a condition, you *should* namespace - your condition with a label, like `controller.domain.com\\ConditionName`." - items: - description: "DetailedCondition is an extension of the normal Kubernetes - conditions, with two extra fields to hold sub-conditions, which - provide more detailed reasons for the state (True or False) of - the condition. \n `errors` holds information about sub-conditions - which are fatal to that condition and render its state False. - \n `warnings` holds information about sub-conditions which are - not fatal to that condition and do not force the state to be False. - \n Remember that Conditions have a type, a status, and a reason. - \n The type is the type of the condition, the most important one - in this CRD set is `Valid`. `Valid` is a positive-polarity condition: - when it is `status: true` there are no problems. \n In more detail, - `status: true` means that the object is has been ingested into - Contour with no errors. `warnings` may still be present, and will - be indicated in the Reason field. There must be zero entries in - the `errors` slice in this case. \n `Valid`, `status: false` means - that the object has had one or more fatal errors during processing - into Contour. The details of the errors will be present under - the `errors` field. There must be at least one error in the `errors` - slice if `status` is `false`. \n For DetailedConditions of types - other than `Valid`, the Condition must be in the negative polarity. - When they have `status` `true`, there is an error. There must - be at least one entry in the `errors` Subcondition slice. When - they have `status` `false`, there are no serious errors, and there - must be zero entries in the `errors` slice. In either case, there - may be entries in the `warnings` slice. \n Regardless of the polarity, - the `reason` and `message` fields must be updated with either - the detail of the reason (if there is one and only one entry in - total across both the `errors` and `warnings` slices), or `MultipleReasons` - if there is more than one entry." - properties: - errors: - description: "Errors contains a slice of relevant error subconditions - for this object. \n Subconditions are expected to appear when - relevant (when there is a error), and disappear when not relevant. - An empty slice here indicates no errors." - items: - description: "SubCondition is a Condition-like type intended - for use as a subcondition inside a DetailedCondition. \n - It contains a subset of the Condition fields. \n It is intended - for warnings and errors, so `type` names should use abnormal-true - polarity, that is, they should be of the form \"ErrorPresent: - true\". \n The expected lifecycle for these errors is that - they should only be present when the error or warning is, - and should be removed when they are not relevant." - properties: - message: - description: "Message is a human readable message indicating - details about the transition. \n This may be an empty - string." - maxLength: 32768 - type: string - reason: - description: "Reason contains a programmatic identifier - indicating the reason for the condition's last transition. - Producers of specific condition types may define expected - values and meanings for this field, and whether the - values are considered a guaranteed API. \n The value - should be a CamelCase string. \n This field may not - be empty." - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: Status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: "Type of condition in `CamelCase` or in `foo.example.com/CamelCase`. - \n This must be in abnormal-true polarity, that is, - `ErrorFound` or `controller.io/ErrorFound`. \n The regex - it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)" - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - message - - reason - - status - - type - type: object - type: array - lastTransitionTime: - description: lastTransitionTime is the last time the condition - transitioned from one status to another. This should be when - the underlying condition changed. If that is not known, then - using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: message is a human readable message indicating - details about the transition. This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: observedGeneration represents the .metadata.generation - that the condition was set based upon. For instance, if .metadata.generation - is currently 12, but the .status.conditions[x].observedGeneration - is 9, the condition is out of date with respect to the current - state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: reason contains a programmatic identifier indicating - the reason for the condition's last transition. Producers - of specific condition types may define expected values and - meanings for this field, and whether the values are considered - a guaranteed API. The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - --- Many .condition.type values are consistent across resources - like Available, but because arbitrary conditions can be useful - (see .node.status.conditions), the ability to deconflict is - important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - warnings: - description: "Warnings contains a slice of relevant warning - subconditions for this object. \n Subconditions are expected - to appear when relevant (when there is a warning), and disappear - when not relevant. An empty slice here indicates no warnings." - items: - description: "SubCondition is a Condition-like type intended - for use as a subcondition inside a DetailedCondition. \n - It contains a subset of the Condition fields. \n It is intended - for warnings and errors, so `type` names should use abnormal-true - polarity, that is, they should be of the form \"ErrorPresent: - true\". \n The expected lifecycle for these errors is that - they should only be present when the error or warning is, - and should be removed when they are not relevant." - properties: - message: - description: "Message is a human readable message indicating - details about the transition. \n This may be an empty - string." - maxLength: 32768 - type: string - reason: - description: "Reason contains a programmatic identifier - indicating the reason for the condition's last transition. - Producers of specific condition types may define expected - values and meanings for this field, and whether the - values are considered a guaranteed API. \n The value - should be a CamelCase string. \n This field may not - be empty." - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: Status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: "Type of condition in `CamelCase` or in `foo.example.com/CamelCase`. - \n This must be in abnormal-true polarity, that is, - `ErrorFound` or `controller.io/ErrorFound`. \n The regex - it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)" - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - message - - reason - - status - - type - type: object - type: array - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - type: object - required: - - metadata - - spec - type: object - served: true - storage: true - subresources: - status: {} -{{- end }} diff --git a/helm-templates/contour/templates/default-backend/deployment.yaml b/helm-templates/contour/templates/default-backend/deployment.yaml deleted file mode 100644 index 1a06844..0000000 --- a/helm-templates/contour/templates/default-backend/deployment.yaml +++ /dev/null @@ -1,172 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if .Values.defaultBackend.enabled }} -apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} -kind: Deployment -metadata: - name: {{ printf "%s-default-backend" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.defaultBackend.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: default-backend - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.defaultBackend.podLabels .Values.commonLabels $versionLabel ) "context" . ) }} - selector: - matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} - app.kubernetes.io/component: default-backend - replicas: {{ .Values.defaultBackend.replicaCount }} - {{- if .Values.defaultBackend.updateStrategy }} - strategy: {{- toYaml .Values.defaultBackend.updateStrategy | nindent 4 }} - {{- end }} - template: - metadata: - {{- if or .Values.defaultBackend.podAnnotations .Values.commonAnnotations }} - {{- $podAnnotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.defaultBackend.podAnnotations .Values.commonAnnotations ) "context" . ) }} - annotations: {{- include "common.tplvalues.render" (dict "value" $podAnnotations "context" $) | nindent 8 }} - {{- end }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} - app.kubernetes.io/component: default-backend - spec: - {{- include "common.images.pullSecrets" ( dict "images" (list .Values.defaultBackend.image) "global" .Values.global) | nindent 6 }} - {{- if .Values.defaultBackend.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.defaultBackend.hostAliases "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.defaultBackend.priorityClassName }} - priorityClassName: {{ .Values.defaultBackend.priorityClassName | quote }} - {{- end }} - {{- if .Values.defaultBackend.affinity }} - affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.defaultBackend.affinity "context" $) | nindent 8 }} - {{- else }} - affinity: - podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.defaultBackend.podAffinityPreset "component" "default-backend" "customLabels" $podLabels "context" $) | nindent 10 }} - podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.defaultBackend.podAntiAffinityPreset "component" "default-backend" "customLabels" $podLabels "context" $) | nindent 10 }} - nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.defaultBackend.nodeAffinityPreset.type "key" .Values.defaultBackend.nodeAffinityPreset.key "values" .Values.defaultBackend.nodeAffinityPreset.values) | nindent 10 }} - {{- end }} - {{- if .Values.defaultBackend.nodeSelector }} - nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.defaultBackend.nodeSelector "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.defaultBackend.tolerations }} - tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.defaultBackend.tolerations "context" .) | nindent 8 }} - {{- end }} - {{- if .Values.defaultBackend.podSecurityContext.enabled }} - securityContext: {{- omit .Values.defaultBackend.podSecurityContext "enabled" | toYaml | nindent 8 }} - {{- end }} - automountServiceAccountToken: false - serviceAccountName: {{ include "envoy.envoyServiceAccountName" . }} - {{- if .Values.defaultBackend.schedulerName }} - schedulerName: {{ .Values.defaultBackend.schedulerName | quote }} - {{- end }} - {{- if .Values.defaultBackend.topologySpreadConstraints }} - topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.defaultBackend.topologySpreadConstraints "context" .) | nindent 8 }} - {{- end }} - {{- if .Values.defaultBackend.terminationGracePeriodSeconds }} - terminationGracePeriodSeconds: {{ .Values.defaultBackend.terminationGracePeriodSeconds }} - {{- end }} - {{- if .Values.defaultBackend.initContainers }} - initContainers: {{- include "common.tplvalues.render" ( dict "value" .Values.defaultBackend.initContainers "context" $ ) | nindent 6 }} - {{- end }} - containers: - - name: default-backend - image: {{ include "common.images.image" ( dict "imageRoot" .Values.defaultBackend.image "global" .Values.global) }} - imagePullPolicy: {{ .Values.defaultBackend.image.pullPolicy | quote }} - {{- if .Values.defaultBackend.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.defaultBackend.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.defaultBackend.command }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.defaultBackend.command "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.defaultBackend.args }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.defaultBackend.args "context" $) | nindent 12 }} - {{- else }} - args: - {{- range $key, $value := .Values.defaultBackend.extraArgs }} - {{- if $value }} - - --{{ $key }}={{ $value }} - {{- else }} - - --{{ $key }} - {{- end }} - {{- end }} - {{- end }} - {{- if .Values.defaultBackend.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.defaultBackend.lifecycleHooks "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.defaultBackend.extraEnvVars }} - env: {{- include "common.tplvalues.render" (dict "value" .Values.defaultBackend.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - {{- if or .Values.defaultBackend.extraEnvVarsCM .Values.defaultBackend.extraEnvVarsSecret }} - envFrom: - {{- if .Values.defaultBackend.extraEnvVarsCM }} - - configMapRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.defaultBackend.extraEnvVarsCM "context" $ ) }} - {{- end }} - {{- if .Values.defaultBackend.extraEnvVarsSecret }} - - secretRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.defaultBackend.extraEnvVarsSecret "context" $ ) }} - {{- end }} - {{- end }} - {{- if .Values.defaultBackend.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.defaultBackend.customLivenessProbe "context" $) | nindent 12 }} - {{- else if .Values.defaultBackend.livenessProbe.enabled }} - livenessProbe: - httpGet: - path: / - port: http - scheme: HTTP - initialDelaySeconds: {{ .Values.defaultBackend.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.defaultBackend.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.defaultBackend.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.defaultBackend.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.defaultBackend.livenessProbe.failureThreshold }} - {{- end }} - {{- if .Values.defaultBackend.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.defaultBackend.customReadinessProbe "context" $) | nindent 12 }} - {{- else if .Values.defaultBackend.readinessProbe.enabled }} - readinessProbe: - httpGet: - path: / - port: http - scheme: HTTP - initialDelaySeconds: {{ .Values.defaultBackend.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.defaultBackend.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.defaultBackend.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.defaultBackend.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.defaultBackend.readinessProbe.failureThreshold }} - {{- end }} - {{- if .Values.defaultBackend.customStartupProbe }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.defaultBackend.customStartupProbe "context" $) | nindent 12 }} - {{- else if .Values.defaultBackend.startupProbe.enabled }} - startupProbe: - httpGet: - path: / - port: http - scheme: HTTP - initialDelaySeconds: {{ .Values.defaultBackend.startupProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.defaultBackend.startupProbe.periodSeconds }} - timeoutSeconds: {{ .Values.defaultBackend.startupProbe.timeoutSeconds }} - successThreshold: {{ .Values.defaultBackend.startupProbe.successThreshold }} - failureThreshold: {{ .Values.defaultBackend.startupProbe.failureThreshold }} - {{- end }} - ports: - - name: http - containerPort: {{ .Values.defaultBackend.containerPorts.http }} - protocol: TCP - {{- if .Values.defaultBackend.resources }} - resources: {{- toYaml .Values.defaultBackend.resources | nindent 12 }} - {{- if .Values.defaultBackend.extraVolumeMounts }} - volumeMounts: {{- include "common.tplvalues.render" ( dict "value" .Values.contour.extraVolumeMounts "context" $ ) | nindent 12 }} - {{- end }} - {{- end }} - {{- if .Values.defaultBackend.sidecars }} - {{- include "common.tplvalues.render" ( dict "value" .Values.defaultBackend.sidecars "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.defaultBackend.extraVolumes }} - volumes: {{- include "common.tplvalues.render" ( dict "value" .Values.defaultBackend.extraVolumes "context" $ ) | nindent 8 }} - {{- end }} -{{- end }} diff --git a/helm-templates/contour/templates/default-backend/ingress.yaml b/helm-templates/contour/templates/default-backend/ingress.yaml deleted file mode 100644 index d639cdc..0000000 --- a/helm-templates/contour/templates/default-backend/ingress.yaml +++ /dev/null @@ -1,70 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if .Values.defaultBackend.enabled }} -apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }} -kind: Ingress -metadata: - name: {{ printf "%s-default-backend" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.defaultBackend.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - annotations: - kubernetes.io/ingress.class: {{ include "contour.ingressClassName" . }} - {{- if .Values.ingress.certManager }} - kubernetes.io/tls-acme: "true" - {{- end }} - {{- if or .Values.ingress.annotations .Values.commonAnnotations }} - {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.ingress.annotations .Values.commonAnnotations ) "context" . ) }} - {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} - {{- end }} -spec: - {{- if and .Values.ingress.ingressClassName (eq "true" (include "common.ingress.supportsIngressClassname" .)) }} - ingressClassName: {{ .Values.ingress.ingressClassName | quote }} - {{- end }} - rules: - {{- if .Values.ingress.rulesOverride }} - {{- toYaml .Values.ingress.rulesOverride | nindent 4 }} - {{- else }} - {{- if .Values.ingress.hostname }} - - host: {{ .Values.ingress.hostname | quote }} - http: - paths: - {{- if .Values.ingress.extraPaths }} - {{- toYaml .Values.ingress.extraPaths | nindent 10 }} - {{- end }} - - path: {{ .Values.ingress.path }} - {{- if eq "true" (include "common.ingress.supportsPathType" .) }} - pathType: {{ .Values.ingress.pathType }} - {{- end }} - backend: {{- include "common.ingress.backend" (dict "serviceName" (printf "%s-default-backend" (include "common.names.fullname" .)) "servicePort" "http" "context" $) | nindent 14 }} - {{- end }} - {{- range .Values.ingress.extraHosts }} - - host: {{ .name | quote }} - http: - paths: - - path: {{ default "/" .path }} - {{- if eq "true" (include "common.ingress.supportsPathType" $) }} - pathType: {{ default "ImplementationSpecific" .pathType }} - {{- end }} - backend: {{- include "common.ingress.backend" (dict "serviceName" (printf "%s-default-backend" (include "common.names.fullname" $)) "servicePort" "http" "context" $) | nindent 14 }} - {{- end }} - {{- if .Values.ingress.extraRules }} - {{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraRules "context" $) | nindent 4 }} - {{- end }} - {{- end }} - {{- if or (and .Values.ingress.tls (or .Values.ingress.certManager .Values.ingress.selfSigned)) .Values.ingress.extraTls }} - tls: - {{- if and .Values.ingress.tls (or .Values.ingress.certManager .Values.ingress.selfSigned) }} - - hosts: - - {{ .Values.ingress.hostname | quote }} - secretName: {{ printf "%s-tls" .Values.ingress.hostname }} - {{- end }} - {{- if .Values.ingress.extraTls }} - {{- include "common.tplvalues.render" ( dict "value" .Values.ingress.extraTls "context" $ ) | nindent 4 }} - {{- end }} - {{- end }} -{{- end }} diff --git a/helm-templates/contour/templates/default-backend/poddisruptionbudget.yaml b/helm-templates/contour/templates/default-backend/poddisruptionbudget.yaml deleted file mode 100644 index 7bf0186..0000000 --- a/helm-templates/contour/templates/default-backend/poddisruptionbudget.yaml +++ /dev/null @@ -1,30 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if and .Values.defaultBackend.enabled .Values.defaultBackend.pdb.create }} -apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} -kind: PodDisruptionBudget -metadata: - name: {{ printf "%s-default-backend" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.defaultBackend.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: default-backend - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - {{- if .Values.defaultBackend.pdb.minAvailable }} - minAvailable: {{ .Values.defaultBackend.pdb.minAvailable }} - {{- end }} - {{- if .Values.defaultBackend.pdb.maxUnavailable }} - maxUnavailable: {{ .Values.defaultBackend.pdb.maxUnavailable }} - {{- end }} - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.defaultBackend.podLabels .Values.commonLabels ) "context" . ) }} - selector: - matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} - app.kubernetes.io/component: default-backend -{{- end }} diff --git a/helm-templates/contour/templates/default-backend/service.yaml b/helm-templates/contour/templates/default-backend/service.yaml deleted file mode 100644 index 4b8cc04..0000000 --- a/helm-templates/contour/templates/default-backend/service.yaml +++ /dev/null @@ -1,30 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if .Values.defaultBackend.enabled }} -apiVersion: v1 -kind: Service -metadata: - name: {{ printf "%s-default-backend" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.defaultBackend.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: default-backend - {{- if or .Values.defaultBackend.service.annotations .Values.commonAnnotations }} - {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.defaultBackend.service.annotations .Values.commonAnnotations ) "context" . ) }} - annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} - {{- end }} -spec: - type: {{ .Values.defaultBackend.service.type }} - ports: - - name: http - port: {{ .Values.defaultBackend.service.ports.http }} - protocol: TCP - targetPort: http - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.defaultBackend.podLabels .Values.commonLabels ) "context" . ) }} - selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: default-backend -{{- end }} diff --git a/helm-templates/contour/templates/default-backend/tls-secrets.yaml b/helm-templates/contour/templates/default-backend/tls-secrets.yaml deleted file mode 100644 index 927dfe8..0000000 --- a/helm-templates/contour/templates/default-backend/tls-secrets.yaml +++ /dev/null @@ -1,46 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if .Values.ingress.enabled }} -{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.defaultBackend.image "chart" .Chart ) ) }} -{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} -{{- if .Values.ingress.secrets }} -{{- range .Values.ingress.secrets }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ .name }} - namespace: {{ include "common.names.namespace" $ | quote }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - {{- if $.Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -type: kubernetes.io/tls -data: - tls.crt: {{ .certificate | b64enc }} - tls.key: {{ .key | b64enc }} ---- -{{- end }} -{{- end }} -{{- if and .Values.ingress.tls .Values.ingress.selfSigned }} -{{- $secretName := printf "%s-tls" .Values.ingress.hostname }} -{{- $ca := genCA "odoo-ca" 365 }} -{{- $cert := genSignedCert .Values.ingress.hostname nil (list .Values.ingress.hostname) 365 $ca }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ $secretName }} - namespace: {{ include "common.names.namespace" . | quote }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -type: kubernetes.io/tls -data: - tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }} - tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }} - ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }} -{{- end }} -{{- end }} diff --git a/helm-templates/contour/templates/envoy/daemonset.yaml b/helm-templates/contour/templates/envoy/daemonset.yaml deleted file mode 100644 index ca5281c..0000000 --- a/helm-templates/contour/templates/envoy/daemonset.yaml +++ /dev/null @@ -1,313 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if and .Values.envoy.enabled (eq .Values.envoy.kind "daemonset") }} -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: envoy - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - {{- if .Values.envoy.updateStrategy }} - updateStrategy: {{- toYaml .Values.envoy.updateStrategy | nindent 4 }} - {{- end }} - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.podLabels .Values.commonLabels $versionLabel ) "context" . ) }} - selector: - matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} - app.kubernetes.io/component: envoy - template: - metadata: - {{- if or .Values.envoy.podAnnotations .Values.commonAnnotations }} - {{- $podAnnotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.podAnnotations .Values.commonAnnotations ) "context" . ) }} - annotations: {{- include "common.tplvalues.render" (dict "value" $podAnnotations "context" $) | nindent 8 }} - {{- end }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} - app.kubernetes.io/component: envoy - spec: - {{- include "common.images.pullSecrets" ( dict "images" (list .Values.contour.image .Values.envoy.image) "global" .Values.global) | nindent 6 }} - {{- if .Values.envoy.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.hostAliases "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.envoy.priorityClassName }} - priorityClassName: {{ .Values.envoy.priorityClassName | quote }} - {{- end }} - {{- if .Values.envoy.affinity }} - affinity: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.affinity "context" $) | nindent 8 }} - {{- else }} - affinity: - podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.envoy.podAffinityPreset "component" "envoy" "customLabels" $podLabels "context" $) | nindent 10 }} - podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.envoy.podAntiAffinityPreset "component" "envoy" "customLabels" $podLabels "context" $) | nindent 10 }} - nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.envoy.nodeAffinityPreset.type "key" .Values.envoy.nodeAffinityPreset.key "values" .Values.envoy.nodeAffinityPreset.values) | nindent 10 }} - {{- end }} - {{- if .Values.envoy.nodeSelector }} - nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.nodeSelector "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.envoy.tolerations }} - tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.tolerations "context" $) | nindent 8 }} - {{- end }} - terminationGracePeriodSeconds: {{ .Values.envoy.terminationGracePeriodSeconds }} - hostNetwork: {{ .Values.envoy.hostNetwork }} - dnsPolicy: {{ .Values.envoy.dnsPolicy }} - {{- if .Values.envoy.podSecurityContext.enabled }} - securityContext: {{- omit .Values.envoy.podSecurityContext "enabled" | toYaml | nindent 8 }} - {{- end }} - containers: - {{- if .Values.envoy.shutdownManager.enabled }} - - command: - - contour - args: - - envoy - - shutdown-manager - {{- if .Values.envoy.shutdownManager.extraArgs }} - {{- include "common.tplvalues.render" (dict "value" .Values.envoy.shutdownManager.extraArgs "context" $) | nindent 12 }} - {{- end }} - image: {{ include "common.images.image" ( dict "imageRoot" .Values.contour.image "global" .Values.global) }} - imagePullPolicy: {{ .Values.contour.image.pullPolicy }} - {{- if .Values.contour.extraEnvVars }} - env: - {{- include "common.tplvalues.render" (dict "value" .Values.contour.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - {{- if or .Values.contour.extraEnvVarsCM .Values.contour.extraEnvVarsSecret }} - envFrom: - {{- if .Values.contour.extraEnvVarsCM }} - - configMapRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsCM "context" $ ) }} - {{- end }} - {{- if .Values.contour.extraEnvVarsSecret }} - - secretRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsSecret "context" $ ) }} - {{- end }} - {{- end }} - {{- if .Values.envoy.shutdownManager.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.envoy.shutdownManager.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.envoy.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.lifecycleHooks "context" $) | nindent 12 }} - {{- else }} - lifecycle: - preStop: - exec: - command: - - contour - - envoy - - shutdown - {{- end }} - name: shutdown-manager - resources: {{- toYaml .Values.envoy.shutdownManager.resources | nindent 12 }} - volumeMounts: - - name: envoy-admin - mountPath: /admin - {{- if .Values.envoy.extraVolumeMounts }} - {{- include "common.tplvalues.render" ( dict "value" .Values.envoy.extraVolumeMounts "context" $ ) | nindent 12 }} - {{- end }} - {{- end }} - - name: envoy - {{- if .Values.envoy.command }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.command "context" $) | nindent 12 }} - {{- else }} - command: - - envoy - {{- end }} - {{- if .Values.envoy.args }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.args "context" $) | nindent 12 }} - {{- else }} - args: - - -c - - /config/envoy.json - - --service-cluster $(CONTOUR_NAMESPACE) - - --service-node $(ENVOY_POD_NAME) - - --log-level {{ .Values.envoy.logLevel }} - {{- if .Values.envoy.extraArgs }} - {{- include "common.tplvalues.render" (dict "value" .Values.envoy.extraArgs "context" $) | nindent 12 }} - {{- end }} - {{- end }} - image: {{ include "common.images.image" ( dict "imageRoot" .Values.envoy.image "global" .Values.global ) }} - imagePullPolicy: {{ .Values.envoy.image.pullPolicy }} - {{- if .Values.envoy.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.envoy.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - env: - - name: CONTOUR_NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - - name: ENVOY_POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - {{- if .Values.envoy.extraEnvVars }} - {{- include "common.tplvalues.render" (dict "value" .Values.envoy.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - {{- if or .Values.envoy.extraEnvVarsCM .Values.envoy.extraEnvVarsSecret }} - envFrom: - {{- if .Values.envoy.extraEnvVarsCM }} - - configMapRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.envoy.extraEnvVarsCM "context" $ ) }} - {{- end }} - {{- if .Values.envoy.extraEnvVarsSecret }} - - secretRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.envoy.extraEnvVarsSecret "context" $ ) }} - {{- end }} - {{- end }} - ports: - - containerPort: {{ .Values.envoy.containerPorts.http }} - # Use of .Values.envoy.useHostPort as boolean is DEPRECATED. Support will be removed in upcoming versions. - {{- if or (and (kindIs "boolean" .Values.envoy.useHostPort) .Values.envoy.useHostPort) (and (kindIs "map" .Values.envoy.useHostPort) .Values.envoy.useHostPort.http) }} - hostPort: {{ .Values.envoy.hostPorts.http }} - {{- end }} - {{- if .Values.envoy.useHostIP }} - hostIP: {{ .Values.envoy.hostIPs.http }} - {{- end }} - name: http - protocol: TCP - - containerPort: {{ .Values.envoy.containerPorts.https }} - # Use of .Values.envoy.useHostPort as boolean is DEPRECATED. Support will be removed in upcoming versions. - {{- if or (and (kindIs "boolean" .Values.envoy.useHostPort) .Values.envoy.useHostPort) (and (kindIs "map" .Values.envoy.useHostPort) .Values.envoy.useHostPort.https) }} - hostPort: {{ .Values.envoy.hostPorts.https }} - {{- end }} - {{- if .Values.envoy.useHostIP }} - hostIP: {{ .Values.envoy.hostIPs.https }} - {{- end }} - name: https - protocol: TCP - - containerPort: {{ .Values.envoy.containerPorts.metrics }} - # Use of .Values.envoy.useHostPort as boolean is DEPRECATED. Support will be removed in upcoming versions. - {{- if or (and (kindIs "boolean" .Values.envoy.useHostPort) .Values.envoy.useHostPort) (and (kindIs "map" .Values.envoy.useHostPort) .Values.envoy.useHostPort.metrics) }} - hostPort: {{ .Values.envoy.hostPorts.metrics }} - {{- end }} - {{- if .Values.envoy.useHostIP }} - hostIP: {{ .Values.envoy.hostIPs.metrics }} - {{- end }} - name: metrics - protocol: TCP - {{- if .Values.envoy.readinessProbe.enabled }} - readinessProbe: - httpGet: - path: /ready - port: {{ .Values.envoy.containerPorts.metrics }} - initialDelaySeconds: {{ .Values.envoy.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.envoy.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.envoy.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.envoy.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.envoy.readinessProbe.failureThreshold }} - {{- end }} - {{- if .Values.envoy.livenessProbe.enabled }} - livenessProbe: - httpGet: - path: /ready - port: {{ .Values.envoy.containerPorts.metrics }} - initialDelaySeconds: {{ .Values.envoy.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.envoy.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.envoy.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.envoy.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.envoy.livenessProbe.failureThreshold }} - {{- end }} - resources: {{ toYaml .Values.envoy.resources | nindent 12 }} - volumeMounts: - - name: envoy-config - mountPath: /config - - name: envoycert - mountPath: /certs - - name: envoy-admin - mountPath: /admin - {{- if .Values.envoy.extraVolumeMounts }} - {{- include "common.tplvalues.render" ( dict "value" .Values.envoy.extraVolumeMounts "context" $ ) | nindent 12 }} - {{- end }} - lifecycle: - preStop: - {{- if .Values.envoy.shutdownManager.enabled }} - httpGet: - path: /shutdown - port: {{ .Values.envoy.shutdownManager.port }} - scheme: HTTP - {{- else }} - exec: - command: - - sh - - '-c' - - sleep {{ .Values.envoy.terminationGracePeriodSeconds }}; kill 1 - {{- end }} - {{- if .Values.envoy.sidecars }} - {{- include "common.tplvalues.render" ( dict "value" .Values.envoy.sidecars "context" $ ) | nindent 8 }} - {{- end }} - initContainers: - - command: - - contour - args: - - bootstrap - - /config/envoy.json - - --xds-address={{ template "common.names.fullname" . }} - - --xds-port={{ .Values.contour.service.ports.xds }} - - --resources-dir=/config/resources - - --envoy-cafile=/certs/ca.crt - - --envoy-cert-file=/certs/tls.crt - - --envoy-key-file=/certs/tls.key - {{- if .Values.contour.overloadManager.enabled }} - - --overload-max-heap={{ int .Values.contour.overloadManager.maxHeapBytes }} - {{- end }} - image: {{ include "common.images.image" ( dict "imageRoot" .Values.contour.image "global" .Values.global) }} - imagePullPolicy: {{ .Values.contour.image.pullPolicy }} - name: envoy-initconfig - resources: {{ toYaml .Values.envoy.resources | nindent 12 }} - volumeMounts: - - name: envoy-config - mountPath: /config - - name: envoycert - mountPath: /certs - readOnly: true - - name: envoy-admin - mountPath: /admin - {{- if .Values.envoy.extraVolumeMounts }} - {{- include "common.tplvalues.render" ( dict "value" .Values.envoy.extraVolumeMounts "context" $ ) | nindent 12 }} - {{- end }} - env: - - name: CONTOUR_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - {{- if .Values.contour.extraEnvVars }} - {{- include "common.tplvalues.render" (dict "value" .Values.contour.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - {{- if or .Values.contour.extraEnvVarsCM .Values.contour.extraEnvVarsSecret }} - envFrom: - {{- if .Values.contour.extraEnvVarsCM }} - - configMapRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsCM "context" $ ) }} - {{- end }} - {{- if .Values.contour.extraEnvVarsSecret }} - - secretRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsSecret "context" $ ) }} - {{- end }} - {{- end }} - {{- if .Values.envoy.initConfig.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.envoy.initConfig.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.envoy.initContainers }} - {{- include "common.tplvalues.render" ( dict "value" .Values.envoy.initContainers "context" $ ) | nindent 8 }} - {{- end }} - automountServiceAccountToken: {{ .Values.envoy.serviceAccount.automountServiceAccountToken }} - serviceAccountName: {{ include "envoy.envoyServiceAccountName" . }} - volumes: - - name: envoy-admin - emptyDir: {} - - name: envoy-config - emptyDir: {} - - name: envoycert - secret: - secretName: {{ include "contour.envoy.certs-secret.name" . }} - {{- if .Values.envoy.extraVolumes }} - {{- include "common.tplvalues.render" ( dict "value" .Values.envoy.extraVolumes "context" $ ) | nindent 8 }} - {{- end }} - restartPolicy: Always -{{- end }} diff --git a/helm-templates/contour/templates/envoy/deployment.yaml b/helm-templates/contour/templates/envoy/deployment.yaml deleted file mode 100644 index 2b0cead..0000000 --- a/helm-templates/contour/templates/envoy/deployment.yaml +++ /dev/null @@ -1,338 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if and .Values.envoy.enabled (eq .Values.envoy.kind "deployment") }} -apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} -kind: Deployment -metadata: - name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: envoy - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - {{- if not .Values.envoy.autoscaling.enabled }} - replicas: {{ .Values.envoy.replicaCount }} - {{- end }} - revisionHistoryLimit: {{ .Values.envoy.revisionHistoryLimit }} - {{- if .Values.envoy.updateStrategy }} - strategy: {{- toYaml .Values.envoy.updateStrategy | nindent 4 }} - {{- end }} - minReadySeconds: {{ .Values.envoy.minReadySeconds }} - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.podLabels .Values.commonLabels $versionLabel ) "context" . ) }} - selector: - matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} - app.kubernetes.io/component: envoy - template: - metadata: - {{- if or .Values.envoy.podAnnotations .Values.commonAnnotations }} - {{- $podAnnotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.podAnnotations .Values.commonAnnotations ) "context" . ) }} - annotations: {{- include "common.tplvalues.render" (dict "value" $podAnnotations "context" $) | nindent 8 }} - {{- end }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} - app.kubernetes.io/component: envoy - spec: - {{- include "common.images.pullSecrets" ( dict "images" (list .Values.contour.image .Values.envoy.image) "global" .Values.global) | nindent 6 }} - {{- if .Values.envoy.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.hostAliases "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.envoy.affinity }} - affinity: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.affinity "context" $) | nindent 8 }} - {{- else }} - affinity: - podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.envoy.podAffinityPreset "component" "envoy" "customLabels" $podLabels "context" $) | nindent 10 }} - podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.envoy.podAntiAffinityPreset "component" "envoy" "customLabels" $podLabels "context" $) | nindent 10 }} - nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.envoy.nodeAffinityPreset.type "key" .Values.envoy.nodeAffinityPreset.key "values" .Values.envoy.nodeAffinityPreset.values) | nindent 10 }} - {{- end }} - {{- if .Values.envoy.priorityClassName }} - priorityClassName: {{ .Values.envoy.priorityClassName | quote }} - {{- end }} - {{- if .Values.envoy.schedulerName }} - schedulerName: {{ .Values.envoy.schedulerName | quote }} - {{- end }} - {{- if .Values.envoy.topologySpreadConstraints }} - topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.topologySpreadConstraints "context" .) | nindent 8 }} - {{- end }} - {{- if .Values.envoy.nodeSelector }} - nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.nodeSelector "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.envoy.tolerations }} - tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.tolerations "context" $) | nindent 8 }} - {{- end }} - terminationGracePeriodSeconds: {{ .Values.envoy.terminationGracePeriodSeconds }} - hostNetwork: {{ .Values.envoy.hostNetwork }} - dnsPolicy: {{ .Values.envoy.dnsPolicy }} - {{- if .Values.envoy.podSecurityContext.enabled }} - securityContext: {{- omit .Values.envoy.podSecurityContext "enabled" | toYaml | nindent 8 }} - {{- end }} - containers: - {{- if .Values.envoy.shutdownManager.enabled }} - - command: - - contour - args: - - envoy - - shutdown-manager - {{- if .Values.envoy.shutdownManager.extraArgs }} - {{- include "common.tplvalues.render" (dict "value" .Values.envoy.shutdownManager.extraArgs "context" $) | nindent 12 }} - {{- end }} - image: {{ include "common.images.image" ( dict "imageRoot" .Values.contour.image "global" .Values.global) }} - imagePullPolicy: {{ .Values.contour.image.pullPolicy }} - {{- if .Values.contour.extraEnvVars }} - env: - {{- include "common.tplvalues.render" (dict "value" .Values.contour.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - {{- if or .Values.contour.extraEnvVarsCM .Values.contour.extraEnvVarsSecret }} - envFrom: - {{- if .Values.contour.extraEnvVarsCM }} - - configMapRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsCM "context" $ ) }} - {{- end }} - {{- if .Values.contour.extraEnvVarsSecret }} - - secretRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsSecret "context" $ ) }} - {{- end }} - {{- end }} - {{- if .Values.envoy.shutdownManager.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.envoy.shutdownManager.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - lifecycle: - preStop: - exec: - command: - - contour - - envoy - - shutdown - {{- if .Values.envoy.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} - name: shutdown-manager - resources: {{- toYaml .Values.envoy.shutdownManager.resources | nindent 12 }} - volumeMounts: - - name: envoy-admin - mountPath: /admin - {{- if .Values.envoy.extraVolumeMounts }} - {{- include "common.tplvalues.render" ( dict "value" .Values.envoy.extraVolumeMounts "context" $ ) | nindent 12 }} - {{- end }} - {{- end }} - - name: envoy - {{- if .Values.envoy.command }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.command "context" $) | nindent 12 }} - {{- else }} - command: - - envoy - {{- end }} - {{- if .Values.envoy.args }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.args "context" $) | nindent 12 }} - {{- else }} - args: - - -c - - /config/envoy.json - - --service-cluster $(CONTOUR_NAMESPACE) - - --service-node $(ENVOY_POD_NAME) - - --log-level {{ .Values.envoy.logLevel }} - {{- if .Values.envoy.extraArgs }} - {{- include "common.tplvalues.render" (dict "value" .Values.envoy.extraArgs "context" $) | nindent 12 }} - {{- end }} - {{- end }} - image: {{ include "common.images.image" ( dict "imageRoot" .Values.envoy.image "global" .Values.global ) }} - imagePullPolicy: {{ .Values.envoy.image.pullPolicy }} - {{- if .Values.envoy.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.envoy.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - env: - - name: CONTOUR_NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - - name: ENVOY_POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - {{- if .Values.envoy.extraEnvVars }} - {{- include "common.tplvalues.render" (dict "value" .Values.envoy.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - {{- if or .Values.envoy.extraEnvVarsCM .Values.envoy.extraEnvVarsSecret }} - envFrom: - {{- if .Values.envoy.extraEnvVarsCM }} - - configMapRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.envoy.extraEnvVarsCM "context" $ ) }} - {{- end }} - {{- if .Values.envoy.extraEnvVarsSecret }} - - secretRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.envoy.extraEnvVarsSecret "context" $ ) }} - {{- end }} - {{- end }} - ports: - - containerPort: {{ .Values.envoy.containerPorts.http }} - # Use of .Values.envoy.useHostPort as boolean is DEPRECATED. Support will be removed in upcoming versions. - {{- if or (and (kindIs "boolean" .Values.envoy.useHostPort) .Values.envoy.useHostPort) (and (kindIs "map" .Values.envoy.useHostPort) .Values.envoy.useHostPort.http) }} - hostPort: {{ .Values.envoy.hostPorts.http }} - {{- end }} - {{- if .Values.envoy.useHostIP }} - hostIP: {{ .Values.envoy.hostIPs.http }} - {{- end }} - name: http - protocol: TCP - - containerPort: {{ .Values.envoy.containerPorts.https }} - # Use of .Values.envoy.useHostPort as boolean is DEPRECATED. Support will be removed in upcoming versions. - {{- if or (and (kindIs "boolean" .Values.envoy.useHostPort) .Values.envoy.useHostPort) (and (kindIs "map" .Values.envoy.useHostPort) .Values.envoy.useHostPort.https) }} - hostPort: {{ .Values.envoy.hostPorts.https }} - {{- end }} - {{- if .Values.envoy.useHostIP }} - hostIP: {{ .Values.envoy.hostIPs.https }} - {{- end }} - name: https - protocol: TCP - - containerPort: {{ .Values.envoy.containerPorts.metrics }} - # Use of .Values.envoy.useHostPort as boolean is DEPRECATED. Support will be removed in upcoming versions. - {{- if or (and (kindIs "boolean" .Values.envoy.useHostPort) .Values.envoy.useHostPort) (and (kindIs "map" .Values.envoy.useHostPort) .Values.envoy.useHostPort.metrics) }} - hostPort: {{ .Values.envoy.hostPorts.metrics }} - {{- end }} - {{- if .Values.envoy.useHostIP }} - hostIP: {{ .Values.envoy.hostIPs.metrics }} - {{- end }} - name: metrics - protocol: TCP - {{- if .Values.envoy.readinessProbe.enabled }} - readinessProbe: - httpGet: - path: /ready - port: {{ .Values.envoy.containerPorts.metrics }} - initialDelaySeconds: {{ .Values.envoy.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.envoy.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.envoy.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.envoy.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.envoy.readinessProbe.failureThreshold }} - {{- end }} - {{- if .Values.envoy.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.customLivenessProbe "context" $) | nindent 12 }} - {{- else if .Values.envoy.livenessProbe.enabled }} - livenessProbe: - httpGet: - path: /ready - port: {{ .Values.envoy.containerPorts.metrics }} - initialDelaySeconds: {{ .Values.envoy.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.envoy.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.envoy.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.envoy.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.envoy.livenessProbe.failureThreshold }} - {{- end }} - {{- if .Values.envoy.customStartupProbe }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.customStartupProbe "context" $) | nindent 12 }} - {{- else if .Values.envoy.startupProbe.enabled }} - startupProbe: - httpGet: - path: /ready - port: {{ .Values.envoy.containerPorts.metrics }} - initialDelaySeconds: {{ .Values.envoy.startupProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.envoy.startupProbe.periodSeconds }} - timeoutSeconds: {{ .Values.envoy.startupProbe.timeoutSeconds }} - successThreshold: {{ .Values.envoy.startupProbe.successThreshold }} - failureThreshold: {{ .Values.envoy.startupProbe.failureThreshold }} - {{- end }} - resources: {{- toYaml .Values.envoy.resources | nindent 12 }} - volumeMounts: - - name: envoy-config - mountPath: /config - - name: envoycert - mountPath: /certs - - name: envoy-admin - mountPath: /admin - {{- if .Values.envoy.extraVolumeMounts }} - {{- include "common.tplvalues.render" ( dict "value" .Values.envoy.extraVolumeMounts "context" $ ) | nindent 12 }} - {{- end }} - lifecycle: - preStop: - {{- if .Values.envoy.shutdownManager.enabled }} - httpGet: - path: /shutdown - port: {{ .Values.envoy.shutdownManager.port }} - scheme: HTTP - {{- else }} - exec: - command: - - sh - - '-c' - - sleep {{ .Values.envoy.terminationGracePeriodSeconds }}; kill 1 - {{- end }} - {{- if .Values.envoy.sidecars }} - {{- include "common.tplvalues.render" ( dict "value" .Values.envoy.sidecars "context" $ ) | nindent 8 }} - {{- end }} - initContainers: - - command: - - contour - args: - - bootstrap - - /config/envoy.json - - --xds-address={{ template "common.names.fullname" . }} - - --xds-port={{ .Values.contour.service.ports.xds }} - - --resources-dir=/config/resources - - --envoy-cafile=/certs/ca.crt - - --envoy-cert-file=/certs/tls.crt - - --envoy-key-file=/certs/tls.key - {{- if .Values.contour.overloadManager.enabled }} - - --overload-max-heap={{ int .Values.contour.overloadManager.maxHeapBytes }} - {{- end }} - image: {{ include "common.images.image" ( dict "imageRoot" .Values.contour.image "global" .Values.global) }} - imagePullPolicy: {{ .Values.contour.image.pullPolicy }} - name: envoy-initconfig - resources: {{ toYaml .Values.envoy.resources | nindent 12 }} - volumeMounts: - - name: envoy-config - mountPath: /config - - name: envoycert - mountPath: /certs - readOnly: true - - name: envoy-admin - mountPath: /admin - {{- if .Values.envoy.extraVolumeMounts }} - {{- include "common.tplvalues.render" ( dict "value" .Values.envoy.extraVolumeMounts "context" $ ) | nindent 12 }} - {{- end }} - env: - - name: CONTOUR_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - {{- if .Values.contour.extraEnvVars }} - {{- include "common.tplvalues.render" (dict "value" .Values.contour.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - {{- if or .Values.contour.extraEnvVarsCM .Values.contour.extraEnvVarsSecret }} - envFrom: - {{- if .Values.contour.extraEnvVarsCM }} - - configMapRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsCM "context" $ ) }} - {{- end }} - {{- if .Values.contour.extraEnvVarsSecret }} - - secretRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsSecret "context" $ ) }} - {{- end }} - {{- end }} - {{- if .Values.envoy.initConfig.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.envoy.initConfig.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.envoy.initContainers }} - {{- include "common.tplvalues.render" ( dict "value" .Values.envoy.initContainers "context" $ ) | nindent 8 }} - {{- end }} - automountServiceAccountToken: {{ .Values.envoy.serviceAccount.automountServiceAccountToken }} - serviceAccountName: {{ include "envoy.envoyServiceAccountName" . }} - volumes: - - name: envoy-admin - emptyDir: {} - - name: envoy-config - emptyDir: {} - - name: envoycert - secret: - secretName: {{ include "contour.envoy.certs-secret.name" . }} - {{- if .Values.envoy.extraVolumes }} - {{- include "common.tplvalues.render" ( dict "value" .Values.envoy.extraVolumes "context" $ ) | nindent 8 }} - {{- end }} - restartPolicy: Always -{{- end }} diff --git a/helm-templates/contour/templates/envoy/extra-list.yaml b/helm-templates/contour/templates/envoy/extra-list.yaml deleted file mode 100644 index 2d35a58..0000000 --- a/helm-templates/contour/templates/envoy/extra-list.yaml +++ /dev/null @@ -1,9 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- range .Values.extraDeploy }} ---- -{{ include "common.tplvalues.render" (dict "value" . "context" $) }} -{{- end }} diff --git a/helm-templates/contour/templates/envoy/headless.yaml b/helm-templates/contour/templates/envoy/headless.yaml deleted file mode 100644 index 5853522..0000000 --- a/helm-templates/contour/templates/envoy/headless.yaml +++ /dev/null @@ -1,38 +0,0 @@ -{{- if .Values.envoy.enabled }} -apiVersion: v1 -kind: Service -metadata: - name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}-headless - namespace: {{ include "common.names.namespace" . | quote }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - app.kubernetes.io/component: envoy - {{- if .Values.envoy.service.labels }} - {{- include "common.tplvalues.render" (dict "value" .Values.envoy.service.labels "context" $) | nindent 4 }} - {{- end }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} -spec: - clusterIP: None - {{- if .Values.envoy.service.sessionAffinity }} - sessionAffinity: {{ .Values.envoy.service.sessionAffinity }} - {{- end }} - {{- if .Values.envoy.service.sessionAffinityConfig }} - sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.service.sessionAffinityConfig "context" $) | nindent 4 }} - {{- end }} - {{- if .Values.envoy.service.ipFamilyPolicy }} - ipFamilyPolicy: {{ .Values.envoy.service.ipFamilyPolicy }} - {{- end }} - ports: - - name: http - port: {{ .Values.envoy.service.ports.http }} - protocol: TCP - targetPort: {{ .Values.envoy.service.targetPorts.http }} - nodePort: null - {{- if .Values.envoy.service.extraPorts }} - {{- include "common.tplvalues.render" (dict "value" .Values.envoy.service.extraPorts "context" $) | nindent 4 }} - {{- end }} - selector: {{- include "common.labels.matchLabels" . | nindent 4 }} - app.kubernetes.io/component: envoy - type: ClusterIP -{{- end }} \ No newline at end of file diff --git a/helm-templates/contour/templates/envoy/hpa.yaml b/helm-templates/contour/templates/envoy/hpa.yaml deleted file mode 100644 index 521864c..0000000 --- a/helm-templates/contour/templates/envoy/hpa.yaml +++ /dev/null @@ -1,55 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if and .Values.envoy.enabled .Values.envoy.autoscaling.enabled (eq .Values.envoy.kind "deployment") (ne .Values.envoy.autoscaling.keda.enabled true) }} -apiVersion: {{ include "common.capabilities.hpa.apiVersion" ( dict "context" $ ) }} -kind: HorizontalPodAutoscaler -metadata: - name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: envoy - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - {{- if .Values.envoy.autoscaling.behavior }} - behavior: - {{- toYaml .Values.envoy.autoscaling.behavior | nindent 4 }} - {{- end }} - scaleTargetRef: - apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} - kind: Deployment - name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - minReplicas: {{ .Values.envoy.autoscaling.minReplicas }} - maxReplicas: {{ .Values.envoy.autoscaling.maxReplicas }} - metrics: - {{- if .Values.envoy.autoscaling.targetMemory }} - - type: Resource - resource: - name: memory - {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} - targetAverageUtilization: {{ .Values.envoy.autoscaling.targetMemory }} - {{- else }} - target: - type: Utilization - averageUtilization: {{ .Values.envoy.autoscaling.targetMemory }} - {{- end }} - {{- end }} - {{- if .Values.envoy.autoscaling.targetCPU }} - - type: Resource - resource: - name: cpu - {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} - targetAverageUtilization: {{ .Values.envoy.autoscaling.targetCPU }} - {{- else }} - target: - type: Utilization - averageUtilization: {{ .Values.envoy.autoscaling.targetCPU }} - {{- end }} - {{- end }} -{{- end }} diff --git a/helm-templates/contour/templates/envoy/prometheusrule.yaml b/helm-templates/contour/templates/envoy/prometheusrule.yaml deleted file mode 100644 index 407c8aa..0000000 --- a/helm-templates/contour/templates/envoy/prometheusrule.yaml +++ /dev/null @@ -1,26 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if and .Values.metrics.prometheusRule.enabled .Values.envoy.enabled .Values.metrics.enabled}} -apiVersion: monitoring.coreos.com/v1 -kind: PrometheusRule -metadata: - name: {{ include "common.names.fullname" . }} - namespace: {{ default .Release.Namespace .Values.metrics.prometheusRule.namespace | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: metrics - {{- if .Values.metrics.prometheusRule.additionalLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.prometheusRule.additionalLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - groups: - - name: {{ include "common.names.fullname" . }} - rules: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.prometheusRule.rules "context" $ ) | nindent 6 }} -{{- end }} diff --git a/helm-templates/contour/templates/envoy/scaledObject.yaml b/helm-templates/contour/templates/envoy/scaledObject.yaml deleted file mode 100644 index 094c3de..0000000 --- a/helm-templates/contour/templates/envoy/scaledObject.yaml +++ /dev/null @@ -1,57 +0,0 @@ -{{- if .Values.envoy.autoscaling.keda.enabled }} -apiVersion: keda.sh/v1alpha1 -kind: ScaledObject -metadata: - name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ include "common.names.namespace" . | quote }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - app.kubernetes.io/component: envoy - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - pollingInterval: {{ .Values.envoy.autoscaling.keda.pollingInterval }} - minReplicaCount: {{ .Values.envoy.autoscaling.minReplicas }} - maxReplicaCount: {{ .Values.envoy.autoscaling.maxReplicas }} - advanced: - horizontalPodAutoscalerConfig: - behavior: - scaleDown: - stabilizationWindowSeconds: {{ .Values.envoy.autoscaling.keda.stabilizationWindowSeconds | default "300" }} - policies: - {{- range .Values.envoy.autoscaling.keda.scaledown.policies }} - - type: {{ .type }} - value: {{ .value }} - periodSeconds: {{ .periodseconds }} - {{- end }} - selectPolicy: {{ .Values.envoy.autoscaling.keda.scaledown.selectpolicy }} - scaleUp: - stabilizationWindowSeconds: {{ .Values.envoy.autoscaling.keda.scaleup.stabilizationWindowSeconds }} - policies: - {{- range .Values.envoy.autoscaling.keda.scaleup.policies }} - - type: {{ .type }} - value: {{ .value }} - periodSeconds: {{ .periodseconds }} - {{- end }} - selectPolicy: {{ .Values.envoy.autoscaling.keda.scaleup.selectpolicy }} - triggers: - - metadata: - value: {{ .Values.envoy.autoscaling.targetCPU | quote }} - metricType: Utilization - type: cpu - - metadata: - value: {{ .Values.envoy.autoscaling.targetMemory | quote }} - metricType: Utilization - type: memory -{{- if .Values.envoy.autoscaling.keda.triggers }} -{{- toYaml .Values.envoy.autoscaling.keda.triggers | nindent 2 }} -{{ end }} - -{{- end }} diff --git a/helm-templates/contour/templates/envoy/service-export.yaml b/helm-templates/contour/templates/envoy/service-export.yaml deleted file mode 100644 index 59dda72..0000000 --- a/helm-templates/contour/templates/envoy/service-export.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{{- if .Values.envoy.service.export.enabled }} -kind: ServiceExport -apiVersion: net.gke.io/v1 -metadata: - namespace: {{ include "common.names.namespace" . | quote }} - name: {{ default (printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-") .Values.envoy.service.name }} ---- -kind: ServiceExport -apiVersion: net.gke.io/v1 -metadata: - namespace: {{ include "common.names.namespace" . | quote }} - name: {{ default (printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-") .Values.envoy.service.name }}-headless -{{- end }} diff --git a/helm-templates/contour/templates/envoy/service-loadbalancer.yaml b/helm-templates/contour/templates/envoy/service-loadbalancer.yaml deleted file mode 100644 index 69746d7..0000000 --- a/helm-templates/contour/templates/envoy/service-loadbalancer.yaml +++ /dev/null @@ -1,46 +0,0 @@ -{{- if .Values.envoy.enabled }} -{{- if .Values.envoy.service.tcpLB }} -apiVersion: v1 -kind: Service -metadata: - name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}-tcp-lb - namespace: {{ include "common.names.namespace" . | quote }} - annotations: - networking.gke.io/load-balancer-type: "Internal" - labels: {{- include "common.labels.standard" . | nindent 4 }} - app.kubernetes.io/component: envoy - {{- if .Values.envoy.service.labels }} - {{- include "common.tplvalues.render" (dict "value" .Values.envoy.service.labels "context" $) | nindent 4 }} - {{- end }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} -spec: - {{- if .Values.envoy.service.sessionAffinity }} - sessionAffinity: {{ .Values.envoy.service.sessionAffinity }} - {{- end }} - {{- if .Values.envoy.service.sessionAffinityConfig }} - sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.service.sessionAffinityConfig "context" $) | nindent 4 }} - {{- end }} - {{- if .Values.envoy.service.ipFamilyPolicy }} - ipFamilyPolicy: {{ .Values.envoy.service.ipFamilyPolicy }} - {{- end }} - ports: - - name: http - port: {{ .Values.envoy.service.ports.http }} - protocol: TCP - targetPort: {{ .Values.envoy.service.targetPorts.http }} - {{- if .Values.envoy.service.ports.grpc }} - - name: grpc - port: {{ .Values.envoy.service.ports.grpc }} - protocol: TCP - targetPort: {{ .Values.envoy.service.targetPorts.http }} - {{- end }} - {{- if .Values.envoy.service.extraPorts }} - {{- include "common.tplvalues.render" (dict "value" .Values.envoy.service.extraPorts "context" $) | nindent 4 }} - {{- end }} - selector: {{- include "common.labels.matchLabels" . | nindent 4 }} - app.kubernetes.io/component: envoy - type: LoadBalancer -{{- end }} -{{- end }} \ No newline at end of file diff --git a/helm-templates/contour/templates/envoy/service.yaml b/helm-templates/contour/templates/envoy/service.yaml deleted file mode 100644 index 83f3939..0000000 --- a/helm-templates/contour/templates/envoy/service.yaml +++ /dev/null @@ -1,103 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }} -{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.podLabels .Values.commonLabels ) "context" . ) }} -{{- if .Values.envoy.enabled }} -apiVersion: v1 -kind: Service -metadata: - name: {{ default (printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-") .Values.envoy.service.name }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.service.labels .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: envoy - annotations: - {{- if (ne (index .Values.envoy.service.annotations "service.beta.kubernetes.io/aws-load-balancer-type" | toString ) "nlb") }} - # This annotation puts the AWS ELB into "TCP" mode so that it does not - # do HTTP negotiation for HTTPS connections at the ELB edge. - # The downside of this is the remote IP address of all connections will - # appear to be the internal address of the ELB. See docs/proxy-proto.md - # for information about enabling the PROXY protocol on the ELB to recover - # the original remote IP address. - # We don't set this for nlb, per the contour docs. - service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp - {{- end }} - {{- if or .Values.envoy.service.annotations .Values.commonAnnotations }} - {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.service.annotations .Values.commonAnnotations ) "context" . ) }} - {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} - {{- end }} -spec: - {{- if .Values.envoy.service.externalTrafficPolicy }} - externalTrafficPolicy: {{ .Values.envoy.service.externalTrafficPolicy | quote }} - {{- end }} - {{- if not (empty .Values.envoy.service.clusterIP) }} - clusterIP: {{ .Values.envoy.service.clusterIP | quote }} - {{- end }} - {{- if .Values.envoy.service.sessionAffinity }} - sessionAffinity: {{ .Values.envoy.service.sessionAffinity }} - {{- end }} - {{- if .Values.envoy.service.sessionAffinityConfig }} - sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.service.sessionAffinityConfig "context" $) | nindent 4 }} - {{- end }} - {{- if .Values.envoy.service.externalIPs }} - externalIPs: {{- toYaml .Values.envoy.service.externalIPs | nindent 4 }} - {{- end }} - {{- if .Values.envoy.service.loadBalancerIP }} - loadBalancerIP: {{ .Values.envoy.service.loadBalancerIP | quote }} - {{- end }} - {{- if .Values.envoy.service.loadBalancerSourceRanges }} - loadBalancerSourceRanges: {{- toYaml .Values.envoy.service.loadBalancerSourceRanges | nindent 4 }} - {{- end }} - {{- if .Values.envoy.service.ipFamilyPolicy }} - ipFamilyPolicy: {{ .Values.envoy.service.ipFamilyPolicy }} - {{- end }} - {{- if .Values.envoy.service.ipFamilies }} - ipFamilies: {{ toYaml .Values.envoy.service.ipFamilies | nindent 4 }} - {{- end }} - {{- if and .Values.envoy.service.loadBalancerClass (eq .Values.envoy.service.type "LoadBalancer") }} - loadBalancerClass: {{ .Values.envoy.service.loadBalancerClass }} - {{- end }} - ports: - - name: http - port: {{ .Values.envoy.service.ports.http }} - protocol: TCP - targetPort: {{ .Values.envoy.service.targetPorts.http }} - {{- if and (or (eq .Values.envoy.service.type "NodePort") (eq .Values.envoy.service.type "LoadBalancer")) (not (empty .Values.envoy.service.nodePorts.http)) }} - nodePort: {{ .Values.envoy.service.nodePorts.http }} - {{- else if eq .Values.envoy.service.type "ClusterIP" }} - nodePort: null - {{- end }} - {{- if .Values.envoy.service.extraPorts }} - {{- include "common.tplvalues.render" (dict "value" .Values.envoy.service.extraPorts "context" $) | nindent 4 }} - {{- end }} - selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: envoy - type: {{ .Values.envoy.service.type }} -{{- if .Values.metrics.serviceMonitor.enabled }} ---- -apiVersion: v1 -kind: Service -metadata: - name: {{ printf "%s-envoy-metrics" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: envoy -spec: - type: ClusterIP - clusterIP: None - {{- if not .Values.envoy.shutdownManager.enabled }} - publishNotReadyAddresses: true - {{- end }} - selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: envoy - ports: - - name: metrics - port: {{ .Values.envoy.service.ports.metrics }} - protocol: TCP - targetPort: {{ .Values.envoy.service.targetPorts.metrics }} -{{- end }} -{{- end }} diff --git a/helm-templates/contour/templates/envoy/serviceaccount.yaml b/helm-templates/contour/templates/envoy/serviceaccount.yaml deleted file mode 100644 index 372d20a..0000000 --- a/helm-templates/contour/templates/envoy/serviceaccount.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if and .Values.envoy.serviceAccount.create .Values.envoy.enabled }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "envoy.envoyServiceAccountName" . }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: envoy - {{- if or .Values.envoy.serviceAccount.annotations .Values.commonAnnotations }} - {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }} - annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} - {{- end }} -automountServiceAccountToken: {{ .Values.envoy.serviceAccount.automountServiceAccountToken }} -{{- end }} diff --git a/helm-templates/contour/templates/envoy/servicemonitor.yaml b/helm-templates/contour/templates/envoy/servicemonitor.yaml deleted file mode 100644 index 7f8caeb..0000000 --- a/helm-templates/contour/templates/envoy/servicemonitor.yaml +++ /dev/null @@ -1,48 +0,0 @@ -{{- /* -Copyright VMware, Inc. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if and .Values.metrics.serviceMonitor.enabled .Values.envoy.enabled }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ default (include "common.names.namespace" .) .Values.metrics.serviceMonitor.namespace | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: envoy - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel | quote }} - selector: - matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 6 }} - app.kubernetes.io/component: envoy - {{- if .Values.metrics.serviceMonitor.selector }} - {{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }} - {{- end }} - namespaceSelector: - matchNames: - - {{ include "common.names.namespace" . | quote }} - endpoints: - - port: metrics - path: /stats/prometheus - {{- if .Values.metrics.serviceMonitor.interval }} - interval: {{ .Values.metrics.serviceMonitor.interval }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} - scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.honorLabels }} - honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.metricRelabelings }} - metricRelabelings: {{ toYaml .Values.metrics.serviceMonitor.metricRelabelings | nindent 6 }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.relabelings }} - relabelings: {{ toYaml .Values.metrics.serviceMonitor.relabelings | nindent 6 }} - {{- end }} -{{- end }} diff --git a/helm-templates/contour/values.yaml b/helm-templates/contour/values.yaml deleted file mode 100644 index 7dc2897..0000000 --- a/helm-templates/contour/values.yaml +++ /dev/null @@ -1,1514 +0,0 @@ -# Copyright VMware, Inc. -# SPDX-License-Identifier: APACHE-2.0 - -## @section Global parameters -## Global Docker image parameters -## Please, note that this will override the image parameters, including dependencies, configured to use the global value -## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass -## - -## @param global.imageRegistry Global Docker image registry -## @param global.imagePullSecrets [array] Global Docker registry secret names as an array -## @param global.storageClass Global StorageClass for Persistent Volume(s) -## -global: - imageRegistry: "" - ## E.g. - ## imagePullSecrets: - ## - myRegistryKeySecretName - ## - imagePullSecrets: [] - storageClass: "" - -## @section Common parameters -## - -## @param nameOverride String to partially override contour.fullname include (will maintain the release name) -## -nameOverride: "" -## @param fullnameOverride String to fully override contour.fullname template -## -fullnameOverride: "" -## @param namespaceOverride String to fully override common.names.namespace -## -namespaceOverride: "" -## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set) -## -kubeVersion: "" -## @param extraDeploy [array] Array of extra objects to deploy with the release -## -extraDeploy: [] -## @param commonLabels Labels to add to all deployed objects -## -commonLabels: {} -## @param commonAnnotations Annotations to add to all deployed objects -## -commonAnnotations: {} - -## Diagnostic mode in the deployment -## -diagnosticMode: - ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) - ## - enabled: false - ## @param diagnosticMode.command [array] Command to override all containers in the deployment - ## - command: - - sleep - ## @param diagnosticMode.args [array] Args to override all containers in the deployment - ## - args: - - infinity - -## @section Contour parameters -## - -## To configure Contour, you must specify ONE of the following two options. -## @param existingConfigMap Specifies the name of an externally-defined ConfigMap to use as the configuration (this is mutually exclusive with `configInline`) -## Helm will not manage the contents of this ConfigMap, it is your responsibility to create it. -## e.g: -## existingConfigMap: contour -## -existingConfigMap: "" -## @param configInline [object] Specifies Contour's configuration directly in YAML format -## When configInline is used, Helm manages Contour's configuration ConfigMap as -## part of the release, and existingConfigMap is ignored. -## Refer to https://projectcontour.io/docs/latest/configuration for available options. -## -configInline: - disablePermitInsecure: false - tls: - fallback-certificate: {} - accesslog-format: envoy - -contour: - ## @param contour.enabled Contour Deployment creation. - ## - enabled: true - ## @param contour.image.registry [default: REGISTRY_NAME] Contour image registry - ## @param contour.image.repository [default: REPOSITORY_NAME/contour] Contour image name - ## @skip contour.image.tag Contour image tag - ## @param contour.image.digest Contour image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag - ## @param contour.image.pullPolicy Contour Image pull policy - ## @param contour.image.pullSecrets [array] Contour Image pull secrets - ## @param contour.image.debug Enable image debug mode - ## - image: - registry: asia-southeast1-docker.pkg.dev - repository: meesho-devops-admin-0622/admin/devops/contour - tag: 1.27-custom-3 - digest: "" - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - debug: false - ## @param contour.contourConfigName Contour Deployment with ContourConfiguration CRD. - # - contourConfigName: "contour" - ## @param contour.configPath Contour Deployment with configmap. - ## - configPath: true - ## @param contour.replicaCount Number of Contour Pod replicas - # - replicaCount: 1 - ## @param contour.priorityClassName Priority class assigned to the pods - ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass - ## - priorityClassName: "" - ## @param contour.schedulerName Name of the k8s scheduler (other than default) - ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ - ## - schedulerName: "" - ## @param contour.terminationGracePeriodSeconds In seconds, time the given to the Contour pod needs to terminate gracefully - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods - ## - terminationGracePeriodSeconds: "" - ## @param contour.topologySpreadConstraints Topology Spread Constraints for pod assignment - ## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ - ## The value is evaluated as a template - ## - topologySpreadConstraints: [] - ## Configures the ports the Envoy proxy listens on - ## @param contour.containerPorts.xds Set xds port inside Contour pod - ## @param contour.containerPorts.metrics Set metrics port inside Contour pod - ## - containerPorts: - xds: 8001 - metrics: 8000 - ## @param contour.hostAliases [array] Add deployment host aliases - ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ - ## - hostAliases: [] - ## @param contour.updateStrategy Strategy to use to update Pods - ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies - ## - updateStrategy: {} - ## @param contour.extraArgs [array] Extra arguments passed to Contour container - ## - extraArgs: [] - ## Contour container resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## ref: https://projectcontour.io/guides/resource-limits/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param contour.resources.limits [object] Specify resource limits which the container is not allowed to succeed. - ## @param contour.resources.requests [object] Specify resource requests which the container needs to spawn. - ## - resources: - ## Example: - ## limits: - ## cpu: 400m - ## memory: 258Mi - ## - limits: {} - ## Examples: - ## requests: - ## cpu: 100m - ## memory: 25Mi - ## - requests: {} - ## @param contour.manageCRDs Manage the creation, upgrade and deletion of Contour CRDs. - ## - manageCRDs: true - ## @param contour.envoyServiceNamespace Namespace of the envoy service to inspect for Ingress status details. - ## - envoyServiceNamespace: "" - ## @param contour.envoyServiceName Name of the envoy service to inspect for Ingress status details. - ## - envoyServiceName: "" - ## @param contour.leaderElectionResourceName Name of the contour (Lease) leader election will lease. - ## - leaderElectionResourceName: "" - ## @param contour.ingressStatusAddress Address to set in Ingress object status. It is exclusive with `envoyServiceName` and `envoyServiceNamespace`. - ## - ingressStatusAddress: "" - ## @param contour.podAffinityPreset Contour Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAffinityPreset: "" - ## @param contour.podAntiAffinityPreset Contour Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAntiAffinityPreset: soft - ## @param contour.podLabels [object] Extra labels for Contour pods - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - ## - podLabels: {} - ## @param contour.lifecycleHooks lifecycleHooks for the container to automate configuration before or after startup. - ## - lifecycleHooks: {} - ## @param contour.customLivenessProbe Override default liveness probe - ## - customLivenessProbe: {} - ## @param contour.customReadinessProbe Override default readiness probe - ## - customReadinessProbe: {} - ## @param contour.customStartupProbe Override default startup probe - ## - customStartupProbe: {} - ## Node affinity preset - ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity - ## @param contour.nodeAffinityPreset.type Contour Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## @param contour.nodeAffinityPreset.key Contour Node label key to match Ignored if `affinity` is set. - ## @param contour.nodeAffinityPreset.values [array] Contour Node label values to match. Ignored if `affinity` is set. - ## - nodeAffinityPreset: - type: "" - ## E.g. - ## key: "kubernetes.io/e2e-az-name" - ## - key: "" - ## E.g. - ## values: - ## - e2e-az1 - ## - e2e-az2 - ## - values: [] - ## @param contour.command Override default command - ## - command: [] - ## @param contour.args Override default args - ## - args: [] - ## @param contour.affinity [object] Affinity for Contour pod assignment - ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set - ## - affinity: {} - ## @param contour.nodeSelector [object] Node labels for Contour pod assignment - ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: {} - ## @param contour.tolerations [array] Tolerations for Contour pod assignment - ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - ## - tolerations: [] - ## @param contour.podAnnotations [object] Contour Pod annotations - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ - ## - podAnnotations: {} - ## @param contour.serviceAccount.create Create a serviceAccount for the Contour pod - ## @param contour.serviceAccount.name Use the serviceAccount with the specified name, a name is generated using the fullname template - ## @param contour.serviceAccount.automountServiceAccountToken Automount service account token for the server service account - ## @param contour.serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`. - ## - serviceAccount: - create: true - name: "" - automountServiceAccountToken: true - annotations: {} - ## Contour Security Context - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod - ## @param contour.podSecurityContext.enabled Default backend Pod securityContext - ## @param contour.podSecurityContext.fsGroup Set Default backend Pod's Security Context fsGroup - ## - podSecurityContext: - enabled: true - fsGroup: 1001 - ## Envoy container security context - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container - ## @param contour.containerSecurityContext.enabled Enabled contour containers' Security Context - ## @param contour.containerSecurityContext.runAsUser Set contour containers' Security Context runAsUser - ## @param contour.containerSecurityContext.runAsNonRoot Set contour containers' Security Context runAsNonRoot - ## @param contour.containerSecurityContext.readOnlyRootFilesystem Set read only root file system pod's Security Conte - ## @param contour.containerSecurityContext.privileged Set contour container's Security Context privileged - ## @param contour.containerSecurityContext.allowPrivilegeEscalation Set contour container's Security Context allowPrivilegeEscalation - ## @param contour.containerSecurityContext.capabilities.drop List of capabilities to be dropped - ## @param contour.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile - ## - containerSecurityContext: - enabled: true - runAsUser: 1001 - runAsNonRoot: true - privileged: false - allowPrivilegeEscalation: false - capabilities: - drop: ["ALL"] - seccompProfile: - type: "RuntimeDefault" - readOnlyRootFilesystem: false - ## @param contour.livenessProbe.enabled Enable/disable the Liveness probe - ## @param contour.livenessProbe.initialDelaySeconds Delay before liveness probe is initiated - ## @param contour.livenessProbe.periodSeconds How often to perform the probe - ## @param contour.livenessProbe.timeoutSeconds When the probe times out - ## @param contour.livenessProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded. - ## @param contour.livenessProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed. - ## - livenessProbe: - enabled: true - initialDelaySeconds: 120 - periodSeconds: 20 - timeoutSeconds: 5 - failureThreshold: 6 - successThreshold: 1 - ## @param contour.readinessProbe.enabled Enable/disable the readiness probe - ## @param contour.readinessProbe.initialDelaySeconds Delay before readiness probe is initiated - ## @param contour.readinessProbe.periodSeconds How often to perform the probe - ## @param contour.readinessProbe.timeoutSeconds When the probe times out - ## @param contour.readinessProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded. - ## @param contour.readinessProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed. - ## - readinessProbe: - enabled: true - initialDelaySeconds: 15 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 3 - successThreshold: 1 - ## @param contour.startupProbe.enabled Enable/disable the startup probe - ## @param contour.startupProbe.initialDelaySeconds Delay before startup probe is initiated - ## @param contour.startupProbe.periodSeconds How often to perform the probe - ## @param contour.startupProbe.timeoutSeconds When the probe times out - ## @param contour.startupProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded. - ## @param contour.startupProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed. - ## - startupProbe: - enabled: false - initialDelaySeconds: 15 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 3 - successThreshold: 1 - ## Contour certgen configs - ## - certgen: - ## @param contour.certgen.serviceAccount.create Create a serviceAccount for the Contour pod - ## @param contour.certgen.serviceAccount.name Use the serviceAccount with the specified name, a name is generated using the fullname template - ## @param contour.certgen.serviceAccount.automountServiceAccountToken Automount service account token for the server service account - ## @param contour.certgen.serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`. - ## - serviceAccount: - create: true - name: "" - automountServiceAccountToken: true - annotations: {} - ## @param contour.certgen.certificateLifetime Generated certificate lifetime (in days). - ## - certificateLifetime: 365 - ## @param contour.tlsExistingSecret Name of the existingSecret to be use in Contour deployment. If it is not nil `contour.certgen` will be disabled. - ## It will override `tlsExistingSecret` - ## - tlsExistingSecret: "" - ## Contour Service properties - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#multi-port-services - ## - service: - ## @param contour.service.type Service type - ## - type: ClusterIP - ## @param contour.service.ports.xds Contour service xds port - ## @param contour.service.ports.metrics Contour service xds port - ## - ports: - xds: 8001 - metrics: 8000 - ## Node ports to expose - ## @param contour.service.nodePorts.xds Node port for HTTP - ## NOTE: choose port between <30000-32767> - ## - nodePorts: - xds: "" - ## @param contour.service.clusterIP Contour service Cluster IP - ## e.g.: - ## clusterIP: None - ## - clusterIP: "" - ## @param contour.service.loadBalancerIP Contour service Load Balancer IP - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer - ## - loadBalancerIP: "" - ## @param contour.service.loadBalancerSourceRanges Contour service Load Balancer sources - ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service - ## e.g: - ## loadBalancerSourceRanges: - ## - 10.10.10.0/24 - ## - loadBalancerSourceRanges: [] - ## @param contour.service.loadBalancerClass Contour service Load Balancer Class - ## ref https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class - ## - loadBalancerClass: "" - ## @param contour.service.externalTrafficPolicy Contour service external traffic policy - ## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip - ## - externalTrafficPolicy: Cluster - ## @param contour.service.annotations Additional custom annotations for Contour service - ## - annotations: {} - ## @param contour.service.tcpLB Enable a separate TCP Load Balancer service for Contour (GCP Internal LB for xDS/gRPC). When true, contour/service-loadbalancer.yaml is rendered with hardcoded GCP annotations; labels and selector come from values. - ## - tcpLB: false - ## @param contour.service.extraPorts Extra port to expose on Contour service - ## - extraPorts: [] - ## @param contour.service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP" - ## If "ClientIP", consecutive client requests will be directed to the same Pod - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies - ## - sessionAffinity: None - ## @param contour.service.sessionAffinityConfig Additional settings for the sessionAffinity - ## sessionAffinityConfig: - ## clientIP: - ## timeoutSeconds: 300 - ## - sessionAffinityConfig: {} - ## @param contour.initContainers [array] Attach additional init containers to Contour pods - ## For example: - ## initContainers: - ## - name: your-image-name - ## image: your-image - ## imagePullPolicy: Always - ## - initContainers: [] - ## @param contour.sidecars [array] Add additional sidecar containers to the Contour pods - ## Example: - ## sidecars: - ## - name: your-image-name - ## image: your-image - ## imagePullPolicy: Always - ## ports: - ## - name: portname - ## containerPort: 1234 - ## - sidecars: [] - ## @param contour.extraVolumes [array] Array to add extra volumes - ## - extraVolumes: [] - ## @param contour.extraVolumeMounts [array] Array to add extra mounts (normally used with extraVolumes) - ## - extraVolumeMounts: [] - ## @param contour.extraEnvVars [array] Array containing extra env vars to be added to all Contour containers - ## For example: - ## extraEnvVars: - ## - name: MY_ENV_VAR - ## value: env_var_value - ## - extraEnvVars: [] - ## @param contour.extraEnvVarsCM ConfigMap containing extra env vars to be added to all Contour containers - ## - extraEnvVarsCM: "" - ## @param contour.extraEnvVarsSecret Secret containing extra env vars to be added to all Contour containers - ## - extraEnvVarsSecret: "" - ## @param contour.ingressClass.name Name of the ingress class to route through this controller. - ## @param contour.ingressClass.create Whether to create or not the IngressClass resource - ## @param contour.ingressClass.default Mark IngressClass resource as default for cluster - ## - ## DEPRECATED: Use a map instead - ## You can use the the 'contour.ingressClass' as a string to indicate the ingress - ## class name. This will skip the creation of an IngressClass resource. - ## e.g: - ## ingressClass: contour - ## - ingressClass: - name: "" - create: true - default: true - - ## @param contour.debug Enable Contour debug log level - ## - debug: false - - ## @param contour.logFormat Set contour log-format. Default text, either text or json. - ## - logFormat: text - - ## @param contour.kubernetesDebug Contour kubernetes debug log level, Default 0, minimum 0, maximum 9. - ## - kubernetesDebug: 0 - - ## @param contour.rootNamespaces Restrict Contour to searching these namespaces for root ingress routes. - ## - rootNamespaces: "" - - ## Exposes configuration of Envoy's Overload Manager through Contour's bootstrapping process - ## When 95% of max heap size is reached for an Envoy, "shrink heap" operation is triggered. - ## When 98% of max heap size is reached for an Envoy, it no longer accepts requests. - ## https://projectcontour.io/docs/main/config/overload-manager/ - ## @param contour.overloadManager.enabled Enable Overload Manager - ## @param contour.overloadManager.maxHeapBytes Overload Manager's maximum heap size in bytes - ## - overloadManager: - enabled: false - maxHeapBytes: "2147483648" - -## @section Envoy parameters -## - -envoy: - ## @param envoy.enabled Envoy Proxy creation - ## - enabled: true - ## Bitnami Envoy image - ## ref: https://hub.docker.com/r/bitnami/envoy/tags/ - ## @param envoy.image.registry [default: REGISTRY_NAME] Envoy Proxy image registry - ## @param envoy.image.repository [default: REPOSITORY_NAME/envoy] Envoy Proxy image repository - ## @skip envoy.image.tag Envoy Proxy image tag (immutable tags are recommended) - ## @param envoy.image.digest Envoy Proxy image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag - ## @param envoy.image.pullPolicy Envoy image pull policy - ## @param envoy.image.pullSecrets [array] Envoy image pull secrets - ## - image: - registry: asia-southeast1-docker.pkg.dev - repository: meesho-devops-admin-0622/admin/devops/bitnami/envoy - tag: 1.27.2-debian-11-r1 - digest: "" - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## @param envoy.priorityClassName Priority class assigned to the pods - ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass - ## - priorityClassName: "" - ## @param envoy.schedulerName Name of the k8s scheduler (other than default) - ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ - ## - schedulerName: "" - ## @param envoy.topologySpreadConstraints Topology Spread Constraints for pod assignment - ## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ - ## The value is evaluated as a template - ## - topologySpreadConstraints: [] - ## @param envoy.extraArgs [array] Extra arguments passed to Envoy container - ## - extraArgs: [] - ## @param envoy.hostAliases [array] Add deployment host aliases - ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ - ## - hostAliases: [] - ## Envoy container resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## ref: https://projectcontour.io/guides/resource-limits/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param envoy.resources.limits [object] Specify resource limits which the container is not allowed to succeed. - ## @param envoy.resources.requests [object] Specify resource requests which the container needs to spawn. - ## - resources: - ## Example: - ## limits: - ## cpu: 400m - ## memory: 250Mi - ## - limits: {} - ## Examples: - ## requests: - ## cpu: 100m - ## memory: 25Mi - ## - requests: {} - ## @param envoy.command Override default command - ## - command: [] - ## @param envoy.args Override default args - ## - args: [] - ## @param envoy.shutdownManager.enabled Contour shutdownManager sidecar - ## @param envoy.shutdownManager.extraArgs [array] Extra arguments passed to shutdown container - ## @param envoy.shutdownManager.port Specify Port for shutdown container - ## @param envoy.shutdownManager.resources.limits [object] Specify resource limits which the container is not allowed to succeed. - ## @param envoy.shutdownManager.resources.requests [object] Specify resource requests which the container needs to spawn. - ## - shutdownManager: - extraArgs: [] - port: "8090" - enabled: true - resources: - ## Example: - ## limits: - ## cpu: 50m - ## memory: 32Mi - ## - limits: {} - ## Examples: - ## requests: - ## cpu: 10m - ## memory: 16Mi - ## - requests: - cpu: 150m - memory: 256Mi - ## Shutdown Manager container security context - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container - ## @param envoy.shutdownManager.containerSecurityContext.enabled Enabled envoy shutdownManager containers' Security Context - ## @param envoy.shutdownManager.containerSecurityContext.runAsUser Set envoy shutdownManager containers' Security Context runAsUser - ## @param envoy.shutdownManager.containerSecurityContext.runAsNonRoot Set envoy shutdownManager containers' Security Context runAsNonRoot - ## @param envoy.shutdownManager.containerSecurityContext.readOnlyRootFilesystem Set read only root file system pod's Security Conte - ## @param envoy.shutdownManager.containerSecurityContext.privileged Set envoy.shutdownManager container's Security Context privileged - ## @param envoy.shutdownManager.containerSecurityContext.allowPrivilegeEscalation Set envoy shutdownManager container's Security Context allowPrivilegeEscalation - ## @param envoy.shutdownManager.containerSecurityContext.capabilities.drop List of capabilities to be dropped - ## @param envoy.shutdownManager.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile - ## - containerSecurityContext: - enabled: true - runAsUser: 1001 - runAsNonRoot: true - privileged: false - allowPrivilegeEscalation: false - capabilities: - drop: ["ALL"] - seccompProfile: - type: "RuntimeDefault" - readOnlyRootFilesystem: true - - ## Envoy Initconfig initcontainer security context - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container - ## @param envoy.initConfig.containerSecurityContext.enabled Enabled envoy initConfig containers' Security Context - ## @param envoy.initConfig.containerSecurityContext.runAsUser Set envoy initConfig containers' Security Context runAsUser - ## @param envoy.initConfig.containerSecurityContext.runAsNonRoot Set envoy initConfig containers' Security Context runAsNonRoot - ## @param envoy.initConfig.containerSecurityContext.readOnlyRootFilesystem Set read only root file system pod's Security Conte - ## @param envoy.initConfig.containerSecurityContext.privileged Set contraller container's Security Context privileged - ## @param envoy.initConfig.containerSecurityContext.allowPrivilegeEscalation Set contraller container's Security Context allowPrivilegeEscalation - ## @param envoy.initConfig.containerSecurityContext.capabilities.drop List of capabilities to be dropped - ## @param envoy.initConfig.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile - ## - initConfig: - containerSecurityContext: - enabled: true - runAsUser: 1001 - runAsNonRoot: true - privileged: false - allowPrivilegeEscalation: false - capabilities: - drop: ["ALL"] - seccompProfile: - type: "RuntimeDefault" - readOnlyRootFilesystem: false - ## @param envoy.kind Install as deployment or daemonset - ## - kind: daemonset - ## @param envoy.replicaCount Desired number of Controller pods - ## - replicaCount: 1 - ## @param envoy.lifecycleHooks lifecycleHooks for the container to automate configuration before or after startup. - ## - lifecycleHooks: {} - ## @param envoy.updateStrategy [object] Strategy to use to update Pods - ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy - ## e.g: - updateStrategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 10% - maxUnavailable: 0 - ## @param envoy.minReadySeconds The minimum number of seconds for which a newly created Pod should be ready - ## - minReadySeconds: 0 - ## @param envoy.revisionHistoryLimit The number of old history to retain to allow rollback - ## - revisionHistoryLimit: 10 - ## Controller Autoscaling configuration - ## @param envoy.autoscaling.enabled Enable autoscaling for Controller - ## @param envoy.autoscaling.minReplicas Minimum number of Controller replicas - ## @param envoy.autoscaling.maxReplicas Maximum number of Controller replicas - ## @param envoy.autoscaling.targetCPU Target CPU utilization percentage - ## @param envoy.autoscaling.targetMemory Target Memory utilization percentage - ## @param envoy.autoscaling.behavior HPA Behavior - ## - autoscaling: - keda: - enabled: false - pollingInterval: 15 - scaledown: - policies: - - periodseconds: 15 - type: Pods - value: 2 - selectpolicy: Min - stabilizationWindowSeconds: 1800 - scaleup: - policies: - - periodseconds: 15 - type: Percent - value: 100 - selectpolicy: Max - stabilizationWindowSeconds: 0 - triggers: [] - enabled: false - minReplicas: 1 - maxReplicas: 11 - targetCPU: "" - targetMemory: "" - behavior: - scaleDown: - stabilizationWindowSeconds: 1800 - ## @param envoy.podAffinityPreset Envoy Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## Allowed values: soft, hard - ## - podAffinityPreset: "" - ## @param envoy.podAntiAffinityPreset Envoy Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## Allowed values: soft, hard - ## - podAntiAffinityPreset: "" - ## Node affinity preset - ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity - ## @param envoy.nodeAffinityPreset.type Envoy Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## @param envoy.nodeAffinityPreset.key Envoy Node label key to match Ignored if `affinity` is set. - ## @param envoy.nodeAffinityPreset.values [array] Envoy Node label values to match. Ignored if `affinity` is set. - ## - nodeAffinityPreset: - type: "" - key: "" - ## E.g. - ## values: - ## - e2e-az1 - ## - e2e-az2 - ## - values: [] - ## @param envoy.affinity [object] Affinity for Envoy pod assignment - ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set - ## - affinity: {} - ## @param envoy.nodeSelector [object] Node labels for Envoy pod assignment - ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: {} - ## @param envoy.tolerations [array] Tolerations for Envoy pod assignment - ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - ## - tolerations: [] - ## @param envoy.podAnnotations [object] Envoy Pod annotations - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ - ## - podAnnotations: {} - ## @param envoy.podLabels Extra labels for Envoy pods - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - ## - podLabels: {} - ## Pod security context - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod - ## @param envoy.podSecurityContext.enabled Envoy Pod securityContext - ## @param envoy.podSecurityContext.fsGroup User ID for the for the mounted volumes - ## @param envoy.podSecurityContext.sysctls Array of sysctl options to allow - ## - podSecurityContext: - fsGroup: 0 - sysctls: [] - enabled: false - ## Envoy container security context - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container - ## @param envoy.containerSecurityContext.enabled Enabled envoy containers' Security Context - ## @param envoy.containerSecurityContext.runAsUser Set envoy containers' Security Context runAsUser - ## @param envoy.containerSecurityContext.runAsNonRoot Set envoy containers' Security Context runAsNonRoot - ## @param envoy.containerSecurityContext.readOnlyRootFilesystem Set read only root file system pod's Security Conte - ## @param envoy.containerSecurityContext.privileged Set envoy container's Security Context privileged - ## @param envoy.containerSecurityContext.allowPrivilegeEscalation Set envoy container's Security Context allowPrivilegeEscalation - ## @param envoy.containerSecurityContext.capabilities.drop List of capabilities to be dropped - ## @param envoy.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile - ## - containerSecurityContext: - enabled: true - runAsUser: 1001 - runAsNonRoot: true - privileged: false - allowPrivilegeEscalation: false - capabilities: - drop: ["ALL"] - seccompProfile: - type: "RuntimeDefault" - readOnlyRootFilesystem: false - ## @param envoy.hostNetwork Envoy Pod host network access - ## ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces - ## - hostNetwork: false - ## @param envoy.dnsPolicy Envoy Pod Dns Policy's DNS Policy - ## ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy - ## - dnsPolicy: ClusterFirst - ## @param envoy.tlsExistingSecret Name of the existingSecret to be use in Envoy deployment - ## - tlsExistingSecret: "" - ## @param envoy.serviceAccount.create Specifies whether a ServiceAccount should be created - ## @param envoy.serviceAccount.name The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template - ## @param envoy.serviceAccount.automountServiceAccountToken Whether to auto mount API credentials for a service account - ## @param envoy.serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#use-the-default-service-account-to-access-the-api-server - ## - serviceAccount: - create: true - name: "" - automountServiceAccountToken: false - annotations: {} - ## @param envoy.livenessProbe.enabled Enable livenessProbe - ## @param envoy.livenessProbe.port LivenessProbe port - ## @param envoy.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe - ## @param envoy.livenessProbe.periodSeconds Period seconds for livenessProbe - ## @param envoy.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe - ## @param envoy.livenessProbe.failureThreshold Failure threshold for livenessProbe - ## @param envoy.livenessProbe.successThreshold Success threshold for livenessProbe - ## - livenessProbe: - enabled: true - port: 8002 - initialDelaySeconds: 120 - periodSeconds: 20 - timeoutSeconds: 5 - failureThreshold: 6 - successThreshold: 1 - ## @param envoy.readinessProbe.enabled Enable/disable the readiness probe - ## @param envoy.readinessProbe.port ReadinessProbe port - ## @param envoy.readinessProbe.initialDelaySeconds Delay before readiness probe is initiated - ## @param envoy.readinessProbe.periodSeconds How often to perform the probe - ## @param envoy.readinessProbe.timeoutSeconds When the probe times out - ## @param envoy.readinessProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded. - ## @param envoy.readinessProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed. - ## - readinessProbe: - enabled: true - port: 8002 - initialDelaySeconds: 10 - periodSeconds: 3 - timeoutSeconds: 1 - failureThreshold: 3 - successThreshold: 1 - ## @param envoy.startupProbe.enabled Enable/disable the startup probe - ## @param envoy.startupProbe.port StartupProbe port - ## @param envoy.startupProbe.initialDelaySeconds Delay before startup probe is initiated - ## @param envoy.startupProbe.periodSeconds How often to perform the probe - ## @param envoy.startupProbe.timeoutSeconds When the probe times out - ## @param envoy.startupProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded. - ## @param envoy.startupProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed. - ## - startupProbe: - enabled: false - port: 8002 - initialDelaySeconds: 15 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 3 - successThreshold: 1 - ## @param envoy.customLivenessProbe Override default liveness probe - ## - customLivenessProbe: {} - ## @param envoy.customReadinessProbe Override default readiness probe - ## - customReadinessProbe: {} - ## @param envoy.customStartupProbe Override default startup probe - ## - customStartupProbe: {} - ## @param envoy.terminationGracePeriodSeconds Envoy termination grace period in seconds - ## - terminationGracePeriodSeconds: 300 - ## @param envoy.logLevel Envoy log level - ## - logLevel: info - ## Envoy Service properties - ## - service: - export: - enabled: false - ## @param envoy.service.name envoy service name - ## - name: "" - ## @param envoy.service.targetPorts [object] Map the controller service HTTP/HTTPS port - ## - targetPorts: - http: http - https: https - metrics: metrics - ## @param envoy.service.type Type of Envoy service to create - ## - type: LoadBalancer - ## @param envoy.service.externalTrafficPolicy Envoy Service external cluster policy. If `envoy.service.type` is NodePort or LoadBalancer - ## - externalTrafficPolicy: null - ## @param envoy.service.labels Labels to add to te envoy service - ## - labels: {} - ## @param envoy.service.clusterIP Internal envoy cluster service IP - ## e.g.: - ## clusterIP: None - ## - clusterIP: "" - ## @param envoy.service.externalIPs [array] Envoy service external IP addresses - ## - externalIPs: [] - ## @param envoy.service.loadBalancerIP IP address to assign to load balancer (if supported) - ## - loadBalancerIP: "" - ## @param envoy.service.loadBalancerSourceRanges [array] List of IP CIDRs allowed access to load balancer (if supported) - ## - loadBalancerSourceRanges: [] - ## @param envoy.service.loadBalancerClass Envoy service Load Balancer Class - ## ref https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class - ## - loadBalancerClass: "" - ## @param envoy.service.ipFamilyPolicy [string], support SingleStack, PreferDualStack and RequireDualStack - ## - ipFamilyPolicy: "" - ## @param envoy.service.ipFamilies [array] List of IP families (e.g. IPv4, IPv6) assigned to the service. - ## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ - ## E.g. - ## ipFamilies: - ## - IPv6 - ## - ipFamilies: [] - ## @param envoy.service.annotations [object] Annotations for Envoy service - ## - annotations: {} - ports: - ## @param envoy.service.ports.http Sets service http port - ## - http: 80 - ## @param envoy.service.ports.https Sets service https port - ## - https: 443 - ## @param envoy.service.ports.metrics Sets service metrics port - ## - metrics: 8002 - ## Specify the nodePort(s) value(s) for the LoadBalancer and NodePort service types. - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport - ## @param envoy.service.nodePorts.http HTTP Port. If `envoy.service.type` is NodePort and this is non-empty - ## @param envoy.service.nodePorts.https HTTPS Port. If `envoy.service.type` is NodePort and this is non-empty - ## - nodePorts: - http: "" - https: "" - ## @param envoy.service.extraPorts [array] Extra ports to expose (normally used with the `sidecar` value) - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#multi-port-services - ## - extraPorts: [] - ## @param envoy.service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP" - ## If "ClientIP", consecutive client requests will be directed to the same Pod - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies - ## - sessionAffinity: None - ## @param envoy.service.sessionAffinityConfig Additional settings for the sessionAffinity - ## sessionAffinityConfig: - ## clientIP: - ## timeoutSeconds: 300 - ## - sessionAffinityConfig: {} - ## @param envoy.useHostPort.http Enable/disable `hostPort` for TCP/80 - ## @param envoy.useHostPort.https Enable/disable `hostPort` TCP/443 - ## @param envoy.useHostPort.metrics Enable/disable `hostPort` for TCP/8002 - ## - useHostPort: - http: false - https: false - metrics: false - ## @param envoy.useHostIP Enable/disable `hostIP` - ## - useHostIP: false - ## @param envoy.hostPorts.http Sets `hostPort` http port - ## @param envoy.hostPorts.https Sets `hostPort` https port - ## @param envoy.hostPorts.metrics Sets `hostPort` metrics port - ## - hostPorts: - http: 80 - https: 443 - metrics: 8002 - ## @param envoy.hostIPs.http Sets `hostIP` http IP - ## @param envoy.hostIPs.https Sets `hostIP` https IP - ## @param envoy.hostIPs.metrics Sets `hostIP` metrics IP - ## - hostIPs: - http: 127.0.0.1 - https: 127.0.0.1 - metrics: 127.0.0.1 - ## Configures the ports the Envoy proxy listens on - ## @param envoy.containerPorts.http Sets http port inside Envoy pod (change this to >1024 to run envoy as a non-root user) - ## @param envoy.containerPorts.https Sets https port inside Envoy pod (change this to >1024 to run envoy as a non-root user) - ## @param envoy.containerPorts.metrics Sets metrics port inside Envoy pod (change this to >1024 to run envoy as a non-root user) - ## - containerPorts: - http: 8080 - https: 8443 - metrics: 8002 - ## @param envoy.initContainers [array] Attach additional init containers to Envoy pods - ## For example: - ## initContainers: - ## - name: your-image-name - ## image: your-image - ## imagePullPolicy: Always - ## - initContainers: [] - ## @param envoy.sidecars Add additional sidecar containers to the Envoy pods - ## Example: - ## sidecars: - ## - name: your-image-name - ## image: your-image - ## imagePullPolicy: Always - ## ports: - ## - name: portname - ## containerPort: 1234 - ## - sidecars: [] - ## @param envoy.extraVolumes [array] Array to add extra volumes - ## - extraVolumes: [] - ## @param envoy.extraVolumeMounts [array] Array to add extra mounts (normally used with extraVolumes) - ## - extraVolumeMounts: [] - ## @param envoy.extraEnvVars [array] Array containing extra env vars to be added to all Envoy containers - ## For example: - ## extraEnvVars: - ## - name: MY_ENV_VAR - ## value: env_var_value - ## - extraEnvVars: [] - ## @param envoy.extraEnvVarsCM ConfigMap containing extra env vars to be added to all Envoy containers - ## - extraEnvVarsCM: "" - ## @param envoy.extraEnvVarsSecret Secret containing extra env vars to be added to all Envoy containers - ## - extraEnvVarsSecret: "" - -## @section Default backend parameters -## - -## Default 404 backend -## -defaultBackend: - ## @param defaultBackend.enabled Enable a default backend based on NGINX - ## - enabled: false - ## Bitnami NGINX image - ## ref: https://hub.docker.com/r/bitnami/nginx/tags/ - ## @param defaultBackend.image.registry [default: REGISTRY_NAME] Default backend image registry - ## @param defaultBackend.image.repository [default: REPOSITORY_NAME/nginx] Default backend image name - ## @skip defaultBackend.image.tag Default backend image tag - ## @param defaultBackend.image.digest Default backend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag - ## @param defaultBackend.image.pullPolicy Image pull policy - ## @param defaultBackend.image.pullSecrets [array] Specify docker-registry secret names as an array - ## - image: - registry: docker.io - repository: bitnami/nginx - tag: 1.25.3-debian-11-r1 - digest: "" - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## Example: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## @param defaultBackend.extraArgs [object] Additional command line arguments to pass to NGINX container - ## - extraArgs: {} - ## @param defaultBackend.lifecycleHooks lifecycleHooks for the container to automate configuration before or after startup. - ## - lifecycleHooks: {} - ## @param defaultBackend.extraEnvVars [array] Array containing extra env vars to be added to all Contour containers - ## For example: - ## extraEnvVars: - ## - name: MY_ENV_VAR - ## value: env_var_value - ## - extraEnvVars: [] - ## @param defaultBackend.extraEnvVarsCM ConfigMap containing extra env vars to be added to all Contour containers - ## - extraEnvVarsCM: "" - ## @param defaultBackend.extraEnvVarsSecret Secret containing extra env vars to be added to all Contour containers - ## - extraEnvVarsSecret: "" - ## @param defaultBackend.extraVolumes [array] Array to add extra volumes - ## - extraVolumes: [] - ## @param defaultBackend.extraVolumeMounts [array] Array to add extra mounts (normally used with extraVolumes) - ## - extraVolumeMounts: [] - ## @param defaultBackend.initContainers [array] Attach additional init containers to the http backend pods - ## For example: - ## initContainers: - ## - name: your-image-name - ## image: your-image - ## imagePullPolicy: Always - ## - initContainers: [] - ## @param defaultBackend.sidecars [array] Add additional sidecar containers to the default backend - ## Example: - ## sidecars: - ## - name: your-image-name - ## image: your-image - ## imagePullPolicy: Always - ## ports: - ## - name: portname - ## containerPort: 1234 - ## - sidecars: [] - ## Configures the ports the http backend listens on - ## @param defaultBackend.containerPorts.http Set http port inside Contour pod - ## - containerPorts: - http: 8001 - ## @param defaultBackend.updateStrategy Strategy to use to update Pods - ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies - ## - updateStrategy: {} - ## @param defaultBackend.command Override default command - ## - command: [] - ## @param defaultBackend.args Override default args - ## - args: [] - ## @param defaultBackend.hostAliases [array] Add deployment host aliases - ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ - ## - hostAliases: [] - ## @param defaultBackend.replicaCount Desired number of default backend pods - ## - replicaCount: 1 - ## Default backend pods' Security Context - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod - ## @param defaultBackend.podSecurityContext.enabled Default backend Pod securityContext - ## @param defaultBackend.podSecurityContext.fsGroup Set Default backend Pod's Security Context fsGroup - ## - podSecurityContext: - enabled: true - fsGroup: 1001 - ## Default backend containers' Security Context (only main container) - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container - ## @param defaultBackend.containerSecurityContext.enabled Enabled defaultBackend containers' Security Context - ## @param defaultBackend.containerSecurityContext.runAsUser Set defaultBackend containers' Security Context runAsUser - ## @param defaultBackend.containerSecurityContext.runAsNonRoot Set defaultBackend containers' Security Context runAsNonRoot - ## @param defaultBackend.containerSecurityContext.readOnlyRootFilesystem Set read only root file system pod's Security Conte - ## @param defaultBackend.containerSecurityContext.privileged Set defaultBackend container's Security Context privileged - ## @param defaultBackend.containerSecurityContext.allowPrivilegeEscalation Set defaultBackend container's Security Context allowPrivilegeEscalation - ## @param defaultBackend.containerSecurityContext.capabilities.drop List of capabilities to be dropped - ## @param defaultBackend.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile - ## - containerSecurityContext: - enabled: true - runAsUser: 1001 - runAsNonRoot: true - privileged: false - allowPrivilegeEscalation: false - capabilities: - drop: ["ALL"] - seccompProfile: - type: "RuntimeDefault" - readOnlyRootFilesystem: false - ## Default backend containers' resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. - ## @param defaultBackend.resources.limits [object] The resources limits for the Default backend container - ## @param defaultBackend.resources.requests [object] The requested resources for the Default backend container - ## - resources: - ## Example: - ## limits: - ## cpu: 250m - ## memory: 256Mi - ## - limits: {} - ## Examples: - ## requests: - ## cpu: 250m - ## memory: 256Mi - ## - requests: {} - ## Default backend containers' liveness probe. Evaluated as a template. - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param defaultBackend.livenessProbe.enabled Enable livenessProbe - ## @param defaultBackend.livenessProbe.httpGet [object] Path, port and scheme for the livenessProbe - ## @param defaultBackend.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe - ## @param defaultBackend.livenessProbe.periodSeconds Period seconds for livenessProbe - ## @param defaultBackend.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe - ## @param defaultBackend.livenessProbe.failureThreshold Failure threshold for livenessProbe - ## @param defaultBackend.livenessProbe.successThreshold Success threshold for livenessProbe - ## - livenessProbe: - enabled: true - failureThreshold: 3 - initialDelaySeconds: 30 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 5 - ## Default backend containers' readiness probe. Evaluated as a template. - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param defaultBackend.readinessProbe.enabled Enable readinessProbe - ## @param defaultBackend.readinessProbe.httpGet [object] Path, port and scheme for the readinessProbe - ## @param defaultBackend.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe - ## @param defaultBackend.readinessProbe.periodSeconds Period seconds for readinessProbe - ## @param defaultBackend.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe - ## @param defaultBackend.readinessProbe.failureThreshold Failure threshold for readinessProbe - ## @param defaultBackend.readinessProbe.successThreshold Success threshold for readinessProbe - ## - readinessProbe: - enabled: true - failureThreshold: 6 - initialDelaySeconds: 0 - periodSeconds: 5 - successThreshold: 1 - timeoutSeconds: 5 - ## @param defaultBackend.startupProbe.enabled Enable/disable the startup probe - ## @param defaultBackend.startupProbe.initialDelaySeconds Delay before startup probe is initiated - ## @param defaultBackend.startupProbe.periodSeconds How often to perform the probe - ## @param defaultBackend.startupProbe.timeoutSeconds When the probe times out - ## @param defaultBackend.startupProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded. - ## @param defaultBackend.startupProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed. - ## - startupProbe: - enabled: false - initialDelaySeconds: 15 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 3 - successThreshold: 1 - ## @param defaultBackend.customLivenessProbe [object] Override default liveness probe, it overrides the default one (evaluated as a template) - ## - customLivenessProbe: {} - ## @param defaultBackend.customReadinessProbe [object] Override default readiness probe, it overrides the default one (evaluated as a template) - ## - customReadinessProbe: {} - ## @param defaultBackend.customStartupProbe Override default startup probe - ## - customStartupProbe: {} - ## @param defaultBackend.podLabels [object] Extra labels for Controller pods - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - ## - podLabels: {} - ## @param defaultBackend.podAnnotations [object] Annotations for Controller pods - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ - ## - podAnnotations: {} - ## @param defaultBackend.priorityClassName Priority class assigned to the pods - ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass - ## - priorityClassName: "" - ## @param defaultBackend.schedulerName Name of the k8s scheduler (other than default) - ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ - ## - schedulerName: "" - ## @param defaultBackend.terminationGracePeriodSeconds In seconds, time the given to the default backend pod needs to terminate gracefully - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods - ## - terminationGracePeriodSeconds: 60 - ## @param defaultBackend.topologySpreadConstraints Topology Spread Constraints for pod assignment - ## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ - ## The value is evaluated as a template - ## - topologySpreadConstraints: [] - ## @param defaultBackend.podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## Allowed values: soft, hard - ## - podAffinityPreset: "" - ## @param defaultBackend.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## Allowed values: soft, hard - ## - podAntiAffinityPreset: soft - ## Node affinity preset - ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity - ## @param defaultBackend.nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## @param defaultBackend.nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set. - ## @param defaultBackend.nodeAffinityPreset.values [array] Node label values to match. Ignored if `affinity` is set. - ## - nodeAffinityPreset: - type: "" - key: "" - ## E.g. - ## values: - ## - e2e-az1 - ## - e2e-az2 - ## - values: [] - ## @param defaultBackend.affinity [object] Affinity for pod assignment. Evaluated as a template. - ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## Note: defaultBackend.podAffinityPreset, defaultBackend.podAntiAffinityPreset, and defaultBackend.nodeAffinityPreset will be ignored when it's set - ## - affinity: {} - ## @param defaultBackend.nodeSelector [object] Node labels for pod assignment. Evaluated as a template. - ## ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: {} - ## @param defaultBackend.tolerations [array] Tolerations for pod assignment. Evaluated as a template. - ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - ## - tolerations: [] - ## Default backend Service parameters - ## @param defaultBackend.service.type Service type - ## @param defaultBackend.service.ports.http Service port - ## @param defaultBackend.service.annotations Annotations to add to the service - ## - service: - type: ClusterIP - ports: - http: 80 - annotations: {} - ## PodDisruptionBudget for default backend - ## Default backend Pod Disruption Budget configuration - ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/ - ## @param defaultBackend.pdb.create Enable Pod Disruption Budget configuration - ## @param defaultBackend.pdb.minAvailable Minimum number/percentage of Default backend pods that should remain scheduled - ## @param defaultBackend.pdb.maxUnavailable Maximum number/percentage of Default backend pods that should remain scheduled - ## - pdb: - create: false - minAvailable: 1 - maxUnavailable: "" - -## Ingress parameters -## -ingress: - ## @param ingress.enabled Ingress configuration enabled - ## Ref: https://kubernetes.io/docs/user-guide/ingress/ - ## - ## Enable Ingress. - ## - enabled: false - ## @param ingress.apiVersion Force Ingress API version (automatically detected if not set) - ## - apiVersion: "" - ## @param ingress.certManager Add annotations for cert-manager - ## - certManager: false - ## @param ingress.annotations Annotations to be added to the web ingress. - ## Example: - ## kubernetes.io/ingress.class: nginx - ## kubernetes.io/tls-acme: 'true' - ## - annotations: {} - ## Either `hosts` or `rulesOverride` must be provided if Ingress is enabled. - ## `hosts` sets up the Ingress with default rules per provided hostname. - ## @param ingress.hostname Hostname for the Ingress object - ## - hostname: contour.local - ## @param ingress.path The Path to Concourse - ## - path: / - ## @param ingress.rulesOverride Ingress rules override - ## Either `hosts` or `rulesOverride` must be provided if Ingress is enabled. - ## `rulesOverride` allows the user to define the full set of ingress rules, for more complex Ingress setups. - ## - rulesOverride: [] - ## @param ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm - ## - selfSigned: false - ## @param ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) - ## - ingressClassName: "" - ## @param ingress.extraPaths Add additional arbitrary paths that may need to be added to the ingress under the main host. - ## For example: The ALB ingress controller requires a special rule for handling SSL redirection. - ## - extraPaths: [] - ## @param ingress.tls TLS configuration. - ## Secrets must be manually created in the namespace. - ## Example: - ## - secretName: concourse-web-tls - ## hosts: - ## - concourse.domain.com - ## - tls: false - ## @param ingress.pathType Ingress Path type - ## - pathType: ImplementationSpecific - ## @param ingress.extraHosts The list of additional hostnames to be covered with this ingress record. - ## Most likely the hostname above will be enough, but in the event more hosts are needed, this is an array - ## extraHosts: - ## - name: concourse.local - ## path: / - ## - extraHosts: [] - ## @param ingress.extraTls The tls configuration for additional hostnames to be covered with this ingress record. - ## see: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls - ## extraTls: - ## - hosts: - ## - concourse.local - ## secretName: concourse.local-tls - ## - extraTls: [] - ## @param ingress.secrets If you're providing your own certificates, please use this to add the certificates as secrets - ## key and certificate should start with -----BEGIN CERTIFICATE----- or - ## -----BEGIN RSA PRIVATE KEY----- - ## - ## name should line up with a tlsSecret set further up - ## If you're using cert-manager, this is unneeded, as it will create the secret for you if it is not set - ## - ## It is also possible to create and manage the certificates outside of this helm chart - ## Please see README.md for more information - ## Example: - ## - name: concourse.local-tls - ## key: - ## certificate: - ## - secrets: [] - ## @param ingress.extraRules Additional rules to be covered with this ingress record - ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules - ## e.g: - ## extraRules: - ## - host: example.local - ## http: - ## path: / - ## backend: - ## service: - ## name: example-svc - ## port: - ## name: http - ## - extraRules: [] - -## @section Metrics parameters -## - -metrics: - ## Prometheus Operator service monitors - ## - serviceMonitor: - ## @param metrics.serviceMonitor.namespace Specify if the servicemonitors will be deployed into a different namespace (blank deploys into same namespace as chart) - ## - namespace: "" - ## @param metrics.serviceMonitor.enabled Specify if a servicemonitor will be deployed for prometheus-operator. - ## - enabled: false - ## @param metrics.serviceMonitor.jobLabel Specify the jobLabel to use for the prometheus-operator - ## - jobLabel: "app.kubernetes.io/name" - ## @param metrics.serviceMonitor.interval Specify the scrape interval if not specified use default prometheus scrapeIntervall, the Prometheus default scrape interval is used. - ## - interval: "" - ## @param metrics.serviceMonitor.metricRelabelings [array] Specify additional relabeling of metrics. - ## - metricRelabelings: [] - ## @param metrics.serviceMonitor.relabelings [array] Specify general relabeling. - ## - relabelings: [] - ## @param metrics.serviceMonitor.honorLabels Specify honorLabels parameter to add the scrape endpoint - ## - honorLabels: false - ## @param metrics.serviceMonitor.scrapeTimeout The timeout after which the scrape is ended - ## - scrapeTimeout: "" - ## @param metrics.serviceMonitor.selector Specify honorLabels parameter to add the scrape endpoint - ## - selector: {} - ## @param metrics.serviceMonitor.labels Extra labels for the ServiceMonitor - ## - labels: {} - - ## Prometheus Operator prometheusRules - ## - prometheusRule: - ## @param metrics.prometheusRule.enabled Creates a Prometheus Operator prometheusRule - ## - enabled: false - ## @param metrics.prometheusRule.namespace Namespace for the prometheusRule Resource (defaults to the Release Namespace) - ## - namespace: "" - ## @param metrics.prometheusRule.additionalLabels Additional labels that can be used so prometheusRule will be discovered by Prometheus - ## - additionalLabels: {} - ## @param metrics.prometheusRule.rules Prometheus Rule definitions - ## - rules: [] - -## @section Other parameters -## - -## @param rbac.create Create the RBAC roles for API accessibility -## -rbac: - create: true - ## @param rbac.rules [array] Custom RBAC rules to set - ## e.g: - ## rules: - ## - apiGroups: - ## - "" - ## resources: - ## - pods - ## verbs: - ## - get - ## - list - ## - rules: [] -## @param tlsExistingSecret Name of the existingSecret to be use in both contour and envoy. If it is not nil `contour.certgen` will be disabled. -## -tlsExistingSecret: "" diff --git a/helm-templates/vault/Chart.lock b/helm-templates/vault/Chart.lock new file mode 100644 index 0000000..623063f --- /dev/null +++ b/helm-templates/vault/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: vault + repository: https://helm.releases.hashicorp.com + version: 0.34.1 +digest: sha256:5a9c8a551bc9ca890ce30d587550ec1ec6b5f23c26e8a106a14723cc6ac9a2a2 +generated: "2026-08-31T07:05:39.750081+05:30" diff --git a/helm-templates/vault/Chart.yaml b/helm-templates/vault/Chart.yaml index 6a05ac5..edd793e 100644 --- a/helm-templates/vault/Chart.yaml +++ b/helm-templates/vault/Chart.yaml @@ -3,5 +3,9 @@ name: vault version: 1.0.0 dependencies: - name: vault - version: 0.20.1 + # Pinned to match the live release exactly (helm list -n vault showed + # vault-0.34.1) — adoption should never silently change the chart + # version out from under a stateful, unsealed Vault. Bump deliberately + # later, with a changelog read first, same as any other chart bump. + version: 0.34.1 repository: https://helm.releases.hashicorp.com \ No newline at end of file diff --git a/helm-templates/vault/charts/vault-0.34.1.tgz b/helm-templates/vault/charts/vault-0.34.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..c2b5a469470b958cc9ee980fc833fe5624df5d84 GIT binary patch literal 54664 zcmV)5K*_%!iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0POw!b{jX6Fb?N$UIkt%JC02bWUQ41PVY^p-?E)#|&q&>>f`r zm%$uQ<1g;ur`PNCo;`U2|Mq&l^1lZMPac19@bvKU^T$u0KY#rAi{8QE<0pq-px#|f zru>r$iTM}3jmIi4?lbwpNx~$SlqI6yLMT*>AOe<>L`>*N29$LZJSBbfEfy1c%y^1^ zP%P8JDgA+PL0QsAv%?lnQ}^d#&>a!q z{o9kLPa_gOfBN*`;06A-;fp6vUpynd7l&P#!__&bQ_SbD*_d5@731(aNRx5vn#^w) zk3_%KK>)hdL4t%Cr*huvAd-Z94y)6jb0S5ngQhsaV=^U)YK}9>rr5Nh$%tbic^1ly zlh$=MBo1Sb{_+wX1c$w#*XccKX@u)B16Y%LgHz&me(&tvxcFdos_c~ zjRtnO{!_Sf*y=i7R&WO0H17NBAKY055`Sa&x`Ty+k!Grw2kDncM z%+fihLy`#6IgLmn>4*~EM{mwwcMgMI ztF?oUW|+o!7!#CYj;BNtE)Y&4BqxM&6p;}~d(CHP#JKvx9073V1g+LMW*GTjbqbIeGyRszv4Is zxFMUSEFp;$=!VJ(O*AN&5gN|zyn`09WA|Z@768AT5Ts5O>Ii4dnLPBzyjD>Cuj-Ix`*6RUGoFq|4vJOcidxnw-NsbedGA>&P z$ymJ7bn=mX@(z|1>vIta!e@jd97UXnoTF%>6b8nD_l^gr$ev0Dbs9Ydz5y1ojG-y0 zj&FqxTo??vz{~{x%Bz9u@F z;&dPI7AlU21p`hYQt`;&kKVl2(0qjvy@!vGVo$Y|0;?YdI8G-xP&y7zh$KSkkvNXo z4T;V<8_}4YDSq#xh=tdLcg;rI=UF1@l-R!wc$}t~PZ`hQ4~c99z8YSm>6$JcygsUd z*Jyr?;I)upwo4L|DUp2MH#9uaLX0MojJc+{5?R3Y=bTN6oRCZ?uH#rTZh8#}ffkab zC?+!!m%%Gs0I(s6*$o7Tl>>`;!U?dH=0;Zg}>Izn@np&Oil z@G_EE?<6H7*PoN=NL4JA&B zLP1Pe7Dp(iLXrfrMC~ueWgorhz391J40|Mvi5mc6?upEO?_fX}#RMzy0#anC1c)Sj zN)wpz4iZZGV~JQ2&k;*}0VUN2)CWYU1%Z-~A>rzH4YA^y7Bb*ZVu#quljw8=f9w~| zJB$(*5k%gpH4=^#y=f?v08SZAB*GGP&4+3z^J{4kPhPzuDJN=XQ6HVh1PcPEktI}F zG{Rv=aI`{h!f~PGjHVhVDbtz*9xEBF&n|NtF^#=r(5J6Ewe%7cBta$P^FC@l!884VI=Hm>?4#4s8I$Ln2z8%>*#gs^uAZ`1Z7Qd$zdBNY0A$D#iD^Q( z2#^-lhEI+7H5vr7S7;A(fXrV9!QV$?q z7M{JNmSipqMK@$gNKy&E0Bq>k)i?Ey8>ExZx(h(VG-nZq>=6i!ncY-51Pc?fPI|RC! zkOUD@_6sGt$<#TBqIDY zk%Z51oC}ukg;Fe)Rz6btj=@DtXCxs)oO7o4m(m2)wkdpJ+3If!kyssiLxM(_#$q3R z=U7aOTXl+#^c*iIoQMgFBcx7sVUN=>ohg3KQh-`++ee3Hw6knFBpmc`60#%`2#=KH z)>jq7ooIrET0d92&J3XEM-wWkIyeBF{wsb(Vmu#caDDXDjPxzLL2RT>!Cjiz(e@O! zQo_}S)F-F{tA!%r6tqhX#!mPRP3Sb6s>vzUN8LA&$ik2a;mHU+I|=%vYN_;brFQCu zqbxSdoM1qc!Vesu$Tsm%b+7_eHxn98{851pER%-W=#;Qb7VuHWDV*SlRuQ;tsP=u- zR=;}6OuO=i6SFaz5k6E3-P{i1Yr{KekfoshN6;9qfZh==IS$D_ipVe@s7eF-tYg1JIJ&S>hC|w$qu1L~$X@IEqM06koAK^|fZ4^HXG=f-KO#k>R%rs5Rg) zG>lnzjZzlr+alcmCp0Gh9F%^SCD__x_x1GwuEH>5$UuLAYC!!7@hn#RbYx(vkKSZTb4^(0xi~Wh1!6=7FqqWyX`s^)qEf*(&0K>Le-}x7FW5CW5DgGn7Tb?|7Lm>tKOoxh zVsR<#-`WB%B&VUVB9lk@YG?f!e>mLChl`>80fpdJLtFHa>GO$CLAb8 zZ4{snA39()ax-r^yhx7yHwZWdq%`M&#{`Ry6`Hk*X3R7_ zU&Zns;1ysE?F>;VoI79WdHJC!i-?{mbiqQYzLe1+k|S}(k_*P9d!cb(e8X9m_LZg={GeS7ondH9BlO-4a?tDb(1#Cx-|q$C)m^i4 z*SzQGc0($3jC?HEmsF)g#xc7&=X6G6GA1V?#M*tU@41-)^QCx5V=5`}#dXA4>iwzo z-lNyA!Of$9QY{x#7J;+`fOalce!7=R(`3i{#3IfdMEQtQGKHt!!>7;QQ1@w=X6mEf z)O-@tDP5;Ugvrtd{Xf&dU+9bvk zOq-S61dQ*Mahy^+lu$V#Ty4~X50&wpVjLW#kW~n@Qx1y;DG475gzab}O5!LmH;JiQ z4D`+n%n!O9AEILXgwb-(kH|t*T3ZCf);egOq@xH?ORo}(5GFYBPn#S|GNmLq{^kNKGEUaTeHZ8C*cD!Jx9!yENLpyQ6D{HO{Uybau{lSip3xxAT>UKQec)+F6(e8%)MPsGrjjim2dOs$Fig zXiTJ0zVwB}JwOAAzy;l$s`XkF25`O< zw4mMW@(6v@GuzoopFL z?M_>}Ul+ZUO@kl&5C!+7rb9nSl$)ls&H@$$nxLx*iBrNwAk$dOP9>zBr=xE`D!W4O zpdU{XNqEYsAn0up&wtkF)=?i|=hE!!dms2#mO0DdwyHf+!5=x&-v>aG|uVN%NsgcB3UTR=w5JVQ8)l- zqx|qvvpqht_CXhyv2t=Hh|A^|+NNfT`N$nTteR@8G@N^ME5Y3_{tfO{Vjmryy|SX$ zcpDr4`+P9-1hs<(lBDRMZ(OxXOy{gCN?|u+LND`sIquEj+Z{HV9KQL-Cy;BezV>kH zI6UyA8y>P5DGj)Qz1&h`@$8RX)2Vj!0`mH4c65(;`?054nIsZI1RV_Qv-S7;}OR5|O(Ws?RtcN%O@X zjOAdqWtg_nZ&o9T#gz?Ae2IGIQycR5619Kq_kZrcIPCS>=DRS?ge3f`qRm0ugQ_Nc zHKG8wy@VuPV{i8RUX!`*+NAF_nHR>5DM{p2h?fk$Kq>E&d@i6*Hw^Zv2y4+Y?d^)!7hTW=r>C(9v z@6x6dF>a>$Osq5MKKh4%BhB|Tb%)M{k@(JzzHcsP`-sReaKqcyFb z_z_d%DE87$HMv8h0g)iaP3$;%mog*m&Aj)W_=jsrF_2aXC%w$da7y)2oEvKN`Mjg{ z%VW=o zEA(}bstW>yvIr9G+h_a2DPSdrWJpIY8%e77JPvh;hz4%56u@T#V_nQ62PaHO&!JKM z+1KelIz$`AgP4V84D;dO#b;*(mehhdK5*F=e7mYazP2IdTxZ-oCoT_6#A(9XXo}g#NjnbBHs_RWL_=Y14P{6M4u*wuOTA7@Ch<@$-Y`b zd5_50pBCyAt~dqE8Xe!j^(e7p$x%g!76Q%&8QWBrR+wJvS;Fx}qEkkgwP+-(&+UZt z$M)HokQ6o}O(K+HP7--RM)nk^!ab6j4PzT9_{bZ;zcP)nBsX|o91pPLC5N%dOhi6= zxVaIJuYouG7fHQYv7DF(64d7fpBja0a6sMG@6!fQz<-SPgA)G&bTWB5q>={WTq3*9+Ape~(kNI*O?hj72vD zY(CU_h6CFrGK2?N5uiaKA&#~{tL}k$-Y{@o4xA36X&)UNJ`Z|9FE}uoPtHY76{=-w z-*g7qAv!h<1U3pqrPfi_2;ur^G$-B7+MAVvsg9Zy3n3?*W#fs`4Quz&9m{aHrVS)` zlf7f zNoQ|_M*|>xHxs-Io1z=jA$dnaLjD8= z%2t_XX-Z^_hr(E=G~ih&Bf1g0Nn(bh?(85q40_AEb#$XnOq1+g2RtMK ziFxquSJZjy5TO1n%~xWMI`2lynoMVC-LV@`wlqjMnX(A|>$}xGUAMCRH>ZszyPmEn zuEn#@)(qtBj!CqSNH7kxI87pi(ctu(Z@)h`)}WY;5zlq*%4ruIFJLN1 zd~8r>-q#Jr;BhurzY1^Fn2#Z~j&PV$P;%p(zKSp|D;+)6&0#~ailfM%96)pjRc`83 zqNhq&!qf^fvXe8)xlZ-dbPeeccv_%k|{(j%O0~{PLSd$g>3Aszu-(Lg-^`@ zly=|r;oGFu7BK+Ky>E8V6?4&@5FE?NU%|dPoU`kfxuUd#)QX)?Nn!+eX$e*j3MVAI zwx0ARE83w$)kAKR-*?K2#|55u3FL~&lDtTQnuJLeSM!CPltTrswg*4Bk(g|qN*=1O zsFK2DL^#(F)HeBsNVKc=z#cMzLB&ZD-Q>)x9pylE8I_{2mrF#i^L>ZD+k~y3VZDNA0CsyS;2{7eSYHwi2~=Dq8+V4W{&a z7X;6G50aoH30l619!2(^l4He%6RAT?AJ6tyi^d#>>X44-&dsf{53|j_=YH+PbVR~= z7?aL~v1@Qx_wK{rsIktAbU5f0k8d0OEMh`ZSgcx+bx%w=8Az5QAxXNgHi$Xq&F9(~ zPRkGB{M!Tp)R{H|1-P90r&@WiqxoV_*vq7sltZD`JR>^9YWZk}-}f^YyBI}nbTWhF zP8n?@?ArM!ozVM3W5$b@GS8|N>q8$tpg;WyU8`|BgVS#=PcGh|FLzTKv5~%~?6q^u znz6wicQOWrgv$|d);YA^7ei7O1v%Mc7_(PAFEJy6yLt?v<; zWSuM#1jh}+s=j&q_M6uyR~IMWoW4D?ZgIu$&M)5n$I0#4!M3D19H|`DvbB0E(S|5khrUtLz7t8*R zr!nGKTbU;~QPQ?!1!1HEsGT|Dhq7r-y9K8ihj#^CHDRh)oJvHn(DCyVHFWO0sf``Q zoW9lt(q6T9Ds4a7@&nO~uc#L%E!D_sg z92d2Nbvdxr_*88_*tBU}X?}{|K1Od@DDCelW_2ZuTL-D?-Q&LqZx*AP$2dMjsFosB z%cyyXPyJ-#Q%{U(--bG-dAXG$)l389?^|cuBHF<(S2T#{@ds)L%il&ih^Ak~EW9rI z)`T?T>edQ=1ikLzlU(ay+<#l?sN0TYA&dLy^7z~XqHQ!!o;)^I4sQ~wn^IeSc~+gq z$$syRs+*TAK&I8gR7#BxY8wL~DguRz1Xvj+To+lpV)r!;t1ZH*jI3=CA6hw^`;AsE zPN6y|HHtvj&fU<8ef9QLIJ0kE{!@&CystH{V$DXg?K@z96xnoNdq9A`H^HKm6*(+t zVy(RUj|t$-xXmH!$L=d8E*MoZG$FA@6xC(R=EfQZ(X~P<<;Fh5K|Dm>AhI9H7c!BOn_Lz~IKf`@YtLxUXY<;dx( zho+N-s%O%bQYkvz7|#}ybIo_928tPY;KB;KMJI@w3KGwBa1@whjjxEShodfi{%F<- z_!r;5$CZ0nSU~j-^F8ntuE3&1JwMBu&E-I@x5<`mFbC4c^jA1BRl6rGr;V}qZ;d#) zGm!RouOkjHr=^aW#P5haCA2Q5&*{i6dB3n8tECv*tF^fOvP@I2P}G0%A5#nmMEm(2 zYKrG(D4*O3lSU$0pB~tEx_Y7p_=*wT4v$8vH@GBQ`J(AflTykx%?!tyM^4ZC=!_-g z7o$t)MU-zpRpKVJ0FVh!f+{pd*EP`5>A4GEQ^!Ej6U_k19TM#9XyQFF1;}%M+%H7~ z=^pO!e+Vy4@L;t#gMC|ENv#*G)0z+gD$>QkDnD{LXU(=naNF?~Lf@8zx;@7Xu-t8M zI?WOt0S$BjLg&7S+SL!eIvei(eu*0qH-2PG6txN%CysBerlYa=b?*vC#5m1fZ|S{Lx`qd1KMo>XdVVMutne;8|yrpUhIw~o>iW8Oc_n`m)W_0 zL&<&X-DK4yAQILFjN=-xH{8Y*%qKorNvtdld!5z4koA6^$TPFrF*nLG>1X&2aRUk*(0g zio1gB6rMOJ1$0qi2efS(+fJ%Nw#;YU9lPL;i5&EcY*Zq{3FTI<>44lIzllSNu8a=EZ&0ZqsP5oueT!d;3G~{>&9n= z=^lK#(={q?alVHIXF%sFRB-#G!lWS3$-XMwelB6do06)`^C@wfu@hiZoTebZw0jA3 zJTJrB^3`GM7l)lvbVNn%V{1LplPjLx3m0~jS9!(g{D)&$ZiJ;ycqJs`cuc&MYc}o* z?uZ;KLhI;0*Onw>npEYZZxCWpw8vVAlA-H_-9WbT7J}Ig^jGyph5`N6g|e$S2wJp)q`9|O_ zlc`IZ$;@q{we7)^Yb;h&o5doqIofM5d~|F=opZP1BOP@9M(zF5G$I20o5w>r);|B? z*qA<4XVtfl)RFc#P9=Gpgo|ap7tMJNM&-Trb+s|mc8W_D%yXrWs(mk!egai%r&F|h z{=@Me;zWI;=#>|4xXnXPZMuro4X@uxLp6BE4ZHXhkay72h1p)%_PMoQX@zPpY2#p| zuq-i6yl(~}jtgHj0=|YpLRrMZP1F$!Od;jy@a7r#^D5qsKI^p2}lI5pu&F3>fs41x$`ZA(kq0JcPZi2 zx;KCkMNdWj$}-K$2_ZHDQg5SulalS4%pti;fN&hBTO%BMpb#+u>Jlg5T8ug;!mgOENg_+&OTC4atf*tCy?W>4c6a@!a#eQv799 zR`tEQ9>R&Bj~OhaQqi@0i^;#Llabo>mvC;U?}DpYA26!8)gvR^dqLI|rgfoFfI?eI@L=C7zhYYz z9aRUu5e$+sDQbUv{2He4AA`4NfkoLFlO#{H=10YXkDr7RgEYw#4GJV6Qch5Ka`BdD zy^m5X#0}$7h3ADk_Kb10-fc5CZ`!sxeX4OJ462LR3qs08=^JcybwyDyy4Np6S8atZ z&yt;#GfANCQO7N}qwV+wF49xgANA4ujypjspH=DR z^pAV)$`YK(iIRspq0f{^PD5ccIPJQsC$QtsIhztWA(=pLO+wGT9Ht~OQT^xMB6d)D zh$}P1l^Nn?G0zb~JJ$2T{%b{yktsQF@M3*gaT!7AL(6*-)3Mm45O2oqF3Fv+trhhf z#*~;jj#(C=@7@gZ{ICk(H{ZP(z$v9;MscjIb>N1)?@Wr;PU`0xDwQ6}-^1)9d?qK1 zL&cdqi`F;C=P(D`T1^zS$6*>?PeqQ79qrcf4-!iF`=!k`syMf!6acRwCu4;K+fcib z`wgzi{0fBR0wj&8&NcU&hkTw&c6CkWb3H9{&ktDz&AI^Ae~rP%GPO*O6|Q$M^Nugs&(2)wh)@& z+N+5zqhjKstV#uFO(_Vz3VzaKe|zM5+}=8~V~5G@isou*>z8>qI`fTjnMJ4P$QaAD zs-IHzXR(BsU5ziw?|4Q2P;0Epj`!v6w{HiRXGd>N_JRs;+EEtAUKJSou+Vo-X=eCE zR9KfBSnDI>VKVed7GbZ*uRbPf(j#q_M8svL^$dRgONMdJGAE3Y2>?`K z-MIUJgMiDkJ;F3*Gf3TF&>x#hW*m=X-xJ9O<*-^0-v-sDUB$liS@%p~2_T%lvdi>y zw5KexhdYs~@oDjvlsg@G8R0KTlqC^P!a4dcmY4`qf693=z+YJc)g4X#$D9-%IMq6( zF_VbrfK^A~PLwcz>c@6TQxogM%E>c8Heo#@o6 z6G%jZ3VD^i9LiOTsQ39^H7T^qZ0PGSQ{)OEcp@_Pmy|0}r)e%oiuFdyu?(+5mSGDs zQ+o-z0eW%=p2WT%=@2R<4k~fs0YjDHZJJWqP)I5>X$l1B%u;G|loS{@r}I}|m8xRo z1qvlY2WZ!GJ^A1N`MRKoJsFUH z43Z&tmaa0vZ1sM7H#gkncia`1+>db0MTKH{(@zmc|NA_;X-d)$bDl73)MB0+evYy2Ei59D}`nW6~l4#eN1WQLiX*0S)JetA< zgye_tRo?3gMDk12u9Ug$%603D^;IDQVmm)c+Aihj{aORH66tPZ-ySVo$Xd-e&x2|1 zZcKBZkY#Sc=7xO%m8k)zvC()L~gw^iHSg{8lM+MM5u;{OE`>8S(&V zQmkcnY~5%~)|I34Q>j%N%lb~0~WoBt? zXRWQ0CW#2hJe=3da;Whv)n*V6WWsK8i-Is%5EI5_C#EwPPEk2G4#1QAg(>j@tLFCb zAW@!Y#9Ywn$XUhh;7$)R)g$+n5_F58ZN2R7j;+OHmfL{|+qAS+(mE3cQV42ySssU)y7yX7-x{=!by4;)8K)Y=yuGu9{+AI&o^)RE& z^3@T7E2ErCeaZ^e(H2un zOGRKd@O?Gx>DjMM~08vhq_hS#9J?r;UPkLwie&7+cs zOOH#CYC@e1E@h)2VWtxRutbt~QY@Y&`zD5~q*Q3dU18+U36p=$t0-9XrOYdV!n5Q^ zoU!DBF~~`tq4#dsgI=#^^Ru|V-wVR4x@P6Be$UbEhIE+Amj+pR z&N-dYn2gDZ2yt8pGlzETW3>{WxeUlBVn4H_Jl2%7yTk8>O5OBc$qSQvIST5^lGl_O zw=Xx}pSCipU4JimMr>N?8=Mr~aBVagNhB}Vwfp`Ql(?36gy~vM3#A?)V$Qt&5uI_< z1ifjs3d|2CuNqvK_FcjyINc;eZ9k@{T?{Gpw8NNT?UQChJJBvA%WxK)?_LaS;(xvW z_PiUZnxbCS!V}txpem~bmcl#0Kg`h53x);{NFDy};+0!A#2-F6XC_sZ9p6K6AGKYi zTRZ1H9OJ0=NO^YGG&xYAEIs&u^3Q_jFVr@E+2$FfkP1{QvaSji*6mj9W!u8PDrP&k(=({>@~~GM(r27NV^0Q<<>EHW^slm0Iq!n{37RqPHBue zDirEE8tWRA|A2#ED~%Q^Sh~bK36Y#IK?;z|#w_z)g=W&csxx51F4HgZd=NahC7zcT zZT=&sX|+jO^Lp#$BK4Ie>L2p9RwJ(>zD&l#W>;U#(0Z%V%ur4_ufd#GT|PK`;i@i| zD>JX?q}5n!75Bq;jDZtuvX+v^gHv>Fw%Q|szI}6ajIPPt&*rdW?WADR)G(|v3Qo3D z91c9zvbxR@)Owz>NY_jAOzz%&4=M3FB~n`n@r+Te^+57AHnRS`Br;DTkVihPxieN8 zYV;{kHq%I5H38NgKuol0rNvXRwz{j>2X~qa2Iqz@1z+>v;OyJ=CLcHAM>Y85vshxX zv<#x}?eKKG3r1gC6;$(4n)4BqanXX>d?+AKwAxC%%d@27fOIX}o_Sqey4n}F zH~Z{cH{p_{&X{+6-#`QDm(&`ej4jmWkh_&($TQ#7?+S-E?K=1ocSg#hr6$n2EWw2p zRCCf6G6kcGT)~yug3*$E!N5ElCJSEc61HBtU{uT!P+m!HFkP86xH@exs!6N91&S@p zYwl+@&nL3Bw6f0cTar^2Ttz}$tnLPNnL@l;f|lVtHGjFHZyhSMc7GW30_PjEOut7c zX5+7cPx~fvmq+&V*JMWGJ~)T9%uS=Hm@TMgi^^G9u{wPE><#rk2Mz2{t6*gvt$E*7 z!e3uv0r`uyF_+2V(vt#e_@n?`af*jDrjn9E;`@l}!bAB_2OYhB?LM*kusW5$rZEw7 zA<49mRkZfW1{I%O4!nHS{!7k5&)R@1a!eaZwlu+XwRgqu@uB&)B4w+O&jsny;3XPJ z`~5=I?NU)ozfxgPQ=IenSIh39sO7SvmN~Q3SG5eP%UV9L%I}|5s@}+AHb$}16iP3} z{x#Mlc5x3fu8*+kq17RVL$Z$|GR(&Npmgk`8_bh^L^!v0R5lv5eBGq2+O^BYymZ!L z+X~VaE2zb4UU@jJ_P{f1(OpVmwa^`G8|s&Wk>p&Ro0t!&y3BbB7w}jt9}%}o zc2jV(4+Sk=1H_K08VILj$4$Tmpu=^|nQKjB1V`y8#^Z8DYo&$mJ+ zx_%;u_&Sz>X9BqSI=5!y5#^rsjnf+PVpU9)r3l=iesTW9zkT=xRMKCux<>DKtW_+7 z;05|)G$J>7^)tg;t_c4xrU04R2Ih5JyE5;zc9sM~tQ81RyqCGftOvwK1Pc#?2 zzx!T=1pCyPC%;;B83(Um>ymGZl?vyQYHA-^7jT{8GOtqiC{Oi3k|<>~F(we5Enm^C z;G$b3qVY(xzKxbDwnz_9rWo3hlU`e9i$3O{{WlNL+R;%QJ8r+hfO(ptz;cByBo90g zGQ~lXSYFZ!8Ws8T*Jz(iMaLb_8-ldk#TIvc`UkL?DI zC04^Ii?7?x#p0prvo#@<=3C4o;TMl76uKE`IZ}#hDUvfNno&wA-HIkUb)$-G4TTce zz*k?P(BHmqz;!6&x;{nU+i}KpU|hWX3*)Jh;4`HKNTX(Xn?Zyer^Lxrqk-xUee}5J zuym<4uyQD?>90qJ-%UexwRfFmEc9N^6C*<7;y$)={pkGEcNRW6KSkgyM4�C3Xdc zgNV#ba?6xgDi4o!V>Q} z)-0SRVa~C*>!IzyThSBY%?Bh%BtbLnbFs>WLNu35%zxg3xGT2U_q%VlFq64=x< z$SbzoP&x6JYf}95QB_qdv}+}wOSoZDhl$t)9RxL52g=%}&3~rHak^}-t%W}O90uU@@6%2(yv`n< z+Y?>6hjOKeocq^G+EH^e*(n`oJJruc3uRmtp_Wj^Z*N~M-9Q&=yXUzvwyP`Nk+!&8 zUvy1g=}fN0TbNp}jly)HxoRUG#e~Z@kk^-^A%@g8>Z6K`N7}u$(18k*YA2q%q}aA& zU7nTYno)7e-Yk|XM@!YCN(BjK!lwECiu=RCAFgC5K<{Y0SV8bD9ZxQZNLeC4_sJU; zP5A!jN|XwL$D|Jo$4z%Ib1Ci9**Ta}J)ib^Q_%MDj6mc+vo7f|77{&0Q<`MbM-dp} zQ|@Fq$f+vX(delj63 z|Dw0?SmniiCOKtysJOkY3n1YE$1mw{d7FG z{ZtEYNr`Cpy@Vp|P|(5$^&s50HK5%0@b+E#)oS2P2XXDp*|W4!Vb~#KF~Lc>Hhcc_ zp?XGoG;6SKJ|4LK+-@}R$Y?&&QiQtJ4H28ScP<@`+81V|U&`wjZ-15`!NJTuQaQ+@$#v&r?@jmiyf#Pv*r+x1 zXf*XgkEYzNety2YJyH41;-?k#ZaZh(`#Q!vEx0jLt)^jf+BKqCJ*`%rnfi8qKby4Z zYJNX*$oH4OpAjEKQIj597DWvNwYADfelK|vo`+0-yUHEnZ~ zla&m!dIfs*Ev*XXsypE7ZRW;XCUBQvb#dQR&U5AMan-G{3TiQsZ#C$;byUL6!}YdI zv*mZ&Eo)b6++nwLD`|XJ-O6}P?xf8J+F*AVe0A@Ox@EuJ=BR)Q7lhx^I<$+oqtW;@B^c%@R>RC&F_%jm;B zTQ}auJ=+h?{Nr(w7qq)gPHMD#WEI4_XSfZ-G<7%ar~S~o0vvcoJh+axSN?pOzNjkXO6Avzr4BIiXU6{ zoM>vuTGKpck|Bb})KL`GD{HqphryC_p2e{?LT%T$l{;E(b%T8f3dHCALnVg(sIoa<0BqaPE&wTtgtpJ->jTJsJ4=zLx zE<|_lLIhFzCo7(nKm91OO;GUQMRgA&KRj%1VbD#ud}UnPtk_i-K6V{BtJ_c7a)MXyTb<+n@Pl<@`-YsJiiS5a+`hr@U6F&_@! zd=O63n1;B)fwtD>yd!5NPG;1> z*iXit?!o!P`?*t0KR7Nf{@fA5CFU|qAM~NS9Qi>X+QOh4G5Lz%^H1c))+Fj=YyPr# zypoi~Y&;*N>dJM@5=8=fFTTomx~>~CoG{klt>fWfS|KQ!JxaOeTXEUKGMwD!fXz*7 z3&U;_y4TQ5RUY#*VVqC$gfVjA=o58qX;uH_JLGCl=s&DG?k7sPN}r^N%7JA39^c1x zcJenYx+h=G?7C{hq>QB5z(#^G< z{g3Sn{wI{Y;^PG-oF-I$P8hk1KnehS&YDDTef0I~kj=IEVvXz_Fw74P)4Qyd^A_LR ztt6#OBZbPtemd&Q689yY?&Jk^G;JlXCxl%Vu%BB-7HuP%kdTdO3-wPYwk+dZ(Y809m{;teD|RWl9&?A3d>V0X$W*c z5s@TxBv>GuqsamRo1)E|4y1c(+fuqsJ1##Wnzy=(qh@8Ofopj$ei#!bY!$C5y|)j3Ow2jbo?=-F(yy>T5o{0BwnQBO1$P zCZC1THXxeXXW%t=FQcvb;f zOy0cQ@o~$?BTdGfEO}u3Jsge?2i0~Esm=3PPVVolT6?4wb`L7aw4upk?OWU;5v`=!PbPhmD5>4=)!D1%1z2hy49HvT#s!WC-vC%=tw(X>28z=0zW81cE+qP{d=iEGR z)xCAU`hM-dd)3-|t}*5uV=NlEB^(FH(f45ll1@%gZ8U0G8(Z{*YlvrP_$2IWg_1MH z+RGAK$YD~!$zA(!UkQF_!#n0mxveTf{^suMitJt5{GyKQ>zZBf{gFv(y+{=r$0TqwElq% z9dkD8N8gZ(N%%`_+?Xz?N}D!Sv6{9&@ecx1U4DgHo1lGML@HaQMqJg^6-)ZNdOy7L zrd^Wz3yhh2{@(%+|vO0RIlf0AI` z_|Tg#+^n{49e%g^lBNEnG?&psA()KL3q`M;5O*@{V?2Dzmb2#hK4ygg3x&&;S$y>=rrEPloii95=tHW<`- z6CNHjIl?1X1K>KeMGs@`&B$=VLi_vyC287xVS&&`I84{d**|d2n)Qw}=ftkBM#j)p zF9i`7S?69OmRcG@R*U7>U&db5pE<0~Sz)G}HFGWFV5jss#18zfc!P?>DfyB>SrgU0 z%SC=1wN+<#tbMCsxT~zMo+Kv4$BFqXsV!oA?9&wHpQhcyq zxVSCnpnv`Ork1w57VX^JP=9KC_27Nzb!D?LA2FlOx4rdE-Yhh+`nR@%LNfn8+rA|0 z`lUWO99^_sCng|&IMeX)$$0FWke6^C%Gj#H~$4OQR+{Ff^WW~0Pm~)3C zi+Lb7LDh>q#+(vzH9<@0ykyirEGCY~=VYID5tt1%335|vtp?13$hb+VjdFj}38v?bkTh z9yz53iU_pSO@hdm2~xp6SK#~9O~RK262f^@L54|wCcz=#CdL$v(!%qaZ1nh34I!6t zHfTVZoIEMDBp|UF7d@PxifKF)pLG~Zc7w}%(&_&BrX?ur=t8PMdIrrjpM2dw;It~M=q8AXv484Bx#e^wLw(a!XzGupl(2(D7- zZuWYFw^>Ks0JB`d`kiKK;2s1frEH8BxPYL#MUOvn+{_)_Fl_sOjI-}(_ zV~1RTvB38uhW*xXp$*gfw(?|kUH*64p*rT}$O@YG(9$ErCySzV>%+>_fQi-dFh!~s0okHUbOKm)@hZy zl!b^+`WnnNyA%e?LbWr`h#1)$Qsb{zFmf#J0!G8T&t#V({j;U zjUw2rHAdVzR02S~k&i?UaYJ0>C7;zc3tg7gjZ&Ry@ouGQU1_ux!BKY}%Tp~Qkx{Ki zpR0s}%p0(hhIanMIdiFhp=<#eVyKcyvT9yP3{xxS7>J8<-URie|L&(;CVGl2D8r1L zf2ZeA@2PA`l-9Tfc=jP!+A_Q@bag1<%c6uqEIi>~uxtqpTIo`s)U~HucG+WAT+S;d z^K}>Y_QZidJ*622Q-Z+wYT@Oq*AGKA|ET&CuAA9l&|kZUxX-0opwpcujXS7VD*KZ< zq3U7_jJIv_xkj4epECs=jo@MQVW;I(wS@@6Z!nb2D1DEIYuNS~Y@5x30XHdyY|3Cm z=)A&P9lC&df{P??r-YwFh}=O5Dyz<+=O*#EZam3{#M~(v;Iy<2feEJ6NA9PE1dox?v<8(u zy`-((Lw}K2=Thj*0ENh*>Kj_3s~1!g86-VB`yC(GCcxi1_(vlBVt(D@Vo4i=n*)%B zP3HC&&twtxXpwMVVp7(j%U%qzRH}fHP4pH~9IA)oV?}qm3;|msS-=(0z zKO-9VSkmZtr)2C6X4^xMWMCJBft{9cTQH#7d2V3&w<}E$$+oIE0Qa8 zRQzXkU8Sn~>v9q5F@SE|NpG=n#&FfulRPpL&Xs)b=Pe2X8fj5BJQ)ujsvH{pyVOf{ zX+QTxSzG4*SZC`fPF!Es&#GzdXuepaJ6ob(DP7_J^oWJ~t4T|9Rou+YCg|^YxubV!!b*%uLQ1aVm;?^(3n1w6*6k=%M7eFY+^2Qmw zX5$XWl>R7TH-tcCzf9OeH500{s68<8n~5zS$C^e>3^JAsdLru`?SOVTAA!m{KvO4t zx4(yWf!V@!6~&Tkz|^O5p9fMVSHpTWDy_h@U=-43gu&O!sW@|3m5P;P4C3APs?SH1ul`P;`iCANPNUZU8 zYl_}G5@j5jooTpqGtnE(>M_pLXtqg2-P8~NU^i=x#0z26!-%cD_}%ASacwGxBRGgs z*y9i$>`4%_H`;O~fN8(X=d^YuGU#sa#M<6dlk+d=@!jbBak!1^t<9C>dDE+U^Ntkn zO@3<_x{(}kGE(^(l7FqQucw>Q@dmtDoL#-$t_Gf8;xdhQ)5gXmWL(k<5rsXs3p9ex z&Uo|><6GYnDGrLC^Z_5W$nu$=*#O{uG~>I#JK*|rp^D(S_~|_x$=6b#EPFXWd+mBS z8c#8iE-8d^Hz@aMbZ~Gzg5Og(Si$J~H;w-EHl<5tEa){z6`y7Uvb->EmY(3Gb%^~T zDK$E(e>LS)M0HZ;?~_4%v?zLWD4=n+6<({s_-0W5Kh zz;thLm4V8_L&qv70}RxW3-!z7{hjJj;MuHc<$n{08jnPWI$EGfKb7wk40sG{DG7FE z?QLg9aM&Q6E5NV4NxMOkB+o96q+~%s@9eA?9V>Zfw4zqY4KAGrO3+Apo{UMe;HV~9 zqMpmE=#r|-nLpaFGu}l>{Fl~XPuBRCPq9I;aP&bIif@K*TkRh1rzG z35cDp%}`OyXUekDJQ|{uYEd=zmi6gI?rfo5RKRaf0=2p+`zl_WjHip}@kxVMOV^@8qmTSF70z?#eH!r~oDu*97U0 zNbq80K3J|@w3hPCf?NtzAh>g#4YaI~kqwMWPKq9SO+LSpxvslx+#h1u6~t83F1v&5 z%ko|%`0&u2j+cVQJ|n!cK{k$b4iq`WgAP(VOpf;~cJI-|+EkSdr!FR!rGz6E{6jsC zf4_dg6)(6WKF?0T!0FDDpXJ||o%s|6cj6qFHGXqIq@FRor5{~*CTi%J=JAKHTj#&$ zRDk?l#34ucJvNRhoA&SB7Z*k>(^nu&&ZhF<)L+p>A^40^mfWH=yd`idEd3CiD7T@3 z8@mWprAo``R>KLyrZCTq24asLzxsSmpVQ^a?x^6Dea4Ta9~?<7EWI|C1gqZQvaNg@ zX87Gkn?%3!uzzE1_)RvoX~hDv$_DBW^m1!t34L_d=yrj+koV{s6eK5Q!5)-FgQ zBoa>p9FKZlCxCq-UJ1k0{IvOnTG@~nf%N@W5-N({rAnx-eoSWUOCzpg5twk~&7x5^ z=gWEX0C`{20kf36uML~+>jeb`)|yv1@DWVG?= z39Rs>chR)dU4;EQigFoRRj}WH1hC;)MdS@qigg9%Z%(&)<9qCRzU%DqKQQLdiikny zEXv%h+b!Oa!Zu~>sXpjYB09DtF6c5{R5WO!MQ`=0?7#FORt&+0WCe@%g zn3ObQvvG%QloY!*kneLUs~l+t7O8C7EX8~00*j-XP1#Gxqy9Jx&TPBxd1k0Hx_Yc=E`E;B0XJ-886D;;_{jSe|yKIVNd^CN35PcO#B zt3swdJtK|G$nUo>u6GJq+nRyRSHmODPL|*Sz~4K1+YBg8SMfO|NeXPZEkdN zM+q$adCKF8g#3qpB%WQ^w#%?0~4^Sg1(_XIG)RbOQ!{(AQjZ^m_HZE};-I%fsw z`PfX-@9<#Z6eX!NZy>*ped}ji$F;ir=UtGqbF0LDvnQtMR)3IRNpSx3Zbl(U(gVzx z$Bi0I$p}RmCMkM{(=kM_5zaUps7^@OVn7Y&k{-_{T@Vzn*56KQwiy*SA-QIW_^)f}6a# zZk?zK+s8w)gd&P>lUf4*xbIZ@O?U>!5+Vj6EoR!g*rITE1o4ON)MsJswuMw-|5^Z%{ zelF8?J>czbOmACl9dqswTbc`Si071_YI@U`N@yEN0uQY{ntvig zB)fIfk+ZB#NSNO*urp0z;#bnIm$y|j4oNH6GS*7_ajaocKDu&iy1Y6sSs*2uO4CsU zSIAU!vEdgEm#O`{NZR7=V53I39#IXW8BZON+F3tJ4u0StH=vhJG2wQn-z-84ZdS1_ zJMM-*=L~8A+G-%aJmH(LUtH3#8OsIz5i*=_@NaOu4n`ofmG06~XfD#m9EgHfgLc+V zNRvo)Od1sn3AftF&`Q*`m9D1fv6Zd0Ou?V8z`JNFSxPaoQnIp2SmQ{%@)L3s&lGw9 z<+M&MeW*54kDlLb9Gt8HQ(dS+7C&b#)Uk)Qv?B~=4zZlIPn!8(lLA(P!Xx~e#V15p znhQ>wnu**!kdDve>+<&38g#&oA&t}oxA54@{p`9#r#0D_hSYUU+Tn4PV>w7NnO~Fe zs(lvdA?x`EEps-rq}ailDR@7rk}2^g>W?_Lbrv&ieYCY;dJKzN;c0#>%{KDC3eBJJNl^})^36Sk9}N+8+_-MTj1`U;QiDPo{@{{%qK zNo{s;v`jwg7|J<99t?shFjGkYHPqIZ`Epw)v=IYBIJ67B+;kde2LGPZHRe5wYgkjC zjJaT~Rn!j{4Odpmg_Z92o|5_h8~T=&g9^{A@3g4#Xw&ed^d&!5xa#5{ddNI?w-5gz zQ$(lfajukqRy1j=(|EbeZ?67ZOMhw!vZFJlGNkpjRI5NKaXjyOygl4`veRAtX`ET< zbZIG}K$^r(Y;CBjt(n9@_<+%lQP5@u9}{X(?X-(&$hEY4tl1esre-6` zITl+A^OD1!P_}aU&jQzR(GiDkmoTyC>w~m0{jW>gesfySs@ki=j;1B9^4Cc_^`mxG zVVl|P)=~TOR_1M0AvE^+1X0AhSe1r};!ZW5xWX7ULL=@9?RlGb?w>zNx6>S@;ncG?tB;;?%^H8S>$ht1ud>Iz zFG5;S3Y8C-gKsUNInw{`@_DN)D~~5z99w|0{SkE~TbM)?i-nF}v89+8lV)9l_p?$? zqUK0WD>cGE7BvO^4?V0Rd*;wpE)cKj1ZE9t{>CYD5vL>)p#yPfYHxr=)S9x zPXmu^VHW}MxacNF12Pu!q!uqT@lr}ccd0IP%#XajV}sP-&}yovrdKC65P^lok>y%l zkw&pL`gzmMr0aV+LW*eMmn@`>|08HeLk`6RHDLK0^+o=gFg>x#@gx|^&&=1!LWQ9{ zOw6xZ_9Qaa5H&XS{DeQNH;LvPK78<%W)tP$KSa*VZaPo*kDfIL)m&MmB%`D}cWQB( zD{T)W6(XcE|AUcj5=uo%!3#tp>tIVJz*PvZ2>KVCT0V4${LXLw z+M=rTta1>?I#aPzuMS@AT!0-2v9RQiif}pJi*U}QFuwHKbs(h-9|ee0IPY6Jzd$9h z#+*EX+r^L~Mm9!kfYD52sd8nNos$vVfl}qs0td8dB%igI;l<@Ru4M4)3*oK;rL}L@ z?y66HOS|Zsd^A4`Swlv~7=q<}bkf{<&pg`RF!1Ew+52bJxrQVqT1piRySR-}xy^N& zY*Y*=c*(qfhTJVHPJc@~sO5|{dQ`yKs#5;CAKsL?2chEdmrB2=yEJAobrnK11svQ%b-(}Cwd=5oTpj5FZAQ$>haFD6;j;xJFE9D* z{cJa%4{zV>&F$`evHa*fHY3vCm+h=Qz^}-gh~kj`ep^qzt2h%G^f}cC%-)pC4u1Ey zyhO6in!57u1z|TtgXF8iuwH-M0)my|9*%8ND&o>2qP)ERX}1By?Bd<4rhX2Z#HyK9 z6)_`J@A@T%T6*rLpc71@dKAmC|J>)U3%<30;60dDd0aU(k=g3(Wy#2Sy3#N90)5WQ z?@b4jF2FJ_f?O%4N4z9TYL=Vm8r5qJ9Zf%rp)g$UW!t$PlO?eIN_h{R3hA<~P(7dx zZ0v~C!_T2(7ZD9-&UDYQ3}|v6YNd~ClENj^w#8G1YLe>}%rZol?l*hbpwOO3))+0k zS8f1aic3k)cB)2mhf;IMmcRUM+Z1S;Nrc}j1Hp7xEL-&|*SkA{9Gm~R<$7Ml(r2|V z^E|wzWlW5~EiM^fwo7d`sJ#l0*o0wRC8{u&xoLp^ck^M9Mtl;JE4w_n#pqo z0ONwT?C_;RGg3O%9e;ys^^z1f?aRu)q1pL#0sUwxFD+Qd8xgB#lu6tB$s-$4uDeAL ze)v3Be-eYdir?quN2jmb1%PhP$DIPp$&yWTT}>p8?Kx8^w~0L!89nls6qu=tT%V1w z^~2!%TW$Ba7d8=b(P!s8-6D^Vd8DE~6t}K|YgU8bg00KgFwjVoM#n1EpWm^w`=c2g zEp)9!I58R^<*SP{9x#gk%dwXo`acJOhS#UN*s$`*#9s;a53l#b(cLG6yaHb&7~-+1 zdEzZwMq;A-#D-VR!y$V#dTO(GjyvQo`@g95ulXPNSEhW&ig-w8e{p5+YdPp5<*h7J zxo}|ym7*hhE2I000EW*e%Zg%zDXv}kTiJP@_+_5|Hx;|Y(*UoDC&s@&*V>{IWFgmQR>t?AhgQ24A% zXDg3`N#is=Sq9JhHn+!F1SD>tglewnPn`X+(Kzd>K;N?$nz1{o#tFAU z1A=OwtJZDst@3t&>)zp(+&THTJoI?tPN;X?{zLgLov*0hSsh(DUEUjt@?}?^!n>W8Q6kAP8LWL2%R$=G`s>4=&mQL?Vo=c45=MaMLV# z4vC_ID;%y#BF)ufI+T6&&v*fIFgsM^RrxO{{-pwT7r49&k^?N@9=?KHLGU1fv3vGC z03H;J=;JUY&gB*k(D$s}?)$s8XH)nJ|BZ;~dLCw`?k<$>)OgM_w ziajoqxDCe=U1!732sHcIQ5Dfq*Cd;OD(6+*m6FW>U(f4#{4u_nFVDTuuE$1pXNa4u zj?mNMWU(5*h}b$6tDqsVGL4>(I1p{5>!xtr1uO}Oz zQkibxp|sqVTj*zSxc%o)c!1+CE^Q?DGQ4{#vB?Bo8SP6OX5DWIqA+_&-}lR$hs4k+ zmZa~S`yLk_O%V>cx-lIwnaGIdt!oalbJl60f!A)6Ntc%MQTA2id0DJ0sj_>T{MH(e zXJMM?Wu(5y)z%pO88*qM zDfl=!p$x3OCX?KBICj?h?J38%=zFJ6-|<8KriZ+8dc5?lhj)>M3=d;t8a_0BUm9F- zBYc8dY7gApM5J>`g)Fxap8Th|9NP9xY8el2&~LVIOU6zhY?$&DPn&6F+a zK@<)@PBg+B9zd*_z=(yn3S4GbErp9SMD)#pyO`qPhxsB zH`blCjXVfpe@4g}&A^yS=B-|JT3aC6HSZTpz`|oUqkFXJEzaUfKzUdcG1;AU&9H|+ zx%a0&%v68MwQwo|Ko6UhIT4uQUN!DT>`~SIp6O9l??vQU)qJK504r!gr9vdEGPiKp zK*Z60AAGy0+-wUUrMJHdR`KFy*hGzhe%$0e9NYh3IpXgA)pMS^zVzHq=g0<%<#DVe z!+QI$bhLg|YkcK^>lkBXh_#wR#dKc3oYd^(y!QQgIXXCw=R8j>a)!o==x!{!R=;N0 zBGOyD_`v)dY3ju|mTy(B+IV&+z`ZU0Ub`CAh?0LZ3#DJ>Eu0(U*3~?rYRDjWOsbKC z*CD4XXAapz?;V_(_y=JOccwL_WrFV3FIe4@R95{iCFE;NrS2DDoZ(P^?*nJIF}VvF zfF13TlGz{7%Bx2Z(`-%JXZi?U>6ZrK@nvR<9J9ydGBLR@S_1pkV(qTKZkGCa-Ae#^ zsGkBEFPt7+00Lc)M}g1O)60KA>ph@-Ljq9W!tidiAqJfT3OR986EMvI`RnPdh4BJT z2r(K`i5tOUSGKD0n#D1v#esn3Kev46S#)%SpQidttK=5f;~!GgbYe!KF%5-74~j6Q zOeO8N*8F*>RMj6Q>{+Pjxmlae>RgVTCdybW+lK8J10_Wedc;6bvo7>x`}7W`=X)}N2y9a?2Kpg=C*sW~C=x)}ku-Ps!tdd}zFW+hPx|Ir|xe-zYBs0m|pqCj-jYcq7sCzJmDtK>7^n7W7m- zm^Rlt@GUh3#g(&vP2(6{e2Ra%h6tOel9QF$~Pb)M4o=C4-n3@`49*u<7epa zt7D-6IBnX@1mGQxi>7-3zbEaza7T(L#icMzt4M8;3e@XX8GH-`2(1sY+{%n`9Gir( zd}ftDPbVf~l6*mlu1#?~PKvfV!IgTMy^hDxf{nwfH#*M7;mXw+nj5fpRq2 z0Y?Y(Rz$l=p#f7;aOYvowSppQh76_3K2BFdo3}W#2K- z>(@6E0?LlvhkA&UA|3V7kEJ59cm#vmK`t5>)l(V&0`dnAD_-E0iQ`$j-Pk4(d*3c)S9?DIA~VYQ&0eP_y^8DE}okOy#rq zJz9P}5!xiV8}IbtEm?4+#Eab9Wo;w+&T#M0raWM5d`k~k#rAcQ0`ZEVqFWLf8n9mn z_EFh}<79P+q(V;j=g6%OdlqJ}uUzRnd4J*&E_H>MYDU)qgVP_4j=!q36-Wy-VSG|r zmGFFHoy~#=v*C&?vEqxl%feaqV4VUa-H-F!cX)!}l`1-*#|+ zIh*$dJihI}?k=8B`pZae9J8e@;~YL*?nYCw%fT_-o&KdB^lS}PFOx)1;TgA#tkRlV zOdpRHr@~ez*3axJ)j|o1wLmh(7F(rH=lE9*tQKcPZl(PWnjh6CvVO2?q9g3!iT{!Y zAZ_b+mIvjeoh6-G-!ltz`MP>r*#s}EoMmXZ_{x|5o4?xl6!Gafq}glli7!6bxfyS@)FlapXx}G>o+^}arJ6bZ z)$bhBxQpAz%d;AF`v!X3zN4AS?z(dbT6;k&AMf7RN~cEj6|bDZxrrMABN<1DG4tt7 zGdrW3-^0t%;pJ%SU6tjdvqn|)+AQRZ?$UQy3CANPdYeFR(M&s@ zn*s{Jx+I5OOg&LPPb`r2F+EQ!O2G(L+s(u4a}V4DI`w)g(LaTWUw~fz*86v~t%o?GwbC8J|}fpW4`O*1;m(J9;(e>gTT# zhWBqavOJdGYSaG$BpPv)9H{E~~^P8p^bD zW>)eBYu@|zb8IgC;WR|OT%p6Ct8RX~`v`D59zja?jG=BkQie+{yZkXCAd=MI}rD=G$w_)z030;pe^5c4~bYLyvfX zf+QZg?{FjzH}m((YB^2irIk!&-Rw0jG7YQGMGz)OH;i;XS74y)Ty^EBQ6S7WgD-;5nMUWm6wS84Hr=`*ER! zGFivMBuM>Z7w+0mhcFW~mG^QDRM`XlhCxn*^R@W^RL6kaxNyGCxMBA$iVxzE-|sTE zzrpy;(Oxq)&_;G{_eF`-wHPNU?g>2lk6%A%rW0}U14DK&rw*KG{aZcxd7~-3^kU_@ zG_zrn&B)$`jUGIwwLU;#VLQurpibK?&~;Px%@?o$IDdfrxQ&5uCM1(oPQ^Mmg}<64 z&C=NXBlD0jX-ux@dOrP?HLLnS$f}T*h`{ToUz^^a#frtC|DC~`d!T_rC|Tz){n0`* znQp(gV_LyI)8m4srW8lAS?b`Azh2fu8<5{|tWoYFb!zmDiCB_F0-#9S4ShvYoJ&G{ zN~(oP^OA&av#4yRWf`ePr7hfWL)y)>SQP*qhwl%=Bp8cnM z3$kR|zR033UOs^_Uk6{$3}4hCV6Hb~s#-2Zd9byJBqfxF@kP8g(WEFrujl+`T;;%D z=iggHUnY#qEO?MmC>(+1mc0PbM64yvskApqfhN}|2M@6>1m(-a@r6%D3{eRFBA~{_ zh&i!`a6gV7!atZs!{rmcNwX^vKoMy(3FKvAZI2cG-Btu7t#xF@s{hEaPgYRBm1H8- zIFxajm%^|`xFU{Wt1=W6AdJ~Hn89a*OO-0Pj^--3g;xFb8SW*+U^;+xrS)no+Q=y41Dbp?CsCyi85{D&|{tBth+MfO^ zf=2S%L9yq`6vmTi$_HM)(fRixg9N`vk(>`8UX?~E9% zKS}>|{GDya6GKPS&+gGT^Yr|2qtE9*P58Mix-B4IRpBMNaWq$7xhiKhw#u+%Pe9u? zT1#k=yc$PS3S!Jbu46A&3;VtjN9ppzH=a>L;o>WDiGPXyrx#zgIrD44t1U^3UBkAd z(mdv2L=JwHlcD*-jul7Pah#7dRRMT=-vzx3&lsDGSN}&@IVH$#FHAdWA#hGo&yJ_v zkwzB!`=_)7Hav=aZb=xXi*5&YGjEz5&*w;dipJ0c+3Ow&zyU#$aU6_fS%(lQh@x)X zis)lPh@ZVxNO~vt>VTE<3~GE$e@SCtv)DhxrPmM50g$w@)rahsA}6Vo0@bOxo6h5R zUy5P#A{)>-By}iCf_bLOc zhdqe!LF&dY0e#ivsK1+%nhl2@hK(WXX^n)4e$G|H2yG`Am{f0EXQL$)Vf6d8+}U$w z@?AiR^j@aGbrBM_HOCKJT&9e)bSIg4c+dS>ofdlmW&O-)1nLLB31m*i1CJfD1W16O zBvt9>MViE|b1Krq2&f-NaKPolOwS)FfXL!Bpn%F__pbxMX;b?bya9c|8<uKsUXbh|G6A$+; z)o^N5B?u}#COdaPm1JW&rXNhqz3+wsX%v$v7q?sy(>>8#K;xA|NZe&C$PqHxf`}dx z=3Whu(Bf*QM=qHva@0P$?JcDz(bQtN8><1uW@2(ay&W%CzHZgj?5Gu$y$3(qq8#nsy3S>%Ux$`TEw}xq@CA!Ge)x2Grw%@ zglL{eYBAOVy4pOBM?yU+jU0@0@l@!}jl`pThfojAG_5_)yw9}EqBS9=)eINIZq3G~ zIPmSQT{V94pVqEwmUKZ}OOZK;L-qPq!bLpr4fv{zr^)zUR>@4g{_<9p8|pUr-ug*% z*ObTwOs}a1T*|Y9koDN&4m@1@MjCdmV!6Ke+D>(_{pA?Q9L7sE#^x1oY#ANQay4Mw+l+uc@$J zdo@iW&iT;!wMTu=puSOT94uM7I-V=Oj#dX_x0@H8W%Po!yyY=Jqw`2G93F69L0fsO#n#dvwiNTY zqpP9RG$l7m*faay!}VTfq0`3-MiU&741|)NZ5+THNzzb;qn(wU>^U9 z%G$9d_U`_ue(ZtruF*Ms$(MdA7-Y_JP{dGW`Wx zyK1W~SRi(spQ)tq7B)bP%vCy>p19oC5ug@&>gnU+;+u>0bYTAMXR#}FhoMPwU>X;u zdO&!VZ24`BApkm^7PFz8%5>9eA&eqhy-55_ok^h_HXQ*M+}NO!2|pE7h}m4qPk(kyQ2y;NDcfuil_KG-&uUb?=(E2<(FA-L6=> z1hhu@J?o`=*!?R6VHn#G46){DwfmYRqMtkJh$2j6UhPzR`)9UU(p{sI#SCT6?1v?8 z4W@WpM;u$5oGRyxZKhtxfqNfj#|{nB+W@?;ncNIPRr8P1i%hOws5jb|o<#{V7N@Wq zorQIUXkQ!1!4YaAhWHqL&fsgCzc4IDWsjeD5uuekOf>_ysoX1SZytod6gtH|uVcjv zWxU1!+C}o(i^ANrZLS~|?Z985WaZuA_yt_$32sU$;EjXcX}#BJH75;IOUM8!yd0j( zzJmMVCkUo!%Y1azcx<9%)YY}kwXLbTV%bb`Y&rIO1i8C0E}w!IhUX-+C}b9Ww7gg| zpj93Gw6()jupRvE{-B8BrBv1%QRH#_?IXU=&li9!V>(XROX|JAWBcHTeE$C^BT*KJ zaaW$5Ef?B4(Ml4r>2l)g{x-F_{rI|iJhHG+V>7N{UB9l(ujmAJ(FNR*sv1ARs__f0 zAz9bZcSHm5U5(>&H4jGs7i`#=F9I>W!Y07}|2mtEupXcC)u05>u3}a-6$t&$FQra- z{?0%(3TT!Yr~;|(Ta?pJ4u>~*lbaV&lkNZvpXpdC?=1O+XI>PBgyo%CG`(FJ{^q-< z(&PSnjXD|Wa%&MM$h1##N8X!y7|?e2OF!icU}gLsl>dYd0#Q$+1G~+|It3tbCFXZG zX=Vv+XDL%3<_O%w2~gj8I5LN0D zQ>JB{?WNLv>GK?skG4d|gkup${hHTLxL3sImB?0DsDK*0AYL-;i{+G%iN^VT=2Hda zcLn_rArboETR!=XtaLrOxa7Gj+n}$sknVVujh<<1RFQFGqO)j0Y77^HDqv(0^Jgz+ zGmsu}v;Tgco!RcJfRPM!Znce0-ctiwmc_{TfmP;tB;Q++O?E0cvO$SOH|Oo{;e+~p z@b%Q;O%&%nski3m9$XU_AIWM!la$Uc5<6pD-4eO! zAONWdRMoj%3o(F&OlPunK|N4`W)Z&UPnUfvIhzT2(nfY{|JUUo*gwcgqmE)uV%`q! zpx)}lgJzLF3-M@>AfoA0h!wAg3x+%lEnf%=#MsKl%?}dcs5U4TWYOsRe&(upmK#p| zkJ!i=)oRVi!B$Z10{^q%K?SDca6>V=+wkuJE z;mA-)D7}dCx;-Gfo8-lO0Fm|qK75XP2@|Xq)0^Wk;6I^uVswR!! z>BTDJV(Hvi1$bmqMEKlTM}kDz#szyBffc7UOqO|gxu@zaJw=<^RV_*BWui-2Xn{WS zn#gMMr&hAxpCUi{M(7{O$~mA*b}1)N5yaxcVS+Z9^y!(>>JRT@1PkOwO4@_;$e#(t z^0<=^UM}M7B}=HF!zi4{6g{@$xD5xd8twfOqWP;}!JXtBU?58BAK76q3j2_EFXPv&?mIasBpja>XMR zccf2yQbLEdn;)Q0t(hgN=-ENp2vfmXyWRcWf8ut`XTCU|%NB6j{y@)yMYVy36-A$vo2&+1g?2df}E=&uhC@xs7bXj zb$>aX(#U)=HR;d;q|18y?5?&C2;rEeG8eqwMQ-`3HVXj4hLHcw211%a+uAPgkp#E` zObWc62q^&gN<`4HLS-nL;XZEboMrU}<3W-aQLY0y7TX@uV+X}9u$vVY(^Ndf1ns?Q zcuZ27CD^e{srBDLFuiEEyozbCjX`4;(RBH#0&f|)2U7;@YxH)v=TW_Y>We@gYWh%C zhxw`9*BgOsyXPn00Z}~vk%2E@`QzR0Xt@&6d#E1n@~`JcA!@sU?M3^7TM|h6MFub8 zmesM;@D0t%E2I`V$d5-+hEGO0i}o^;eqA>3caejznw`GtlYceLWOCZWysY*vw5bQf z;zSoQ+%x@zP4CAD4$ZWM1YfkrP9?tkMs8h$_PuePu0zhwDa$vD0W;~#pQ?smx2||4 z)^6Yh&UVr@d8A90s=q-i>)Y?{uQgIw#H%}qOBFWCrd3O-cxL0BWs^FHwl0Q{3!hqO zHEZ$dnGKmvX!@3UTwQe0{yzY9K#IS;>sqTS?W~aS%SHOtVtu(Bzn5vBmF4l9!orKF z0oX*19;zBmr`+e!GP7eP??oaIo|r8!gOE}8Ncb`eDfc6}zM*G~-|Jq5ND2+}xp&K4 z41$o0kVng0f;OaHrqNA&tZVKrEPbkxg_J2vV!SQ_b(t<5b#djjb=U zQz}m+ZFOOxhU(Rp&jc{csn4S$6BuR9h-bdvU{YnhZ8SNjWE8W>a1a@ES;A=OtQlMR z+<|;SXXSYq)enk85t2tDT$0~@JE(dqqBARl;TFhs(N@Vo=dtHidvalCLGn(v14k?t zG@HG!Nw#(;+~1Y+t?ai==GfoRa8}NMsUHekQv0SRhg0Z^`8V0Th~~^*zq`EpczT}s zjgT9)9j`*MC?->!a^|@@B);^wb4U)UrWs?#%UthfxNlaw&qqsP*yYoWai0|%%K}E^}81cw%a93Ey0%A zJ-Gbo^!($|>vzALRSa*+gH<%WJh?hLEWI%++o~)6MZx^&&HKx%lZ#p>uhkIsPv34> z$f#=%yBZR}V-OD9Y~OZkb9r1rM`uIm$i?Rs3enJ3NT<;Xf53_YHoBc;(V1}BX?e>E zNX2uzIDB>W@$B94$;Z>AOF|8v(I?zP$>WK z+(>mf>G*HL$9!XJcQ!>7X#Fp@3MKe^X?LbCCo3O(n{l z_%}Qh{(||@&oq?zumMZ9>2x>k6Wu89-ZM(1Zz3RzkWQ&jM+l9#cCec%Og ztpMB=f&GlS+-FjrhhoC=!CUxb-#OR-ujP6TXf)5Cl{$eRSs_P$n$UlJkCjYSRUk^f zlU(9`eDDlcpYGpD90aVu4^}aA&&bi7IoDbu{1+1Yl2NtIw!KS|kVSFmlXkA{)tnLb ziATf{E+ZkEdd!KW4m6^k?)4zoijX#GCL^*z?5GOuicUUGeYV$KmlVt&!9fVRNf+9gOf9IwFAkQG&C)@)xj`lyL2v$MS$rp)#6 zSrFyj?t6A-4|LtLoj$~E&u!p+FMGDT```6!f3>f=$EVC$Iv&eY9UbGJWK44flm7FF zgv??5hLOwDAFoa>-jZo37UZWyO3d}5ZZe%lknN0-Sx6nGcU(Q^9(nOMv6%40?NM&GvLF(&%SZ&9;4}Sd@rsqi=#w(j0I%QLPjD%W(v#{*aQk%ZnzV1;S*ZYfitHNY%NF-ih#~&#CC`jBxJwF zOhyuYSA7A6rWe%Bi#@83NMNwG8tit?Jw|x+T&DJ2e^$02oN<{68BXa^{hVG#^56a& zxmHtYn%nc;i-5agitOWdsd&GU`XLZ9x{PQMxhFs5&+6d-(v0vKK(bg_tU~ZAGhmXn z!q*x@WtAP(kjTX9hf=-V%A~OxlB)O$6yhC^@fbxvgh=PDC69amF%scy)F1_WbJd`;M(x^uM=1#eT#+@_}r9=WmhbjFIn5D`G3^ zT#?nTz~l}ibv)4)`Oa^(vLaAc1vo`})Djay%|aHC<_UTJf8l}-$cre9+20{&^Y(Ma z^iD!XuQMI`-+%Ywh5yf;?d_}t4gB;VGgIGY*ZGuuAm91n6Nii>{f zAyd>pi4-_vf3WO7MgA}551ae*PaE)m-FBh=NAD^B=i@wI5&xHO9P^5#pUDsK?SrTD zY{vW>h}y+je({K|n6C)r`fRBxV{SO8)AL$cDpxmLMT!b7*X5=xZE%;gln<1C?=FB+ z9yU~#1W~~OB(?`N{JDUl7~8pI`-#F0CfLLV8Mn>M!Z%7U8S}?VDH-!5J?Hr*=_F&m zDurYbOwJ04981$bu4<6kzCx&C+AXE|I9~u}%jhn?7m9yxs6J1DMuHNphIB%;WxJ1r74iNby*@nq@#M|BA6pCe;m25c|2yqLXOPeT*X{P6 z?*F4a&z_NXtJiOJ$cw{x7R!iqdLZ@ z+iJJ^g?F2dpsk9Mnr zUv>6d-FD+8;TMS!+R$Gk-v0dcDvrcD!@2@XR zTnt|1mLnFsb1LWD5n+HH$W291cZ1mTc2$$@M&pNgMqcqxdN*J3Ph_n1;BSS?#-QcX z?&Z3$q1JSfkohhPnM>Qndv#aYZTGet4FgVX^5WlOZ%MlM zf~DSFVX36yN?00H!%|PfQWL;uCG0qJ=3I+7GO*Kb^-|d3m~93(v#FajLC>s+ER-B1 z)Cq-@q@xHM$b3tHxqi1c%=Nq5wcxyua1H?9XuM)HibH)`hpuZ#K0s;eJ4Jq^5xb>J za(I49USD0EL;13#w*P(Rt|6(1kmNJ6cP~il-W8Hc8m@$-el;X@^N?h}XKkwPTB^5u z!)B+|>*inPzDsV}tsW@fGC%!5BWT#^wF-#thgAU3HUQAC23G1^-_p=+8cgCbgxdo+ z>A`;OlOF6Bp!A388#QRPTOFKayVc$3M&Zo%>cik3+@E6>DCFxqOMTFA0jlqN*UYZh zB1dx;hRbHaoonXeD=?Q){ke>`ORgkB)=3g~MAG0r@;BkLgij|gLM$mOZ7A!sdV_!7 zhAEBOwWl;{Cs(u!SCslO4VOgG*}Gj+px1Y~rs~$UH@~IkQkPs(bMN4isyn(vI;~Eg z&nUa8YBSYE?dW%N*R)f>si;jmfP-9_-!e&HDSYzb$JfnHXE>;RTEoG1qj9R_k{ig3 zm79a-iCYp&T{cDr%;D1|+%42!nRx;5tFN_I_^t4{nj+4tU!O7RYsRR!Cy9bx&B)ie zQFO`TLn;G@%&!}(DNW;70 zyR~~m!`(3UcafErO&N)hWk#1txodh5h#nr6*-o0R#3S0NekPjfkan4N#EfuzeqNpZdL(sNAgLAmzK85=IWfG{{EB2zq)@CA%SbFt zG=p(x(s140ugz|@_xIObuRyrklxyyl?FMT`u6?oF`~5OX_lkca+=s-a=$piSlYuk> zE@IC7jKd8{FhADmhZJ5gtGz*8wqS2CP&5ZqEDOEv`0N_Mr~_GqhvxqoxS_z zjGSIxzCXD<0O;0ihnZ1&Sb8=x5<#FYfCxbX(X*>Tk1<+E&98f>Yr9tu%?|F2X7gfa z#dRMcQ(Q)80naXk%ctBy_Etb;LOWSr%JdL{!rrl=`FeBv!`esRAKF*(JXD;vwv%{;uo5J(m0xnkpE57N_EN4L$P4doW-(K&S-aQ%RfK_Uy=*95I2mx zKR-UaIzfTlAiw4!jv!>JdCMkqA+BMp(OzA|GTQ5H8;zMG0^ko#*Tn9+)9%&Q1GIZ1 z3yRw0#bFR~PbN=(!rE0Bd&^}?nSB>i4)4kECjLS5Gvro)1s!L5>OhmMj`zHuO`=h#Gygy2$fbLMy zn0HPj6#Vqs3H%ryOYxnWms0y6rioxOr%4+0F|wbMMdXIlREC*ykF_8($QXudj|uoQ zl3Njbu5lqK?GS>iy<57J#ASgemZWF)z`TTmTCH{3hVP>=W@8fjp4uoq8JGEFvNVDL zxC&r<#YcgXM)4EOTcqhi#?7W=Chv(oyYK&1iUs@V$LiAkdE5eHovTg?VXyXi4DIu1 zr{|&Nvdn$n{5sdd*S$OA>kY-|zQWgg))gx#L(&XB8oDvlj3nK5AI~cGb-T!SGUPJ0QXP*|jj4q%1EFQu{n|3y z{vd-i)#4sbRiRZ7d;4{Fe{X-7pOq*4SySOPH&GtzT9O2cc4{3JZbP^3*6(MqS)#W~ zmBx@MP{Hz8L3=1XrZ>TSoN(Xe{!ETrIE8j?($X&K5?&Ha0j>{5=L1h>l~n~Ls0qAq zJr9|h;J{y{lr3L*~TOVI-Y}py6-R9^)jt<;wh{E+ax;#A~ zZ|OBdM%t8lH?p8E;4s#Fy_Ojj3O%|!C8+L~EP5_e6uLL8yQh1@Zc*(uX2F~-SV+A$ ze8D33)V1cH2>+$H z@PvjQ-xM2mD-leu)zNpXHfuEOSqKLB)2ult>ACJ**cqelgE8`{4 z*ew~SNifHTi2gK@Lu;adY|rI zG>6;W&ED?v%bHxNPF>^FUZ=nEvUc=Mx^K@bF6%ufUn%&Ft&|%mi)F85rWO&-pk14= zv6ShPO!lp@p)~wvLtwcr=V>*#eMP(#rsh?n)x!NM?jK z|Q4|#dd8iVRu*$+i09n+fRJ2 zy_z*>8&q(&o|C0z+?Z@kYU2t8BdNLRopHId^+k^G3?yW52m0Yi6w^nw*}2iEbf0lU z^hRg~X0I+z9PI(x1wTYOqYCJ=j-TDZ{dz8kiB7AhyREC$8ttXF4{$&;ktl5&CLu)W zGQU^W9NMkUsMR(nQWt%UMx9NGRr?`^C~jZ(e%)d=MaAC(Yf^gfeZ4#V+9%)dYk%mF zIWX(7Ve^t`VYnZFqFU-^u~Y?Cd}D{)&bc!uGzcIrJ`!XiqB$VgQ{6EJ&&^qeBQp!A z4P$-KoEDioAFw^jqvJGN)R?d|WQ|Gu8-u&xzsG#q94?VQKv7oJv5`;&n315ImC zmn@G4?QQ7$UaP9+Jx!*7mAq&AQqBu}>?gmN@P`{@+jPr>1;zCbYqKRo#g?QtQp|W| z)T)Vn!Wf^;aXpu1Ec|Ft+iPQxat`3{`j#$9caRdFjcCtMb1tJ^Z5gmvW=nXR_Z!hU zfx)(-5D@z2LkV+`WX-k!pyEvG3Nxdgt*$eKDsREj$|F>QxrE&?pYW+|(dH6ysxUHu zyF;jicy8@Q-$vymPO~<=Tb?l5<8?_o!wPP}5Fx|stGVBb@LEFRZQ;af%he2{IaQ0> zNqr*nO(Q`dNgSSqk#CriWg?7n2WzR4V{SN@8j}nvk{ALqVI+z}pScR2(^oxoI2hGt zd`HMq8#6D82VzRb%`s{t)pg=FQ8hlM0)|)g9M>Mr*^*2Jx~BnQxWFGx4!H(a5=pDIL~>Ex-4vJ zp&DfQ9b#Eo^;|#=4pXS@S2skzI&%sb2()|CA?Lz9<}!>yeE%VK6-MNKj_d9Gv!*D8 z<3X6NO|C{ru0XvB3@VD}L|X;P3%l6kc2<`O8_=yyBC=*(w4qhoBnt+#jE-nn+kt(! z-!B?`wf7xjG?z`ek1^_${N?cN8zLrZkBzGnU?mC8LmCEZ&jE$cx9Yl4?k5<)(8*tr zOeX%OpwKbHhGId+H=PNKXlJZ9q4u5JPfReKeLLu}TOp_ZY+)!f+fHjAoFP+8mi@im z>h!ZddoQ&xl{wR(1nx6v9??$idp78$fW5Nrdntr5Gj3h*9%3MH$wGD5twOUAn=MNg zS=%#fIP4^%3DwyUKyw)ttL+!9&#CQsSUYZZ2w}5%tZuBKDRR|(Zt6^harHQ8?Y$kD zy-h<$d{>FLN~{IZ8&sOWV}cWf;U9;!11pB36n?JWTo$1uT~er)q&Kp*HFua=b31!k zZ`qN)i=FIUMCb3EFBqtAv64rQhNUtdFm&oPJ|vuf0)QLM`g%`prywi2?`W4C=*q{? zTXiO>I$^<_IrX_*U^)-HiA>K?&Ut{_R@>M#?C)={z)S6Qc&SqaUc9m1}Y5^5bts_igba z+}qZ3tg9azwiEqWXJ8rBy1me?pod5e^L0cle3iHh4{94b2cxdxKoh-)R%#wv+T9Fm z03+3w5eIuI?X{AS?OE5pC|Ko~7xsxq@B9lEh09l1;&B6}WiYHw%7&$~fQBmDvsAI; zk?5YhR zMtvR7sV7hud(bQ}GT5$P8$A1?bcj^4HU>+nyR9oF4!|YRjuk9PISvWasotB~6Ys&qRoAJH zlbh3LwHEZ#d!OD=?x7Q?Jz{N~)*GZ-rD;#oVPPZX~w%6bwsNEDjh04#Sxa;2PAHUIyK=XbnXGkn&xpbs3C< zE_3lWEUL~mgP=jKwnBZ-X{X1db+-R574u;odTsBzK?kGpvpPPDl&;e54Qi_)23@%E z?@x_s7PEwCV`<(7(64=K`e5}m_Y!PD)mT-@cxqhgNs(Fsvunj&t&JW!iN|uMlSU$R z`YV~Nae@LhEgI% zl41@9s_lW*M-Qyi)BwNg;P>k8cz-nty00g>R+Hpo=H!b5@7KLR{e8GVCknrS z7C{n+`q2A?X)KV5bx2qqi;d{lW{vwpzy@!`jCkyZd4O|t2{&te1;Uso*IOENsG-ag zvsdtb*5Snyvp1^4u|9~pB3XZLuaborLr-JS;@j5IWG?_H@Eq#WlK%c6fAbaXwDV5D zuxhPIhMd$p#tOZKdee~a1`_kzGC%ZikBg>Jf}Me^irVEl`wwa4g&}Yo&A_IJ+Zxzv z-`!yuTR2ARWg4NFgF9`ZNpibT*W?4Sv%K^NwRdum>?CB$dc`Io+8F&*ayNi*ns~8I z`6rVx19ey^vQa6oW+dFT=hj<6hiDuLu$8HU zTf|<(1COO6B3{dBlLXi}j1mfAk^q#E$c$OTWjE@- z3n8K_)k4pqQyYPH(EB$3Vw!7rmD;5*lBU zGVLHJ$TdrRmPu8_eOIR{2jzXL3;=lEt9xgAd!2HB45TmA^K>>BEvw-ubp@K<9;g8z zwdFaD=Gb@aay(s^Ml=bcui~bAwVB!;GPN1aa|KgtG4xt0?A3Oi>Y?k@m8~(h#~Y&XYID5Wf?mkESk4Lb){zck^0MzV8>QSKr6Ojsv!LTieT`i(VGSWy(#1zO?R)k=Vz)_{?_$!Tl%`rU4sVJ8493nB>l+ekP(gDhmS1 zXCUm<&j-D~pYh_&98@l_1jXxgb1{cXs=V*jwk`G0wq!QhN^B{kkfY%k-Bw+8GfqXL zUTy7EZ`9dzW0PEqy%N`qQl)B--5@!__|?WMK}hyD;lQea<1WWp4N{WTVlewrd#fYjZ1YM8nii8w|S-~?*B{`W9b1?C1f zymz(&2F@j^3x+8V&AWgHB8{Ror5eWk-DQU4p_>znKWm69OA-yI_W(RTHO$r}{@@!ZqPkoOxZ zBM5?r>*0?lXICFj&;IS?=<1^u&E8+V{&;?P^?F?5GYDj>HWS?08(0gi*5-I(HcJzf z-3TX1`dBWHBMq;O^gDQ_*{!IaRb~h5+(|HeuQn;@*`y$Kh|Ks(8t+JB$;;<r;8C zn6rnN^DT85LDfKtJPYLBfMB;S0qAx|3IyRogOh7&Bs38wMdfkAgan~*6jn>4&E%W{ z`!QkBEn~i=UpKB$1%7K(y8_avzn*NOx#ZG>`stx+m-oxCK+E7N_#f*V)?rPZyL_`amTIP^z>uyH-$sOpmdUgR)i>?`c zoJH44%$iBkH&0Mk*F&&$=C&d{HjZO@3F>Xhe91NM08Fnglr^ex+@|i+Xt15#US`yV z3c;pZeH#jYR)J|1E0O0T7HW4qZ;7g6=AyxwdrT&K*iH9v&)UKbCZqbgyygM50C?gKbY zywKsBq%NjQ-k+vIhpAH*3GM2QTcku=id-hDE+B@cDu=)U9N{>b_=H930>8exI^R|Q zyChmNmPuv|qM$v$;H*c5aJ9Id&Be(b)_9pLj>ggan0ahQ!ShDzwT(V21*!tD#KA07 zq*sB;WQoyKpuPaa4E`}X?U*@Y%rB;6t&)DCWgrxQ}4-&~`UtQU(ZxO(X-URuw(Kq~YgE z9E5br7bX0r!9;UrCl!EH##qMEW(L!mt!YbFIM+#CSv%fkLKQOsdTpN^@zC+u(W$)^ zEU_3!LPHVzu5C1su``FX9O?M#vQ>dki5aQ!lAOY<&Xve&JPu0U%U?(nk)&>F6GbtN0asJ7s!M~aarDhTNs0E)G_=`|L??}*2u3wP zWrLKH`n3PZlgFqZEgC;Hb8YZYBpl)Cj3_BKZxC%q0shBI*^*_PtO$@?Y!OW^uD(vD zcvO`5<#LBX0D6N!iDvWuR$0-&l&l%zve#{6S!jzACF?0590+$G7j3_mJpvCN7K(;) z9T7EQ4Pt<%MNC>P48%a5ZC9NXE`1FAKad?m+;x)BZs9hh&}Ik~R?LD}e-o2K1-LpKz{_S=7cxPu7$-F04s=WV{$8zCx;6Nj_}E)v>+>QWoG_O>Vt)m ziDX)OnW8!OuNCYb317yZLKs${nUD7{p=L@DYr5jrA16{8>i>Cy=FwM#`H?Od+9Kp~ z9!IK?zMKuBxba94|DWOsj3tTW3+`cpcWadN8h4UwJX%fq#yQ5sWPJkvYvWIt>`mVH zdMd&OArm1Y8HF?m)XO-@IGU3Mi{`?uq*eKhjgFz0V;vs^vf*;!jR}T(Xx=pvvze#h zIa`i^V*;Wdsom+eJA*%w_UD*P z{)uHo!#}m}Jyw2k-^lZl{P(;@f;mFV*49rEql>1Fx={Fh0le7Lwf@#0bN|n-E>3@V ze|38HV{73)@EEJ_f4A3Z_w)CE*dIOJ|HpWqDfTQ1`6P}q?2BSB8;zGQ&#~f-FCupE z@+J9&k%(SvUIHS_P{RsxnutT>J)V;&R15*s_>e5*B9`8=)i|A!rHILdd7Rxa_AGS3w|j_H$tBMvEdiI{>bEu{4QxI_M3t%b^K0<|F~3l3fs4Va$*n-6E?F|qW3HN-5@BX2S@KBDKuI(*YOv{4gb^0jy%nL1P-CaK zxH)Lik%6Yr<~imI3WUca<}KCaP_RY;p&`L9m;1ApIx!jqA#*s5n3^4tN}>`|*fl)( z#8T$Md~c~A5lU{s3wqkX^2kuqEJ^2iOP81=h(@hO<4R3SQts~PUBxcIQ5d!sm5EO(F3UUXx=kofrfE zUWqVX{PjcUudpFJO)ZV-ouJ|kxmEMLWeVy%As`zX+W8^frqsb^B8*ZEUaRrL($ozA zo37`fF-t(+;X-FSATm)d846qqBpk2{sI6@L8gu8`TjF*TtXu{f;ZMB!opBnF5o@u2BLRr?8BtmKu`kgDr9j z022tQZoiUfZW*B-DzZ`jRLzwPsxLMB6tIvp-+^0ja>IP1IpESjDTqkw@{wc`;|1mZ z7_yav(u#&m_aCxZ?9tF$l1Us9pWUV<{nSgs_m&Nk&K#10lPS9;3*kp|wV5wX=?O49 zqN5=TLgB`aHruIP!kfsa$zloj9WU0^ht#s1h`BJ7#DH&gww|Z{)dF@5f*1VSA{v96 z3T6@e6zza|OgbTBK9O?~$$v!EvO=$r!#4=UB8UL9r1OAMj7tL77j4?0ZC|F+rIIum zg^XhWPOzXBxs0gCQV&@~UVyz_5=RuC z9@|NQV?o1f%zM10zT0Xw8od^Ik9Ep9K&=yUh-=wN51B0JQf-3ArbrT~-Uz^|e8I>I zz~Owsq?+79ZTu}`*K&KukPlOoD!H>Fl%&~IT~FY8{p0_kK2nVVNF-EG=DH_SX*C-C z+$QRGP-&V&+YoKHSn$Yhqt8_JAF?S6neSj@tb?LnCkrMeoiQRsl5Czh!qvE2-LYi9 zJf`lM>doW+HJtMxH${Y=7P&OLw1Y;D3Mh*Nxn?X-U8ZLcg%nioYCJ#JKf1Yc-({aP zFr}GjP?bZbais9r4QID3lsiNRc7Y+XDFOywwNv6VN3A?W=!UXP+@C2L!89adPQN)1 zwEH;tiN?MTgUhG7YGG6O9UTpjYHKYSTv4rLvvP(S|7t8?qF^{;4M0(vAi(;ir3Fo` z$5SdJGG)x2Q0JPsn9#{(H_Q`(B5*C3P$4B(GNH10=wLT1{0*{KI*~WlSODr*y$6za zjHZ#quN-#(3l(6}DC71ZqcC<-2cLoo#RODS(`RDr#ZjM;^N_*BC65#(dud+O;Xcew zi-63Tw-^&=&K!jS6ng@>$GoNPO07V#oM)POjxv)@{LRxH4`V+~sg@Z8c@qIZ1RSiw zK-@#BcU)yTQa{3~4;qc}cr544^BUUDgw2~%^4))&|8o4>u6l15f7?|PZ{gpNu)X9J z(ln_L)dZVBMaScD;|$0P`^20$V(A3ZjG4s^I4I0b?L(7Cq}dD?qx7zvR9+yV=NY9~c3K|hxW!L2;`S1gcWU1qe>aOXC zkfncZHwYPz#}g{&4MHX%ONvyJfPn9yDNIbP@(4X z*R(gap=p2WQ%lZQbdi?bhO^Ke*%$o^<3^$kaz1D%Qh|HfvcS`RJC8X_+N7^EloVZ> z0&z;Yx1;U*XcpFG$2Ig7v2a6iA!sR06T<*C1aAru9z&+?DFa7R#f}-gQi9VX(SS<5 zCZ!+rM5N;BTQ(lN0xOZ?GsqPSLpl}VA{SbRQ*L}1YdF_$?T$D1sft3zb`>|jo9$ye zMW&5J#5UwE5{4dWnrbx?qJ^=!h^#dgP!yHRs_tdLee4}@r|BLG zY~?6Ed7l#dkFHQh_R%7*=E9~&V!G3$^cTf|`ZMfC0jo@EPa2P=3@2jf5p^KW$LE@V z4iu1t90Nejj11w#giFZVG|72vCaj?kb1QOmn@F-xi_lejDz)Xw_^{C+U^FyuCiX45 zP~1V&Ds`yy5$Ks~%QLbTbIh3%p>AR+QTFCiy9Hn=pdHXbfOLNVmrh-3_3yLh13cJM z#`D6A(P$C~he@_(0#c*!^)wabGPNA_Hl(Oq=fZjcDWMIg%hhHm)<7}MY&*N0{|;kp z{i`(Ibk-jH`GEYZoC~ODE1i&|H@8j!4ecB%*`K$_f26ZlfBZ6MzNvejc)WtIDaU!M z)7I1y=4A#qGftpDpTEGuiZ;}!E?O3rCC4nH+>?z)Jwju|UkQ4xrHS!NcrcK2fGX<{ zZN(s`>{oF=u15|{^FurC*gi1plS-A%_9st!-c@45pd{oN2`yF zuLzuWBAu!GC}MDWGTyM(bvCg#=rDy^2<_2;N{UvaaYEH3Rj255A(KPZx=f4rHGWsA zC3@U!%DK30D#mI|rXHQae)>vGT)?`h3%XhB_Jc871Ep%uB5awcNl;kPhpL%vE)jJn zs~RWAg+=Ds3e{)pw=WEo~2~A#-S561s;(Xfb~>g9`k3>d>eOV+zfHIGDHhA zGN~nj!b-uMB0BWe#4RcoiBV8pP!l07z{5ttD3^o*yA2M=v1HTOL+>D40}6P9IuXWs zX&D!*(NHOwBp`=!Po{`c*H}$+rsBpjs2Yo?p8G`p8Y@nB0#Pi zSS)nGJQC0-Vxh12(k3}l;;vEX<1X3Jxwd<52?2`vt`5yQAilr=$+U?fF@!iS8N;pq z=<;x^zr@VmsNeklyBC>lBLAm;Nj(4OFS2NETcgNZxV-kY4Z-G?diWsH0qq4;t{kUp8-qd=*;hmUG#NbafjmA~`q@XnqX~{V!AeRsf#dV|tJ$fy!0X_XT`g*f32zGFE z3|3Rco0-+G#vqEF9DUrr|7 z(rSF!TCjx(m)~~>!?%3nMotia-yO6Ura?J4s$a5zsF#SJ()gMW?Y~w}trT+qp#*GU z2?}1n`px(Fg4f)7-Q=@wd}dnpw>^U(w33IMP80EUA<#hYljv5Y9Ge6~^{wImX9Asx zB@1XsweGmUY|$`blMIKRD$EtFlO{td5IwN0s(*Z!`Vpuv3+Tcp%#V0z1x}%s0%Hga zl_{era_KuqG@_oE?H(s#H3wzPP(2buY7?0i&|4rj*}~4>Lt@PWmH9hi&RmeKX0y4q zy`JbiM>&H0nY8Or92mPuYSh2Ln%*LJ>geNQT3pG4faXyEdXh3H#(~G?6)e6+MoSMo zA_$|Bdti-~w>)y@#*@aPC~?DFI@jj`JQvp4E? z^8TNley{uF|M?itkqDL{=+a&|+oap>?4=lDhn)IOtI>EX{>D9zlJj`tamQe$ouo!# zx77w8onwY^d%~CMbEifA>p%Zr3#a|pfBt{SB#;H8z9ft~bHaU>-*7jk9uXn&*bLIt zMi4&<))~kID|b@tmKZItFL(hp*5HF7Zhc9P#0}u-OEHaZX{dyRPOF=rkcptmPfXL6 zi7tO_$jy=M90wYsXwE`OUht`+HruE!n=A>%&g_w>(Ml;6hC5(l&TP&9mYM!x!oBQ- zOJ!8%Qxo}ahVQgG>I&)Nod)ic3lENu zBGN^Lirvwqqr%?7P7h(Hb7!B2J?cZ1_k|f95?^Z5kP;&DCk{Q2pyxL@g=h=rVbJK8p+#S-ij_(2h(C1WR1H>r z52ao&1(Obv%ySBdcH~jMP&UqgKwIW@?n8HI^1-} zB!k+~{lUow0O+yA&LqNrIz$SUiqZiNwy~XBsqQTi?YTb+pnoAk{Yf#7+j*GJF^)9LIqBAGB3f{CH%jG3C>aGP=qw4;h-Bpt3K9bF}Po=m3$J@K3Gk^jPFbZ~i!sw)xf`VRM zc8kr5dg|sGh5{Uf;gXR{M+ECu2b^KD#KaL9owMEwR}u^^p=J%LD_OoF@gda%cCtD|rtoroJS>6;s_XQ#-5Ss}zF zS;t^uk*OxoX_O2tNS2{apaRQV&81?XA+lmvTNp@#n!*8j!M7FaLq!E};Tk>h(1i=S z{ICD~-!h9zY+*bvz@*vz7uu9eWr8VkcP;5m-??pT;Z8a3NO)3p z0EGiLz6uk`e21-^aw`G$6gt2c2c$vdan*im5H;>|2G7f#BqNLdXqMxNnLw%9zVK>S z)BVsS2$4!`WZ1LQ;PZCcknNlQ7r+68cisO zzM-DlUYO~qmEr%O?@MD8?kRz(*XpYO^^n^4T79%JCXI~fQbM{i-6<@un9yEJN6tzP ziT}8|Fg?Y09$TaaUTy+ zC;IdqvWO)Ffh2IRRX7Itv!qY8h8E~sN| zmZnMFY{k=69A1@jKxuW+;&2ERR6WQ56GkClMI6 z<=c<;N9BCT47Q@b*BAZPNsh*o2b0thz>WBEZN0%Y@n8lf1dU~TfZ)t-<-TM4wC$bF ztgs)FV|5*Wte|UlVY4`CJhWxIFJf_Y2MN4ip=K)!h3@7`4aAp5F5#R?rTr#QlXhzF z5~>=t`-=9B@iS3}=cl|c;w#TUUdDstVXuDhL5DZ}oxnMVZ!oTNxwNa;DRs>>4I?pW zD%j@lW-<1g=X|ljV8AL|(Q1(B$8fv@bl$e?Vn&!fakZC|wNvrJ9@*=>T+!|};*r~~ zyVedpG2$bl`x^j`q@Jq^ME6!!)(ktj1!(U*0ftSyk*jJ{^ z8-RfV;0#V{L|-APqh9xY&qu4eZq*HpE2^%)mJQh-d08lL7m)i@PAjF57ZnPgEC~Xq znMmeer>D!N);SniSm%hZkt4hfGpe5jC!H?+(SH?ioBiM!c@Nf5WxFbu^Hrd{K z%PP}_-SW(}&U1oZqwAj$dp^LaDRfP^J9teE1@cKkU`#6=wQidQ4=mkrt5t{KTTi?~ z0RZe_QPu!KQO!-DQ}I=Dd*e%57OV$A^y)h`kYEaiv!%T6rBZ+aVGFT>45p_cyJ;jE zM0x@i=%UtnPl1sg@}u3@G(c(?+!WA-HgZCaL6x$YmWaqj}Lcuq@m-q3x>TP>^F2*EA!C~leub}-t90M%i08&)gdXy^%&^@RK|`}HZME1 zkap|JShvA`^9*A*PLloj?{&w&!j>#*-%Z;dSg5-RI~OpCr?zUb=FOb%>jhzKyKCcZ zJU~Q31C)1DA1A;>5O6z_$0<{3E&(}hY4?IDJS9^K?g8Gps$$9?p@mdrBCSee=<5xu zOw|7PE!c(GrL`$zv3o_2{5CT%fBvhyqBE9#I{T;SD zSCwJh0Fdb`rD%l#a$3F&V^Xk^NaR}O4d_u8SMN0BuHk5yrn=ELD*PphqJ3~1kga9M z`ODA$EA2Y|<>&tk!_Q>{V(n}>va7Fkk-6|S;XSEr#34g4 zYH%+ut7YJE9kCtNO{<~`v@##b%+yvBDmW=-${HoOMCPhWXR-iS&PYtOg9Y^JlF~#3 zXuKk(1pxS#7jW^t*64qzw7CXQ4K$^GXk^Y9y%h52v+AlAy8IMd+&O|Y45h8XoG9vu zonuNCBLfo;K##y5g=TTE*fy;8X$S))Elthy;=@@O8Uu%ar4~|G93F$~p#;{7V5==r zaxcGqke)P>tqUh@| zc5Z7r;e!N-{yTWBC`GEPw3(x0fh`RB3GW-_SP}5vbRgtQVk;~)p z;S)^Z!DZSxYI1%UA~}>T!*?imRvI5gW6gD?;E;siB32ZF10bg;`D7(RiGY=+GgZ{~ z|A04HP!!P4TqfsosyH$V!Z4GzSCDbTOLTC3@~cRZYQXNEXlrlfrD31Zv@A1gx{lC$ zXX*dF(ivbBD2PJ?na8d13z7HDlFo8;pp4tV>mKCho1MrDCV+*LR2v5DWO;N!9 zssadWbOaBNB=knGtvUjTut)0|?ymBZxEsII6(>g9EF-B$037ep98`2VI^5i8#z_(_J&LKbS;7{v}yv#50JwO&m>-z1Q>Vx zO4PXq;1404dr8sGcEU!#>7<0ik2{HYqi)?JoD9r2)4na6B6Cj5FkWVAbt|jPxn5*o zM*2u66}PjU>_NH~IDCD6=0Jgva?!egf!UQlMV6Q~+eqQP&@^O=aBd6dtWCAu6Zkew zhHz?)Hn5EN;i8#efjP0W?ehz51w#Wh5Xrn_7zO_D$v2S?J@TaDJ3g_1^HlPsKQ<3l z=2M*pGj+g$-An(WQT2HOd3gGA(+#7tmrzQC%6bDrR1_49bh&1bv(?H(=q4Wo>;_a6 z2Q*=(gE%cJT;qDX><2)tr6~nx%u;zPGMyN-zETAP2fAY*obezm<-E^cN4s+Xyw^@{ zapKHLW#~MjbVDCNaBXxiV$9kE5Ng!U4IKQ(VN|%7uDBDU&7Go|e$pUw#f5zWalU)` zR9L^3m2v#mj0AU8eB#5voxb2MUw08v zmTY@Hue{Mq4m`1&Y~v;uWYj3}`t1pmYX-UrCm;))UkLn2TU?l>UuHW z+L~i)07&ok+mo%`WP2+CoLlX#)w$3ISf@ridP@L)@V6=vu->1U9R_6)bt6CBxAKw# zkB=N>s-TPU?q-(+f`=Pf)R9Ax-Cz>Zz|-#TK6#3hyezN1T9Dpz=c21w7G_goaJ2R@ zRzPLru(7)p5y;LrBK`+%vffpiIwjKMtIHi>I?+TI!DYZtNFB)AJ&wc|_#pnnYk94# zi2rly_yqso{@#-(J^sJ_d;YKA<#Ta#esOvH`rzf!^JiT=|CgtyFHepx56_NX9KE?X zJ~%n=J(GNI$|5>EIequy{Kc!w!_%{)%eQBz|9W(I(RwyhH}US{{UE)P%MonIWCUA{SZ-I@;f%JoxcjNluuo}OR+ z+tJzi@#&lA&u(^-z1?KbK8?3PYbEUbAXUGF%_oG)O~kpv&TO3>9lUsbl+5XdW?3nU zBAX<_hhr>c96bPRD*P*+BDp-HbBn+5U-&zUM`Wvrfu3R#Ljb22T&_O4Z0TbjbLU4&!*6>7i0x0?@7mo@Nb1U{!p!b zZ!BC3@PDB++Artqb@v-K|ll)^VgK z>Id;?{n4;IZj7vaZ$uBkm0(oeEMkzdpyA32Y2eA@;o$+k_egDg!=;kXo;p4h3&l&Pz7*`f#_1ZyT7z4F z_4nNd{Ip`!-01Sq1#O~gI)1hJvN40VO0g~@AhXq z+(ntGF_jb;Yp8!>@W>6-Bk*@pK^$qf`<^(7@{=QwxPa6a?`>Y&ab3Od{YgoHTjvu;!$P1komJzRXJk4s&eNw{mHi zGdXGu%|AZlo8g$+je=bzBARSF0AXXp1_Z1}NGYnS4#+U-sH{xQ)*_cR5W!tPg}YjP z!p;lK->Q-M+79AORca*u_T3QS-`0i;#spNPcKViOQ$>A}yF{F;x+Z40;Ah)I7(t}W z0AgN9AxO&wqzl6slb&TxW(d)7bZ)4y)<6-tjEg0^3s$m1?4eDuxe2fBCHsHc+@x=U za(9y5KmTcSQ^bzP0kR7K?a{O#7J`?MBn$&XZ5D1$BXDvH^pGeM3?b=SdxgwH1mw~b zT&$hKcScSXOdYc=)}9Nz8xDo4Mi4ErPkqOtBET=@*DI_#Ypf!OJeB<4NQIh~g(-6t zt^2p2#F;NG6cl3h?ogjcYwpiA$OpJm$cTnn5KBzgruG0T09D7m1i=;^_CjRueA`+_ z$p4IYA`Pnt&#>Gg$V1LFV)KQ>yxf$LUHD5UPbv#itFa7RsnM;vvJ2@~FG?7%jZlNk z%SuJ=N(yzISsp$0=zaL-i+pezNq)+OD$GnzkUZeC)$s}YZ)fl8uKo9Te|zuV{`);X z4~0hnKmO*mu$D{$IN&3(yS=*~Jrw6}U;IZ*!P@v3{LT}ts$#G|^~JIX?wE>v-D#V?AGqhcHh;bd|wAf+r~nq&JT#S}2z zg%$r;tW|2NONha77PD*dgaGB7S*dg